73 lines
2.6 KiB
Bash
73 lines
2.6 KiB
Bash
# --- Postgres ---
|
|
POSTGRES_DB=lambdamail
|
|
POSTGRES_USER=lambdamail
|
|
POSTGRES_PASSWORD=change-me-in-local-dev
|
|
|
|
# --- Redis ---
|
|
REDIS_PASSWORD=change-me-in-local-dev
|
|
|
|
# --- Shared secrets (local dev values — never reuse in production) ---
|
|
JWT_SECRET=local-dev-jwt-secret-change-me
|
|
# Encrypts DKIM private keys and provider tokens at rest. Losing it makes every
|
|
# stored secret unrecoverable — back it up separately from the database.
|
|
LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-min
|
|
|
|
# --- Host identity ---
|
|
PRIMARY_MAIL_HOST=mail.localhost
|
|
MAIL_DOMAIN=localhost
|
|
PUBLIC_IPV4=127.0.0.1
|
|
PUBLIC_IPV6=
|
|
|
|
# --- DNS automation (Cloudflare) ---
|
|
# The token needs Zone.DNS:Edit plus Zone.Zone:Read on the zone. Leave it empty
|
|
# to disable reconciliation; the service then logs that DNS sync is off.
|
|
CLOUDFLARE_API_TOKEN=
|
|
DNS_SYNC_INTERVAL_SECONDS=21600
|
|
|
|
# --- TLS ---
|
|
# traefik: read the certificate Traefik manages (default, DANE not possible).
|
|
# acme: obtain the certificate ourselves via DNS-01. Required for DANE,
|
|
# because only this mode can reuse a pre-generated key.
|
|
TLS_MODE=traefik
|
|
# Used only when TLS_MODE=acme. Leave ACME_DIRECTORY_URL empty for Let's
|
|
# Encrypt production; point it at the staging directory while testing, since
|
|
# production rate limits can lock a domain out for a week.
|
|
ACME_EMAIL=
|
|
ACME_DIRECTORY_URL=
|
|
COOLIFY_PROXY_DIR=./local/acme
|
|
TRAEFIK_ACME_FILENAME=acme.json
|
|
CERT_POLL_INTERVAL_SECONDS=60
|
|
# Static certificate files, used when no ACME store is available (local dev).
|
|
PROTOCOLS_CERT_PATH=/etc/lambdamail/certs/cert.pem
|
|
PROTOCOLS_KEY_PATH=/etc/lambdamail/certs/key.pem
|
|
PROTOCOLS_SPOOL_DIR=/var/lambdamail/spool
|
|
|
|
# --- Transport security policy ---
|
|
# Start at "testing": senders honour the policy but do not hard-fail on it.
|
|
# Promote to "enforce" only once TLS-RPT reports come back clean.
|
|
MTA_STS_MODE=testing
|
|
OUTBOUND_MTA_STS_ENABLED=true
|
|
# DANE stays off unless TLS_MODE=acme. Under Traefik-managed certificates the
|
|
# key changes at every renewal and the published TLSA record stops matching,
|
|
# which permanently rejects mail at every validating MTA.
|
|
OUTBOUND_DANE_ENABLED=false
|
|
DNSSEC_RESOLVER=1.1.1.1:53
|
|
MAX_MESSAGE_BYTES=52428800
|
|
|
|
# ARC seals accepted messages so a downstream receiver can still tell that the
|
|
# mail authenticated at the first hop. Only worth enabling on a host that
|
|
# forwards mail onward.
|
|
ARC_SEAL_ENABLED=false
|
|
|
|
# --- Smarthost (for hosts where outbound port 25 is blocked) ---
|
|
# Setting RELAY_HOST routes all delivery through the relay and adds it to the
|
|
# published SPF record, without which every relayed message fails SPF.
|
|
RELAY_HOST=
|
|
RELAY_PORT=587
|
|
RELAY_USER=
|
|
RELAY_PASS=
|
|
|
|
# --- Webmail ---
|
|
WEBMAIL_HOST=localhost:3000
|
|
ADMIN_HOST=
|