From c0d08b0880dcce7337d9bdf046c93b318a84c2dc Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Sun, 20 Sep 2026 15:58:10 +0200
Subject: deploy: pass BOKFD_SECRET_KEY through compose; document waves 1-2

---
 docs/STATE.md | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'docs/STATE.md')

diff --git a/docs/STATE.md b/docs/STATE.md
index 981aace..8b33b52 100644
--- a/docs/STATE.md
+++ b/docs/STATE.md
@@ -158,6 +158,11 @@ check.
     Settings `invoice_receivable_account`, `invoice_revenue_account`,
     `invoice_bankgiro`. **Swish QR: decided 2026-09-20 — not supported**
     (invoice 1's QR is dropped; the generator has no image support).
+    **Wave 2 done 2026-09-20**: settings secrets are AES-256-GCM encrypted
+    with `BOKFD_SECRET_KEY` (`smtp_password`; `settings.get` never returns
+    it), SMTP over TLS/STARTTLS/plain (`src/smtp.c`) and `invoice.send`
+    (subject `Faktura <nr>`, PDF attached, `last_sent_*`, audited,
+    `SMTP_NOT_CONFIGURED`/`SMTP_FAILED`). Wave 3 (TUI Fakturering) pending.
 
 ## Pending decisions
 
-- 
cgit v1.3