# Mailu configuration — copy to deploy/mailu/mailu.env and fill the secrets.
# See docs/mail.md for the full setup (DNS, certs, gateway).
#
# Generate secrets with:  openssl rand -hex 16
#
# NOTE: DOMAIN is the member ADDRESS domain (the @-part); HOSTNAMES is the mail
# SERVER host (TLS/HELO + webmail/admin/API). These deliberately differ:
# members get <name>@bbs.profullstack.com, served from mail.profullstack.com.

# --- General -----------------------------------------------------------------
SECRET_KEY=CHANGEME_16_HEX            # openssl rand -hex 16
DOMAIN=bbs.profullstack.com           # member addresses are <name>@bbs.profullstack.com
HOSTNAMES=mail.profullstack.com,smtp.profullstack.com
POSTMASTER=postmaster
# Apex profullstack.com is reserved for corporate mail and is NOT served here.

# Admin REST API: agentbbs auto-provisions member mailboxes through it. Mirror
# this value into the agentbbs service as AGENTBBS_MAIL_API_TOKEN.
API=true
API_TOKEN=CHANGEME_api_token          # openssl rand -hex 24

# TLS_FLAVOR=mail: Mailu does NOT run its own ACME (Caddy owns :80/:443). We feed
# it certs copied from Caddy's mail.profullstack.com cert (deploy/mailu/refresh-certs.sh).
TLS_FLAVOR=mail

# --- Features ----------------------------------------------------------------
ADMIN=true                            # the admin UI (fronted at /admin via Caddy, internal only)
WEBMAIL=roundcube                     # the only member-facing surface (https://mail.profullstack.com)
WEBDAV=none
ANTIVIRUS=none                        # set to clamav on a 4GB+ host
ANTISPAM=true

# --- Networking --------------------------------------------------------------
# Mailu's front binds the mail ports on the host and HTTP on loopback only;
# Caddy reverse-proxies https://mail.profullstack.com to BIND_ADDRESS4:80.
BIND_ADDRESS4=127.0.0.1
SUBNET=192.168.203.0/24
MESSAGE_SIZE_LIMIT=52428800           # 50 MB

# --- Addressing --------------------------------------------------------------
# Plus-addressing (subaddressing): deliver mail sent to <name>+<tag>@ into the
# <name>@ mailbox (keeping the +tag in the To: header for filtering) instead of
# bouncing it as an unknown recipient. Required by qaaas.dev's packages/mail,
# which mints throwaway addresses like chovy+run-42@bbs.profullstack.com off the
# single chovy@ mailbox. NOTE: this affects DELIVERY only — it does NOT let
# <name>+<tag>@ be used as a LOGIN (Mailu authenticates the exact address; log
# into webmail as the base <name>@ and all +tagged mail is already there).
RECIPIENT_DELIMITER=+

# --- Gateway (the BBS reads/sends on behalf of members) ----------------------
# A Dovecot master user lets the agentbbs gateway open any member's mailbox with
# one secret (login "<name>*<master>"). Created by deploy/mailu/provision-mailbox.sh.
# Mirror these into the agentbbs service env:
#   AGENTBBS_MAIL_ADDR_DOMAIN=bbs.profullstack.com
#   AGENTBBS_MAIL_DOMAIN=mail.profullstack.com
#   AGENTBBS_MAIL_IMAP_ADDR=mail.profullstack.com:993
#   AGENTBBS_MAIL_SMTP_ADDR=127.0.0.1:25
#   AGENTBBS_MAIL_ADMIN_URL=http://127.0.0.1:8080
#   AGENTBBS_MAIL_API_TOKEN=<the API_TOKEN above>
#   AGENTBBS_MAIL_MASTER_USER=gateway
#   AGENTBBS_MAIL_MASTER_PASS=<the master password you set>

# --- Admin bootstrap ---------------------------------------------------------
INITIAL_ADMIN_ACCOUNT=admin
INITIAL_ADMIN_DOMAIN=bbs.profullstack.com
INITIAL_ADMIN_PW=CHANGEME_admin_password