v0.2.22

README.md

@@ -1,4 +1,4 @@
-# RustBox 0.2.20
+# RustBox 0.2.22
 
 RustBox is a webmail derived from `c0h1b4/oxi`. The consumed Oxi revision is recorded in `UPSTREAM_BASE`.
 
@@ -59,6 +59,10 @@ Administrator-only deep runtime diagnostics can be enabled separately under `[di
 
 Mail endpoints are configured by the administrator, not on the login screen. Users enter only email and password.
 
+Login brute-force protection is on by default and configured in the `[login_rate_limit]` section (or `LOGIN_RATE_LIMIT__*` environment variables): a per-IP token bucket on the login endpoint plus failed-attempt lockouts per mailbox and per client IP with exponential back-off. Locked attempts are answered with `429` and `Retry-After` without contacting the IMAP server. Counters are in memory per node. See `config.example.toml` for every option.
+
+Session cookies get the `Secure` attribute according to `cookie_secure` (default `auto`): only when the browser reached RustBox over HTTPS, detected from a trusted proxy's `X-Forwarded-Proto`/`Forwarded`/`X-Forwarded-Ssl` header or the browser's `Origin`/`Referer`. Plain-HTTP installations keep working; set `cookie_secure = "always"` behind an HTTPS proxy that does not forward the scheme.
+
 Edit `config.dev.toml` before the first run:
 
 ```toml
@@ -77,6 +81,15 @@ tls_enabled = true
 max_attachment_size_mb = 10
 # Hard limit for the complete rendered RFC822/MIME message submitted to the MTA.
 max_message_size_mb = 50
+# Memory guard for messages with attachments. Sending a message or saving an IMAP
+# draft snapshot loads every attachment into RAM and the MIME builder keeps several
+# copies (about 3-4x the message size). Attachment sets that cannot fit
+# max_message_size_mb are rejected with 413 before any file is read, and at most
+# max_concurrent_message_builds requests may hold attachments in memory at once;
+# the others wait up to message_build_wait_secs and then get 503.
+# Rough peak RAM = max_concurrent_message_builds x 4 x max_message_size_mb.
+max_concurrent_message_builds = 4
+message_build_wait_secs = 30
 
 # Optional features exposed by the server/UI.
 sieve_enabled = true
@@ -102,6 +115,8 @@ If the mail host settings are omitted, RustBox uses `localhost` with IMAP `993`
 
 Mail-size limits are intentionally separate. `max_attachment_size_mb` applies to each raw uploaded file, while `max_message_size_mb` is checked against the final RFC822/MIME byte stream immediately before SMTP submission. The latter therefore includes message bodies, headers, MIME boundaries, base64 expansion, inline CID parts and OpenPGP transformations. The composer displays only an estimate; the server-side final-MIME check is authoritative.
 
+Attachments are streamed to blob storage on upload, but sending a message or saving an IMAP draft snapshot has to hold them in memory while the MIME message is built. RustBox therefore (1) rejects an attachment set whose base64-encoded size cannot fit `max_message_size_mb` with `413` before any file is read into memory, and also while an upload is still streaming, and (2) allows only `max_concurrent_message_builds` such operations at the same time; further requests wait up to `message_build_wait_secs` and then receive `503`. Peak RAM for these operations is roughly `max_concurrent_message_builds` x 4 x `max_message_size_mb`. Fully streamed MIME assembly is not implemented.
+
 ## Database, storage, search and cluster traffic
 
 `database_backend = "sqlite" | "mysql" | "pgsql"` selects only the authoritative SQL database. It does not force or forbid local blob/search storage. In particular, PostgreSQL/MySQL are valid in a single-node installation together with `storage.backend="filesystem"` and `search.backend="local_tantivy"`.