Appearance
Configuration
Everything is configurable through environment variables — a container needs no config file. (Outside Docker, a clacks.toml works too; env vars always win.)
Values shown are the defaults. Only CLACKS_HOSTNAME and the TLS settings are required in practice.
Core
| Variable | Default | |
|---|---|---|
CLACKS_HOSTNAME | — | FQDN the server identifies as (EHLO, banners, MX target). Must match your PTR. |
CLACKS_DB | /data/clacks.db | SQLite database path (the image mounts /data as a volume) |
CLACKS_LOG_LEVEL | info | debug | info | warn | error |
TLS
| Variable | Default | |
|---|---|---|
CLACKS_TLS_MODE | selfsigned | acme (Let's Encrypt via Cloudflare DNS-01) | selfsigned | none |
CLACKS_TLS_ACME_EMAIL | — | ACME account email |
CLACKS_CLOUDFLARE_TOKEN | — | Cloudflare API token scoped to Zone → DNS → Edit |
CLACKS_TLS_ACME_STAGING | false | use the staging CA while testing |
CLACKS_TLS_RENEW_BEFORE_DAYS | 30 | renew when fewer days remain |
Certificates are stored in the database and renew automatically.
Ports
| Variable | Default | |
|---|---|---|
CLACKS_SMTP_PORT | 25 | inbound MX |
CLACKS_SMTP_SUBMISSION_PORT | 587 | submission, STARTTLS |
CLACKS_SMTP_SUBMISSIONS_PORT | 465 | submission, implicit TLS |
CLACKS_IMAP_PORT | 143 | IMAP, STARTTLS |
CLACKS_IMAP_TLS_PORT | 993 | IMAP, implicit TLS |
CLACKS_HTTP_PORT | 443 | HTTPS API + webmail |
Mail limits
| Variable | Default | |
|---|---|---|
CLACKS_SMTP_MAX_MESSAGE_SIZE | 26214400 | 25 MiB |
CLACKS_SMTP_MAX_RECIPIENTS | 100 | per message |
CLACKS_DELIVERY_MAX_RETRY_HOURS | 72 | bounce outbound after this long |
Built-in spam checks
Used when the Rspamd sidecar is not enabled — see Spam filtering & antivirus.
| Variable | Default | |
|---|---|---|
CLACKS_SPAM_ENABLED | true | SPF/DKIM/DMARC/DNSBL scoring on inbound mail |
CLACKS_SPAM_SCORE_THRESHOLD | 5 | score ≥ this files to Junk |
CLACKS_SPAM_DNSBL_ZONES | zen.spamhaus.org,bl.spamcop.net | comma-separated; empty disables |
Rate limits & resource caps
| Variable | Default | |
|---|---|---|
CLACKS_RATELIMIT_ENABLED | true | per-IP limits on port 25 |
CLACKS_RATELIMIT_CONNECTIONS_PER_MINUTE | 60 | |
CLACKS_RATELIMIT_MAX_CONCURRENT | 20 | |
CLACKS_RATELIMIT_MESSAGES_PER_HOUR | 500 | |
CLACKS_LIMITS_MAX_CONNECTIONS_PER_LISTENER | 512 | |
CLACKS_LIMITS_PRE_AUTH_TIMEOUT_SECONDS | 30 | drop idle unauthenticated connections |
CLACKS_LIMITS_MAX_UPLOAD_MB | 2048 | HTTP body cap (mail-import uploads) |
Environment-only settings
| Variable | |
|---|---|
CLACKS_SECRET | Random string that encrypts stored IMAP-import credentials. Required to use IMAP import; keep it stable across restores. |
CLACKS_RESTORE_FROM | Disaster recovery: restore this backup on boot — see Backups & restore. |
Backups (CLACKS_BACKUP_*), antivirus (CLACKS_ANTIVIRUS_*), and Rspamd (CLACKS_RSPAMD_*) have their own pages.