Is play-mailer an smtp server - playframework-2.6

Question

I need the functionality to send emails from my Play 2.6.x server. I found that I could use play-mailer (https://github.com/playframework/play-mailer#usage)
Question 1 - Do I need a separate smtp server or is play-mailer an smtp server itself.
Question 2 - At the moment, I am running the application on localhost but I'll eventually deploy it. Would my application work if I just use localhost in the configuration below?
play.mailer {
host = localhost // (mandatory)
port = 25 // (defaults to 25)
ssl = no // (defaults to no)
tls = no // (defaults to no)
tlsRequired = no // (defaults to no)
user = null // (optional)
password = null // (optional)
debug = no // (defaults to no, to take effect you also need to set the log level to "DEBUG" for the application logger)
timeout = null // (defaults to 60s in milliseconds)
connectiontimeout = null // (defaults to 60s in milliseconds)
mock = true// (defaults to no, will only log all the email properties instead of sending an email)
}
Question 3 - Once I deploy the application in the cloud (say AWS), do I just need to change host in the above configuration to make it work?
Question 4 - I am suppose to pass username and password in the play.mailer config. Considering that I version-control my application.conf, is it safe to enter the username and password in the file?

Answer 1

Answer 1:
You will need an smtp server for play.mailer to connect to. This is generally what you'll put in your host in production.
Answer 2:
Yes it should work just like that, I think you'll have to set mock = yes though.
Answer 3:
If you decide to use aws (https://aws.amazon.com/ses/), your conf will look something like this.
play.mailer {
host = "email-smtp.us-east-1.amazonaws.com" // (mandatory) - url from amazon
port = 465 // (defaults to 25)
ssl = yes // (defaults to no)
tls = no // (defaults to no)
tlsRequired = no // (defaults to no)
user = "id_from_amazon"
password = "password_from_amazon"
debug = no // (defaults to no)
timeout = null // (defaults to 60s in milliseconds)
connectiontimeout = null // (defaults to 60s in milliseconds)
mock = no // for actually sending emails. set it to yes if you want to mock.
}
Answer 4:
So the security aspect depends on what environment you're using your play server in. If application.conf is likely to be seen by somebody then you could use environment variables instead of writing it in the application.conf
password = ${APP_MAILER_PASSWORD}
and then set APP_MAILER_PASSWORD as an environment variable. Again, this isn't secure if someone can access the console of your server - but not much is at that point.