simplelogin-aio.xml

<?xml version="1.0"?>
<Container version="2">
  <Name>simplelogin-aio</Name>
  <Repository>jsonbored/simplelogin-aio:latest</Repository>
  <Registry>https://hub.docker.com/r/jsonbored/simplelogin-aio</Registry>
  <Network>bridge</Network>
  <MyIP/>
  <Shell>sh</Shell>
  <Privileged>false</Privileged>
  <Support>https://github.com/JSONbored/simplelogin-aio/issues</Support>
  <Project>https://github.com/JSONbored/simplelogin-aio</Project>
  <Overview>SimpleLogin is an open-source email alias platform that lets you shield your real inbox behind forwarding aliases.&#xD;
&#xD;
[b]All-In-One Unraid Edition[/b]&#xD;
`simplelogin-aio` packages the web UI, background jobs, inbound email handler, Postfix, PostgreSQL, and Redis into one Unraid-first container with persistent appdata paths.&#xD;
&#xD;
[b]Quick Install (Beginners)[/b]&#xD;
1. Install this template in Unraid.&#xD;
2. Set [code]URL[/code], [code]EMAIL_DOMAIN[/code], [code]SUPPORT_EMAIL[/code], and [code]FLASK_SECRET[/code].&#xD;
3. Registration is disabled by default for safety. Temporarily set [code]DISABLE_REGISTRATION[/code] to [code]false[/code] only if you need web sign-up for first boot, then switch it back to [code]true[/code] and restart.&#xD;
4. Choose an outbound relay mode if your ISP blocks outbound TCP 25.&#xD;
5. Forward inbound TCP 25 from your router/firewall to the Unraid host if you want internet mail delivery.&#xD;
6. Start the container, wait for first boot to finish, then add the required DNS records from the setup guide.&#xD;
&#xD;
[b]Power Users (Advanced View)[/b]&#xD;
- Advanced View exposes the full official upstream self-hosting environment surface plus wrapper-specific relay and AIO controls.&#xD;
- Leave defaults in place for the easiest install. Only set overrides you actually need.&#xD;
- You can point the app at external PostgreSQL or Redis, customize alias domain behavior, enable SSO providers, tune anti-spam and analytics integrations, and provide custom asset/key files through the optional [code]/custom-assets[/code] mount.&#xD;
&#xD;
[b]Important Notes[/b]&#xD;
- Current upstream packaging is [code]linux/amd64[/code] only.&#xD;
- This is still a real self-hosted mail stack. DNS, deliverability, router/firewall port forwarding, and sender reputation still matter.&#xD;
- For the simplest operation, keep the internal Postgres/Redis/Postfix defaults and only set the small required config set above.</Overview>
  <Changes>### 2026-06-18&#xD;
- Generated from CHANGELOG.md during release preparation. Do not edit manually.&#xD;
- Bump simplelogin to v4.81.4</Changes>
  <Category>Network:Privacy Network:Web Tools:Utilities</Category>
  <WebUI>http://[IP]:[PORT:7777]</WebUI>
  <TemplateURL>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/simplelogin-aio.xml</TemplateURL>
  <ReadMe>https://github.com/JSONbored/simplelogin-aio#readme</ReadMe>
  <Icon>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/icons/simplelogin.jpeg</Icon>
  <ExtraSearchTerms>email alias privacy forwarding self-hosted proton mail postfix smtp dkim</ExtraSearchTerms>
  <Requires>**For full inbound mail delivery:** a public domain, correct DNS records, and inbound TCP 25 forwarded to your Unraid host. If outbound TCP 25 is blocked, use an SMTP relay mode instead of direct delivery.</Requires>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/simplelogin-aio/01-login.png</Screenshot>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/simplelogin-aio/02-dashboard.png</Screenshot>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/simplelogin-aio/03-settings.png</Screenshot>
  <ExtraParams/>
  <PostArgs/>
  <CPUset/>
  <DateInstalled/>
  <DonateText>Support JSONbored on GitHub Sponsors.</DonateText>
  <DonateLink>https://github.com/sponsors/JSONbored</DonateLink>
  <Description/>

  <Networking>
    <Mode>bridge</Mode>
    <Publish>
      <Port>
        <HostPort>7777</HostPort>
        <ContainerPort>7777</ContainerPort>
        <Protocol>tcp</Protocol>
      </Port>
      <Port>
        <HostPort>25</HostPort>
        <ContainerPort>25</ContainerPort>
        <Protocol>tcp</Protocol>
      </Port>
    </Publish>
  </Networking>

  <!-- Core volumes -->
  <Config Name="Appdata Directory" Target="/appdata" Default="/mnt/user/appdata/simplelogin-aio" Mode="rw" Description="Primary persistent directory for PostgreSQL, Redis, DKIM keys, uploads, generated JWT keys, and application state." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/simplelogin-aio</Config>
  <Config Name="PGP Keyring Directory" Target="/pgp" Default="/mnt/user/appdata/simplelogin-aio/pgp" Mode="rw" Description="Persistent directory for your GnuPG keyring and optional server-generated PGP signing keys." Type="Path" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Custom Assets Directory" Target="/custom-assets" Default="" Mode="rw" Description="Optional host path mounted at /custom-assets for advanced file-based settings such as custom words lists, OpenID keys, Paddle public keys, or imported PGP material." Type="Path" Display="advanced" Required="false" Mask="false"/>

  <!-- Core ports -->
  <Config Name="Web UI Port" Target="7777" Default="7777" Mode="tcp" Description="Port used by the SimpleLogin web UI." Type="Port" Display="always" Required="true" Mask="false">7777</Config>
  <Config Name="SMTP Inbound Port" Target="25" Default="25" Mode="tcp" Description="Inbound SMTP port. Forward TCP 25 from your router or firewall to the Unraid host if you want aliases to receive internet mail." Type="Port" Display="always" Required="true" Mask="false">25</Config>

  <!-- Core required -->
  <Config Name="App URL" Target="URL" Default="https://app.example.com" Mode="" Description="Canonical HTTPS URL for the dashboard, for example https://app.example.com. This does not need to be the same as your SMTP/MX hostname." Type="Variable" Display="always" Required="true" Mask="false"/>
  <Config Name="Primary Email Domain" Target="EMAIL_DOMAIN" Default="example.com" Mode="" Description="Real public alias domain, for example example.com. Do not use a private-only tailnet domain here. First-account registration must use a separate existing mailbox, not this alias domain." Type="Variable" Display="always" Required="true" Mask="false"/>
  <Config Name="Support Email" Target="SUPPORT_EMAIL" Default="support@example.com" Mode="" Description="Working mailbox used for system mail, for example support@example.com. Use an address that already exists." Type="Variable" Display="always" Required="true" Mask="false"/>
  <Config Name="Flask Secret" Target="FLASK_SECRET" Default="" Mode="" Description="Long random app secret. Generate with: openssl rand -hex 32" Type="Variable" Display="always" Required="true" Mask="true"/>
  <Config Name="SMTP Relay Mode" Target="RELAY_MODE" Default="direct|brevo|protonmail|gmail|mailgun|custom" Mode="" Description="Outbound mail mode. Choose one of the built-in dropdown values only: direct, brevo, protonmail, gmail, mailgun, or custom. Use a relay provider if your ISP blocks outbound TCP 25." Type="Variable" Display="always" Required="true" Mask="false">direct</Config>

  <!-- Relay credentials -->
  <Config Name="Brevo Username" Target="BREVO_USERNAME" Default="" Mode="" Description="Brevo SMTP username, usually your account email. Required when RELAY_MODE=brevo." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Brevo Password" Target="BREVO_PASSWORD" Default="" Mode="" Description="Brevo SMTP key or password. Required when RELAY_MODE=brevo." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Proton Mail SMTP Token" Target="PROTONMAIL_TOKEN" Default="" Mode="" Description="Proton SMTP token. Required when RELAY_MODE=protonmail. The username stays SUPPORT_EMAIL." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Gmail Username" Target="GMAIL_USERNAME" Default="" Mode="" Description="Full Gmail address used for relay auth. Required when RELAY_MODE=gmail." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Gmail App Password" Target="GMAIL_APP_PASSWORD" Default="" Mode="" Description="16-character Gmail app password. Required when RELAY_MODE=gmail." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Mailgun Username" Target="MAILGUN_USERNAME" Default="" Mode="" Description="Mailgun SMTP username, usually postmaster@yourdomain. Required when RELAY_MODE=mailgun." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Mailgun Password" Target="MAILGUN_PASSWORD" Default="" Mode="" Description="Mailgun SMTP password. Required when RELAY_MODE=mailgun." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Custom Relay Host" Target="CUSTOM_RELAYHOST" Default="" Mode="" Description="Required when RELAY_MODE=custom. Example: [smtp.provider.com]:587" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Custom Relay Username" Target="CUSTOM_USERNAME" Default="" Mode="" Description="SMTP username for your custom relay. Required when RELAY_MODE=custom." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Custom Relay Password" Target="CUSTOM_PASSWORD" Default="" Mode="" Description="SMTP password for your custom relay. Required when RELAY_MODE=custom." Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- AIO core overrides -->
  <Config Name="External PostgreSQL DB_URI" Target="DB_URI" Default="" Mode="" Description="Leave blank for the bundled database. When set to an external host, the bundled PostgreSQL stays idle. Format: postgresql://user:pass@host:5432/dbname" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="External Redis URL" Target="REDIS_URL" Default="" Mode="" Description="Leave blank for the bundled Redis. When set to an external host, the bundled Redis stays idle. Format: redis://:pass@host:6379/0" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Postfix Server Override" Target="POSTFIX_SERVER" Default="127.0.0.1" Mode="" Description="Advanced escape hatch. Leave at 127.0.0.1 to keep the bundled Postfix path." Type="Variable" Display="advanced" Required="false" Mask="false">127.0.0.1</Config>
  <Config Name="Postfix Port Override" Target="POSTFIX_PORT" Default="25" Mode="" Description="Advanced escape hatch. Leave at 25 for the bundled Postfix path." Type="Variable" Display="advanced" Required="false" Mask="false">25</Config>
  <Config Name="DNS Nameservers" Target="NAMESERVERS" Default="1.1.1.1,1.0.0.1" Mode="" Description="Comma-separated resolvers used for lookups, for example 1.1.1.1,1.0.0.1." Type="Variable" Display="advanced" Required="false" Mask="false">1.1.1.1,1.0.0.1</Config>
  <Config Name="Custom Temp Directory" Target="TEMP_DIR" Default="" Mode="" Description="Optional temp directory path inside the container or a mounted path." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Words File Path" Target="WORDS_FILE_PATH" Default="/code/local_data/test_words.txt" Mode="" Description="Advanced path override for the words file used for random alias generation. Use /custom-assets if you mount your own file." Type="Variable" Display="advanced" Required="false" Mask="false">/code/local_data/test_words.txt</Config>
  <Config Name="Local File Uploads" Target="LOCAL_FILE_UPLOAD" Default="true|false" Mode="" Description="Leave true for local file storage inside /appdata." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="GnuPG Home" Target="GNUPGHOME" Default="/pgp" Mode="" Description="GnuPG home directory path used for PGP features." Type="Variable" Display="advanced" Required="false" Mask="false">/pgp</Config>
  <Config Name="Partner API Token Secret" Target="PARTNER_API_TOKEN_SECRET" Default="" Mode="" Description="Optional partner token secret. Generate with: openssl rand -hex 32. Blank uses FLASK_SECRET." Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- Security and registration -->
  <Config Name="Disable Registration" Target="DISABLE_REGISTRATION" Default="true|false" Mode="" Description="Recommended default. Keep true to block public sign-up. Temporarily switch to false only while creating a first account, then set true again and restart." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="Disable Onboarding Emails" Target="DISABLE_ONBOARDING" Default="true|false" Mode="" Description="Recommended for self-hosted installs." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="Disable Alias Suffix" Target="DISABLE_ALIAS_SUFFIX" Default="true|false" Mode="" Description="Recommended for self-hosted installs to allow cleaner aliases without the random suffix." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="Enable SPF Enforcement" Target="ENFORCE_SPF" Default="true|false" Mode="" Description="Enable SPF enforcement using the extra headers provided by Postfix." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="Print Emails Instead of Sending" Target="NOT_SEND_EMAIL" Default="false|true" Mode="" Description="For testing only. When true, email bodies are logged instead of sent." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Enable Colored Logs" Target="COLOR_LOG" Default="" Mode="" Description="Optional colored log output for debugging." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Admin Email" Target="ADMIN_EMAIL" Default="" Mode="" Description="General stats and admin alert email recipient. This is not a login credential." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Support Name" Target="SUPPORT_NAME" Default="" Mode="" Description="Display name used alongside SUPPORT_EMAIL." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Postmaster Address" Target="POSTMASTER" Default="" Mode="" Description="Postmaster email used by some mail-related features." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Max Free Plan Email Count" Target="MAX_NB_EMAIL_FREE_PLAN" Default="10" Mode="" Description="Max number of emails a non-premium user can generate." Type="Variable" Display="advanced" Required="false" Mask="false">10</Config>
  <Config Name="Alias Rate Limit" Target="ALIAS_LIMIT" Default="" Mode="" Description="Alias creation rate limit. Example: 100/day;50/hour;5/minute" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Automatically Disable Aliases" Target="ALIAS_AUTOMATIC_DISABLE" Default="" Mode="" Description="Optional automatic alias disable behavior." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Allowed Redirect Domains" Target="ALLOWED_REDIRECT_DOMAINS" Default="" Mode="" Description="JSON list of allowed redirect domains. Example: [&quot;app.example.com&quot;]" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Landing Page URL" Target="LANDING_PAGE_URL" Default="" Mode="" Description="Optional landing page URL shown by the app." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Status Page URL" Target="STATUS_PAGE_URL" Default="" Mode="" Description="Optional status page URL shown by the app." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="hCaptcha Secret" Target="HCAPTCHA_SECRET" Default="" Mode="" Description="hCaptcha secret key from your hCaptcha site. Set both hCaptcha fields to enable." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="hCaptcha Site Key" Target="HCAPTCHA_SITEKEY" Default="" Mode="" Description="hCaptcha site key from your hCaptcha site. Set both hCaptcha fields to enable." Type="Variable" Display="advanced" Required="false" Mask="false"/>

  <!-- Alias domains and routing -->
  <Config Name="Email Servers With Priority" Target="EMAIL_SERVERS_WITH_PRIORITY" Default="" Mode="" Description="Leave blank to auto-use mail.EMAIL_DOMAIN. Set this only if your MX host should be something else, for example [(10, &quot;mx.example.com.&quot;)]." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Other Alias Domains" Target="OTHER_ALIAS_DOMAINS" Default="" Mode="" Description="JSON list of extra alias domains. Example: [&quot;example.net&quot;,&quot;example.org&quot;]" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Domains Override" Target="ALIAS_DOMAINS" Default="" Mode="" Description="Full alias-domain override as a JSON list. If set, it replaces OTHER_ALIAS_DOMAINS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Premium Alias Domains" Target="PREMIUM_ALIAS_DOMAINS" Default="" Mode="" Description="JSON list of premium-only domains. Example: [&quot;vip.example.com&quot;]" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="First Alias Domain" Target="FIRST_ALIAS_DOMAIN" Default="" Mode="" Description="Alias domain used when creating the first alias." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Bounce Prefix" Target="BOUNCE_PREFIX" Default="" Mode="" Description="VERP bounce prefix. Must end with + if used." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Bounce Suffix" Target="BOUNCE_SUFFIX" Default="" Mode="" Description="VERP bounce suffix. Must start with + if used." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Bounce Prefix For Reply Phase" Target="BOUNCE_PREFIX_FOR_REPLY_PHASE" Default="" Mode="" Description="Reply-phase bounce prefix without a trailing +." Type="Variable" Display="advanced" Required="false" Mask="false"/>

  <!-- Social and SSO auth -->
  <Config Name="GitHub Client ID" Target="GITHUB_CLIENT_ID" Default="" Mode="" Description="GitHub OAuth app client ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="GitHub Client Secret" Target="GITHUB_CLIENT_SECRET" Default="" Mode="" Description="GitHub OAuth app client secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Google Client ID" Target="GOOGLE_CLIENT_ID" Default="" Mode="" Description="Google OAuth client ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Google Client Secret" Target="GOOGLE_CLIENT_SECRET" Default="" Mode="" Description="Google OAuth client secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Facebook Client ID" Target="FACEBOOK_CLIENT_ID" Default="" Mode="" Description="Facebook OAuth client ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Facebook Client Secret" Target="FACEBOOK_CLIENT_SECRET" Default="" Mode="" Description="Facebook OAuth client secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Proton Client ID" Target="PROTON_CLIENT_ID" Default="" Mode="" Description="Proton OAuth client ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Client Secret" Target="PROTON_CLIENT_SECRET" Default="" Mode="" Description="Proton OAuth client secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Proton Base URL" Target="PROTON_BASE_URL" Default="" Mode="" Description="Proton API base URL override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Validate Certs" Target="PROTON_VALIDATE_CERTS" Default="true|false" Mode="" Description="Certificate verification for Proton integration." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="Connect With Proton" Target="CONNECT_WITH_PROTON" Default="" Mode="" Description="Enable Proton login integration." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Cookie Name" Target="CONNECT_WITH_PROTON_COOKIE_NAME" Default="" Mode="" Description="Cookie name for Proton login integration." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="OIDC Icon" Target="CONNECT_WITH_OIDC_ICON" Default="" Mode="" Description="Font Awesome icon slug for generic OIDC login button." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="OIDC Discovery URL" Target="OIDC_WELL_KNOWN_URL" Default="" Mode="" Description="OIDC discovery URL, usually ending in /.well-known/openid-configuration." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="OIDC Scopes" Target="OIDC_SCOPES" Default="openid email profile" Mode="" Description="Space-separated OIDC scopes. Default works for most providers." Type="Variable" Display="advanced" Required="false" Mask="false">openid email profile</Config>
  <Config Name="OIDC Name Field" Target="OIDC_NAME_FIELD" Default="name" Mode="" Description="OIDC user-info field used for display name." Type="Variable" Display="advanced" Required="false" Mask="false">name</Config>
  <Config Name="OIDC Client ID" Target="OIDC_CLIENT_ID" Default="" Mode="" Description="OIDC client ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="OIDC Client Secret" Target="OIDC_CLIENT_SECRET" Default="" Mode="" Description="OIDC client secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- OpenID provider / JWT -->
  <Config Name="Enable SimpleLogin OIDC Provider" Target="ENABLE_OIDC_SERVER" Default="0|1" Mode="" Description="Set to 1 to enable SimpleLogin as an OpenID provider." Type="Variable" Display="advanced" Required="false" Mask="false">0</Config>
  <Config Name="OpenID Private Key Path" Target="OPENID_PRIVATE_KEY_PATH" Default="" Mode="" Description="Optional OpenID private key path. Blank auto-generates when ENABLE_OIDC_SERVER=1." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="OpenID Public Key Path" Target="OPENID_PUBLIC_KEY_PATH" Default="" Mode="" Description="Optional OpenID public key path matching the private key above." Type="Variable" Display="advanced" Required="false" Mask="false"/>

  <!-- Apple -->
  <Config Name="Apple API Secret" Target="APPLE_API_SECRET" Default="" Mode="" Description="Apple sign-in API secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Mac App Apple API Secret" Target="MACAPP_APPLE_API_SECRET" Default="" Mode="" Description="Apple sign-in secret for the native Mac app." Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- Telemetry -->
  <Config Name="Sentry DSN" Target="SENTRY_DSN" Default="" Mode="" Description="Sentry DSN for backend error tracking." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Sentry Front-End DSN" Target="SENTRY_FRONT_END_DSN" Default="" Mode="" Description="Optional separate Sentry DSN for front-end error tracking." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Plausible Host" Target="PLAUSIBLE_HOST" Default="" Mode="" Description="Plausible Analytics host." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Plausible Domain" Target="PLAUSIBLE_DOMAIN" Default="" Mode="" Description="Plausible tracked domain." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Flask Profiler Path" Target="FLASK_PROFILER_PATH" Default="" Mode="" Description="Optional Flask profiler sqlite path." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Flask Profiler Password" Target="FLASK_PROFILER_PASSWORD" Default="" Mode="" Description="Optional Flask profiler password." Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- Anti-spam and breach checks -->
  <Config Name="Enable SpamAssassin" Target="ENABLE_SPAM_ASSASSIN" Default="0|1" Mode="" Description="Set to 1 to enable SpamAssassin integration." Type="Variable" Display="advanced" Required="false" Mask="false">0</Config>
  <Config Name="SpamAssassin Host" Target="SPAMASSASSIN_HOST" Default="" Mode="" Description="SpamAssassin server host or IP." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="HIBP Scan Interval Days" Target="HIBP_SCAN_INTERVAL_DAYS" Default="7" Mode="" Description="How often to check Have I Been Pwned data." Type="Variable" Display="advanced" Required="false" Mask="false">7</Config>
  <Config Name="HIBP API Keys" Target="HIBP_API_KEYS" Default="" Mode="" Description="JSON list of HIBP API keys. Example: [&quot;key1&quot;,&quot;key2&quot;]" Type="Variable" Display="advanced" Required="false" Mask="true"/>

  <!-- PGP and DKIM -->
  <Config Name="Auto-Generate PGP Server Key" Target="AUTO_GENERATE_PGP" Default="0|1" Mode="" Description="Set to 1 to auto-generate a PGP server key pair." Type="Variable" Display="advanced" Required="false" Mask="false">0</Config>
  <Config Name="PGP Sender Private Key Path" Target="PGP_SENDER_PRIVATE_KEY_PATH" Default="" Mode="" Description="Optional path to a private PGP key used to sign forwarding emails. Use /custom-assets or /pgp if you provide your own key." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="DKIM Private Key Path" Target="DKIM_PRIVATE_KEY_PATH" Default="/dkim.key" Mode="" Description="Advanced DKIM private key path override. Leave at /dkim.key for the wrapper-managed default." Type="Variable" Display="advanced" Required="false" Mask="false">/dkim.key</Config>

  <!-- AWS / storage / billing -->
  <Config Name="S3 Bucket" Target="BUCKET" Default="" Mode="" Description="Bucket name used by upstream S3-backed features." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="AWS Access Key ID" Target="AWS_ACCESS_KEY_ID" Default="" Mode="" Description="AWS or S3-compatible access key ID." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="AWS Secret Access Key" Target="AWS_SECRET_ACCESS_KEY" Default="" Mode="" Description="AWS or S3-compatible secret access key." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="AWS Region" Target="AWS_REGION" Default="" Mode="" Description="AWS region." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Vendor ID" Target="PADDLE_VENDOR_ID" Default="" Mode="" Description="Paddle vendor ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Monthly Product ID" Target="PADDLE_MONTHLY_PRODUCT_ID" Default="" Mode="" Description="Paddle monthly product ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Yearly Product ID" Target="PADDLE_YEARLY_PRODUCT_ID" Default="" Mode="" Description="Paddle yearly product ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Public Key Path" Target="PADDLE_PUBLIC_KEY_PATH" Default="" Mode="" Description="Path to your Paddle public key file, for example /custom-assets/paddle_public.pem." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Auth Code" Target="PADDLE_AUTH_CODE" Default="" Mode="" Description="Paddle auth code." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Coinbase Webhook Secret" Target="COINBASE_WEBHOOK_SECRET" Default="" Mode="" Description="Coinbase webhook secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Coinbase Checkout ID" Target="COINBASE_CHECKOUT_ID" Default="" Mode="" Description="Coinbase checkout ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Coinbase API Key" Target="COINBASE_API_KEY" Default="" Mode="" Description="Coinbase API key." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Coinbase Yearly Price" Target="COINBASE_YEARLY_PRICE" Default="" Mode="" Description="Coinbase yearly price value." Type="Variable" Display="advanced" Required="false" Mask="false"/>

  <!-- Expert upstream deployment knobs -->
  <Config Name="Custom Config File Path" Target="CONFIG" Default="" Mode="" Description="Expert-only alternate dotenv file path. Usually leave blank and use the template fields instead." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Monitoring Email" Target="MONITORING_EMAIL" Default="" Mode="" Description="Optional monitoring report email recipient." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Unsubscriber Address" Target="UNSUBSCRIBER" Default="" Mode="" Description="Optional address that receives unsubscribe requests." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Legacy Unsubscriber Address" Target="OLD_UNSUBSCRIBER" Default="" Mode="" Description="Legacy alias for unsubscribe routing." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Users With HTTP Unsubscribe" Target="USERS_WITH_HTTP_UNSUBSCRIBE" Default="" Mode="" Description="Comma-separated users allowed to use HTTP unsubscribe." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Legacy Free Plan Alias Limit" Target="MAX_NB_EMAIL_OLD_FREE_PLAN" Default="" Mode="" Description="Legacy free-plan alias cap used for old accounts." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="DB Connection Name" Target="DB_CONN_NAME" Default="" Mode="" Description="Optional PostgreSQL application_name override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="AWS Endpoint URL" Target="AWS_ENDPOINT_URL" Default="" Mode="" Description="Optional custom S3-compatible endpoint URL." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Monthly Product IDs" Target="PADDLE_MONTHLY_PRODUCT_IDS" Default="" Mode="" Description="JSON list of extra Paddle monthly product IDs. Example: [12345,67890]" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Yearly Product IDs" Target="PADDLE_YEARLY_PRODUCT_IDS" Default="" Mode="" Description="JSON list of extra Paddle yearly product IDs. Example: [12345,67890]" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Paddle Coupon ID" Target="PADDLE_COUPON_ID" Default="" Mode="" Description="Optional Paddle coupon product ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Extra Header Name" Target="PROTON_EXTRA_HEADER_NAME" Default="" Mode="" Description="Optional Proton integration header name override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Extra Header Value" Target="PROTON_EXTRA_HEADER_VALUE" Default="" Mode="" Description="Optional Proton integration header value." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Prevent Linked Proton Change" Target="PROTON_PREVENT_CHANGE_LINKED_ACCOUNT" Default="false|true" Mode="" Description="Presence-based upstream flag. Set true to prevent linked Proton account changes." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Sentry Trace Rate" Target="SENTRY_TRACE_RATE" Default="" Mode="" Description="Optional Sentry trace sample rate. Example: 0.001" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Postfix Backup Servers" Target="POSTFIX_BACKUP_SERVERS" Default="" Mode="" Description="Comma-separated backup outbound SMTP servers." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Postfix Submission TLS" Target="POSTFIX_SUBMISSION_TLS" Default="false|true" Mode="" Description="Presence-based upstream flag. Set true to use Postfix submission with TLS on port 587." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Postfix Timeout" Target="POSTFIX_TIMEOUT" Default="" Mode="" Description="Postfix send timeout in seconds." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Postfix Connect Timeout" Target="POSTFIX_CONNECT_TIMEOUT" Default="" Mode="" Description="Postfix connect timeout in seconds." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton MX Servers" Target="PROTON_MX_SERVERS" Default="" Mode="" Description="Comma-separated Proton MX servers." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Proton Email Domains" Target="PROTON_EMAIL_DOMAINS" Default="" Mode="" Description="Comma-separated Proton email domains." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Load PGP In Email Handler" Target="LOAD_PGP_EMAIL_HANDLER" Default="false|true" Mode="" Description="Presence-based upstream flag for niche local PGP loading behavior." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Apple Webhook Secret Check" Target="APPLE_WEBHOOK_SECRET_CHECK_ENABLED" Default="false|true" Mode="" Description="Presence-based upstream flag to validate Apple webhook shared secret." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Max Spam Score" Target="MAX_SPAM_SCORE" Default="" Mode="" Description="SpamAssassin spam score threshold for forwarded mail." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Max Reply Spam Score" Target="MAX_REPLY_PHASE_SPAM_SCORE" Default="" Mode="" Description="SpamAssassin spam score threshold for reply-phase mail." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="PGP Signer Address" Target="PGP_SIGNER" Default="" Mode="" Description="Optional signer address used for outgoing encrypted email." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="No Reply Address" Target="NOREPLY" Default="" Mode="" Description="Formatted no-reply address override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Partner No Reply Address" Target="PARTNER_NOREPLY" Default="" Mode="" Description="Formatted partner no-reply address override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="HIBP API RPM" Target="HIBP_API_RPM" Default="" Mode="" Description="Have I Been Pwned requests-per-minute limit." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Skip HIBP For Partner Aliases" Target="HIBP_SKIP_PARTNER_ALIAS" Default="" Mode="" Description="Optional HIBP behavior override for partner aliases." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Save Unsent Directory" Target="SAVE_UNSENT_DIR" Default="" Mode="" Description="Optional directory where unsent emails are stored." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Rspamd Signs DKIM" Target="RSPAMD_SIGN_DKIM" Default="false|true" Mode="" Description="Presence-based upstream flag indicating DKIM signing is handled by Rspamd." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Twilio Auth Token" Target="TWILIO_AUTH_TOKEN" Default="" Mode="" Description="Optional Twilio auth token for phone-related integrations." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Phone Provider 1 Secret" Target="PHONE_PROVIDER_1_SECRET" Default="" Mode="" Description="Optional phone provider secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Phone Provider 2 Header" Target="PHONE_PROVIDER_2_HEADER" Default="" Mode="" Description="Optional phone provider header name." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Phone Provider 2 Secret" Target="PHONE_PROVIDER_2_SECRET" Default="" Mode="" Description="Optional phone provider secret." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Zendesk Host" Target="ZENDESK_HOST" Default="" Mode="" Description="Optional Zendesk host for support integrations." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Zendesk API Token" Target="ZENDESK_API_TOKEN" Default="" Mode="" Description="Optional Zendesk API token." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Zendesk Enabled" Target="ZENDESK_ENABLED" Default="false|true" Mode="" Description="Presence-based upstream flag to enable Zendesk integration." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="DMARC Check Enabled" Target="DMARC_CHECK_ENABLED" Default="false|true" Mode="" Description="Presence-based upstream flag to enable DMARC checks." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="VERP Prefix" Target="VERP_PREFIX" Default="" Mode="" Description="VERP prefix override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="VERP Email Secret" Target="VERP_EMAIL_SECRET" Default="" Mode="" Description="Custom VERP secret. Generate with: openssl rand -hex 32. Must be at least 32 chars." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Transactional Bounce Prefix" Target="TRANSACTIONAL_BOUNCE_PREFIX" Default="" Mode="" Description="Optional transactional bounce prefix." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Transactional Bounce Suffix" Target="TRANSACTIONAL_BOUNCE_SUFFIX" Default="" Mode="" Description="Optional transactional bounce suffix." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Transfer Token Secret" Target="ALIAS_TRANSFER_TOKEN_SECRET" Default="" Mode="" Description="Alias transfer token secret. Generate with: openssl rand -hex 32" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Disable Create Contacts For Free Users" Target="DISABLE_CREATE_CONTACTS_FOR_FREE_USERS" Default="" Mode="" Description="Optional upstream behavior override for free-user contact creation." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Random Suffix Length" Target="ALIAS_RAND_SUFFIX_LENGTH" Default="" Mode="" Description="Length of generated alias random suffix." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Event Webhook URL" Target="EVENT_WEBHOOK" Default="" Mode="" Description="Optional event webhook destination URL." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Event Webhook Skip Verify SSL" Target="EVENT_WEBHOOK_SKIP_VERIFY_SSL" Default="false|true" Mode="" Description="Presence-based upstream flag to skip SSL verification for the event webhook." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Event Webhook Disabled" Target="EVENT_WEBHOOK_DISABLE" Default="false|true" Mode="" Description="Presence-based upstream flag to disable event webhooks." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Event Webhook Enabled User IDs" Target="EVENT_WEBHOOK_ENABLED_USER_IDS" Default="" Mode="" Description="Comma-separated user IDs allowed to emit event webhooks." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Event Listener DB URI" Target="EVENT_LISTENER_DB_URI" Default="" Mode="" Description="Optional dedicated DB URI for the event listener." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Max API Keys" Target="MAX_API_KEYS" Default="" Mode="" Description="Maximum number of API keys per user." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Memory Store URI" Target="MEM_STORE_URI" Default="" Mode="" Description="Optional memory store URI override." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Recovery Code HMAC Secret" Target="RECOVERY_CODE_HMAC_SECRET" Default="" Mode="" Description="Recovery-code HMAC secret. Generate with: openssl rand -hex 32. Must be at least 16 chars." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Min Rspamd Score For Failed DMARC" Target="MIN_RSPAMD_SCORE_FOR_FAILED_DMARC" Default="" Mode="" Description="Rspamd score threshold for quarantining DMARC-failed email." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Enable All Reverse Alias Replacement" Target="ENABLE_ALL_REVERSE_ALIAS_REPLACEMENT" Default="false|true" Mode="" Description="Presence-based upstream flag to replace all reverse aliases." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Max Reverse Alias Replacements" Target="MAX_NB_REVERSE_ALIAS_REPLACEMENT" Default="" Mode="" Description="Maximum reverse aliases replaced when the related feature is enabled." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Disable Rate Limit" Target="DISABLE_RATE_LIMIT" Default="false|true" Mode="" Description="Presence-based upstream flag to disable rate limiting." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="Alias Create Rate Limit Free" Target="ALIAS_CREATE_RATE_LIMIT_FREE" Default="" Mode="" Description="Free-user alias create rate limits in hits,seconds:hits,seconds format." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Create Rate Limit Paid" Target="ALIAS_CREATE_RATE_LIMIT_PAID" Default="" Mode="" Description="Paid-user alias create rate limits in hits,seconds:hits,seconds format." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Restore One Rate Limit" Target="ALIAS_RESTORE_ONE_RATE_LIMIT" Default="" Mode="" Description="Single-alias restore rate limits in hits,seconds:hits,seconds format." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Restore All Rate Limit" Target="ALIAS_RESTORE_ALL_RATE_LIMIT" Default="" Mode="" Description="Bulk alias restore rate limits in hits,seconds:hits,seconds format." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Max Bounces Per Day" Target="MAX_BOUNCES_1D" Default="" Mode="" Description="Maximum daily bounces before automatic handling triggers." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Max Bounces Per Week" Target="MAX_BOUNCES_1W" Default="" Mode="" Description="Maximum weekly bounces before automatic handling triggers." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Partner DNS Custom Domains" Target="PARTNER_DNS_CUSTOM_DOMAINS" Default="" Mode="" Description="Expert partner mapping in key=value;key=value format. Example: a.com=x.com;b.com=y.com" Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Partner Domain Validation Prefixes" Target="PARTNER_CUSTOM_DOMAIN_VALIDATION_PREFIXES" Default="" Mode="" Description="Expert validation prefixes in key=value;key=value format." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Mailbox Verification Override Code" Target="MAILBOX_VERIFICATION_OVERRIDE_CODE" Default="" Mode="" Description="Optional mailbox verification override code for controlled environments." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Audit Log Max Days" Target="AUDIT_LOG_MAX_DAYS" Default="" Mode="" Description="Maximum audit log retention in days." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Alias Trash Days" Target="ALIAS_TRASH_DAYS" Default="" Mode="" Description="Days before trashed aliases are purged." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Allowed OAuth Schemes" Target="ALLOWED_OAUTH_SCHEMES" Default="" Mode="" Description="Comma-separated allowed OAuth callback schemes." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Max Email Forward Recipients" Target="MAX_EMAIL_FORWARD_RECIPIENTS" Default="" Mode="" Description="Maximum forward recipients per email." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Master Encryption Key Hex" Target="MASTER_ENC_KEY_HEX" Default="" Mode="" Description="Hex-encoded master encryption key. Generate with: openssl rand -hex 32" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="MAC Key Hex" Target="MAC_KEY_HEX" Default="" Mode="" Description="Hex-encoded MAC key. Generate with: openssl rand -hex 32" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Abuser HKDF Salt" Target="ABUSER_HKDF_SALT" Default="" Mode="" Description="Hex-encoded HKDF salt. Generate with: openssl rand -hex 32" Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="Invalid MX IPs" Target="INVALID_MX_IPS" Default="" Mode="" Description="Comma-separated invalid MX IPs ignored by validation logic." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Use Rust PGP" Target="USE_RUST_PGP" Default="false|true" Mode="" Description="Presence-based upstream flag to use the Rust PGP implementation." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="SMTP Size Limit" Target="SMTP_SIZE_LIMIT" Default="" Mode="" Description="Maximum SMTP message size in bytes." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Partner Support URL" Target="PARTNER_SUPPORT_URL" Default="" Mode="" Description="Optional partner support URL shown by the app." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Admin FIDO Required" Target="ADMIN_FIDO_REQUIRED" Default="none|any|hardware" Mode="" Description="Admin FIDO requirement. Choose one of the built-in dropdown values only: none, any, or hardware. Leave this at none unless you already intend to enforce admin FIDO or security keys." Type="Variable" Display="advanced" Required="false" Mask="false">none</Config>
  <Config Name="Admin Grace Period" Target="ADMIN_GRACE_PERIOD" Default="" Mode="" Description="Admin grace period in seconds before FIDO enforcement." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Drop PGP Key Attachments On Reply" Target="DROP_PGP_KEY_ATTACHMENTS_ON_REPLY" Default="false|true" Mode="" Description="Presence-based upstream flag to drop PGP key attachments on reply." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="UpCloud Username" Target="UPCLOUD_USERNAME" Default="" Mode="" Description="Optional UpCloud username for niche upstream integrations." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="UpCloud Password" Target="UPCLOUD_PASSWORD" Default="" Mode="" Description="Optional UpCloud password for niche upstream integrations." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="UpCloud DB ID" Target="UPCLOUD_DB_ID" Default="" Mode="" Description="Optional UpCloud database ID for niche upstream integrations." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="Store Transactional Emails" Target="STORE_TRANSACTIONAL_EMAILS" Default="false|true" Mode="" Description="Presence-based upstream flag to store transactional emails." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>

</Container>