host = "0.0.0.0"
port = 3001
environment = "production"
database_backend = "pgsql"
session_backend = "database"
cluster_mode = true
pgp_enabled = false

[storage]
backend = "s3"
bucket = "rustbox"
region = "us-east-1"
endpoint = "http://s3:9000"
path_style = true
allow_http = true
prefix = "mail"

[sync]
# Background IMAP reconciliation cadence; active folders still use IDLE.
interval_secs = 30
# Full bodies fetched per pass when search.deep_index is effective.
deep_index_batch_size = 10

[search]
backend = "opensearch"
# Production: do not proactively download/store every full message body.
deep_index = false
urls = ["http://opensearch:9200"]
index_prefix = "rustbox"
allow_insecure_http = true
required = true
worker_interval_secs = 2
worker_batch_size = 100
worker_max_attempts = 8

# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
# token/basic credentials in the orchestrator secret store.
[diagnostics_endpoint]
enabled = false
path = "/api/system/diagnostics"
allowed_networks = ["127.0.0.1/32", "::1/128"]
auth = "token"
include_user_identifiers = false
probe_timeout_secs = 5
security_window_secs = 900