added IMAP, LetsEncrypt, update layout

internal/config/config.go

@@ -34,6 +34,10 @@ var defaults = []struct {
 		{"helo_hostname", "mail.example.com", ""},
 		{"", "", `IP address to bind to (0.0.0.0 = all interfaces), on Windows must use specific IP`},
 		{"BIND_IP", "0.0.0.0", ""},
+		{"", "", "HTTP port for the admin web UI (overridden by the -port flag if given)"},
+		{"WEB_HTTP_PORT", "5000", ""},
+		{"", "", "HTTPS port for the admin web UI (self-signed by default, or the Let's Encrypt cert when enabled)"},
+		{"WEB_HTTPS_PORT", "5001", ""},
 		{"", "", `Custom server banner (to make it empty use "" must be double quotes)`},
 		{"server_banner", "", ""},
 		{"", "", "Time zone for the server"},
@@ -79,6 +83,63 @@ var defaults = []struct {
 		{"", "", `Full origin (scheme+host+port) the dashboard is served at, e.g. "https://mail.example.com"`},
 		{"rp_origin", "http://localhost:5000", ""},
 	}},
+	{"IMAP", []defaultKV{
+		{"", "", "IMAP server configuration for mailbox retrieval (Thunderbird, etc.)"},
+		{"", "", "Plain IMAP port (STARTTLS not offered, matching the SMTP plain-port design)"},
+		{"IMAP_PORT", "1143", ""},
+		{"", "", "Implicit-TLS IMAP port (IMAPS)"},
+		{"IMAP_TLS_PORT", "1993", ""},
+	}},
+	{"Mailstore", []defaultKV{
+		{"", "", "Local mailbox storage configuration"},
+		{"", "", "Directory where encrypted message blobs are written"},
+		{"mailstore_path", "server_data/mailstore", ""},
+		{"", "", "Path to the server-held master key that wraps every mailbox's encryption key"},
+		{"", "", "(generated on first run if missing; back this file up separately from the database -"},
+		{"", "", "losing it makes all stored mail unrecoverable, even for admins)"},
+		{"master_key_path", "server_data/mailstore_master.key", ""},
+		{"", "", "Default per-mailbox storage quota in bytes (5 GiB)"},
+		{"default_quota_bytes", "5368709120", ""},
+		{"", "", "Minimum length for IMAP/SMTP app passwords (floor of 25 enforced regardless of this value)"},
+		{"app_password_min_length", "25", ""},
+		{"", "", "Reject messages scoring at or above this built-in heuristic spam score"},
+		{"spam_reject_score", "5", ""},
+	}},
+	{"Rspamd", []defaultKV{
+		{"", "", "Optional rspamd integration for spam scoring (off by default; the built-in"},
+		{"", "", "heuristic score above always runs regardless of this setting)"},
+		{"enabled", "false", ""},
+		{"", "", "rspamd controller/worker URL"},
+		{"url", "http://127.0.0.1:11333", ""},
+		{"", "", "Reject messages rspamd scores at or above this threshold"},
+		{"reject_score", "15", ""},
+	}},
+	{"LetsEncrypt", []defaultKV{
+		{"", "", "Let's Encrypt (ACME, DNS-01 only) automatic certificate configuration for the"},
+		{"", "", "SMTP/IMAP TLS listeners. Leave 'enabled' false to keep using the self-signed cert."},
+		{"enabled", "false", ""},
+		{"", "", "Use Let's Encrypt's staging directory (untrusted certs, no rate limits) for testing"},
+		{"staging", "false", ""},
+		{"", "", "Contact email for the ACME account"},
+		{"contact_email", "", ""},
+		{"", "", "Comma-separated domains to request, e.g. mail.example.com,*.mail.example.com"},
+		{"domains", "", ""},
+		{"", "", "DNS provider used to solve the DNS-01 challenge: cloudflare, route53, digitalocean, gcloud"},
+		{"dns_provider", "", ""},
+		{"", "", "-- Cloudflare --"},
+		{"cloudflare_api_token", "", ""},
+		{"", "", "-- AWS Route53 (leave access key/secret blank to use the host's default AWS credential chain) --"},
+		{"route53_access_key_id", "", ""},
+		{"route53_secret_access_key", "", ""},
+		{"route53_region", "", ""},
+		{"route53_hosted_zone_id", "", ""},
+		{"", "", "-- DigitalOcean --"},
+		{"digitalocean_api_token", "", ""},
+		{"", "", "-- Google Cloud DNS --"},
+		{"gcloud_project", "", ""},
+		{"", "", "Path to an uploaded service-account JSON key; leave blank to use Application Default Credentials"},
+		{"gcloud_service_account_json_path", "", ""},
+	}},
 }
 
 // GenerateSettingsIni writes settings.ini with default values and comments if it does