; Haraka plugin configuration
;
; This file provides default configuration for all Elektrine plugins.
; Environment variables take precedence over these settings.
;
; Environment Variables:
;   HARAKA_ROLE             - Runtime role (inbound-mx/submission/outbound-relay)
;   PHOENIX_WEBHOOK_URL     - Webhook URL for inbound emails
;   PHOENIX_VERIFY_URL      - Recipient verification URL
;   PHOENIX_DOMAINS_URL     - Domains endpoint URL
;   PHOENIX_API_KEY         - API key for Haraka -> Phoenix calls
;   HARAKA_HTTP_API_KEY     - API key required by Haraka /api/v1/send
;   HARAKA_API_KEY          - Optional shared key
;   HARAKA_HTTP_PORT        - HTTP API port (default: 8080)
;   HARAKA_HTTP_HOST        - HTTP API host (default: 0.0.0.0)
;   HARAKA_CORS_ORIGIN      - Allowed CORS origin for browser calls
;   HARAKA_DKIM_DIR         - Persistent directory for DKIM key storage
;   LOCAL_DOMAINS           - Comma-separated list of local domains
;   OPS_ALLOWED_CIDRS       - CIDRs allowed to call /status and /healthz
;   METRICS_ALLOWED_CIDRS   - CIDRs allowed to call /metrics
;   HARAKA_TRUSTED_PROXY_CIDRS - CIDRs trusted for forwarded client IP headers
;   REDIS_URL               - Redis URL for async queue
;   ELEKTRINE_QUEUE_NAME    - Queue key name
;   ELEKTRINE_DLQ_NAME      - Dead letter queue key name

[main]
; Runtime role used by startup profile selection
role = inbound-mx

; Phoenix app webhook URL for inbound emails
url = https://app.example.com/api/haraka/inbound

; Phoenix app recipient verification URL
verify_url = https://app.example.com/api/haraka/verify-recipient

; Phoenix app domains URL
domains_url = https://app.example.com/api/haraka/domains

; Haraka -> Phoenix key
; phoenix_api_key =

; Haraka /api/v1/send key
; http_api_key =

; Optional shared key
; api_key =

; Webhook timeout in milliseconds
timeout = 30000

; Recipient verification timeout in milliseconds
verify_timeout = 5000

; Enable/disable webhook processing
enabled = true

; Include email headers in webhook payload
include_headers = true

; Include email body in webhook payload
include_body = true

; Include attachment content in webhook payload
include_attachments = true

[http_api]
; HTTP API server port
port = 8080

; HTTP API server host
host = 0.0.0.0

; Persistent DKIM key storage directory used by /api/v1/dkim/domains/*
; dkim_storage_dir = /data/haraka/dkim

; Browser API callers origin allowlist (optional)
; cors_origin =

; Trusted reverse proxy CIDRs used when resolving client IP
trusted_proxy_cidrs = 127.0.0.1/32, ::1/128, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7

[rate_limit]
; Rate limit window in milliseconds (default: 60000 = 1 minute)
window_ms = 60000

; Maximum requests per window per IP
max_requests = 50

[ops]
; Optional CIDRs allowed to access /status and /healthz without an API key
allowed_cidrs =

[metrics]
; Optional CIDRs allowed to access /metrics without an API key
allowed_cidrs =

[domains]
; Local domains (space or comma separated)
; These domains receive inbound mail and are protected from spoofing
local = example.com

; Domain cache refresh interval in ms
cache_ttl_ms = 300000

[queue]
redis_url = redis://redis:6379
name = elektrine:inbound
dlq_name = elektrine:inbound:dlq
pop_timeout_sec = 5
max_raw_bytes = 26214400

[worker]
webhook_max_retries = 5
webhook_retry_base_delay_ms = 1000