1 files changed, 47 insertions, 0 deletions
diff --git a/packaging/conf/hub.toml.example b/packaging/conf/hub.toml.example
index 7f5ac8f..2687a87 100644
--- a/packaging/conf/hub.toml.example
+++ b/packaging/conf/hub.toml.example
@@ -81,3 +81,50 @@ allowed_hosts = []
 # restriction for those clients. Leave it off unless you ship the desktop
 # client. See docs/captcha.md §6.
 allow_unattributed_host = false
+
+
+[mail]
+# What this hub will send, and how much of it. These are the **defaults**: an
+# administrator changes them from the Settings panel, and what they set is
+# stored in the database. A value here is what a missing setting falls back
+# to, so an instance that never touches the panel behaves as this file says.
+#
+# Why the bounds exist at all: the hub reaches its local Postfix with no
+# authentication, and three API paths reach the hub — two of them at an
+# address the caller types. Unbounded, that is an open relay wearing this
+# instance's reputation.
+
+# Everything this instance sends, in one hour. The one bound registration
+# being open cannot buy past: per-account and per-IP limits bound a caller,
+# and a caller is something an attacker makes more of.
+hourly_budget = 200
+
+# Of that budget, the share kept back for the two messages a person is
+# actively waiting on — a passphrase reset and a group invitation. Without it
+# a flood of sign-ups spends the hour and locks out the people who need a
+# message to arrive. Sign-ups and address changes may spend
+# `hourly_budget - hourly_reserved_for_recovery`.
+hourly_reserved_for_recovery = 50
+
+# Per recipient, across every purpose, account and endpoint. This is the bound
+# that describes what a person being flooded actually receives, and the only
+# one that does.
+destination_daily_cap = 10
+destination_cooldown_seconds = 120
+
+# Between two sign-up codes to one pending account. Reaching this branch needs
+# no token and no captcha — the caller chose the username and address a moment
+# earlier — so it is the widest of the three doors and wants its own delay.
+verification_resend_cooldown = 120
+
+# Between two passphrase-reset codes for one account, whoever asks. The code
+# itself lives an hour, so this stays far below its lifetime: someone who did
+# not receive the first waits, rather than being unable to use the second.
+reset_cooldown = 300
+
+# Before an account may propose a *different* address. Long, because this is
+# the only path where a signed-in account chooses who receives a message.
+# Asking again for the address already pending is exempt — it reaches no new
+# recipient, and without the exemption a typo would lock the account out of
+# correcting it for two days.
+email_change_cooldown = 172800   # 48 hours