v0.2.8

docker/.env.example

@@ -15,7 +15,7 @@ SMTP_PORT=587
 TLS_ENABLED=true
 
 # Application logging.
-RUST_LOG=info
+RUST_LOG=warn,rustbox=info,tower_http=info
 
 # Shared session encryption key. Required to be identical on all RustBox nodes.
 # Replace for any non-local deployment.
@@ -52,3 +52,12 @@ COMPOSE_PROJECT_NAME=rustbox
 
 # development = cookies work over plain HTTP; production = Secure cookies, requires HTTPS
 ENVIRONMENT=development
+
+# Administrator-only diagnostics endpoint (requires corresponding TOML section).
+# DIAGNOSTICS_ENDPOINT__ENABLED=true
+# DIAGNOSTICS_ENDPOINT__AUTH=token
+# DIAGNOSTICS_ENDPOINT__TOKEN=replace-with-at-least-24-random-characters
+# Alternative Basic Auth:
+# DIAGNOSTICS_ENDPOINT__AUTH=basic
+# DIAGNOSTICS_ENDPOINT__BASIC_USERNAME=rustbox-monitor
+# DIAGNOSTICS_ENDPOINT__BASIC_PASSWORD=replace-with-a-long-random-password

docker/README.md

@@ -80,7 +80,7 @@ cp .env.example .env
 | `SMTP_HOST` | `mail.example.com` | all | SMTP server hostname used for sending mail. |
 | `SMTP_PORT` | `587` | all | SMTP submission port. |
 | `TLS_ENABLED` | `true` | all | Enables TLS for mail connections according to RustBox configuration. |
-| `RUST_LOG` | `info` | all | Rust logging filter/level. |
+| `RUST_LOG` | `warn,rustbox=info,tower_http=info` | all | Rust logging filter. Keeps dependencies quiet by default; use explicit target directives for dependency debugging. |
 | `SESSION_ENCRYPTION_KEY` | development key | PostgreSQL, MySQL | Shared key used to encrypt session data. All application nodes must use the same value. Replace it outside local testing. |
 | `POSTGRES_PASSWORD` | `rustbox-dev-password` | PostgreSQL | Password for PostgreSQL user `rustbox`; also used in `DATABASE_URL`. |
 | `S3_ACCESS_KEY` | `rustbox` | PostgreSQL/S3 | Access key for the bundled S3-compatible SILO service and RustBox S3 client. |
@@ -201,4 +201,4 @@ docker compose -p rustbox -f compose-postgres-s3-opensearch.yml exec opensearch
   -d '{"index.blocks.read_only_allow_delete":null}'
 ```
 
-RustBox 0.2.6 retains the OpenSearch outbox backoff introduced in 0.2.2, so these 429/flood-stage responses no longer produce one warning per queued event on a full disk.
+RustBox 0.2.8 retains the OpenSearch outbox backoff introduced in 0.2.2, so these 429/flood-stage responses no longer produce one warning per queued event on a full disk.

docker/compose-ha-garage.yml

@@ -23,7 +23,7 @@ x-rustbox-common: &rustbox-common
     SMTP_HOST: ${SMTP_HOST:-mail.example.com}
     SMTP_PORT: ${SMTP_PORT:-587}
     TLS_ENABLED: ${TLS_ENABLED:-true}
-    RUST_LOG: ${RUST_LOG:-info}
+    RUST_LOG: ${RUST_LOG:-warn,rustbox=info,tower_http=info}
     DATABASE_URL: postgres://rustbox:${POSTGRES_PASSWORD:-rustbox-dev-password}@postgres:5432/rustbox
     SESSION_ENCRYPTION_KEY: ${SESSION_ENCRYPTION_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
     AWS_ACCESS_KEY_ID: ${GARAGE_ACCESS_KEY_ID:-GKb69252a3b0643e8bd08d4cd4}

docker/compose-mysql-nfs-opensearch.yml

@@ -52,7 +52,7 @@ services:
       SMTP_HOST: ${SMTP_HOST:-mail.example.com}
       SMTP_PORT: ${SMTP_PORT:-587}
       TLS_ENABLED: ${TLS_ENABLED:-true}
-      RUST_LOG: ${RUST_LOG:-info}
+      RUST_LOG: ${RUST_LOG:-warn,rustbox=info,tower_http=info}
       DATABASE_URL: mysql://rustbox:${MYSQL_PASSWORD:-rustbox-dev-password}@mysql:3306/rustbox
       SESSION_ENCRYPTION_KEY: ${SESSION_ENCRYPTION_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
     volumes:

docker/compose-postgres-s3-opensearch.yml

@@ -76,7 +76,7 @@ services:
       SMTP_HOST: ${SMTP_HOST:-mail.example.com}
       SMTP_PORT: ${SMTP_PORT:-587}
       TLS_ENABLED: ${TLS_ENABLED:-true}
-      RUST_LOG: ${RUST_LOG:-info}
+      RUST_LOG: ${RUST_LOG:-warn,rustbox=info,tower_http=info}
       DATABASE_URL: postgres://rustbox:${POSTGRES_PASSWORD:-rustbox-dev-password}@postgres:5432/rustbox
       SESSION_ENCRYPTION_KEY: ${SESSION_ENCRYPTION_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=}
       AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-rustbox}

docker/compose-single-sqlite.yml

@@ -17,7 +17,7 @@ services:
       SMTP_HOST: ${SMTP_HOST:-mail.example.com}
       SMTP_PORT: ${SMTP_PORT:-587}
       TLS_ENABLED: ${TLS_ENABLED:-true}
-      RUST_LOG: ${RUST_LOG:-info}
+      RUST_LOG: ${RUST_LOG:-warn,rustbox=info,tower_http=info}
     volumes:
       - ./configs/single-sqlite.toml:/etc/rustbox/rustbox.toml:ro
       - rustbox-data:/var/lib/rustbox

docker/configs/ha-garage.toml

@@ -21,8 +21,16 @@ path_style = true
 allow_http = true
 prefix = "mail"
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Dev: proactively cache/index full message bodies for testing.
+deep_index = true
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -30,3 +38,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/mysql-nfs-opensearch.toml

@@ -11,8 +11,16 @@ backend = "filesystem"
 path = "/mnt/rustbox-shared"
 shared = true
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -20,3 +28,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/postgres-s3-opensearch.toml

@@ -15,8 +15,16 @@ path_style = true
 allow_http = true
 prefix = "mail"
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -24,3 +32,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/single-sqlite.toml

@@ -12,6 +12,27 @@ backend = "filesystem"
 path = "/var/lib/rustbox/blobs"
 shared = false
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "local_tantivy"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 path = "/var/lib/rustbox/search"
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+