proofpoint-quarantine-portal/config.example.toml

# PPS Quarantine Manager — example config.
# Copy to config.toml and fill in real values. config.toml is gitignored.

[pps]
# Base URL of the PPS admin service (REST APIs live on the admin port, default 10000).
base_url = "https://pps.example.com:10000"
# API user (admin account with an API Role that has the Quarantine module enabled).
username = "apiuser"
password = "secret"            # PoC only — plaintext.
# PPS admin certs are frequently self-signed. Set false to skip TLS verification (PoC),
# or set to a path to a CA bundle to verify against it.
verify_tls = false
# Seconds to wait on a single PPS API call. Actions can be slow, so this is generous.
timeout = 120
# Mutual TLS (client certificate). Required if PPS/nginx returns
# "400 No required SSL certificate was sent". A ready-made self-signed PoC cert lives
# in certs/ (upload certs/client.crt to PPS: System > Certificates > Client Certificates).
# Either a combined cert+key PEM (leave client_key empty), or a cert PEM plus its key.
# Leave both empty if client-cert auth is not used.
client_cert = "certs/client.pem"
client_key = ""

[quarantine]
default_folder = "Quarantine"              # folder shown on first load
# Full folder list — the API cannot enumerate folders, so this is the source of truth
# for the folder switcher, the Move dropdown, and the delete/report targets below.
# Names MUST match PPS exactly (case- and space-sensitive).
folders = ["Quarantine", "Attachment Defense", "Debugging - Josef", "Deleted"]
deleted_folder = "Deleted"                 # where Delete (and Release) send messages
report_release_folder = "Debugging - Josef"  # Report & Release moves a copy here
default_limit = 200                        # UI default row count (max 1000)
# The search API requires a from/rcpt/subject filter — a bare wildcard means
# "everything in the folder". If your PPS doesn't treat this as match-all, change it
# (e.g. "rcpt=@yourdomain.com").
list_query = "from=*"
default_days_back = 7                      # startdate window (API alone only returns last 24h)
chunk_size = 25                            # localguids per PPS POST when the worker batches

[app]
secret_key = "change-me-to-a-random-string"  # Flask session signing key
listen = "127.0.0.1"
port = 8080
db_path = "jobs.db"                        # SQLite job queue file
log_level = "INFO"                         # DEBUG for full request/response tracing
worker_log = "worker.log"                  # audit log: one line per message acted on (rotated)

[auth]
# Static PoC login. Replaced by SAML/OIDC later.
username = "admin"
password = "admin"