; SnappyMail configuration file
; Please don't add custom parameters here, those will be overwritten

[webmail]
; Text displayed as page title
title = "SnappyMail Webmail"

; Text displayed on startup
loading_description = "SnappyMail"
favicon_url = ""
app_path = ""

; Theme used by default
theme = "Default"

; Allow theme selection on settings screen
allow_themes = On
allow_user_background = Off

; Language used by default
language = "en"

; Allow language selection on settings screen
allow_languages_on_settings = On
allow_additional_accounts = On
allow_additional_identities = On

; When identity is not set yet, open identity popup after login
popup_identity = On

; Number of messages displayed on page by default
messages_per_page = 20

; Mark message read after N seconds
message_read_delay = 5

; Minimal check for new messages interval in minutes
min_refresh_interval = 5

; File size limit (MB) for file upload on compose screen
; 0 for unlimited.
attachment_size_limit = 2

; brotli or gzip compress the output.
; Warning: only enable when server does not do this, else double compression errors occur
compress_output = Off

[interface]
show_attachment_thumbnail = On

[contacts]
; Enable contacts
enable = Off
allow_sync = Off
sync_interval = 20
type = "sqlite"
pdo_dsn = "host=127.0.0.1;port=3306;dbname=snappymail"
pdo_user = "root"
pdo_password = ""

; PEM format certificate
mysql_ssl_ca = ""
mysql_ssl_verify = On

; HIGH
mysql_ssl_ciphers = ""
sqlite_global = Off
suggestions_limit = 20

[security]
custom_server_signature = "SnappyMail"
x_xss_protection_header = "1; mode=block"
gnupg = On
openpgp = On
auto_verify_signatures = Off

; Access settings
allow_admin_panel = On

; Login and password for web admin panel
admin_login = "admin"
admin_password = ""
admin_totp = ""

; Use email address instead of login password for encrypting sensitive data (like account passwords)
insecure_cryptkey = Off
force_https = Off
hide_x_mailer_header = On

; https://en.m.wikipedia.org/wiki/Load_(computing)
max_sys_getloadavg = 0

; For example to allow all images use "img-src https:". More info at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#directives
content_security_policy = ""

; Report CSP errors to PHP and/or SnappyMail Log
csp_report = Off

; A valid cipher method from https://php.net/openssl_get_cipher_methods
encrypt_cipher = "camellia-128-cfb"

; Strict, Lax or None
cookie_samesite = "Strict"

; Additional allowed Sec-Fetch combinations separated by ";".
; For example:
; * Allow iframe on same domain in any mode: dest=iframe,site=same-origin
; * Allow navigate to iframe on same domain: mode=navigate,dest=iframe,site=same-origin
; * Allow navigate to iframe on (sub)domain: mode=navigate,dest=iframe,site=same-site
; * Allow navigate to iframe from any domain: mode=navigate,dest=iframe,site=cross-site
; 
; Default is "site=same-origin;site=none"
secfetch_allow = ""

[admin_panel]
host = ""
key = "admin"
allow_update = Off

; Admin Panel interface language
language = "en"

[ssl]
; Require verification of SSL certificate used.
verify_certificate = Off

; Allow self-signed certificates. Requires verify_certificate.
allow_self_signed = Off

; https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
security_level = 1

; Location of Certificate Authority file on local filesystem (/etc/ssl/certs/ca-certificates.crt)
cafile = ""

; capath must be a correctly hashed certificate directory. (/etc/ssl/certs/)
capath = ""

; Location of client certificate file (pem format with private key) on local filesystem
local_cert = ""

; This can help mitigate the CRIME attack vector.
disable_compression = On

[capa]
; Allow clear folder and delete messages without moving to trash
dangerous_actions = On

; Allow download attachments as Zip (and optionally others)
attachments_actions = On

[login]
; If someone logs in without "@domain.tld", this value will be used
; When this value is HTTP_HOST, the $_SERVER["HTTP_HOST"] value is used.
; When this value is SERVER_NAME, the $_SERVER["SERVER_NAME"] value is used.
; When this value is gethostname, the gethostname() value is used.
; 
default_domain = ""

; Allow language selection on webmail login screen
allow_languages_on_login = On

; Detect language from browser header `Accept-Language`
determine_user_language = On

; Like default_domain but then HTTP_HOST/SERVER_NAME without www.
determine_user_domain = Off

; This option allows webmail to remember the logged in user
; once they closed the browser window.
; 
; Values:
;   "DefaultOff" - can be used, disabled by default;
;   "DefaultOn"  - can be used, enabled by default;
;   "Unused"     - cannot be used
sign_me_auto = "DefaultOff"

; When login fails, wait N seconds before responding
fault_delay = 5

[plugins]
; Enable plugin support
enable = On

; Comma-separated list of enabled plugins
enabled_list = "mailbox-detect"

[defaults]
; Editor mode used by default (Plain, Html)
view_editor_type = "Html"

; layout: 0 - no preview, 1 - side preview, 2 - bottom preview
view_layout = 1
view_use_checkboxes = On

; Show next message when (re)move current message
view_show_next_message = On
autologout = 30
view_html = On
show_images = Off

; View external images:
;   "ask" - always ask
;   "match" - whitelist or ask
;   "always" - show always
view_images = "ask"
contacts_autosave = On
mail_list_grouped = Off
mail_use_threads = Off
allow_draft_autosave = On
mail_reply_same_folder = Off

; 1 - reply, 2 - reply all
msg_default_action = 1
collapse_blockquotes = On
allow_spellcheck = Off

[logs]
; Enable logging
enable = Off

; Path where log files will be stored
path = ""

; Log messages of set RFC 5424 section 6.2.1 Severity level and higher (0 = highest, 7 = lowest).
; 0 = Emergency
; 1 = Alert
; 2 = Critical
; 3 = Error
; 4 = Warning
; 5 = Notice
; 6 = Informational
; 7 = Debug
level = 4

; Required for development purposes only.
; Disabling this option is not recommended.
hide_passwords = On
time_zone = "UTC"

; Log filename.
; For security reasons, some characters are removed from filename.
; Allows for pattern-based folder creation (see examples below).
; 
; Patterns:
;   {date:Y-m-d}  - Replaced by pattern-based date
;                   Detailed info: http://www.php.net/manual/en/function.date.php
;   {user:email}  - Replaced by user's email address
;                   If user is not logged in, value is set to "unknown"
;   {user:login}  - Replaced by user's login (the user part of an email)
;                   If user is not logged in, value is set to "unknown"
;   {user:domain} - Replaced by user's domain name (the domain part of an email)
;                   If user is not logged in, value is set to "unknown"
;   {user:uid}    - Replaced by user's UID regardless of account currently used
; 
;   {user:ip}
;   {request:ip}  - Replaced by user's IP address
; 
; Others:
;   {imap:login} {imap:host} {imap:port}
;   {smtp:login} {smtp:host} {smtp:port}
; 
; Examples:
;   filename = "log-{date:Y-m-d}.txt"
;   filename = "{date:Y-m-d}/{user:domain}/{user:email}_{user:uid}.log"
;   filename = "{user:email}-{date:Y-m-d}.txt"
;   filename = "syslog"
;   filename = "stderr"
filename = "log-{date:Y-m-d}.txt"

; Enable auth logging in a separate file (for fail2ban)
auth_logging = Off
auth_logging_filename = "fail2ban/auth-{date:Y-m-d}.txt"
auth_logging_format = "[{date:Y-m-d H:i:s}] Auth failed: ip={request:ip} user={imap:login} host={imap:host} port={imap:port}"

; Enable auth logging to syslog for fail2ban
auth_syslog = Off
json_response_write_limit = 300

[debug]
; Special option required for development purposes
enable = Off
javascript = Off
css = Off

[cache]
; The section controls caching of the entire application.
; 
; Enables caching in the system
enable = On

; Path where cache files will be stored
path = ""

; Additional caching key. If changed, cache is purged
index = "v1"

; Additional caching key. If changed, fast cache is purged
fast_cache_index = "v1"

; Browser-level cache. If enabled, caching is maintainted without using files
http = On

; Browser-level cache time (seconds, Expires header)
http_expires = 3600

; Caching message UIDs when searching and sorting (threading)
server_uids = On
system_data = On

[imap]
use_force_selection = Off
use_expunge_all_on_delete = Off
message_list_fast_simple_search = On
message_list_permanent_filter = ""
message_all_headers = Off
show_login_alert = On
fetch_new_messages = On

[labs]
; Allow drag & drop .eml files from system into messages list
allow_message_append = Off
smtp_show_server_errors = Off

; PHP mail() remove To and Subject headers
mail_func_clear_headers = On

; PHP mail() set -f emailaddress
mail_func_additional_parameters = Off
folders_spec_limit = 50
curl_proxy = ""
curl_proxy_auth = ""
custom_login_link = ""
custom_logout_link = ""
http_client_ip_check_proxy = Off
use_local_proxy_for_external_images = On
image_exif_auto_rotate = Off
cookie_default_path = ""
cookie_default_secure = Off
replace_env_in_configuration = ""
boundary_prefix = ""
dev_email = ""
dev_password = ""

[version]
current = "2.38.2"
saved = "Thu, 04 Sep 2025 21:38:13 +0000"