v0.2.22

config.example.toml

@@ -2,6 +2,12 @@
 host = "127.0.0.1"
 port = 3001
 environment = "production"
+# Secure attribute of session cookies: auto | always | never.
+# auto (default) sets Secure only when the browser reached RustBox over HTTPS:
+# X-Forwarded-Proto / Forwarded: proto= / X-Forwarded-Ssl from a trusted proxy,
+# otherwise the scheme of the browser's Origin/Referer. Plain-HTTP installations
+# therefore keep working. Use "always" behind HTTPS if your proxy strips headers.
+cookie_secure = "auto"
 # Global light/dark theme: system | dark | light
 default_theme = "system"
 # Global interface style used by the login screen and by accounts set to
@@ -51,6 +57,22 @@ tls_enabled = true
 max_attachment_size_mb = 10
 # Maximum size of the complete RFC822/MIME message submitted to the MTA (MiB).
 max_message_size_mb = 50
+# Memory guard for messages with attachments. Sending a message or saving an IMAP
+# draft snapshot loads every attachment into RAM and the MIME builder keeps several
+# copies (about 3-4x the message size). Attachment sets that cannot fit
+# max_message_size_mb are rejected with 413 before any file is read, and at most
+# max_concurrent_message_builds requests may hold attachments in memory at once;
+# the others wait up to message_build_wait_secs and then get 503.
+# Rough peak RAM = max_concurrent_message_builds x 4 x max_message_size_mb.
+max_concurrent_message_builds = 4
+message_build_wait_secs = 30
+
+# "Undo Send" window in seconds. A submitted message is held in memory (not
+# persisted) for this long before it is actually dispatched to SMTP, so the
+# sender can cancel it. 0 disables the feature and sends immediately. Must be
+# <= 120; keep this short, since a server restart during the window loses the
+# staged send.
+undo_send_window_secs = 8
 
 # Optional reverse-proxy subpath, e.g. "/mail".
 # base_path = "/mail"
@@ -97,6 +119,36 @@ pgp_max_key_bytes = 1048576
 # Private-key export is deliberately disabled unless the administrator opts in.
 pgp_allow_private_export = false
 
+# Login brute-force protection (POST /api/auth/login). Enabled by default.
+# Environment overrides use a double underscore, e.g.
+# LOGIN_RATE_LIMIT__ACCOUNT_MAX_FAILURES=10 or LOGIN_RATE_LIMIT__ENABLED=false.
+# Client IPs are taken from X-Forwarded-For only when the peer is in trusted_proxies.
+# State is kept in memory on each node: behind a load balancer every node counts
+# separately, so use sticky routing or lower thresholds in cluster mode.
+[login_rate_limit]
+enabled = true
+# Per-IP token bucket: up to ip_burst attempts at once, then one new attempt
+# every ip_replenish_secs seconds. Requests over the limit get HTTP 429.
+ip_burst = 5
+ip_replenish_secs = 12
+# Failed logins counted inside failure_window_secs before a lockout.
+# account_max_failures: per mailbox (case-insensitive), from any IP.
+# ip_max_failures: per client IP, across all mailboxes (password spraying).
+# 0 disables that lockout type.
+account_max_failures = 5
+ip_max_failures = 20
+failure_window_secs = 900
+# First lockout length; every consecutive lockout of the same key doubles it
+# up to max_lockout_secs. Locked attempts are refused before contacting IMAP.
+# Trade-off: an attacker can keep a known mailbox locked for webmail logins
+# (IMAP/SMTP clients are unaffected), so keep max_lockout_secs moderate.
+lockout_secs = 300
+max_lockout_secs = 3600
+# IPs/CIDRs exempt from the per-IP lockout (account lockouts still apply).
+exempt_networks = []
+# Memory cap per tracking table (accounts, IPs).
+max_tracked_keys = 100000
+
 [storage]
 backend = "filesystem" # filesystem | s3
 # path = "/var/lib/rustbox/blobs" # defaults to data_dir for filesystem