[MR-SS]

Description

Helm users can configure SMTP through extraSecrets, but the Open Source configuration page does not show how to connect that mechanism to password resets and email notifications. Add a focused guide using the existing extraSecrets.DD_EMAIL_URL setting.

The guide covers STARTTLS and implicit TLS URLs, percent-encoded credentials, the public site URL, Secret-triggered rollouts, and an upgrade pinned to the installed chart version. It also explains direct transport tests from Django and the Celery worker, the separate asynchronous notification check, and troubleshooting common connection failures.

Test results

• Built the documentation site with Hugo Extended 0.153.5 using npm run build -- --environment development.
• Rendered and linted the current dev chart with the documented YAML override; verified the SMTP Secret and its references from Django, Celery worker, Celery beat and initializer.
• Verified Secret checksum annotations on the three application Deployments with trackConfig: enabled.
• Checked the STARTTLS, implicit TLS and local receiver URLs with django-environ.
• Checked shell example syntax after substituting the chart-version placeholder, and ran git diff --check.
• Reproduced the unconfigured SMTP failure (localhost:25, connection refused) on a local Minikube installation of the unmodified published chart 1.9.60, app 3.4.202.
• Upgraded that release with the same published chart version, extraSecrets.DD_EMAIL_URL=smtp://mailpit:1025, the public lab siteUrl, trackConfig: enabled, and all three create*Secret flags set to false. Preserved the existing application, PostgreSQL and Valkey Secret data, verified the application rollouts and received direct test emails from both Django and the Celery worker.
• Exercised the actual HTTP password-reset flow with a temporary active user: requested reset, received the Mailpit email, verified the public URL, submitted a new password and confirmed an authenticated HTTP login with it.
• Enqueued the real async_create_notification task through the broker with the temporary user's mail preference enabled. Verified worker receipt and success in its logs and the resulting notification in Mailpit. Removed the temporary user and restored the original system mail settings afterward.
• Live tests used a local unauthenticated Mailpit receiver, not an external SMTP provider. SMTP authentication, STARTTLS and implicit TLS handshakes were not tested end to end; the TLS URL parsing examples were checked separately.

Documentation

Updates the English Open Source Configuration page. Uses existing chart behavior; no application or Helm chart changes.

Checklist

• Based on dev and intended to target dev.
• Documentation build completed successfully.
• Examples checked against the existing chart templates.
• No model changes, migrations or application changes.