105 lines
4.7 KiB
TOML
105 lines
4.7 KiB
TOML
# RustBox local development configuration.
|
|
host = "127.0.0.1"
|
|
port = 3001
|
|
environment = "development"
|
|
# Global light/dark theme: system | dark | light
|
|
default_theme = "system"
|
|
# Global interface style used by the login screen and by accounts set to
|
|
# "Global default". Presets include gmail, proton, zoho, outlook, fastmail,
|
|
# apple-mail, yahoo, hey, nord, minimal and Roundcube variants.
|
|
default_interface_skin = "rustbox"
|
|
data_dir = ".dev/data"
|
|
log_level = "debug"
|
|
session_timeout_hours = 24
|
|
|
|
# Application database. The selected engine stores all RustBox account data.
|
|
# With session_backend="database", it stores sessions as well.
|
|
database_backend = "sqlite" # sqlite | mysql | pgsql
|
|
# SQLite defaults to data_dir/rustbox.sqlite. MySQL/PostgreSQL require database_url.
|
|
# database_url = "postgres://rustbox:secret@db.example.com/rustbox"
|
|
session_backend = "database" # database | redis
|
|
cluster_mode = false
|
|
pgp_enabled = true
|
|
# For shared database sessions, Redis sessions, or cluster mode provide the same 32-byte key (base64) on all nodes.
|
|
# session_encryption_key = "..."
|
|
# Direct Redis session backend:
|
|
# redis_url = "redis://redis.example.com:6379/"
|
|
# Or Redis Sentinel:
|
|
# redis_sentinel_nodes = ["sentinel-a:26379", "sentinel-b:26379", "sentinel-c:26379"]
|
|
# redis_sentinel_master = "mymaster"
|
|
# redis_sentinel_password = "sentinel-secret"
|
|
# redis_password = "secret"
|
|
|
|
# Mail server configuration is administrator-owned. If omitted, development
|
|
# also defaults to localhost:993 (IMAP) and localhost:587 (SMTP).
|
|
# Certificate verification is disabled automatically only for loopback hosts.
|
|
tls_enabled = true
|
|
# tls_verify = false
|
|
# Per-file raw upload limit and final RFC822/MIME MTA limit (MiB).
|
|
max_attachment_size_mb = 10
|
|
max_message_size_mb = 50
|
|
|
|
# Optional administrator-facing features.
|
|
sieve_enabled = true
|
|
diagnostics_enabled = true
|
|
about_enabled = true
|
|
# Allow more than one signed-in account in the same browser session.
|
|
multi_account_enabled = true
|
|
security_headers_enabled = false
|
|
|
|
# ManageSieve. Leave sieve_host unset to use imap_host. Ignored when disabled.
|
|
sieve_port = 4190
|
|
sieve_tls_mode = "starttls" # starttls | implicit | none
|
|
sieve_allow_insecure_auth = false
|
|
sieve_timeout_secs = 10
|
|
|
|
trusted_proxies = "127.0.0.1,::1"
|
|
[sync]
|
|
interval_secs = 30
|
|
# Maximum number of full message bodies fetched from IMAP during one sync pass when
|
|
# automatic deep indexing is enabled. Higher values fill the cache/index faster but
|
|
# increase network traffic, application database/search-storage usage and indexing CPU/I/O bursts.
|
|
deep_index_batch_size = 10
|
|
|
|
# Development search/cache profile.
|
|
[search]
|
|
backend = "local_tantivy"
|
|
# Force automatic full-body cache/index for every account in this development instance.
|
|
# Each periodic sync may download up to sync.deep_index_batch_size full MIME bodies.
|
|
# This is intentionally ON in dev so cache/index behaviour is visible during testing.
|
|
# Setting it to false falls back to the existing per-account deep_index preference.
|
|
deep_index = true
|
|
# Search outbox worker cadence/batch; these do NOT control IMAP body downloads.
|
|
worker_interval_secs = 2
|
|
worker_batch_size = 100
|
|
worker_max_attempts = 12
|
|
|
|
|
|
# Periodic IMAP reconciliation. Active folders still use IMAP IDLE for near-real-time
|
|
# updates; this interval controls the fallback/background pass for counters, flags,
|
|
# new headers in other folders, and the automatic deep-index pass. Lower values make
|
|
# background state converge faster but increase IMAP traffic and server load.
|
|
|
|
# Administrator-only system diagnostics endpoint. Disabled by default.
|
|
# When enabled it exposes a redacted runtime/configuration report plus live probes
|
|
# for SQL, session persistence (database/Redis), blob storage (filesystem/S3),
|
|
# search (Tantivy/OpenSearch), IMAP IDLE counters and security telemetry.
|
|
# Access requires BOTH an allowed source network and the configured auth method.
|
|
# Secrets (passwords, tokens, S3 keys, session keys and URL credentials) are never returned.
|
|
[diagnostics_endpoint]
|
|
enabled = false
|
|
path = "/api/system/diagnostics"
|
|
# Default/fail-safe allowlist: only this host. Add trusted LAN/pod/monitoring CIDRs explicitly.
|
|
allowed_networks = ["127.0.0.1/32", "::1/128"]
|
|
# token | basic. Credentials should normally come from .env / secret manager, not TOML.
|
|
auth = "token"
|
|
# token = "replace-with-at-least-24-random-characters"
|
|
# basic_username = "rustbox-monitor"
|
|
# basic_password = "replace-with-a-long-random-password"
|
|
# E-mail addresses and stable user hashes are omitted by default; aggregate counts remain available.
|
|
include_user_identifiers = false
|
|
# Timeout applied independently to database/session/storage/search probes.
|
|
probe_timeout_secs = 5
|
|
# Rolling in-memory window used for login failures, 403, 429 and 5xx attack/problem signals.
|
|
security_window_secs = 900
|