v0.1.0

config.example.toml

@@ -1,3 +1,15 @@
+# PostfixAdmin-RS production configuration.
+# Copy to /etc/postfixadmin-rs/config.toml (mode 0640, group postfixadmin).
+# Secrets can be supplied via environment instead, e.g.
+#   POSTFIXADMIN_RS__DATABASE__PASSWORD=...
+#
+# First start on an empty database:
+#   postfixadmin-rs --init-schema
+#   postfixadmin-rs --create-superadmin admin@example.com
+# Existing PostfixAdmin database: `postfixadmin-rs --init-schema --dry-run`
+# shows which (additive) changes would be made.
+
+# Listen only on localhost and publish the panel through a TLS reverse proxy.
 host = "127.0.0.1"
 port = 8080
 environment = "production"
@@ -76,7 +88,8 @@ domain_dns_status_check = 1
 smtp_active_flag = false
 generate_password = true
 show_password = false
-edit_mailbox_name = true
+# Mailbox users may change their own display name: false | true | ["example.com", ...]
+edit_mailbox_name = false
 domain_list_hide_maxquota = false
 domain_list_hide_password_expiry = false
 
@@ -97,6 +110,8 @@ create_mailbox_subdirs_prefix = ""
 transport_default = "virtual"
 transport_options = ["virtual", "local", "relay"]
 vacation_domain = "autoreply.change-this-to-your.domain.tld"
+# Reply intervals offered for the auto-reply (seconds): 0 = once, 1 = every mail, 604800 = weekly
+vacation_choice_of_reply = [0, 604800]
 default_aliases = { abuse = "abuse@change-this-to-your.domain.tld", hostmaster = "hostmaster@change-this-to-your.domain.tld", postmaster = "postmaster@change-this-to-your.domain.tld", webmaster = "webmaster@change-this-to-your.domain.tld" }
 welcome_text = "Hi,\n\nWelcome to your new account.\n"
 recipient_delimiter = ""
@@ -107,10 +122,19 @@ motd_admin = ""
 motd_superadmin = ""
 
 [security]
-session_timeout_minutes = 1440
+session_timeout_minutes = 480
+# Keep true in production: the session cookie is then only sent over HTTPS.
 cookie_secure = true
+# Send Strict-Transport-Security (only when the panel is served over HTTPS).
+hsts = true
+# Reverse proxies whose X-Forwarded-For / X-Real-IP headers are trusted.
+# Required behind nginx, otherwise rate limiting and TOTP exceptions see 127.0.0.1.
+trusted_proxies = ["127.0.0.1", "::1"]
+# Failed logins per client IP and account within the window.
 login_attempts = 8
 login_window_seconds = 300
+# Re-check sessions against the database (disabled accounts, changed rights).
+session_revalidate_seconds = 30
 request_body_limit_mb = 2
 allow_legacy_shell_hooks = false
 allow_unsafe_alias_destinations = false