<?php
// Settings for the Roundcube that comes with NE Hub.
$config['product_name'] = 'Mail';
$config['x_frame_options'] = false;     // the hub shows this page inside its Mail tab (same address, so only the hub can frame it)
$hosts = [
  'ssl://imap.gmail.com:993' => 'Gmail',
  'ssl://imap.mail.me.com:993' => 'iCloud Mail',
  'ssl://imap.mail.yahoo.com:993' => 'Yahoo Mail',
];
// Microsoft 365 through OAuth 2.0 (needs an app registration, see README). It goes first because that is where OAuth sign-ins are sent.
if (getenv('M365_CLIENT_ID')) {
  $hosts = ['ssl://outlook.office365.com:993' => 'Microsoft 365 (use the Microsoft button)'] + $hosts;
  $tenant = getenv('M365_TENANT') ?: 'organizations';
  $config['oauth_provider'] = 'generic';
  $config['oauth_provider_name'] = 'Microsoft 365';
  $config['oauth_client_id'] = getenv('M365_CLIENT_ID');
  $config['oauth_client_secret'] = getenv('M365_CLIENT_SECRET');
  $config['oauth_auth_uri'] = "https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize";
  $config['oauth_token_uri'] = "https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token";
  $config['oauth_identity_uri'] = 'https://graph.microsoft.com/oidc/userinfo';
  $config['oauth_identity_fields'] = ['email', 'preferred_username'];
  $config['oauth_scope'] = 'email openid profile offline_access https://outlook.office365.com/IMAP.AccessAsUser.All https://outlook.office365.com/SMTP.Send';
  $config['oauth_login_redirect'] = false;
  if (getenv('PUBLIC_URL')) $config['oauth_redirect_uri'] = rtrim(getenv('PUBLIC_URL'), '/') . '/webmail/index.php/login/oauth';
}
$config['imap_host'] = $hosts;
$config['smtp_host'] = 'tls://smtp.%z:587';   // smtp.gmail.com, smtp.mail.me.com, smtp.mail.yahoo.com
$config['session_lifetime'] = 43200;          // minutes (30 days); the hub's own sign-in is what protects access
// Behind the hub: believe its forwarded address and https.
if (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') $_SERVER['HTTPS'] = 'on';
if (!empty($_SERVER['HTTP_X_FORWARDED_HOST'])) $_SERVER['HTTP_HOST'] = $_SERVER['HTTP_X_FORWARDED_HOST'];
// A fixed encryption key kept with the data, so saved settings and sessions survive restarts and updates.
$kf = '/var/roundcube/db/des_key';
if (!is_file($kf)) @file_put_contents($kf, bin2hex(random_bytes(12)));
if (is_file($kf)) $config['des_key'] = trim(file_get_contents($kf));