Skip to main content
Everything the server can be told to do without the HTTP API is an oximail subcommand. This page maps the surface; oximail <command> --help is always the authoritative reference for flags, and the per-feature pages explain the workflows.

Conventions

  • --config <path> — every command that touches the database takes it; default /etc/oximail/oximail.toml.
  • --tenant-id <id> (alias --tenant) — defaults to default. When a command takes --account <email> instead, the email lookup resolves its own organization.
  • Account selection — commands accept --account <email> or --account-id <id>, mutually exclusive.
  • Destructive commands prompt. [y/N] confirmation, skipped only with an explicit --yes (for scripts).
  • Repair commands are dry-run by default. dedupe-folders, dedupe-tasks, blob promote-room-blobs, and their kin print their plan and touch nothing until --apply.

The command map

Serve & setup

Accounts & organizations

Mail, filtering & groupware

Compliance

Security & TLS

Storage & maintenance

Diagnostics

Two behaviours of the maintenance verbs

sql routes on the shape of the statement, not on its first word. It used to sniff the prefix, so a CTE — WITH … SELECT — was taken for a mutation, executed, its rows thrown away, and reported as 0 rows affected. A statement that returns data being reported as a successful write is exactly the silent failure this project forbids, and it is worse on a verb that scripts trust. Each statement is now prepared and routed on whether it returns columns, which also gets VALUES, EXPLAIN and INSERT … RETURNING right, while a WITH … INSERT stays on the write path and is counted. Multi-statement input keeps batch semantics (everything runs, it stops at the first error, earlier writes stand) and now counts per statement. Result rows go to stdout, counts to stderr, so the output stays pipeable. blobs gc will not collect a fresh unreferenced blob. Between a client’s upload and the /set that names it, a blob is unreferenced by protocol (RFC 8620 §6.1). The collector skips anything unreferenced and younger than a 24-hour grace window, read from the file’s own timestamp — an unreadable or future timestamp keeps the file. The summary counts “unreferenced but in grace” separately, so the number is visible rather than implied.

Where the CLI ends

The CLI covers provisioning, maintenance, and repair. Day-to-day data administration — runtime config overrides, ban listing over HTTP, version verification — also exists on the admin REST API, and journaling rules are equally manageable over admin JMAP. CLI and API are thin adapters over the same orchestration, so an operation behaves identically wherever it is invoked from.