72 lines
4 KiB
Plaintext
72 lines
4 KiB
Plaintext
|
# mail-imap-sync configuration — placeholders only. NEVER commit real values.
|
||
|
|
#
|
||
|
|
# On PIHA these keys are APPENDED to the existing /opt/homelab/kb/.env, which is already
|
||
|
|
# root-owned 0600 and already holds KB_DSN, PAPERLESS_API_TOKEN and ANTHROPIC_API_KEY
|
||
|
|
# (recon Decyzja (c)). systemd reads EnvironmentFile as root BEFORE dropping to
|
||
|
|
# User=oskar, so the secrets reach the process without being readable by `oskar` at rest —
|
||
|
|
# a better property than a 0600 file owned by the job's own user. Keep it that way.
|
||
|
|
#
|
||
|
|
# Rules, all learned the hard way in this repo:
|
||
|
|
# 1. Never on the command line. This job has no --user/--password flag on purpose;
|
||
|
|
# argv shows up in `ps` and in shell history.
|
||
|
|
# 2. Never echoed to a terminal. Two secrets have already had to be rotated after
|
||
|
|
# leaking into a session transcript (docs/sessions/2026-07-15.md,
|
||
|
|
# docs/sessions/2026-07-21.md). Install them with an editor, not `echo >>`.
|
||
|
|
# 3. App passwords, not account passwords — revocable one at a time, no access to
|
||
|
|
# account settings, no bypassing 2FA.
|
||
|
|
#
|
||
|
|
# Full setup, including how to mint the app passwords: kb/runbooks/mail-sync-run.md
|
||
|
|
|
||
|
|
# --- which mailboxes to sync -------------------------------------------------------
|
||
|
|
# Required. Comma-separated; each name is also the envelope.source value and the
|
||
|
|
# mail_sync_state.account key. Start with one account if the other is not set up yet.
|
||
|
|
MAIL_ACCOUNTS=gmail,fastmail
|
||
|
|
|
||
|
|
# --- gmail -------------------------------------------------------------------------
|
||
|
|
# App password requires 2FA on the account. Paste it WITHOUT the spaces Google displays.
|
||
|
|
MAIL_GMAIL_USER=you@gmail.com
|
||
|
|
MAIL_GMAIL_APP_PASSWORD=change-me-16-char-app-password
|
||
|
|
# Optional, defaults shown. The folder is chosen by SPECIAL-USE attribute, never by name:
|
||
|
|
# with a Polish UI the mailbox is called "[Gmail]/Wszystkie", and a hardcoded
|
||
|
|
# "[Gmail]/All Mail" would sync nothing while reporting success every hour.
|
||
|
|
# MAIL_GMAIL_HOST=imap.gmail.com
|
||
|
|
# MAIL_GMAIL_PORT=993
|
||
|
|
# MAIL_GMAIL_SPECIAL_USE=\All
|
||
|
|
# MAIL_GMAIL_FOLDERS=
|
||
|
|
#
|
||
|
|
# What the FIRST tick on a folder does — new-only | since | full. Ignored once a
|
||
|
|
# mail_sync_state row exists for that folder.
|
||
|
|
# new-only : start the corpus here, fetch nothing older.
|
||
|
|
# since : fetch everything the server RECEIVED on/after MAIL_*_INITIAL_SINCE.
|
||
|
|
# full : sweep the whole folder (dedup absorbs what is already in the DB).
|
||
|
|
# For gmail, 'since' is the point of the exercise: the corpus stops at 2026-06-19, so a
|
||
|
|
# 'new-only' first tick would leave that gap unfilled forever. Pick a date a few days
|
||
|
|
# BEFORE the last envelope in the DB — dedup makes the overlap free.
|
||
|
|
MAIL_GMAIL_INITIAL_MODE=since
|
||
|
|
MAIL_GMAIL_INITIAL_SINCE=2026-06-15
|
||
|
|
|
||
|
|
# --- fastmail ----------------------------------------------------------------------
|
||
|
|
# Fastmail app passwords can be scoped to IMAP only — use that, not a full-access one.
|
||
|
|
MAIL_FASTMAIL_USER=you@fastmail.com
|
||
|
|
MAIL_FASTMAIL_APP_PASSWORD=change-me-app-password
|
||
|
|
# Optional, defaults shown. Fastmail has no \All equivalent, so the scope is a literal
|
||
|
|
# list. Spam/Trash/Drafts are excluded on purpose (defined noise; drafts have no stable
|
||
|
|
# Message-ID and mutate).
|
||
|
|
# MAIL_FASTMAIL_HOST=imap.fastmail.com
|
||
|
|
# MAIL_FASTMAIL_PORT=993
|
||
|
|
# MAIL_FASTMAIL_FOLDERS=INBOX,Archive,Sent
|
||
|
|
#
|
||
|
|
# Fastmail is greenfield — zero rows, zero archive files. Whether to pull its history is
|
||
|
|
# a decision the recon deliberately leaves open until measured:
|
||
|
|
# mail-imap-sync --measure
|
||
|
|
# prints MESSAGES per folder. Decide 'new-only' vs 'full' from that number, then set it
|
||
|
|
# here BEFORE the first --apply run (after the first run the cursor exists and this key
|
||
|
|
# no longer has any effect).
|
||
|
|
MAIL_FASTMAIL_INITIAL_MODE=new-only
|
||
|
|
|
||
|
|
# --- shared ------------------------------------------------------------------------
|
||
|
|
# Already present in /opt/homelab/kb/.env on PIHA — listed here for completeness.
|
||
|
|
# KB_DSN=postgresql://kb:CHANGE-ME@localhost:5433/kb
|
||
|
|
# MAIL_ARCHIVE_ROOT=/home/oskar/kb/mail/archive
|
||
|
|
# KB_MAIL_SYNC_PROM_PATH=/opt/homelab/state/node-exporter/kb-mail-sync.prom
|