import nodemailer from "nodemailer";

export function createTransport() {
  const host = process.env.SMTP_HOST!;
  const port = Number(process.env.SMTP_PORT || 465);
  const user = process.env.SMTP_USER!;
  const pass = process.env.SMTP_PASS!;

  const transporter = nodemailer.createTransport({
    host,
    port,
    secure: port === 465, // 465 = implicit TLS
    auth: { user, pass },
    requireTLS: port !== 465, // bei 587 erzwinge STARTTLS
    tls: {
      minVersion: "TLSv1.2",
      ciphers:
        "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256",
      rejectUnauthorized: true,
      servername: host, // SNI
    },
    // Optional: DKIM-Signatur, falls du einen Selector + Private Key hast
    // dkim: {
    //   domainName: "shortman.me",
    //   keySelector: "mail",
    //   privateKey: process.env.DKIM_PRIVATE_KEY!,
    //   cacheDir: false,
    // },
  });

  return transporter;
}
