.env.example

# SMTP Server Environment Configuration
# Copy this file to .env and update with your actual values
# ⚠️ NEVER commit .env to version control!

# ==============================================================================
# Server Configuration
# ==============================================================================

# Server host and port
SMTP_HOST=0.0.0.0
SMTP_PORT=2525

# Maximum concurrent connections
SMTP_MAX_CONNECTIONS=1000

# Maximum message size (bytes)
SMTP_MAX_MESSAGE_SIZE=52428800  # 50MB

# Server hostname (FQDN)
SMTP_HOSTNAME=mail.example.com

# ==============================================================================
# TLS/SSL Configuration
# ==============================================================================

# Enable TLS/SSL
SMTP_ENABLE_TLS=true

# Certificate paths (required if TLS enabled)
SMTP_TLS_CERT=/etc/smtp-server/certs/fullchain.pem
SMTP_TLS_KEY=/etc/smtp-server/certs/privkey.pem

# For development/testing with self-signed certificates:
# SMTP_TLS_CERT=/tmp/test.crt
# SMTP_TLS_KEY=/tmp/test.key

# ==============================================================================
# Authentication Configuration
# ==============================================================================

# Enable authentication (recommended: true for production)
SMTP_ENABLE_AUTH=true

# Advertise Gmail-style aggregate/category mailboxes over IMAP. Enabled by
# default. Set false for clients that should only see physical mailboxes.
IMAP_GMAIL_LABELS_ENABLED=true

# Database path for user credentials
SMTP_DB_PATH=/var/lib/smtp-server/smtp.db

# ==============================================================================
# AWS S3 Storage (Optional)
# ==============================================================================

# S3 credentials (required if using S3 storage)
AWS_ACCESS_KEY_ID=your-access-key-here
AWS_SECRET_ACCESS_KEY=your-secret-key-here
AWS_REGION=us-east-1

# S3 bucket for email storage
AWS_S3_BUCKET=smtp-server-emails

# ==============================================================================
# Rate Limiting
# ==============================================================================

# Requests per minute per IP
SMTP_RATE_LIMIT_PER_IP=100

# Requests per minute per authenticated user
SMTP_RATE_LIMIT_PER_USER=200

# Rate limit cleanup interval (seconds)
SMTP_RATE_LIMIT_CLEANUP_INTERVAL=3600

# ==============================================================================
# Timeouts Configuration
# ==============================================================================

# General connection timeout (seconds)
SMTP_TIMEOUT_SECONDS=300

# DATA command timeout (seconds)
SMTP_DATA_TIMEOUT_SECONDS=600

# Command timeout (seconds)
SMTP_COMMAND_TIMEOUT_SECONDS=300

# Initial greeting timeout (seconds)
SMTP_GREETING_TIMEOUT_SECONDS=30

# ==============================================================================
# Security Features
# ==============================================================================

# Enable DNSBL (DNS Blacklist) checking. When on (default), a listing feeds the
# spam score; it only hard-rejects at SMTP time if SMTP_DNSBL_REJECT=true.
SMTP_ENABLE_DNSBL=true

# Hard-reject (5xx) connections from DNSBL-listed IPs at RCPT instead of just
# scoring them toward Junk. Off by default (a rare false positive would bounce).
SMTP_DNSBL_REJECT=false

# Enable greylisting (temporary rejection). Very effective against dumb spam
# bots that never retry, at the cost of a short delay on first contact.
SMTP_ENABLE_GREYLIST=false

# Content-based spam scoring for unauthenticated inbound mail. Combines the
# SPF/DKIM/DMARC verdicts with DNSBL/reverse-DNS/HELO sanity and message
# heuristics, then files spam into the recipient's Junk mailbox (>= junk score)
# or rejects it (>= reject score). Adds X-Spam-Score/Status/Flag headers.
SMTP_SPAM_FILTER=true
SMTP_SPAM_JUNK_SCORE=5
SMTP_SPAM_REJECT_SCORE=12
# Maildir subfolder spam is delivered into (mail/<user>/<folder>/).
SMTP_JUNK_FOLDER=Junk

# Maximum recipients per message
SMTP_MAX_RECIPIENTS=100

# ==============================================================================
# Logging Configuration
# ==============================================================================

# Enable JSON structured logging
SMTP_ENABLE_JSON_LOGGING=false

# Log level (debug, info, warn, error)
SMTP_LOG_LEVEL=info

# Log file path
SMTP_LOG_FILE=/var/log/smtp-server/smtp.log

# ==============================================================================
# Tracing & Monitoring
# ==============================================================================

# Enable distributed tracing
SMTP_ENABLE_TRACING=false

# Service name for tracing
SMTP_TRACING_SERVICE_NAME=smtp-server

# Tracing endpoint (e.g., Jaeger, Zipkin)
SMTP_TRACING_ENDPOINT=http://localhost:9411/api/v2/spans

# ==============================================================================
# Webhook Configuration (Optional)
# ==============================================================================

# Enable webhooks for events
SMTP_WEBHOOK_ENABLED=false

# Webhook URL for notifications
SMTP_WEBHOOK_URL=https://hooks.example.com/smtp-events

# ==============================================================================
# Email Storage
# ==============================================================================

# Mailbox storage path (mbox format)
SMTP_MAILBOX_PATH=/var/spool/mail

# Backup directory
SMTP_BACKUP_PATH=/var/backups/smtp-server

# Enable automatic backups
SMTP_ENABLE_AUTO_BACKUP=true

# Backup interval (hours)
SMTP_BACKUP_INTERVAL=24

# ==============================================================================
# Protocol-Specific Configuration
# ==============================================================================

# IMAP Configuration
IMAP_PORT=143
IMAP_SSL_PORT=993
IMAP_ENABLE_SSL=true
IMAP_MAX_CONNECTIONS=100

# POP3 Configuration
POP3_PORT=110
POP3_SSL_PORT=995
POP3_ENABLE_SSL=true
POP3_MAX_CONNECTIONS=50

# ActiveSync Configuration
ACTIVESYNC_PORT=80
ACTIVESYNC_SSL_PORT=443
ACTIVESYNC_ENABLE_SSL=true

# CalDAV/CardDAV Configuration
CALDAV_PORT=8008
CALDAV_SSL_PORT=8443
CALDAV_ENABLE_SSL=true

# WebSocket Configuration
WEBSOCKET_PORT=8080
WEBSOCKET_SSL_PORT=8443
WEBSOCKET_MAX_MESSAGE_SIZE=1048576  # 1MB
WEBSOCKET_PING_INTERVAL=30

# ==============================================================================
# Development/Testing Only
# ==============================================================================

# Profile (development, staging, production)
SMTP_PROFILE=production

# Enable debug mode (verbose logging)
SMTP_DEBUG=false

# Allow insecure connections (development only!)
SMTP_ALLOW_INSECURE=false

# ==============================================================================
# Notes
# ==============================================================================
#
# Security Best Practices:
# 1. Use strong, unique values for all credentials
# 2. Never commit .env files to version control
# 3. Rotate credentials regularly
# 4. Use different credentials for dev/staging/production
# 5. Restrict file permissions: chmod 600 .env
# 6. Use a secrets manager in production (AWS Secrets Manager, HashiCorp Vault)
#
# Required Variables for Production:
# - SMTP_HOSTNAME
# - SMTP_TLS_CERT (if TLS enabled)
# - SMTP_TLS_KEY (if TLS enabled)
# - SMTP_DB_PATH
# - AWS_ACCESS_KEY_ID (if using S3)
# - AWS_SECRET_ACCESS_KEY (if using S3)
#
# Testing:
# - Use test credentials for S3 or tests will skip
# - Generate test certificates: ./scripts/generate-cert.sh
# - Set SMTP_PROFILE=testing for test environment
#
# ==============================================================================