v0.2.8

docker/configs/ha-garage.toml

@@ -21,8 +21,16 @@ path_style = true
 allow_http = true
 prefix = "mail"
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Dev: proactively cache/index full message bodies for testing.
+deep_index = true
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -30,3 +38,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/mysql-nfs-opensearch.toml

@@ -11,8 +11,16 @@ backend = "filesystem"
 path = "/mnt/rustbox-shared"
 shared = true
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -20,3 +28,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/postgres-s3-opensearch.toml

@@ -15,8 +15,16 @@ path_style = true
 allow_http = true
 prefix = "mail"
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "opensearch"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 urls = ["http://opensearch:9200"]
 index_prefix = "rustbox"
 allow_insecure_http = true
@@ -24,3 +32,16 @@ required = true
 worker_interval_secs = 2
 worker_batch_size = 100
 worker_max_attempts = 8
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+

docker/configs/single-sqlite.toml

@@ -12,6 +12,27 @@ backend = "filesystem"
 path = "/var/lib/rustbox/blobs"
 shared = false
 
+[sync]
+# Background IMAP reconciliation cadence; active folders still use IDLE.
+interval_secs = 30
+# Full bodies fetched per pass when search.deep_index is effective.
+deep_index_batch_size = 10
+
 [search]
 backend = "local_tantivy"
+# Production: do not proactively download/store every full message body.
+deep_index = false
 path = "/var/lib/rustbox/search"
+
+# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
+# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
+# token/basic credentials in the orchestrator secret store.
+[diagnostics_endpoint]
+enabled = false
+path = "/api/system/diagnostics"
+allowed_networks = ["127.0.0.1/32", "::1/128"]
+auth = "token"
+include_user_identifiers = false
+probe_timeout_secs = 5
+security_window_secs = 900
+