v0.2.22

packaging/rustbox.toml

@@ -10,6 +10,12 @@
 host = "0.0.0.0"
 port = 3001
 environment = "production"
+# Secure attribute of session cookies: auto | always | never.
+# auto (default) sets Secure only when the browser reached RustBox over HTTPS:
+# X-Forwarded-Proto / Forwarded: proto= / X-Forwarded-Ssl from a trusted proxy,
+# otherwise the scheme of the browser's Origin/Referer. Plain-HTTP installations
+# therefore keep working. Use "always" behind HTTPS if your proxy strips headers.
+cookie_secure = "auto"
 
 data_dir = "/var/lib/rustbox"
 log_dir = "/var/log/rustbox"
@@ -127,6 +133,18 @@ max_attachment_size_mb = 50
 
 # Maximum complete RFC822/MIME message size in MiB.
 max_message_size_mb = 100
+# Memory guard for messages with attachments. Sending a message or saving an IMAP
+# draft snapshot loads every attachment into RAM and the MIME builder keeps several
+# copies (about 3-4x the message size). Attachment sets that cannot fit
+# max_message_size_mb are rejected with 413 before any file is read, and at most
+# max_concurrent_message_builds requests may hold attachments in memory at once;
+# the others wait up to message_build_wait_secs and then get 503.
+# Rough peak RAM = max_concurrent_message_builds x 4 x max_message_size_mb.
+max_concurrent_message_builds = 4
+message_build_wait_secs = 30
+
+# "Undo Send" window in seconds (0 disables; max 120). See config.example.toml.
+undo_send_window_secs = 8
 
 
 # -----------------------------------------------------------------------------
@@ -210,6 +228,41 @@ pgp_allow_private_export = true
 #
 # pgp_enabled = false
 
+
+# -----------------------------------------------------------------------------
+# Login brute-force protection
+# -----------------------------------------------------------------------------
+
+# Login brute-force protection (POST /api/auth/login). Enabled by default.
+# Environment overrides use a double underscore, e.g.
+# LOGIN_RATE_LIMIT__ACCOUNT_MAX_FAILURES=10 or LOGIN_RATE_LIMIT__ENABLED=false.
+# Client IPs are taken from X-Forwarded-For only when the peer is in trusted_proxies.
+# State is kept in memory on each node: behind a load balancer every node counts
+# separately, so use sticky routing or lower thresholds in cluster mode.
+[login_rate_limit]
+enabled = true
+# Per-IP token bucket: up to ip_burst attempts at once, then one new attempt
+# every ip_replenish_secs seconds. Requests over the limit get HTTP 429.
+ip_burst = 5
+ip_replenish_secs = 12
+# Failed logins counted inside failure_window_secs before a lockout.
+# account_max_failures: per mailbox (case-insensitive), from any IP.
+# ip_max_failures: per client IP, across all mailboxes (password spraying).
+# 0 disables that lockout type.
+account_max_failures = 5
+ip_max_failures = 20
+failure_window_secs = 900
+# First lockout length; every consecutive lockout of the same key doubles it
+# up to max_lockout_secs. Locked attempts are refused before contacting IMAP.
+# Trade-off: an attacker can keep a known mailbox locked for webmail logins
+# (IMAP/SMTP clients are unaffected), so keep max_lockout_secs moderate.
+lockout_secs = 300
+max_lockout_secs = 3600
+# IPs/CIDRs exempt from the per-IP lockout (account lockouts still apply).
+exempt_networks = []
+# Memory cap per tracking table (accounts, IPs).
+max_tracked_keys = 100000
+
 [storage]
 
 # filesystem | s3