v0.15.0 password recovery, phone layout, CLI pager, embed policy fixes

deploy/freebsd/rc.d/chessd

@@ -18,11 +18,25 @@
 #                          Default: ${chessd_home}/jwt.key
 # chessd_trusted_proxies:  Reverse-proxy address(es) whose X-Real-IP header is
 #                          trusted as the client address. Default: none
+# chessd_public_url:       The web client's public address, which emailed links
+#                          open. Default: none
+# chessd_smtp_host:        SMTP relay for password-reset email (the mail jail).
+#                          Unset leaves password recovery off. Default: none
+# chessd_smtp_port:        Relay port. Default: 25
+# chessd_smtp_user:        Relay user name, when the relay authenticates
+#                          this host. Default: none
+# chessd_smtp_password_file: File holding that user's password, mode 0600.
+#                          Default: ${chessd_home}/smtp.secret when it exists
+# chessd_mail_from:        Sender address of server email. Default: none
 # chessd_flags:            Additional flags passed to the binary. Default: ""
 #
 # Add the following to /etc/rc.conf to enable:
 #   chessd_enable="YES"
 #   chessd_trusted_proxies="<address nginx connects from>"
+# and, for password recovery by email, once the mail jail relays for this one:
+#   chessd_public_url="https://<site>/chess/web-client/"
+#   chessd_smtp_host="<mail jail address>"
+#   chessd_mail_from="Chess <chess@<site>>"
 
 . /etc/rc.subr
 
@@ -43,6 +57,12 @@ load_rc_config "$name"
 : ${chessd_dsn:="postgres:///chess?host=/tmp"}
 : ${chessd_jwt_key:="${chessd_home}/jwt.key"}
 : ${chessd_trusted_proxies:=""}
+: ${chessd_public_url:=""}
+: ${chessd_smtp_host:=""}
+: ${chessd_smtp_port:="25"}
+: ${chessd_smtp_user:=""}
+: ${chessd_smtp_password_file:=""}
+: ${chessd_mail_from:=""}
 : ${chessd_flags:=""}
 
 command="${chessd_bin}"
@@ -85,6 +105,19 @@ chessd_start()
     if [ -n "${chessd_trusted_proxies}" ]; then
         set -- "$@" -trusted-proxies "${chessd_trusted_proxies}"
     fi
+    # Password recovery by email: relay, sender, and the client address the
+    # link opens. The server refuses a relay without the other two.
+    if [ -n "${chessd_smtp_host}" ]; then
+        set -- "$@" -smtp-host "${chessd_smtp_host}" -smtp-port "${chessd_smtp_port}" \
+            -mail-from "${chessd_mail_from}" -public-url "${chessd_public_url}"
+        if [ -n "${chessd_smtp_user}" ]; then
+            set -- "$@" -smtp-user "${chessd_smtp_user}"
+            secret="${chessd_smtp_password_file:-${chessd_home}/smtp.secret}"
+            if [ -f "${secret}" ]; then
+                set -- "$@" -smtp-password-file "${secret}"
+            fi
+        fi
+    fi
 
     echo "Starting ${desc}."
     # -r restarts the server 5 seconds after an unexpected exit (for example