.env.example

############################################
# Application registration at Microsoft

# Registered application credentials (one or two or many). Can be specified as
# comma-separated list or as a JSON array enclosed in braces {}. Keys and/or
# values can be optionally put inside double quotes, in which case the JSON
# String parsing rules apply
APP_SECRETS=application-id-1:secret-1,application-id-2:secret-2

# Default application ID for new users. Old users will keep their application
# ID unless they login to UI without a valid browser session. Defaults to first
# application ID in APP_SECRETS
#DEFAULT_APP_ID=

############################################
# Account registration filter

# The configuration uses JavaScript regular expressions, so special characters
# need to be escaped with backslash. Example: \. for dot, \+ for plus, etc.
# The regular expressions are case-insensitive by default and should be written
# without leading and trailing slashes.
# See https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_expressions

# By default, rejection filters (DISALLOWED_*), if defined, take precedence over
# acceptance filters (ALLOWED_*). The *_EMAILS filters are applied to the whole
# email address, the *_DOMAINS filters are applied to the whole domain only. The
# email filters take precedence over domain filters. The filters are
# case-insensitive. If any filter matches, it is the final decision. If no
# filter matches, the default decision will be made - see below.
#
# Each filter has its RegEx form (*_REGEX), a comma-separated list form
# (*_LIST), and a new-line separated file form (*_REGEX_FILE, *_LIST_FILE).
# The files can be reloaded from the disk when the SIGHUP signal is received.
#
# The order of the filters is as follows:
#
#   1. DISALLOWED_EMAILS_LIST
#   2. DISALLOWED_EMAILS_LIST_FILE
#   3. DISALLOWED_EMAILS_REGEX
#   4. DISALLOWED_EMAILS_REGEX_FILE
#   5. DISALLOWED_DOMAINS_LIST
#   6. DISALLOWED_DOMAINS_LIST_FILE
#   7. DISALLOWED_DOMAINS_REGEX
#   8. DISALLOWED_DOMAINS_REGEX_FILE
#   9. ALLOWED_EMAILS_LIST
#  10. ALLOWED_EMAILS_LIST_FILE
#  11. ALLOWED_EMAILS_REGEX
#  12. ALLOWED_EMAILS_REGEX_FILE
#  13. ALLOWED_DOMAINS_LIST
#  14. ALLOWED_DOMAINS_LIST_FILE
#  15. ALLOWED_DOMAINS_REGEX
#  16. ALLOWED_DOMAINS_REGEX_FILE
#  17. Default decision - if any ALLOWED_* is defined with any value, no email
#      address will match. If no ALLOWED_* is defined, all email addresses
#      will be accepted. Only the definitions in the default rule set or in
#      RULES_ORDER are considered.
#
# The set of rules and the order can be changed completely by the RULES_ORDER
# environment variable. The value is a comma-separated list of the filter names
# in the order they should be applied. The filter names are the same as the
# environment variable names. The default decision will be always the last one.

# Examples:
#
# Accept only one email:
#ALLOWED_EMAILS_LIST=my.email@example.com
#
# Accept emails from a domain, but not some emails:
#ALLOWED_DOMAINS_REGEX=example\.(com|net)
#DISALLOWED_EMAILS_LIST=not-him@example.com
#
# Reject only one domain, accept everything else:
#DISALLOWED_DOMAINS_LIST=example.org
#
# Custom rule set with custom order:
#RULES_ORDER=ALLOWED_EMAILS_LIST,ALLOWED_DOMAINS_REGEX,DISALLOWED_EMAILS_LIST,DISALLOWED_DOMAINS_LIST

############################################
# Database configuration

# SQLite database path
#SQLITE_PATH=data/db.sqlite

############################################
# Cookie configuration

# Session cookie name and secret key with at least 32 characters. For secret
# keys with special characters use array notation as shown below
SESSION_COOKIE=session
SESSION_SECRET=generate-a-secure-string

# Use comma-separated list in case of key-rotation. Usage of surrounding
# brackets [] is optional. First secret key is the current session secret
#SESSION_SECRET=new key, old-key, very-old-key
# Double quotes around the secrets are optional, but required if the secret
# contains comma or when leading and/or trailing spaces need to be preserved.
# Double quote itself needs to be escaped with backslash - JSON String parsing
# rules apply for double-quoted values. Example:
#SESSION_SECRET=[" ^key*, with \"special\" @characters$ "]

############################################
# Target server configuration

# Target server hostname or IP address
#SMTP_TARGET_HOST=smtp-mail.outlook.com

# Target server port
#SMTP_TARGET_PORT=587

# Use SSL/TLS to connect to the target server (true) or STARTTLS (false)
#SMTP_TARGET_TLS=false

############################################
# Listening server configuration

# SMTP server listening host or address. Multiple addresses can be specified
# separated by comma, empty value equals to listening on all interfaces.
# Defaults to localhost in development and empty value in production
#SMTP_HOST=

# SMTP server listening on unprotected port with SSL/TLS frontend. If not
# specified, the server will not listen on unprotected port. The unprotected
# port can be used by local clients to send emails without requiring encryption
#SMTP_PORT=25

# SMTP server listening on SSL/TLS port. The value might contain multiple ports
# separated by comma. If not specified, the server will not listen on SSL/TLS
# port
#SMTP_TLS_PORT=465

# SMTP server listening on unprotected port with STARTTLS upgrade to SSL/TLS.
# The value might contain multiple ports separated by comma. If not specified,
# the server will not listen on the STARTTLS port
#SMTP_STARTTLS_PORT=587

# SMTP server listening on specially crafted unprotected port with STARTTLS
# upgrade to SSL/TLS and SSL/TLS port with implicit TLS at the same time. The
# protocol is detected from the first few bytes sent by client during possible
# SSL/TLS handshake. For the STARTTLS mode the server is the first one to send
# the initial greeting, so the protocol detection adds a delay in case the
# client wants the STARTTLS upgrade. The value might contain multiple ports
# separated by comma. If not specified, the server will not listen on the
# specially crafted port
#SMTP_AUTOTLS_PORT=587

# Delay in milliseconds before the server sends the initial greeting in case of
# the specially crafted STARTTLS/SSL/TLS port. If the client does not start the
# the SSL/TLS handshake within the delay, the server will send the initial
# greeting and expect the client to use STARTTLS upgrade. Defaults to 3000 ms
# (3 seconds)
#SMTP_PROTOCOL_INSPECTION_DELAY_MS=3000

# SMTP server SSL/TLS/STARTTLS certificates in PEM format
#SMTP_KEY_FILE=certs/smtp_key.pem
#SMTP_CERT_FILE=certs/smtp_cert.pem

# Externally reachable host or address of the SMTP server, reported on
# configuration page
#SMTP_PUBLIC_HOST=smtp.example.com

# Initial SMTP greeting sent in initial 220 server response in addition to the
# target server's one. Defaults to SMTP_PUBLIC_HOST
#SMTP_GREETING_NAME=smtp.example.com

# Externally reachable port of the SSL/TLS SMTP server. The value might contain
# multiple ports separated by comma. If defined empty, no SSL/TLS port will be
# shown on the UI. Defaults to 465 if either SMTP_PORT, SMTP_TLS_PORT or
# SMTP_AUTOTLS_PORT is defined
#SMTP_PUBLIC_TLS_PORT=465

# Externally reachable port of the STARTTLS SMTP server. The value might contain
# multiple ports separated by comma. If defined empty, no STARTTLS port will be
# shown on the UI. Defaults to 587 if SMTP_STARTTLS_PORT or SMTP_AUTOTLS_PORT is
# defined
#SMTP_PUBLIC_STARTTLS_PORT=587

############################################
# HTTP server configuration

# HTP server listening host or address. Multiple addresses can be specified
# separated by comma, empty value equals to listening on all interfaces.
# Defaults to SMTP_HOST value
#HTTP_HOST=

# HTTP server port
#HTTP_PORT=3000

# When certificates are provided, the server will listen as HTTPS on HTTP_PORT
#HTTPS_KEY_FILE=certs/https_key.pem
#HTTPS_CERT_FILE=certs/https_cert.pem

# Comma-separated list of trusted proxy IP addresses, if any. Proxy
# headers will be accepted only from trusted proxies. Multiple addresses can be
# specified separated by comma. The format of the address must conform to
# proxy-addr library syntax, see https://www.npmjs.com/package/proxy-addr. In
# short, the address might be either loopback (127.0.0.1, ::1), linklocal
# (fe80::/10 and 169.254.0.0/16), uniquelocal (fc00::/7, 10.0.0.0/8,
# 172.16.0.0/12, 192.168.0.0/16), or custom address with mask like
# 10.10.1.0/24 or 172.16.5.2/32 or fd03:cc8b:0d31::/48.
# Defaults to empty string (don't trust any proxy headers).
#TRUST_PROXY=