# OpenVibe.Mail — environment (production: /etc/openvibe/mail.env). Names only; never commit values.

NODE_ENV=production
PORT=5250
HOST=127.0.0.1
BASE_URL=https://openvibe.email
TRUST_PROXY=2

# PostgreSQL (ADR-035), written by OpenVibe.Host roles/data/add-service.sh: the runtime role through PgBouncer,
# the owner on a direct connection (migrations), and Valkey (per-address rate counters).
# Without DATABASE_URL, development uses an embedded PGlite database in data/pglite.
DATABASE_URL=
DATABASE_DIRECT_URL=
VALKEY_URL=
VALKEY_PREFIX=ov:mail:
#MAIL_PGLITE_DIR=./data/pglite

# OpenVibe.Network: the person's token is verified offline against the JWKS; a typed token (a `typ` or `purpose`
# claim) is not a person's session and is refused.
OV_NETWORK_URL=https://openvibe.network
OV_NETWORK_INTERNAL_URL=http://127.0.0.1:4000
# OV_NETWORK_ISSUER=https://openvibe.network
# OV_SESSION_AUDIENCE=openvibe.network
# MAIL_AUDIENCE=openvibe.mail

# Sign-in on openvibe.email (openvibe-sdk/sso, OAuth2 + PKCE). The client must be registered in the Network with
# redirect https://openvibe.email/auth/callback. COOKIE_SECURE defaults to true in production.
OV_OAUTH_CLIENT_ID=mail
OV_OAUTH_CLIENT_SECRET=
# OV_OAUTH_REDIRECT_URI=https://openvibe.email/auth/callback
# OV_OAUTH_SCOPE=profile
# COOKIE_SECURE=true

# The addresses. Masks live on their own domain, burners rotate over the subdomains below, and an agent's inbox is
# <agent>.<user>@<base domain>. A new burner domain needs no code: add it here and restart.
MAIL_BASE_DOMAIN=openvibe.email
MAIL_MASK_DOMAIN=mask.openvibe.email
BURNER_DOMAINS=burn1.openvibe.email,burn2.openvibe.email,burn3.openvibe.email

# Stalwart (the mail server itself), reached over loopback only. The admin credential is used for the management
# API (domains, cache invalidation) and to read a person's mailbox over JMAP.
STALWART_URL=http://127.0.0.1:8080
STALWART_ADMIN_USER=admin
STALWART_ADMIN_PASSWORD=

# Stalwart's own settings (deploy/stalwart/config.toml reads the same names).
STALWART_DB_HOST=127.0.0.1
STALWART_DB_PORT=5432
STALWART_DB_NAME=ov_mail
STALWART_DB_USER=
STALWART_DB_PASSWORD=

# Blobs: local disk by default (M1). STALWART_BLOB_STORE=s3 turns on the B2/MinIO path below; with fs only
# STALWART_BLOB_PATH and STALWART_BLOB_DEPTH matter. The depth must not change after blobs are written.
STALWART_BLOB_STORE=fs
STALWART_BLOB_PATH=/var/lib/openvibe-stalwart/blobs
STALWART_BLOB_DEPTH=2
STALWART_BLOB_ENDPOINT=
STALWART_BLOB_BUCKET=
STALWART_BLOB_ACCESS_KEY_ID=
STALWART_BLOB_SECRET_KEY=
STALWART_BLOB_REGION=us-east-1

# OpenVibe.Events: the outbox relay publishes mail.received and mail.mask.created. Unset keeps the rows in the
# outbox and status() says the relay is off.
MAIL_EVENTS_URL=
MAIL_EVENTS_CLIENT_ID=mail
MAIL_EVENTS_CLIENT_SECRET=
#MAIL_EVENTS_INTERVAL_MS=5000

# Caps (server/domain/limits.js).
#MAIL_MAX_MASKS=20
#MAIL_MAX_LIVE_BURNERS=5
# A global ceiling on anonymous burners alive at once: 503 mail.burner_capacity past it.
#MAIL_MAX_LIVE_ANON_BURNERS=2000
# Per IP: ten anonymous burners an hour, each living at most ten minutes.
#MAIL_BURNERS_PER_IP_HOUR=10
#MAIL_ANON_BURNER_TTL_MINUTES=10
#MAIL_API_RATE_LIMIT_PER_MIN=240
#MAIL_PURGE_INTERVAL_MS=60000

# Sending an agent's reply (track HO6). A reply to one of our own domains (the base, the mask domain, a burner
# domain) is handed to the mail server over loopback SMTP below: no relay and no packet off the host.
# Sending to anyone else is NOT ours yet (plan M2: it waits on the owner for a separate mail IPv4, its PTR record
# and Workers Paid for the relay). MAIL_OUTBOUND=on is the only way on, and it is OFF unless set: with it off a
# reply to an outside address opens no connection at all and the agent's system turns it into the person's approval.
MAIL_SMTP_HOST=127.0.0.1
MAIL_SMTP_PORT=25
# MX target for a person's custom domain. Set to the hostname that hands inbound SMTP to this Stalwart instance.
# A custom domain cannot pass MX verification while this is empty.
#MAIL_CUSTOM_DOMAIN_MX=mail.openvibe.email
#MAIL_OUTBOUND=off
#MAIL_RELAY_HOST=
#MAIL_RELAY_PORT=587
#MAIL_RELAY_USER=
#MAIL_RELAY_PASSWORD=
#MAIL_RELAY_SECURE=false
#MAIL_RELAY_STARTTLS=true

# Answering (track HO6): the due poll that tells an agent's system about the mail at its own address, for an inbox
# whose switch the person turned on.
#MAIL_AGENT_MAIL_INTERVAL_MS=30000
#MAIL_AGENT_MAIL_BATCH=50
#MAIL_AGENT_MAIL_SCAN=100