# $Cambridge: hermes/src/prayer/files/etc.hermes/prayer.cf,v 1.49 2008/06/02 13:17:40 dpc22 Exp $
#
# Prayer master configuration file (webmail.hermes version)
#
# Typical configuration:
#   Read-only                  files stored under $prefix
#   Read-write (i.e: variable) files stored under $var_prefix

prefix      = "/opt/prayer"
var_prefix  = "/var/spool/prayer"

# User ID to run as if we start off as root
prayer_user           = "prayer"
# Group ID to run as if we start off as root
prayer_group          = "prayer"

# Run prayer as background process.
#   TRUE => will return as soon as valid configuration is found.
prayer_background     = TRUE

# Create mode for new files
file_perms            = 0640

# Create mode for new directories
directory_perms       = 0750

# Check existing directories under ${var_prefix}?
check_directory_perms = TRUE

######################################################################

# Location of backend servers

# Syntax for imapd server entries (applies to both lookups and default):
#   host          - Default IMAP port on given target system
#   host:port     - Defined port on given target system
#   host/ssl      - Default IMAPS port on given target system
#                   (only if SSL support compiled into c-client library)
#   host:port/ssl - Defined port for imap over SSL on given target system
#
# "host1, host2, host3" => interfaces for a multihomed system: Prayer picks
# one interface at random to seed c-client or accountd interface code.

# CDB lookup map overrides default imapd_server location
imapd_user_map      = "/opt/dist/users/cyrus.cdb"

# No default imapd server.
imapd_server=""

# Name of Prayer user preferences file on IMAP server
prefs_folder_name   = ".prayer"

# "Accountd" is the auxillary account management daemon. At the moment its
# only suitable for the central mail systems in Cambridge.

# Syntax for accountd server entries (applies to both lookups and default):
#   host          - Default ACCOUNTD port on given target system (145)
#   host:port     - Defined port on given target system
#   host/ssl      - Default ACCOUNT port on given target system using SSL.
#                   (only if ACCOUNTD running with SSL support!)
#   host:port/ssl - Defined port for accountd over SSL on given target system
#
# "host1, host2, host3" => interfaces for a multihomed system: Prayer picks
# one interface at random to seed c-client or accountd interface code.

# CDB lookup map overrides default accountd_server location
accountd_user_map   = ""

accountd_server     = "localhost"
accountd_nis_server = "canvas-intramail.csi.cam.ac.uk"
accountd_timeout    = 2m

# Warn user if password changes are not immediate
accountd_passwd_delay   = 30m
accountd_fullname_delay = 24h

# Talk to Cyrus timsieved using MANAGESIEVE protocol. Overrides accountd stuff
# 
#sieved_server   = localhost:2000
sieved_user_map  = "/opt/dist/users/cyrus.cdb"

# Default timsieved timeout is 10 minutes
sieved_timeout   = 9m

######################################################################
# Mail domain configuration

# Following is used in as SMTP bounce address. Typically one of the entries
# defined on the local_domain list. Defaults to "$default_domain".
#
return_path_domain    = "hermes.cam.ac.uk"

# Define a list of local_domains. These are domains which can be used as
# valid default_domains. Two possible formats:
#
# local_domain  <domain>
# local_domain  <domain> <map>
#
# First format just defines a local_domain which will appear on the list
# visible to user preferences. Second format also defines a list a CDB map
# file which defines valid entries in that domain: used for personal name
# expansion and checking for valid addresses. Defaults to a single
# entry which corresponds to "$default_domain".
#
#
#
local_domain cam.ac.uk        /opt/dist/prayer/domains/cam.cdb
local_domain hermes.cam.ac.uk /opt/dist/prayer/domains/hermes.cdb

# Filter configuration.
#
# A filter pattern which is equivalent to, or at least approximates the
# list of local domains. Defaults to "$default_domain"
filter_domain_pattern = "*cam.ac.uk"

######################################################################

# hostname_service is a DNS servicename for the entire service. Typically
# only needed if you are running more than one Webmail gateway system.
# (Example: webmail.hermes.cam.ac.uk is an alias for webmail[123].hermes...)
hostname_service = "webmail.hermes.cam.ac.uk"

# Hostname is the canonical name for this particular system, used in
# session and icon URLs which are generated by Prayer. This is derived
# automatically using gethostname(2) if no value provided. However, there
# are situations, especially involving SSL certificates where the default
# hostname may not be appropriate. The special value "__UNDEFINED__" here
# means the startup script or command line must provide a hostname using a
# --config-option override or via the environment variable PRAYER_HOSTNAME.
# This is just a safeguard for systems which use DNS round robining to
# distribute load across a number of machines.

hostname         = "webmail.hermes.cam.ac.uk"

# Define one HTTP and one HTTPS port.
#
# You can define an arbitary list of ports of both kinds by using a series
# of separate "use_http_port" and "use_https_port" directives, with one
# port on each line. Format: "interface:port" or "ipaddr:port" to bind to a
# single interface, "port" to bind to all interfaces.

use_http_port       80
use_https_port      443

# Prayer will put a warning on the login page for HTTP connections if both
# HTTP and HTTPS sessions are available. This will provide a link to the
# SSL version of the service, defaulting to port 443 or failing that the
# first defined HTTPS port. ssl_default_port overrides the built in logic.
# Should be rarely required now that Prayer automatically derives an
# appropriate port if none is provided here
#
# ssl_default_port = 443

# Make sure that the login request actually comes from the page in question
referer_block_invalid = TRUE
referer_log_invalid = TRUE

# Enable Contact address and warning for initial welcome page.
contact_email = "postmaster@hermes.cam.ac.uk"
contact_warning = TRUE

# Enable verbose logging.
log_debug  =  TRUE

# Client must connect from consistent IP addresses. May be useful as
# a security measure in LAN environments. Painful for dialup users
# whose connections may drop out.
fix_client_ipaddr = FALSE

# GZIP compression enabled by default if:
#  1) gzip compression enabled at compile time.
#  2) use_gzip set in user prefs
#  3) User agent known to support Content-Encoding: gzip
#  4) User agent asks for Content-Encoding: gzip or x-gzip.
#
# Following IP address lists allow us to tune this a bit more tightly.
# allow list is scanned first, then deny list.
#
#gzip_allow_nets = 131.111.99.0/24
#gzip_deny_nets =  127.0.0.1 : \
#  131.111.0.0/16 : 129.169.0.0/16 : \
#  128.232.0.0/16 : 193.60.80.0/20"
#
# Quick hack to work around IE6 breakage. Real fix should be put in user_agent.c
gzip_deny_nets = 0.0.0.0/0

# Log hostnames rather than IP addresses to session_log when logging in
# from one of the following networks. A list of fast local networks which
# we know will provide fast reverse lookup from IP address to name.

#log_name_nets = 127.0.0.1 : \
#  131.111.0.0/16 : 129.169.0.0/16 : \
#  128.232.0.0/16 : 193.60.80.0/20

# Limit on any single process to stop runaway process killing system.
limit_vm = 600m

######################################################################
######################################################################
# Stuff that is less likely to change

# Maximum sizes for components in HTTP request. Prayer should be able to
# cope with arbitary size input, however the incoming request has to be
# stored somewhere. Eventually you will run out of swap if someone tries
# hard enough...

# Maximum for initial line in HTTP request
http_max_method_size = 32K
# Maximum for headers associated to this request
http_max_hdr_size    = 64K

# Maximum for HTTP payload. This is the one that is likely to be reached in
# normal use.
http_max_body_size   = 200M

# Minimum and maximum number of preforked "prayer" HTTP servers.
http_min_servers     = 32
http_max_servers     = 768

# Maximum number of connections that each frontend server will process
http_max_connections = 100

# Present HTTP cookies to browser as "username:port=value" rather than
# "username=value" Allows simultaneous login sessions from a single client
# browser.  However can leave a trail of cookies behind. Probably don't
# want this in the long term, its here for experimentation purposes only at
# the moment.
http_cookie_use_port = FALSE

# Various timeouts for HTTP sessions.
# Timeout for (dirty) spare server waiting for fresh HTTP connection
http_timeout_idle    = 10s

# Timeout for HTTP connection which last served an icon URL
http_timeout_icons   = 5s

# Timeout for HTTP connection which last served an session URL
http_timeout_session = 15s

# Icons URLs are valid for 7 days. (In contrast sessions URLs expire
# immediately: Browsers really shouldn't be trying to cache this stuff,
# especially when it is coming in over HTTPS).
icon_expire_timeout  = 7d

# Allow links to HTTP objects in HTML pages served up over HTTPS
# connections, if we know that the browser is unlikely to whinge or fall
# over in a heap. Experimental, and now largely obsolete with the advent of
# short URL optimisations.
http_icon_embed   = TRUE

# Locatation of SSL certificate file.
# Required if we are going to provide SSL services.
ssl_cert_file       = "/opt/dist/prayer/certs/webmail.pem"

# Locatation of SSL private key file.
# Required if we are going to provide SSL services.
ssl_privatekey_file = "/opt/dist/prayer/certs/webmail.pem"

# Master server will regenerate shared RSA key at this interval:
ssl_rsakey_lifespan = 60m

# RSA key remains fresh in child process for this long after first actual use.
ssl_rsakey_freshen  = 60m

# SSL session cache timeout.
ssl_session_timeout = 24h

# EGD socket, if system has no /dev/urandom
#egd_socket = "/var/prngd/urandom"

######################################################################
# Session specific configuration

# Session switches to idle mode after this much time: connections to IMAP
# and accountd servers are shut down.
session_idle_time   = 5m

# Session disconnects entirely after this much idle time.
session_timeout     = 30m

# Session disconnects entirely after this much idle time on compose screen
session_timeout_compose = 4h

# Checkpoint "inbox" and "other" streams every 20 minutes
stream_checkpoint    = T
stream_ping_interval = 20m

# Shut down Postponed, Preferences and Transfer streams entirely
# after 15 minutes idle time, but only if idle mode doesn't beat us to it.
stream_misc_timeout = 15m 

# Stat log files every few minutes to see if target file has been
# renamed or removed. 0s => stat() log file every time something is logged.
log_ping_interval  = 10m

# Reopen database files every few minutes to cope with log cycling.
db_ping_interval   = 60m

# Banners for login screen
login_banner        = "Hermes Webmail Service"
login_service_name  = "Hermes"

# Address are pruned to this many characters on the mailbox list screen
list_addr_maxlen    = 30

# Subjects are pruned to  this many characters on the mailbox list screen
list_subject_maxlen = 30

# Maximum number of folders in shortcut dialogue
change_max_folders  = 64

# Ispell languages that we want to support, with some descriptive text
# for the preferences screen.
use_ispell_language  british   "British English"
use_ispell_language  american  "American English"

# Max size of single attachment
draft_att_single_max = 50M

# Max size of all attachments
draft_att_total_max  = 50M

# fix_from_address suppresses From address option from Preferences and
# Roles screens.
fix_from_address = FALSE

# Defaults for Cyrus (actually Hermes derivative) spam_purge command.
spam_purge_name = "spam_purge"
spam_purge_prefix = "# Spam Purge Timeout:"
spam_purge_timeout = 60

######################################################################

# Location of sendmail binary or drop in replacement such as Exim.
sendmail_path       = /usr/lib/sendmail

# Location of Aspell Binary (takes precedence over ispell_path)
aspell_path         = /usr/bin/aspell

# Location of Ispell Binary (backwards compatibility only)
#ispell_path         = /usr/bin/ispell

# Prayer defaults to a fairly safe and boring login page. The following
# three files will expand to an arbitary HTML page with a login dialogue
# stuck in the middle as follows:
#
#  <login_prefix_path>
#
#  <Login Dialogue>
#
#  <motd_path>
#  <login_suffix_path>

# Login page prefix
login_prefix_path   = "$prefix/etc/login_prefix.html"

# Message of the day file
motd_path           = "$prefix/etc/motd.html"

# Login page suffix
login_suffix_path   = "$prefix/etc/login_suffix.html"

# Login security: Prayer's front page defaults to a login form.
# If the user does not connect via SSL then this can be changed
# to a page without a form (in order to encourage secure logins)
# or changed to a redirect to the secure login page. The insecure
# login page remains accessible if these settings are enabled, so
# it can be disabled for full security.

# Encourage secure logins by omitting the login form from the front page.
ssl_encouraged      = TRUE

# Redirect from the insecure front page to the secure one.
ssl_redirect        = TRUE

# Insecure logins are forbidden.
ssl_required        = TRUE

# Welcome text displayed when user first logs in
welcome_path        = "$prefix/etc/welcome.html"

# Location of help files
help_dir            = "$prefix/help"

# Location of icon files
icon_dir            = "$prefix/icons"

# Location of icon files
static_dir          = "$prefix/static"

# Location of binary files
bin_dir             = "$prefix/sbin"

# Various directories used by the running system
# Logs stored in $log_dir
log_dir             = "$var_prefix/logs"

# $lock_dir used for interlocking between prayer processes
lock_dir            = "$var_prefix/locks"

# $socket_dir is location for unix domain sockets which connect frontend
# to backend in proxy mode of operation.
socket_dir          = "$var_prefix/sockets"

# Split socket directory into 64 subdirs keyed on first letter of sessionID
# Code provides compatibility in both directions: can switch back and forward
socket_split_dir    = TRUE

# Name of Unix domain socket (in $socket_dir) used for initial handshake
# between prayer and prayer-session processes when a user logs in
init_socket_name    = init

# $ssl_session_dir is location for SSL session cache 
ssl_session_dir     = "$var_prefix/ssl_scache"

# Location for temporary files e.g; attachments and folders in transist
# during upload and download operation. Core files also end up here
tmp_dir             = "$var_prefix/tmp"

# Location for PID files for prayer and prayer-session master processes.
pid_dir             = "$var_prefix/pid"

# Interface to Hermes finger database
lookup_rpasswd   = "/data/finger/rpasswd.cdb"
lookup_rusername = "/data/finger/rusername.cdb"
lookup_username  = "/data/finger/username.cdb"
lookup_fullname  = "/opt/dist/prayer/domains/hermes.cdb"

# Interface to LDAP server
ldap_server      = "ldap.lookup.cam.ac.uk"
ldap_base_dn     = "ou=people,o=University of Cambridge,dc=cam,dc=ac,dc=uk"
ldap_timeout     = 30s

######################################################################
# Template stuff

template_path = "/opt/prayer/templates"
template_set  = "xhtml_strict"
template_use_compiled = TRUE

######################################################################
# Theme stuff

theme blue description           "Web Safe Blue"
theme blue fgcolor               "#000000"       # Black
theme blue fgcolor_link          "#0000ff"       # Dark    Blue
theme blue bgcolor               "#ccffff"       # Light   Blue 
theme blue bgcolor_banner        "#66ffff"       # Darkish Blue
theme blue bgcolor_row1          "#ccffff"       # Light   Blue
theme blue bgcolor_row2          "#99ffff"       # Middle  Blue
theme blue bgcolor_status        "#ffffcc"       # Yellow
theme blue bgcolor_status_none   "#ccffcc"       # Green
theme blue fgcolor_quote1        "#800000"       # Brick Red
theme blue fgcolor_quote2        "#008000"       # Green
theme blue fgcolor_quote3        "#000080"       # Blue
theme blue fgcolor_quote4        "#ff0000"       # Orange

theme green description          "Web Safe Green"
theme green fgcolor              "#000000"       # Black
theme green fgcolor_link         "#0000ff"       # Dark    Blue
theme green bgcolor              "#ccffcc"       # Light   Green
theme green bgcolor_banner       "#99ff99"       # Middle  Green
theme green bgcolor_row1         "#ccffcc"       # Light   Green
theme green bgcolor_row2         "#99ff99"       # Middle  Green
theme green bgcolor_status       "#ffffcc"       # Yellow
theme green bgcolor_status_none  "#ccffff"       # Light   Blue
theme green fgcolor_quote1       "#800000"       # Brick Red
theme green fgcolor_quote2       "#008000"       # Green
theme green fgcolor_quote3       "#000080"       # Blue
theme green fgcolor_quote4       "#ff0000"       # Orange

theme yellow description         "Web Safe Yellow"
theme yellow fgcolor             "#000000"       # Black
theme yellow fgcolor_link        "#0000ff"       # Dark   Blue
theme yellow bgcolor             "#ffffcc"       # Light  Yellow
theme yellow bgcolor_banner      "#ffff66"       # Middle Yellow
theme yellow bgcolor_row1        "#ffffcc"       # Light  Yellow
theme yellow bgcolor_row2        "#ffff66"       # Middle Yellow
theme yellow bgcolor_status      "#ccffff"       # Light  Blue
theme yellow bgcolor_status_none "#ccffcc"       # Green
theme yellow fgcolor_quote1      "#800000"       # Brick Red
theme yellow fgcolor_quote2      "#008000"       # Green
theme yellow fgcolor_quote3      "#000080"       # Blue
theme yellow fgcolor_quote4      "#ff0000"       # Orange

theme gray description          "Shades of Gray" # NB: Not Web safe!
theme gray fgcolor              "#000000"        # Black
theme gray fgcolor_link         "#0000ff"        # Dark   Blue
theme gray bgcolor              "#eeeeee"        # Light  gray
theme gray bgcolor_banner       "#cccccc"        # Dark   gray
theme gray bgcolor_row1         "#eeeeee"        # Light  gray
theme gray bgcolor_row2         "#dddddd"        # Middle gray
theme gray bgcolor_status       "#ffffcc"        # Yellow
theme gray bgcolor_status_none  "#ccffcc"        # Green
theme gray fgcolor_quote1       "#800000"        # Brick Red
theme gray fgcolor_quote2       "#008000"        # Green
theme gray fgcolor_quote3       "#000080"        # Blue
theme gray fgcolor_quote4       "#ff0000"        # Orange

theme high description          "High Constrast" # Yuck!
theme high fgcolor              "#000000"        # Black
theme high fgcolor_link         "#0000ff"        # Dark  Blue
theme high bgcolor              "#ffffff"        # Very, very white
theme high bgcolor_banner       "#cccccc"        # Dark gray
theme high bgcolor_row1         "#ffffff"        # Very, very white
theme high bgcolor_row2         "#cccccc"        # Dark gray
theme high bgcolor_status       "#ffffcc"        # Yellow
theme high bgcolor_status_none  "#ccffcc"        # Green
theme high fgcolor_quote1       "#800000"        # Brick Red
theme high fgcolor_quote2       "#008000"        # Green
theme high fgcolor_quote3       "#000080"        # Blue
theme high fgcolor_quote4       "#ff0000"        # Orange

theme help description          "Default Help Text theme"
theme help fgcolor              "#000000"        # Black
theme help fgcolor_link         "#0000ff"        # Dark Blue
theme help bgcolor              "#ffffcc"        # Yellow
theme help bgcolor_banner       "#66ffff"        # Darkish Blue
theme help bgcolor_row1         "#ccffff"        # Light   Blue
theme help bgcolor_row2         "#99ffff"        # Middle  Blue
theme help bgcolor_status       "#ccffff"        # Light   Blue
theme help bgcolor_status_none  "#ccffcc"        # Green
theme help fgcolor_quote1       "#800000"        # Brick Red
theme help fgcolor_quote2       "#008000"        # Green
theme help fgcolor_quote3       "#000080"        # Blue
theme help fgcolor_quote4       "#ff0000"        # Orange

theme_default_main  = blue
theme_default_help  = help

######################################################################

# Default user preferences

# Confirmation dialogue when user logs out
confirm_logout      = TRUE

# Confirmation dialogue when user hits expunge
confirm_expunge     = FALSE

# Confirmation dialogue when user deletes mail folder or directory
confirm_rm          = TRUE

# Number of messages per screen on message list screen
msgs_per_page       = 10

# Max Number of messages per screen on message list screen
msgs_per_page_max   = 50

# Min Number of messages per screen on message list screen
msgs_per_page_min   = 4

# Number of addressbook entries per page on abook_list screen
abook_per_page      = 10

# Max Number of addressbook entries per page on abook_list screen
abook_per_page_max  = 50

# Min Number of addressbook entries per page on abook_list screen
abook_per_page_min  = 4

# Supress dotfiles from directory listing
suppress_dotfiles   = TRUE

# Mail directory in users account
maildir             = ""

# Use IMAP NAMESPACE command to find personal_hierarchy and hiersep
use_namespace       = TRUE

# If not supplied by NAMESPACE
personal_hierarchy  = ""

# If not supplied by NAMESPACE
hiersep             = "/"

# Dual use mailboxes
dualuse             = FALSE

# Names of postponed_folder and sent_mail_folder, relative to maildir
postponed_folder    = "postponed-msgs"
sent_mail_folder    = "sent-mail"

# Default domain for outgoing mail. Defaults to "$hostname".
default_domain      = "cam.ac.uk"

# Language for ispell.
ispell_language     = "british"

# Only works with aspell
spell_skip_quoted   = TRUE

# Size of small and large compose windows
small_cols          = 80
small_rows          = 14
large_cols          = 80
large_rows          = 24

# Default Sort mode for mailbox list. One of:
#   ARRIVAL, DATE, FROM, TO, CC, SIZE, SUBJECT, REFERENCES, ORDEREDSUBJECT
#
# ARRIVAL is most efficient, and recommended  
#
sort_mode           = ARRIVAL

# Favour reverse sort rather than normal sort order?
sort_reverse        = FALSE

# Default Sort mode for addressbook list. One of:
#   ORDERED, ALIAS, NAME, COMMENT, ADDRESS
abook_sort_mode     = ORDERED

# Favour reverse sort rather than normal sort order?
abook_sort_reverse        = FALSE

# Wrap lines at this many characters
line_wrap_len       = 76

# Enabled advanced line wrap options?
line_wrap_advanced  = FALSE

# Line wrap automaticaly on reply.
line_wrap_on_reply  = TRUE

# Line wrap automaticaly on spell check
line_wrap_on_spell   = TRUE

# Line wrap automaticaly on send.
line_wrap_on_send   = TRUE

# sent_mail item on compose screen
use_sent_mail       = TRUE

# Use persistent mark
use_mark_persist    = FALSE

# Zoom automatically after sucessful search
use_search_zoom     = TRUE

# Unmake messages after sucessful aggregate operation
use_agg_unmark      = TRUE

# Use icons: may be overriden by value of User-Agent
use_icons           = TRUE

# Duplicate banner icons on certain screens.
use_tail_banner     = FALSE

# Enable welcome screen
use_welcome         = TRUE

# Use HTTP cookie for Session-ID, if the browser supports cookies
# If disabled, or user rejects cookie, then session-ID is stored in URL.
use_cookie          = TRUE

# Use page substiution rather than HTTP redirects. Faster, but the
# URLs that are generated are less predictable.
use_substitution    = TRUE

# Allow HTTP/1.1, if the browser supports it
use_http_1_1        = TRUE

# Allow HTTP/1.1 pipelining, if the browser supports it
use_pipelining      = TRUE

# Allow HTTP links embedded in HTTPS responses, if the browser supports it
use_embed_http      = TRUE

# Allow persistent HTTP/1.1 and HTTP/1.0 persistent connections,
# if the browser supports them
use_persist         = TRUE

# Allow short URLs, if the browser supports them
use_short           = TRUE

# Allow gzip compression, if the browser supports it
use_gzip            = TRUE

# Announce User-Agent as Netscape 4 (but only if it claims to be Netscape 4!)
#
# This enables use of a couple of HTML markup oddities which aren't
# strictly correct in HTML 4.01 transitional but without which Netscape 4
# plays silly buggers, namely:
#   border=0 on <img src="/icons/whatever" ...>
#   wrap="virtual" in textareas.
is_netscape4        = TRUE

# Show text/html bodyparts inline. Content is scrubbed to remove
# dangerous tags: see documentation for more details.
html_inline         = TRUE

# Same as above for text/* bodyparts which start "<HTML>" (case-independant!)
# Does anyone other than spammers actually use this?
html_inline_auto    = TRUE

# Send message mime-type through to browser. If FALSE then mime-type
# is replaced with "application/octet-stream" which should force
# download to local disk, bypassing any automatic processing of bodyparts
# by the User-Agent. Unclear at the moment whether we need to do this,
# or whether this should be done selectively based on the User-Agent
preserve_mimetype   = TRUE
