# ============================================================================
#  Webmail production configuration.
#
#  Copy to docker/.env.prod, fill in the three REQUIRED values, keep it safe:
#      cp docker/.env.prod.example docker/.env.prod && chmod 600 docker/.env.prod
#
#  THIS FILE IS A BACKUP ARTEFACT. MASTER_KEY is not stored anywhere else: lose
#  it and every saved mail-account password becomes permanently undecryptable,
#  even from a perfect database backup. Keep a copy in a password manager.
# ============================================================================

# --- REQUIRED ---------------------------------------------------------------

# Where all persistent data lives on the host. Use a real shared folder your NAS
# backup tool can see — not a Docker named volume.
#   Synology: /volume1/docker/webmail/data
#   QNAP:     /share/Container/webmail/data
DATA_ROOT=/volume1/docker/webmail/data

# 32 random bytes, base64. Generate ONCE, then never change it:
#   openssl rand -base64 32
MASTER_KEY=

# Database password. Generate once:
#   openssl rand -base64 24 | tr -d '/+=' | cut -c1-24
POSTGRES_PASSWORD=

# --- Identity ---------------------------------------------------------------
# The domain your user handles are minted under (user@APP_DOMAIN) and the issuer
# shown in 2FA authenticator apps. It does NOT have to be publicly resolvable.
APP_DOMAIN=mail.home.lan

# --- Network ----------------------------------------------------------------
# The single published port. Avoid 5000/5001 (Synology DSM) and 8080 (QNAP QTS).
WEB_PORT=8088
# Bind to one NAS interface instead of every network, e.g. WEB_BIND=192.168.1.185
WEB_BIND=0.0.0.0

TZ=Europe/Warsaw

# --- Search -----------------------------------------------------------------
# pg   = Postgres full-text. No extra container, no extra RAM. Default.
# meili = Meilisearch: typo tolerance, better ranking, faster on large mailboxes.
#         Costs a container and ~0.7-1 GB RAM. Start it with:
#             ./deploy/webmail.sh up --meili
#         and after switching an existing install, rebuild the index:
#             ./deploy/webmail.sh reindex
SEARCH_BACKEND=pg
# Required if SEARCH_BACKEND=meili — generate with: openssl rand -base64 32
MEILI_MASTER_KEY=

# --- Images -----------------------------------------------------------------
# `local` = built on this host from the repo. To deploy prebuilt images from
# your Gitea registry instead, set both of these (see deploy/build-push.sh):
#   REGISTRY_PREFIX=192.168.1.185:8418/claude/webmail
#   IMAGE_TAG=v1.0.0
REGISTRY_PREFIX=webmail
IMAGE_TAG=local

# --- Application ------------------------------------------------------------
LOG_LEVEL=INFO
UNDO_SECONDS=10
SESSION_TTL_DAYS=30
MAX_ATTACHMENT_MB=25
# Auto-purge Trash/Spam older than N days (0 disables).
TRASH_RETENTION_DAYS=30
# Server-side sender avatars (Gravatar + favicon), fetched by the server so
# senders never see your IP. Set false to make zero outbound web requests.
SENDER_AVATARS_ENABLED=true

GOOGLE_OAUTH_ENABLED=false
OAUTH_GOOGLE_CLIENT_ID=
OAUTH_GOOGLE_CLIENT_SECRET=
OAUTH_MS_CLIENT_ID=
OAUTH_MS_CLIENT_SECRET=

# Plugins whose schema is migrated on every start. Remove one to stop shipping
# its tables; `hello` is the SDK demo and is intentionally not listed.
ENABLED_PLUGINS="calendar contacts labels filters"

# --- Backups ----------------------------------------------------------------
BACKUP_AT=03:30
BACKUP_KEEP_DAYS=14

# --- Sizing (defaults suit a personal install on a shared NAS) --------------
# Peak worker RAM is roughly PARSE_CONCURRENCY x STREAM_PARSE_MB plus overhead.
INTERACTIVE_CONCURRENCY=8
BULK_CONCURRENCY=1
PARSE_CONCURRENCY=2
STREAM_PARSE_MB=8
PER_HOST_CONN_CAP=10
HOT_BUDGET_PER_WORKER=50

# Container caps. Memory only: CPU limits (`cpus:`) are deliberately absent
# because Synology's Docker daemon rejects them (NanoCPUs).
# Container caps. Total without Meilisearch: ~2.2 GB of *limits*; real steady
# usage for one or two mail accounts is around 700 MB-1 GB.
PG_MEM_LIMIT=768m
PG_SHARED_BUFFERS=256MB
PG_MAX_CONNECTIONS=100
PG_WORK_MEM=8MB
PG_MAINTENANCE_WORK_MEM=128MB
PG_EFFECTIVE_CACHE_SIZE=768MB
REDIS_MEM_LIMIT=160m
REDIS_MAXMEMORY=96mb
API_MEM_LIMIT=512m
WORKER_SYNC_MEM_LIMIT=512m
WORKER_JOBS_MEM_LIMIT=640m
WEB_MEM_LIMIT=96m
BACKUP_MEM_LIMIT=256m
MEILI_MEM_LIMIT=1g