# RustBox 0.1.0 - packaged production configuration (DEB/RPM)
#
# The active values below intentionally keep the existing package profile.
# Alternative storage/cluster examples are provided at the end of this file
# and are fully commented out, so they do not change the default package setup.

# -----------------------------------------------------------------------------
# Server
# -----------------------------------------------------------------------------
host = "0.0.0.0"
port = 3001
environment = "production"
data_dir = "/var/lib/rustbox"
log_dir = "/var/log/rustbox"

# Sessions and "remember me".
# With no database/session backend keys configured, RustBox defaults to
# persistent SQLite sessions under data_dir and survives process restarts.
session_timeout_hours = 72
remember_me_enabled = true
remember_me_days = 30

# -----------------------------------------------------------------------------
# Mail endpoints
# -----------------------------------------------------------------------------
imap_host = "localhost"
imap_port = 993
smtp_host = "localhost"
smtp_port = 587
tls_enabled = true
# This packaged profile intentionally keeps certificate verification disabled.
# For remote production mail servers, tls_verify = true is recommended.
tls_verify = false

# Size limits in MiB.
max_attachment_size_mb = 50
max_message_size_mb = 100

# -----------------------------------------------------------------------------
# ManageSieve
# -----------------------------------------------------------------------------
sieve_port = 4190
sieve_tls_mode = "none"
sieve_allow_insecure_auth = true
sieve_timeout_secs = 10

# -----------------------------------------------------------------------------
# Mailbox/UI defaults
# -----------------------------------------------------------------------------
default_junk_folder = "Spam"
default_theme = "system"
default_interface_skin = "apple-mail"

# -----------------------------------------------------------------------------
# Reverse proxy and outgoing mail
# -----------------------------------------------------------------------------
trusted_proxies = "127.0.0.1,::1"
outgoing_headers = []

# -----------------------------------------------------------------------------
# OpenPGP
# -----------------------------------------------------------------------------
pgp_wkd_enabled = true
pgp_hkp_enabled = false
pgp_hkp_url = "https://keys.openpgp.org"
pgp_network_timeout_secs = 10
pgp_max_key_bytes = 1048576
pgp_allow_private_export = true

# =============================================================================
# OPTIONAL CONFIGURATION EXAMPLES
# =============================================================================
# Do not enable more than one conflicting example at the same time.
# Copy/uncomment only the keys required by the selected profile.
#
# session_encryption_key must represent the same 32-byte key on every node that
# shares a SQL/Redis session store. Keep it secret and outside source control.

# -----------------------------------------------------------------------------
# Profile A: standalone SQLite sessions (default package behavior)
# -----------------------------------------------------------------------------
# No extra keys are required. The equivalent explicit configuration is:
# database_backend = "sqlite"
# session_backend = "database"
# cluster_mode = false
#
# RustBox stores sessions in data_dir/rustbox.sqlite and creates/uses the local
# session encryption key for this single-node SQLite setup.

# -----------------------------------------------------------------------------
# Profile B: PostgreSQL-backed persistent sessions
# -----------------------------------------------------------------------------
# database_backend = "pgsql"
# database_url = "postgres://rustbox:change-me@127.0.0.1/rustbox"
# session_backend = "database"
# cluster_mode = false
# session_encryption_key = "BASE64_32_BYTE_KEY"

# -----------------------------------------------------------------------------
# Profile C: MySQL-backed persistent sessions
# -----------------------------------------------------------------------------
# database_backend = "mysql"
# database_url = "mysql://rustbox:change-me@127.0.0.1/rustbox"
# session_backend = "database"
# cluster_mode = false
# session_encryption_key = "BASE64_32_BYTE_KEY"

# -----------------------------------------------------------------------------
# Profile D: Redis sessions, single application node
# -----------------------------------------------------------------------------
# session_backend = "redis"
# redis_url = "redis://127.0.0.1:6379/"
# cluster_mode = false
# session_encryption_key = "BASE64_32_BYTE_KEY"
#
# If Redis requires authentication, include credentials in redis_url or use the
# supported Redis password configuration for your deployment.

# -----------------------------------------------------------------------------
# Profile E: Redis Sentinel sessions for multiple RustBox nodes
# -----------------------------------------------------------------------------
# session_backend = "redis"
# cluster_mode = true
# redis_sentinel_nodes = ["sentinel-a:26379", "sentinel-b:26379", "sentinel-c:26379"]
# redis_sentinel_master = "mymaster"
# redis_sentinel_password = "sentinel-secret"
# redis_password = "redis-secret"
# session_encryption_key = "BASE64_32_BYTE_KEY"

# -----------------------------------------------------------------------------
# Profile F: PostgreSQL sessions shared by a RustBox application cluster
# -----------------------------------------------------------------------------
# database_backend = "pgsql"
# database_url = "postgres://rustbox:change-me@db.internal/rustbox"
# session_backend = "database"
# cluster_mode = true
# session_encryption_key = "BASE64_32_BYTE_KEY"

# -----------------------------------------------------------------------------
# Profile G: MySQL sessions shared by a RustBox application cluster
# -----------------------------------------------------------------------------
# database_backend = "mysql"
# database_url = "mysql://rustbox:change-me@db.internal/rustbox"
# session_backend = "database"
# cluster_mode = true
# session_encryption_key = "BASE64_32_BYTE_KEY"