feat: update email configuration to use environment variables for credentials

.env.example

@@ -1 +1,3 @@
 FRONTEND_URL=https://yourdomain.com
+MAIL_USERNAME=your-gmail-account@gmail.com
+MAIL_PASSWORD=your-16-character-app-password

.gitea/workflows/build.yaml

@@ -163,6 +163,8 @@ jobs:
             ADMIN_FIRST_NAME=${{ secrets.ADMIN_FIRST_NAME }}
             ADMIN_LAST_NAME=${{ secrets.ADMIN_LAST_NAME }}
             MONGO_URI=${{ secrets.MONGO_URI }}
+            MAIL_USERNAME=${{ secrets.MAIL_USER }}
+            MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
             USE_MONGODB=true
             EOF
 

.gitea/workflows/promote-master.yaml

@@ -375,6 +375,8 @@ jobs:
             ADMIN_FIRST_NAME=${{ secrets.PROD_ADMIN_FIRST_NAME }}
             ADMIN_LAST_NAME=${{ secrets.PROD_ADMIN_LAST_NAME }}
             MONGO_URI=${{ secrets.MONGO_URI }}
+            MAIL_USERNAME=${{ secrets.MAIL_USER }}
+            MAIL_PASSWORD=${{ secrets.MAIL_PASSWORD }}
             EOF
 
             chmod 600 .env .rollback-meta

backend/main.py

@@ -80,12 +80,16 @@ app.register_blueprint(push_subscription_api)
 app.register_blueprint(digest_action_api)
 
 app.config.update(
-    MAIL_SERVER='smtp.gmail.com',
+    MAIL_SERVER=os.environ.get('MAIL_SERVER', 'smtp.gmail.com'),
-    MAIL_PORT=587,
+    MAIL_PORT=int(os.environ.get('MAIL_PORT', '587')),
-    MAIL_USE_TLS=True,
+    MAIL_USE_TLS=os.environ.get('MAIL_USE_TLS', 'true').lower() in ('1', 'true', 'yes'),
-    MAIL_USERNAME='ryan.kegel@gmail.com',
+    MAIL_USERNAME=os.environ.get('MAIL_USERNAME'),
-    MAIL_PASSWORD='ruyj hxjf nmrz buar',
+    MAIL_PASSWORD=os.environ.get('MAIL_PASSWORD'),
-    MAIL_DEFAULT_SENDER='ryan.kegel@gmail.com',
+    MAIL_DEFAULT_SENDER=(
+        os.environ.get('MAIL_DEFAULT_SENDER')
+        or os.environ.get('MAIL_USERNAME')
+        or 'no-reply@reward-app.local'
+    ),
     FRONTEND_URL=os.environ.get('FRONTEND_URL', 'https://localhost:5173'),  # Dynamic via env var, defaults to localhost
     VAPID_CLAIMS_EMAIL=os.environ.get('VAPID_CLAIMS_EMAIL', 'admin@reward-app.local'),
 )
@@ -162,4 +166,4 @@ start_state_expiry_scheduler(app)
 start_chore_expiry_notification_scheduler(app)
 
 if __name__ == '__main__':
-    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True)
+    app.run(debug=False, host='0.0.0.0', port=5000, threaded=True)

backend/utils/email_sender.py

@@ -147,9 +147,9 @@ def send_reset_password_email(to_email: str, token: str) -> None:
         if os.environ.get('DB_ENV') == 'e2e':
             return
         Mail(current_app).send(msg)
-        print(f"[EMAIL to {to_email}] Reset password: {reset_url}")
+        current_app.logger.info("Password reset email sent")
-    except Exception as e:
+    except Exception:
-        print(f"Failed to send email to {to_email}. Reset link: {reset_url}. exception: {e}")
+        current_app.logger.exception("Failed to send password reset email")
 
 
 def send_pin_setup_email(to_email: str, code: str) -> None:
@@ -259,4 +259,4 @@ def send_digest_email(to_email: str, items: list, unsubscribe_token: str) -> Non
         Mail(current_app).send(msg)
         print(f"[EMAIL to {to_email}] Daily digest sent ({len(items)} items)")
     except Exception:
-        print(f"Failed to send digest email to {to_email}")
+        print(f"Failed to send digest email to {to_email}")

docker-compose.test.yml

@@ -14,6 +14,8 @@ services:
       - DIGEST_TOKEN_SECRET=${DIGEST_TOKEN_SECRET}
       - VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY}
       - VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY}
+      - MAIL_USERNAME=${MAIL_USERNAME}
+      - MAIL_PASSWORD=${MAIL_PASSWORD}
       - SEED_EMAIL=${SEED_EMAIL}
       - SEED_PASSWORD=${SEED_PASSWORD}
       - SEED_PIN=${SEED_PIN}

docker-compose.yml

@@ -15,6 +15,8 @@ services:
       - DIGEST_TOKEN_SECRET=${DIGEST_TOKEN_SECRET}
       - VAPID_PUBLIC_KEY=${VAPID_PUBLIC_KEY}
       - VAPID_PRIVATE_KEY=${VAPID_PRIVATE_KEY}
+      - MAIL_USERNAME=${MAIL_USERNAME}
+      - MAIL_PASSWORD=${MAIL_PASSWORD}
       - MONGO_URI=${MONGO_URI}
       - DATA_ENV=prod
       - DB_ENV=prod