Email setup

Piranha sends transactional email — today, the set-password / invite link when an admin creates or resets an account. Email is optional: with no SMTP configured the app runs normally and simply skips sending (the invite token is always returned so an admin can copy it). Sending is best-effort — a mail outage never blocks minting a link.

Quickest setup: Gmail App Password

Send as a single mailbox with an App Password (no admin-console changes):

SWIM_SMTP_HOST=smtp.gmail.com
SWIM_SMTP_PORT=587
SWIM_SMTP_USERNAME=you@yourdomain.org
SWIM_SMTP_PASSWORD=<16-char App Password>
SWIM_SMTP_SENDER=you@yourdomain.org
SWIM_PUBLIC_BASE_URL=https://meets.yourdomain.org

App Passwords require 2-Step Verification on the account. If myaccount.google.com/apppasswords is empty, turn on 2SV first.

Recommended: Google Workspace SMTP relay

If you own a Workspace domain, the SMTP relay lets you send as any address in your domain at higher volume, from any IP (so it works on hosts whose egress IP rotates):

1. Admin console → Apps → Gmail → Routing → SMTP relay service → add a rule.
2. Allowed senders: Only addresses in my domains.
3. Authentication: ✅ Require SMTP Authentication — and uncheck “Only accept mail from the specified IP addresses.” (If the IP option stays on, the relay rejects mail whose source IP isn’t registered, even when SMTP auth succeeds — a common gotcha, especially over IPv6.)
4. Encryption: ✅ Require TLS.

Then point the app at the relay host with an App Password credential:

SWIM_SMTP_HOST=smtp-relay.gmail.com
SWIM_SMTP_USERNAME=relay@yourdomain.org
SWIM_SMTP_PASSWORD=<App Password>
SWIM_SMTP_SENDER=noreply@yourdomain.org

For deliverability, set up SPF / DKIM / DMARC on the domain (Workspace’s Authenticate email generates the DKIM record).

The recipient allowlist (fail-closed)

While you’re proving email out, a transport-level allowlist prevents accidental sends to real users — enforced no matter where you deploy:

SWIM_EMAIL_ALLOWLIST	Effect
unset / empty	Locked to the built-in safe addresses. A blank var never opens delivery up.
a@x.org,b@y.org	Exactly those addresses.
*	Unrestricted — the deliberate “we’re live” switch.

Leave it unset until you’re confident, then set SWIM_EMAIL_ALLOWLIST=*.

SWIM_PUBLIC_BASE_URL is required for links

Invite links are absolute. If SWIM_PUBLIC_BASE_URL is unset, the send is skipped rather than mailing a broken relative link — so set it to your real public origin whenever email is on.