Skip to content

Configuration

Everything is configurable through environment variables — a container needs no config file. (Outside Docker, a clacks.toml works too; env vars always win.)

Values shown are the defaults. Only CLACKS_HOSTNAME and the TLS settings are required in practice.

Core

VariableDefault
CLACKS_HOSTNAMEFQDN the server identifies as (EHLO, banners, MX target). Must match your PTR.
CLACKS_DB/data/clacks.dbSQLite database path (the image mounts /data as a volume)
CLACKS_LOG_LEVELinfodebug | info | warn | error

TLS

VariableDefault
CLACKS_TLS_MODEselfsignedacme (Let's Encrypt via Cloudflare DNS-01) | selfsigned | none
CLACKS_TLS_ACME_EMAILACME account email
CLACKS_CLOUDFLARE_TOKENCloudflare API token scoped to Zone → DNS → Edit
CLACKS_TLS_ACME_STAGINGfalseuse the staging CA while testing
CLACKS_TLS_RENEW_BEFORE_DAYS30renew when fewer days remain

Certificates are stored in the database and renew automatically.

Ports

VariableDefault
CLACKS_SMTP_PORT25inbound MX
CLACKS_SMTP_SUBMISSION_PORT587submission, STARTTLS
CLACKS_SMTP_SUBMISSIONS_PORT465submission, implicit TLS
CLACKS_IMAP_PORT143IMAP, STARTTLS
CLACKS_IMAP_TLS_PORT993IMAP, implicit TLS
CLACKS_HTTP_PORT443HTTPS API + webmail

Mail limits

VariableDefault
CLACKS_SMTP_MAX_MESSAGE_SIZE2621440025 MiB
CLACKS_SMTP_MAX_RECIPIENTS100per message
CLACKS_DELIVERY_MAX_RETRY_HOURS72bounce outbound after this long

Built-in spam checks

Used when the Rspamd sidecar is not enabled — see Spam filtering & antivirus.

VariableDefault
CLACKS_SPAM_ENABLEDtrueSPF/DKIM/DMARC/DNSBL scoring on inbound mail
CLACKS_SPAM_SCORE_THRESHOLD5score ≥ this files to Junk
CLACKS_SPAM_DNSBL_ZONESzen.spamhaus.org,bl.spamcop.netcomma-separated; empty disables

Rate limits & resource caps

VariableDefault
CLACKS_RATELIMIT_ENABLEDtrueper-IP limits on port 25
CLACKS_RATELIMIT_CONNECTIONS_PER_MINUTE60
CLACKS_RATELIMIT_MAX_CONCURRENT20
CLACKS_RATELIMIT_MESSAGES_PER_HOUR500
CLACKS_LIMITS_MAX_CONNECTIONS_PER_LISTENER512
CLACKS_LIMITS_PRE_AUTH_TIMEOUT_SECONDS30drop idle unauthenticated connections
CLACKS_LIMITS_MAX_UPLOAD_MB2048HTTP body cap (mail-import uploads)

Environment-only settings

Variable
CLACKS_SECRETRandom string that encrypts stored IMAP-import credentials. Required to use IMAP import; keep it stable across restores.
CLACKS_RESTORE_FROMDisaster recovery: restore this backup on boot — see Backups & restore.

Backups (CLACKS_BACKUP_*), antivirus (CLACKS_ANTIVIRUS_*), and Rspamd (CLACKS_RSPAMD_*) have their own pages.

Licensed under AGPL-3.0 · GNU Terry Pratchett