Limits as sentences, with presets for who uses the server

jcoffey-dev commented

2026-09-28 19:53:31 +00:00

Owner

First second-wave item from the settings-reorg spec. Based on main; independent of the other open PRs.

Why: a stock server has no rate limits at all: no inbound or outbound throttles and no queue quotas. One stolen password can send without end.

Guide (from each limits list, with "Guided or manual?" each time): Who uses this server? offers three profiles: me and my family, a company or school, or open to the public. Each gives starting numbers for five rules, shown as sentences with an editable number:

Rule	Family	Org	Public	How
Connections per outside server, port 25	20/min	60/min	300/min	inbound, key remoteIp, `local_port == 25`
Messages per signed-in person	100/h	500/h	100/h	inbound, key authenticatedAs, `!is_empty(authenticated_as)`
Recipients per signed-in person, in total	500/h	2000/h	500/h	inbound, key authenticatedAs; the condition also reads `rcpt`, which makes the server check it at RCPT TO
Deliveries per receiving server	30/min	60/min	120/min	outbound, key mx
Messages waiting per sender	500	2000	500	queue quota, key sender, size cap about 0.5 MB each

The "in total" recipients rule is keyed by account alone. Keying by account + rcpt would count each recipient separately.
Rules the guide writes are named Preset: …. Running it again shows the current values and edits those rules; unticking a rule removes it. Hand-made rules are never touched, and the first step says how many there are.
Going over a limit: incoming gets a temporary refusal, outgoing waits in the queue. Nothing is lost.

Lists: above the incoming, outgoing and quota lists, every rule reads as a sentence ("Each sending IP address: 45 connections a minute."), in the guide's own words for preset rules. An empty list says No limits here yet: nothing is slowed down or refused.

Checked: 7 unit tests for the sentences and the preset bookkeeping (432 total), plus typecheck, lint and build. In Chrome against a local server:

the Org profile with connections changed to 45 wrote exactly the five rules above;
read back over JMAP, the expressions compiled with no config warnings;
all three lists read as sentences;
a second run showed "Now:" values and reported nothing to change.

The numbers are starting points I chose, not measured ones. Worth a look.

English only: about 45 new strings.

First second-wave item from the settings-reorg spec. Based on main; independent of the other open PRs. **Why:** a stock server has no rate limits at all: no inbound or outbound throttles and no queue quotas. One stolen password can send without end. **Guide** (from each limits list, with "Guided or manual?" each time): *Who uses this server?* offers three profiles: me and my family, a company or school, or open to the public. Each gives starting numbers for five rules, shown as sentences with an editable number: | Rule | Family | Org | Public | How | |---|---|---|---|---| | Connections per outside server, port 25 | 20/min | 60/min | 300/min | inbound, key remoteIp, `local_port == 25` | | Messages per signed-in person | 100/h | 500/h | 100/h | inbound, key authenticatedAs, `!is_empty(authenticated_as)` | | Recipients per signed-in person, in total | 500/h | 2000/h | 500/h | inbound, key authenticatedAs; the condition also reads `rcpt`, which makes the server check it at RCPT TO | | Deliveries per receiving server | 30/min | 60/min | 120/min | outbound, key mx | | Messages waiting per sender | 500 | 2000 | 500 | queue quota, key sender, size cap about 0.5 MB each | - The "in total" recipients rule is keyed by account alone. Keying by account + rcpt would count each recipient separately. - Rules the guide writes are named `Preset: …`. Running it again shows the current values and edits those rules; unticking a rule removes it. Hand-made rules are never touched, and the first step says how many there are. - Going over a limit: incoming gets a temporary refusal, outgoing waits in the queue. Nothing is lost. **Lists:** above the incoming, outgoing and quota lists, every rule reads as a sentence ("Each sending IP address: 45 connections a minute."), in the guide's own words for preset rules. An empty list says *No limits here yet: nothing is slowed down or refused*. **Checked:** 7 unit tests for the sentences and the preset bookkeeping (432 total), plus typecheck, lint and build. In Chrome against a local server: - the Org profile with connections changed to 45 wrote exactly the five rules above; - read back over JMAP, the expressions compiled with no config warnings; - all three lists read as sentences; - a second run showed "Now:" values and reported nothing to change. The numbers are starting points I chose, not measured ones. Worth a look. English only: about 45 new strings.

jcoffey-dev added 3 commits 2026-09-28 21:57:10 +00:00

Guided setup: connect a sign-in directory

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

0c64ff214b

Directories and Authentication offer a guide ("Guided or manual?" each
time) that:

- starts from Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik
  or another OpenID Connect provider, with filters and attributes set for
  that directory and example connection values;
- saves the directory, which changes nothing while no domain uses it,
  and tests a real person against it with the server's directory test:
  found or not (with aliases and groups), and whether a password signs
  in, a wrong password told apart from a broken connection. The guide
  won't go on until a person is found and, if given, the password works;
- then asks which domains sign in through it, with each domain's account
  count, and the server default as a separate switch. Choosing the
  domain you sign in on, or the default, needs an explicit "I've checked
  I can still sign in";
- switches the chosen domains over, putting them back if making it the
  default is refused.

Needs inbuxa-server's POST /api/directory/test.

Sender checks as a level: Relaxed, Recommended or Strict

ci / build (pull_request) Successful in 1m38s

Details

ci / publish (pull_request) Skipped

Details

86ae2c6672

Mail flow › Receiving › Sender checks opens with one choice instead of
six strategy fields, and a table of what each level does to mail that
fails. From the SMTP code:

- Relaxed (the stock settings): SPF, DKIM, DMARC and reverse DNS are
  checked on port 25 and scored by the spam filter; nothing is refused.
- Recommended: also refuses mail that fails DMARC for a domain that
  publishes p=reject, and checks ARC.
- Strict: also refuses senders that fail reverse DNS or SPF on MAIL
  FROM (including senders with none), and broken ARC chains. It warns
  that some real mail from small or badly set-up servers will bounce.

No level refuses unsigned mail (strict DKIM, which RFC 6376 advises
against). Checks stay on port 25, like the stock settings. Values set by
hand show as "Set by hand below", and applying a level then says it
replaces them. The form reloads after a level is applied; DKIM signing
isn't touched.

Limits as sentences, with presets for who uses the server

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

8fdae4a32b

A stock server has no rate limits: one stolen password can send without
end. A guide ("Guided or manual?" each time) asks who uses the server
(me and my family, a company or school, open to the public) and offers
five rules as sentences with numbers you can change:

- each outside server may connect N times a minute on port 25;
- each signed-in person may send N messages an hour;
- each signed-in person may address N recipients an hour in total
  (keyed by account alone; the condition reads rcpt, so the server
  checks it at RCPT TO);
- at most N deliveries a minute to any one receiving server;
- each sender may have at most N messages waiting.

Rules it writes are marked "Preset:" so running it again edits them; it
never touches rules made by hand. Above the incoming, outgoing and quota
lists, every rule now reads as a sentence, and an empty list says that
nothing is limited.

jcoffey-dev force-pushed feature/limit-presets from 830aa29d20 to 8fdae4a32b

2026-09-28 21:57:10 +00:00

Compare

jcoffey-dev merged commit a9973fac9b into main

2026-09-28 22:00:22 +00:00

jcoffey-dev deleted branch feature/limit-presets

2026-09-28 22:00:23 +00:00

jcoffey-dev referenced this pull request

2026-09-28 22:16:37 +00:00

Settings › Overview offers the limits and directory guides too #49

Limits as sentences, with presets for who uses the server #42