[jayleaton]

Both apps fall back to FROM_EMAIL=noreply@example.com when it is unset, and production accepted that sender. No mail provider sends from it, so every verification, reset and admin invite email failed, visible only as a log line.

Summary

 config.Load (apps/web and apps/admin), APP_ENV=production:
+  FROM_EMAIL unset                        → "FROM_EMAIL is required in production (a sender on your verified email domain)"
+  sender on a reserved example/test domain → "FROM_EMAIL must be a sender on your verified email domain in production, got %q"

"Reserved" means example.com|net|org, .example, .test, .invalid, .localhost and their subdomains (RFC 2606/6761), in either a@b or Name <a@b> form. Development and test keep the noreply@example.com default. README ("Every service runs with…") and .env.example say so.

Evidence

Before (main, APP_ENV=production, RESEND_API_KEY set, FROM_EMAIL unset): both boot and report healthy.

web   {"msg":"listening","addr":"0.0.0.0:39300","env":"production"}   /healthz → {"data":{"status":"ok"},"error":null}
admin {"msg":"admin listening","addr":"0.0.0.0:39301","env":"production"}   /healthz → {"data":{"status":"ok"},"error":null}

After (same env; each line is web, then admin):

FROM_EMAIL unset                     → invalid config: FROM_EMAIL is required in production (a sender on your verified email domain)
                                       invalid admin config: FROM_EMAIL is required in production (…)
FROM_EMAIL=noreply@example.com       → invalid config: FROM_EMAIL must be a sender on your verified email domain in production, got "noreply@example.com"
FROM_EMAIL=hello@mail.example.org    → refused (both)
FROM_EMAIL=ops@app.test              → refused (both)
FROM_EMAIL=Acme <noreply@example.com>→ refused (both)
FROM_EMAIL=Acme <noreply@acme.io>    → listening (both)
FROM_EMAIL=noreply@acme.io           → listening (both)
APP_ENV=development, FROM_EMAIL unset→ listening (both)

Config is not a test boundary (AGENTS.md), so these are reproduction runs of the built binaries, not unit tests.

Checks: make check-fast ✅. make generate lint test ✅ (all coverage floors pass).

Depends on: deploy plan/setup rejecting the example sender

deploy/platform.yaml (and platform.DefaultConfig) default email.from: noreply@example.com, which railway-setup writes into FROM_EMAIL. With this PR alone, a fresh make railway-setup on the defaults deploys services that refuse to boot until email.from is set. That refusal is the point of the fix, but the deploy tooling should catch it first. The deploy-bugs work (branch fix/template-deploy-bugs, which owns deploy/ and railway-setup) is making plan/setup reject the noreply@example.com default. Merge it with or before this PR. This PR does not touch deploy/.

Merge Danger

Door: two-way. It is config validation only, and a revert restores the old boot behaviour.

Blast Radius: deployments. Any production web or admin deployment with an unset or example FROM_EMAIL stops booting on its next deploy and shows the reason. Its emails were already failing.

🤖 Generated with Claude Code

[jayleaton]

Rebased onto main 5d72efe. The config change is as written: both apps' config.Load refuse an unset or reserved-domain FROM_EMAIL in production, and it already passes the strict name and magic-number rules. The README sentence moved to docs/deploy.md after #107.

Added one commit: scripts/release-smoke.sh (from #115, newer than this PR) boots web and admin with only what production requires, and that set now includes FROM_EMAIL. Its first CI run failed with exactly this PR's error (web migrate failed: FROM_EMAIL is required in production), so the smoke now sets release-smoke@go-fast-stack.dev. Nothing is sent; the Resend key is a dummy.

Checked on the rebased web binary with APP_ENV=production: unset → FROM_EMAIL is required in production …; noreply@example.com and Acme <noreply@example.com> → must be a sender on your verified email domain …; noreply@acme.io → no FROM_EMAIL error. make check-fast ok, ci-ok success on fc2d8b1 (smoke: web and admin /healthz 200).

Not merged yet, per this PR's own "Depends on": main's deploy/platform.yaml and platform.DefaultConfig still default email.from: noreply@example.com, and no merged or open PR rejects it in plan/setup. Merged alone, a fresh make railway-setup on the defaults would deploy web and admin into this boot refusal. Waiting on that deploy-side check, or a call to merge without it.

[jayleaton]

The dependency is in: #132 (ece908d) makes plan, setup and apply refuse an unset or example email.from. Rebased onto it, keeping the release-smoke commit. #132's reservedSenderDomains is the same list as this PR's realSender (example.com, example.net, example.org, example, test, invalid, localhost and their subdomains, same suffix matching), so nothing to align. Added one small commit: both apps' realSender now point back at reservedSenderDomains ("keep the two lists the same", as #132 does), and docs/deploy.md links to #132's "A real sender is required" paragraph instead of repeating it. make check-fast ok, make lint-layering ok (112 probes), ci-ok success on 743c773.