host = "0.0.0.0"
port = 3001
environment = "development"
database_backend = "pgsql"
session_backend = "redis"
redis_url = "redis://valkey:6379/"
cluster_mode = true
pgp_enabled = false
sieve_enabled = false
diagnostics_enabled = true
about_enabled = true
security_headers_enabled = false
trusted_proxies = "10.240.6.0/24"

[storage]
backend = "s3"
bucket = "rustbox"
region = "garage"
endpoint = "http://garage:3900"
path_style = true
allow_http = true
prefix = "mail"

[sync]
# Background IMAP reconciliation cadence; active folders still use IDLE.
interval_secs = 30
# Full bodies fetched per pass when search.deep_index is effective.
deep_index_batch_size = 10

[search]
backend = "opensearch"
# Dev: proactively cache/index full message bodies for testing.
deep_index = true
urls = ["http://opensearch:9200"]
index_prefix = "rustbox"
allow_insecure_http = true
required = true
worker_interval_secs = 2
worker_batch_size = 100
worker_max_attempts = 8

# Administrator-only system diagnostics. Disabled by default and loopback-only when enabled.
# For monitoring in Docker/Kubernetes, explicitly add the monitoring/pod CIDR and keep
# token/basic credentials in the orchestrator secret store.
[diagnostics_endpoint]
enabled = false
path = "/api/system/diagnostics"
allowed_networks = ["127.0.0.1/32", "::1/128"]
auth = "token"
include_user_identifiers = false
probe_timeout_secs = 5
security_window_secs = 900