<?php
// dezky replacement for Z-Push's backend/imap/config.php (applied at image
// build, see Dockerfile). Talks to Stalwart over the internal network —
// plaintext IMAP/submission on the container network is fine, TLS
// terminates at Traefik for the public endpoints.

define('IMAP_SERVER', getenv('IMAP_SERVER') ?: 'stalwart');
define('IMAP_PORT', (int) (getenv('IMAP_PORT') ?: 143));
// Dev talks plain IMAP on the docker network; prod host-Stalwart only
// exposes IMAPS :993, so zpush.yaml sets '/ssl/novalidate-cert' (the cert
// is for mail.dezky.eu, we connect via the cluster service name).
define('IMAP_OPTIONS', getenv('IMAP_OPTIONS') ?: '/notls/norsh');
define('IMAP_AUTOSEEN_ON_DELETE', false);

// Stalwart's auto-created special-use folders. Configured explicitly so
// Z-Push doesn't guess from localized names.
define('IMAP_FOLDER_CONFIGURED', true);
define('IMAP_FOLDER_PREFIX', '');
define('IMAP_FOLDER_PREFIX_IN_INBOX', false);
define('IMAP_FOLDER_INBOX', 'INBOX');
define('IMAP_FOLDER_SENT', 'Sent Items');
define('IMAP_FOLDER_DRAFT', 'Drafts');
define('IMAP_FOLDER_TRASH', 'Deleted Items');
define('IMAP_FOLDER_SPAM', 'Junk Mail');
define('IMAP_FOLDER_ARCHIVE', 'Archive');

define('IMAP_INLINE_FORWARD', true);
define('IMAP_EXCLUDED_FOLDERS', '');
// From-address comes from the authenticated login (full email).
define('IMAP_DEFAULTFROM', '');

// Outgoing mail: authenticated submission to Stalwart as the device's own
// user — the same Basic credentials the EAS client supplied. Prod uses
// implicit TLS (SMTP_SERVER gets an ssl:// prefix, port 465 — host-Stalwart
// has no plain :587); the verify flags are off because this is node-internal
// traffic against a cert issued for the public hostname.
define('IMAP_SMTP_METHOD', 'smtp');
global $imap_smtp_params;
$imap_smtp_params = array(
    'host' => getenv('SMTP_SERVER') ?: (getenv('IMAP_SERVER') ?: 'stalwart'),
    'port' => (int) (getenv('SMTP_PORT') ?: 587),
    'auth' => true,
    'username' => 'imap_username',
    'password' => 'imap_password',
    'verify_peer' => false,
    'verify_peer_name' => false,
    'allow_self_signed' => true,
);