188 lines
5.5 KiB
TOML
188 lines
5.5 KiB
TOML
# PostfixAdmin-RS production configuration.
|
|
# Copy to /etc/postfixadmin-rs/config.toml (mode 0640, group postfixadmin).
|
|
# Secrets can be supplied via environment instead, e.g.
|
|
# POSTFIXADMIN_RS__DATABASE__PASSWORD=...
|
|
#
|
|
# First start on an empty database:
|
|
# postfixadmin-rs --init-schema
|
|
# postfixadmin-rs --create-superadmin admin@example.com
|
|
# Existing PostfixAdmin database: `postfixadmin-rs --init-schema --dry-run`
|
|
# shows which (additive) changes would be made.
|
|
|
|
# Listen only on localhost and publish the panel through a TLS reverse proxy.
|
|
host = "127.0.0.1"
|
|
port = 8080
|
|
environment = "production"
|
|
default_language = "en"
|
|
base_path = "/"
|
|
|
|
[database]
|
|
backend = "mysql" # mysql | pgsql | sqlite
|
|
host = "localhost"
|
|
port = 3306
|
|
user = "postfix"
|
|
password = "change-me"
|
|
name = "postfix"
|
|
# path = "/etc/postfix/sqlite/postfixadmin.db"
|
|
use_ssl = false
|
|
verify_server_cert = true
|
|
prefix = ""
|
|
max_connections = 10
|
|
|
|
read_only = false
|
|
[password]
|
|
scheme = "php_crypt:MD5"
|
|
doveadm = "/usr/bin/doveadm"
|
|
authlib_default_flavor = "md5raw"
|
|
min_length = 5
|
|
min_letters = 3
|
|
min_digits = 2
|
|
|
|
[smtp]
|
|
host = "localhost"
|
|
port = 25
|
|
kind = "plain" # plain | starttls | tls
|
|
username = ""
|
|
password = ""
|
|
client_name = ""
|
|
admin_email = ""
|
|
admin_name = "Postmaster"
|
|
|
|
[features]
|
|
quota = false
|
|
domain_quota = true
|
|
transport = false
|
|
vacation = false
|
|
vacation_control = true
|
|
vacation_control_admin = true
|
|
edit_alias = true
|
|
alias_control = true
|
|
alias_control_admin = true
|
|
special_alias_control = false
|
|
alias_domain = true
|
|
backup = false
|
|
sendmail = true
|
|
sendmail_all_admins = false
|
|
logging = true
|
|
fetchmail = true
|
|
fetchmail_extra_options = false
|
|
emailcheck_resolve_domain = true
|
|
emailcheck_localaliasonly = false
|
|
show_status = true
|
|
show_undeliverable = true
|
|
show_popimap = true
|
|
show_vacation = false
|
|
show_disabled = false
|
|
show_expired = false
|
|
totp = false
|
|
app_passwords = false
|
|
dkim = false
|
|
dkim_all_admins = false
|
|
forgotten_user_password_reset = true
|
|
forgotten_admin_password_reset = false
|
|
used_quotas = false
|
|
new_quota_table = true
|
|
xmlrpc = false
|
|
password_expiration = false
|
|
domain_dns_status_check = 1
|
|
smtp_active_flag = false
|
|
generate_password = true
|
|
show_password = false
|
|
# Mailbox users may change their own display name: false | true | ["example.com", ...]
|
|
edit_mailbox_name = false
|
|
domain_list_hide_maxquota = false
|
|
domain_list_hide_password_expiry = false
|
|
|
|
[defaults]
|
|
aliases = 10
|
|
mailboxes = 10
|
|
maxquota_mb = 10
|
|
domain_quota_mb = 2048
|
|
quota_multiplier = 1024000
|
|
quota_level_med_pct = 55
|
|
quota_level_high_pct = 90
|
|
page_size = 10
|
|
domain_path = true
|
|
domain_in_mailbox = false
|
|
maildir_template = ""
|
|
create_mailbox_subdirs = []
|
|
create_mailbox_subdirs_prefix = ""
|
|
transport_default = "virtual"
|
|
transport_options = ["virtual", "local", "relay"]
|
|
vacation_domain = "autoreply.change-this-to-your.domain.tld"
|
|
# Reply intervals offered for the auto-reply (seconds): 0 = once, 1 = every mail, 604800 = weekly
|
|
vacation_choice_of_reply = [0, 604800]
|
|
default_aliases = { abuse = "abuse@change-this-to-your.domain.tld", hostmaster = "hostmaster@change-this-to-your.domain.tld", postmaster = "postmaster@change-this-to-your.domain.tld", webmaster = "webmaster@change-this-to-your.domain.tld" }
|
|
welcome_text = "Hi,\n\nWelcome to your new account.\n"
|
|
recipient_delimiter = ""
|
|
show_undeliverable_exceptions = ["unixmail.domain.ext", "exchangeserver.domain.ext"]
|
|
show_custom_domains = ["subdomain.domain.ext", "domain2.ext"]
|
|
motd_user = ""
|
|
motd_admin = ""
|
|
motd_superadmin = ""
|
|
|
|
[security]
|
|
session_timeout_minutes = 480
|
|
# Keep true in production: the session cookie is then only sent over HTTPS.
|
|
cookie_secure = true
|
|
# Send Strict-Transport-Security (only when the panel is served over HTTPS).
|
|
hsts = true
|
|
# Reverse proxies whose X-Forwarded-For / X-Real-IP headers are trusted.
|
|
# Required behind nginx, otherwise rate limiting and TOTP exceptions see 127.0.0.1.
|
|
trusted_proxies = ["127.0.0.1", "::1"]
|
|
# Failed logins per client IP and account within the window.
|
|
login_attempts = 8
|
|
login_window_seconds = 300
|
|
# Re-check sessions against the database (disabled accounts, changed rights).
|
|
session_revalidate_seconds = 30
|
|
request_body_limit_mb = 2
|
|
allow_legacy_shell_hooks = false
|
|
allow_unsafe_alias_destinations = false
|
|
|
|
[hooks]
|
|
mailbox_postcreation = []
|
|
mailbox_postedit = []
|
|
mailbox_postdeletion = []
|
|
mailbox_postpassword = []
|
|
mailbox_post_totp_change = []
|
|
mailbox_post_totp_exception_add = []
|
|
mailbox_post_totp_exception_delete = []
|
|
mailbox_post_app_password = []
|
|
domain_postcreation = []
|
|
domain_postedit = []
|
|
domain_postdeletion = []
|
|
|
|
[backup]
|
|
mysql_dump = "/usr/bin/mysqldump"
|
|
pg_dump = "/usr/bin/pg_dump"
|
|
|
|
[sieve]
|
|
# Optional ManageSieve filters for mailbox users. No IMAP access is used.
|
|
enabled = false
|
|
host = "127.0.0.1"
|
|
port = 4190
|
|
tls_mode = "starttls" # starttls | implicit | none
|
|
allow_insecure_auth = false
|
|
timeout_secs = 10
|
|
read_only = false
|
|
|
|
[dkim]
|
|
# UI opened first when both implementations are enabled: postfixadmin | rspamd
|
|
default_backend = "postfixadmin"
|
|
|
|
# Optional Rspamd DKIM host integration. Uses selector_map/path_map instead of
|
|
# growing a domain { ... } block for every domain.
|
|
[rspamd_dkim]
|
|
enabled = false
|
|
rspamadm = "/usr/bin/rspamadm"
|
|
key_dir = "/var/lib/rspamd/dkim"
|
|
signing_config = "/etc/rspamd/local.d/dkim_signing.conf"
|
|
selector_map = "/var/lib/rspamd/dkim/postfixadmin-rs-selectors.map"
|
|
path_map = "/var/lib/rspamd/dkim/postfixadmin-rs-paths.map"
|
|
default_selector = "mail"
|
|
key_bits = 2048
|
|
# Prefer a tightly scoped sudoers rule for reload rather than running the web app as root.
|
|
# reload_command = ["/usr/bin/sudo", "-n", "/usr/bin/systemctl", "reload", "rspamd"]
|
|
reload_command = []
|
|
dev_mock = false
|