Email

Olympusx AI sends mail for one purpose: letting people in. An invitation, a password reset and an email verification are sent by the identity provider. Everything else the platform tells people, such as an import that finished or a component that went down, arrives as a notification in the console.

Who sends what

Mail	Sent by	Needs
Invitation: a link to set a password	The identity provider	A mail relay on the provider
Password reset	The identity provider	A mail relay, and password reset allowed on the realm
Email verification	The identity provider	A mail relay

With your own identity provider, all of this is your provider’s mail, sent the way it already sends it. The rest of this page is about the built-in identity service.

The built-in identity service has no mail relay until you give it one

Without one it sends nothing, and inviting someone still works, in two steps instead of one.

Give it a relay at installation

Set the relay in the Olympus resource, in the built-in identity service’s mail settings, or in the equivalent chart values. See Configuration for the exact path.

Field	Value
`host`	The relay’s host name, with no scheme and no port. Required.
`port`	587 when empty. Use 465 with `ssl`.
`from`	The sender address, such as `olympus@example.com`. Required.
`fromDisplayName`	`Olympusx AI` when empty.
`encryption`	`starttls` (the default), `ssl` or `none`.
`auth.username`	For a relay that requires a login. Omit `auth` for one that does not.
`auth.passwordSecret`	The name of a Secret holding the relay’s password, never the password itself.
`auth.passwordSecretKey`	The entry in that Secret; `password` by default.

Create the Secret first:

kubectl -n <namespace> create secret generic olympus-smtp \
  --from-literal=password='<the relay password>'

The password is in no rendered object and not in the resource: the identity service reads it from the Secret when it starts. A missing Secret, or one without the entry, keeps the identity service from starting, and its pod names the Secret.

The resource is refused when the relay has no host or from, when the host carries a scheme or a port, when the port is outside 1 to 65535, or when a login has no passwordSecret.

Change the relay on a running platform

Open the built-in identity service’s administration console and the olympus realm.
Open the realm’s email settings, and enter the host, port, sender, encryption and login.
Use Test connection there: it sends a message to the address of the administrator who is signed in.
Save.

Inviting with a relay

A tenant admin, or a platform administrator for any tenant, selects Invite on Govern › Users. The new person receives a link to set their password, valid for twelve hours unless the realm says otherwise. The console shows Invitation sent. If the link runs out before it is used, Resend invitation on the person’s row sends a new one.

The set-password page is the first screen an invited person sees, and the invitation is the first mail they receive. Both carry the Olympusx look. See Identity and sign-in.

Inviting without a relay

Invite adds the person to the tenant with their role. The console says Added, but the email was not sent, with the identity provider’s reason, such as “No sender address configured in the realm settings for emails”. The person has no way in yet.
Select Set a temporary password. The platform generates one, sets it as temporary, and shows it to you once. Copy it before you close the dialog.
Give it to the person yourself, by a channel you trust. The first time they sign in with it, they choose their own.

The password is stored nowhere. The audit trail records that it was set, by whom and for whom, never the value. The row’s menu offers Set temporary password for anyone in the tenant except a platform administrator and yourself; any password the person had stops working.

Once a relay is configured, Resend invitation sends the mail the first attempt could not.

Limits

Limit	Value
Invitation link	Valid 12 hours by default
Relay port	1 to 65535; 587 by default
Mail language	English