v0.2.8

config.dev.toml

@@ -52,3 +52,51 @@ sieve_allow_insecure_auth = false
 sieve_timeout_secs = 10
 
 trusted_proxies = "127.0.0.1,::1"
+[sync]
+interval_secs = 30
+# Maximum number of full message bodies fetched from IMAP during one sync pass when
+# automatic deep indexing is enabled. Higher values fill the cache/index faster but
+# increase network traffic, application database/search-storage usage and indexing CPU/I/O bursts.
+deep_index_batch_size = 10
+
+# Development search/cache profile.
+[search]
+backend = "local_tantivy"
+# Force automatic full-body cache/index for every account in this development instance.
+# Each periodic sync may download up to sync.deep_index_batch_size full MIME bodies.
+# This is intentionally ON in dev so cache/index behaviour is visible during testing.
+# Setting it to false falls back to the existing per-account deep_index preference.
+deep_index = true
+# Search outbox worker cadence/batch; these do NOT control IMAP body downloads.
+worker_interval_secs = 2
+worker_batch_size = 100
+worker_max_attempts = 12
+
+
+# Periodic IMAP reconciliation. Active folders still use IMAP IDLE for near-real-time
+# updates; this interval controls the fallback/background pass for counters, flags,
+# new headers in other folders, and the automatic deep-index pass. Lower values make
+# background state converge faster but increase IMAP traffic and server load.
+
+# Administrator-only system diagnostics endpoint. Disabled by default.
+# When enabled it exposes a redacted runtime/configuration report plus live probes
+# for SQL, session persistence (database/Redis), blob storage (filesystem/S3),
+# search (Tantivy/OpenSearch), IMAP IDLE counters and security telemetry.
+# Access requires BOTH an allowed source network and the configured auth method.
+# Secrets (passwords, tokens, S3 keys, session keys and URL credentials) are never returned.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+# Default/fail-safe allowlist: only this host. Add trusted LAN/pod/monitoring CIDRs explicitly.
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+# token | basic. Credentials should normally come from .env / secret manager, not TOML.
+auth = "token"
+# token = "replace-with-at-least-24-random-characters"
+# basic_username = "rustbox-monitor"
+# basic_password = "replace-with-a-long-random-password"
+# E-mail addresses and stable user hashes are omitted by default; aggregate counts remain available.
+include_user_identifiers = false
+# Timeout applied independently to database/session/storage/search probes.
+probe_timeout_secs = 5
+# Rolling in-memory window used for login failures, 403, 429 and 5xx attack/problem signals.
+security_window_secs = 900