Configuration reference

oximail config externalize-secrets --config /etc/oximail/oximail.toml          # shows the moves
oximail config externalize-secrets --config /etc/oximail/oximail.toml --apply  # performs them

curl -X PUT https://mail.example.com/admin/v1/config \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"overrides": {"rate_limit.smtp_outbound_rcpt_per_hour": 600}}'

# /etc/oximail/oximail.toml

[server]
hostname = "mail.example.com"          # server identity
bind = "0.0.0.0:443"                    # HTTPS / JMAP socket
# bind = "unix:/run/oximail-http/jmap.sock"  # behind a local reverse proxy:
                                       # a Unix socket only the proxy's group
                                       # may open; list no trusted_proxies then
base_url = "https://mail.example.com"  # used in JMAP Session URLs
http_bind = "0.0.0.0:80"               # ACME challenges + HTTPS redirect
# admin_bind = "127.0.0.1:9000"        # optional separate admin port
trusted_proxies = ["127.0.0.1"]        # read X-Forwarded-For from these
allowed_origins = []                   # CORS allowlist (empty = reject all).
                                       # The setup wizard fills this when the
                                       # webmail lives on another origin —
                                       # never solve CORS at the reverse proxy.

[storage]
sqlite_path = "/var/lib/oximail/data.db"
blob_path = "/var/lib/oximail/blobs"
encrypted = false                      # plain SQLite. `true` is REFUSED at boot
                                       # since ADR-148: the volume carries the
                                       # at-rest protection, not the application.
# pool_size = 32                       # shared SQLite pool; ~8 MiB page cache
                                       # per connection. Raise on read-heavy
                                       # boxes with cores to spare.
# durable_doors = ["smb", "smtp-inbound", "smtp-submission"]
                                       # replies preceded by an fdatasync of
                                       # the WAL (the default: all three)

[auth]
default_tenant = "default"

[mode]
role = "primary"                       # "primary", "backup" or "smarthost"

[smtp]
bind = "0.0.0.0:25"                    # inbound (receive)
submission_bind = "0.0.0.0:587"        # submission (send, STARTTLS)
smtps_bind = "0.0.0.0:465"             # submission over implicit TLS
hostname = "mail.example.com"
dane_enabled = true                    # DANE for this box's name: publishes and re-signs its TLSA (RFC 7672)

# One signing key per sending domain (v0.30 array form).
[[smtp.dkim_keys]]
domain = "example.com"
selector = "default"
key_path = "/etc/oximail/dkim/example.com.default.key"

[dns]
provider = "manual"                    # required while dane_enabled = true: "cloudflare" or "rfc2136" republish TLSA themselves

[tls]
acme_enabled = true                    # Let's Encrypt; stays on behind a proxy (the mail ports' certificate)
acme_email = "admin@example.com"
# acme_reuse_key = true                # default: renewals keep the key, so the DANE 3 1 1 pin stays

[backup]
strategy = "hypervisor-snapshot"       # the declared plan: "hypervisor-snapshot", "oximail-backup" or "none"
# recipients = ["age1…"]               # without a hypervisor: the age public keys `backup --to` encrypts to
# s3_endpoint = "https://s3.provider.example"   # --to s3://…: a bucket under Object Lock (absent = AWS)
# s3_region = "eu-1"
# s3_access_key_id = "…"                # a key that may only add and list (checked before each run)
# s3_secret_access_key_file = "/etc/oximail/backup-s3.secret"   # 0600, one line
# max_rate_mbps = 20                    # at most this rate sent by a run
# max_duration_minutes = 360            # a run stops after this long; the next continues

[erasure]
# ledger_hook = ["/usr/local/sbin/ship-erasure-ledger.sh"]   # ships the erasure ledger off the box after each erasure

[security]
fail2ban_max_attempts = 5
fail2ban_ban_minutes = 60
trusted_ips = ["10.0.0.0/8"]           # bypass rate limit AND fail2ban

[rate_limit]
http_per_ip_per_minute = 100
smtp_outbound_rcpt_per_hour = 150     # recipients per hour, per account; 0 = unlimited

[spam]
dnsbl_servers = []

[legacy]
enabled = true                         # IMAP / CalDAV / CardDAV bridges

[bimi]
external_resolution_enabled = true   # server switch: off = no DNS, no fetch, for every organization
serve_enabled = true                 # incident switch: off = no external logo is emitted or served, cache kept
# trust_bundle = "/etc/oximail/mark-ca-bundle.pem"   # replaces the embedded roots + issuing CAs
# ct_log_keys  = "/etc/oximail/ct-logs.json"         # replaces the embedded transparency log keys
max_concurrent = 4                   # concurrent domain resolutions
positive_ttl_hours = 24              # life of a resolved logo (also clamped by the certificate and its revocation list)
negative_ttl_hours = 24              # life of a negative outcome

[federation]
enabled = true
endpoint = "https://mail.example.com/jmap/federation"   # https, a DNS name, the door's path
tls_pins = []                  # optional sha256/<base64 SPKI digest>, at most four
mirror_staleness_secs = 120    # a mirror account's copy is at most this old (10 at least)
content_cache_secs = 60        # mirrored content kept in memory; 120 at most, never above the staleness bound
content_cache_mib = 256        # the in-memory cache's ceiling, LRU
content_cache_file_mib = 64    # a larger file is read at the owner each time

oximail check-config --config /etc/oximail/oximail.toml