proofpoint-quarantine-portal/config.example.toml

# PPS Quarantine Manager — example config.
# Copy to config.toml and fill in real values. config.toml is gitignored and is written
# back by the admin panel, so keep comments meaningful — they are preserved on save.
#
# Zones:  (S) server-only, edit this file directly, never shown/written by the panel.
#         (A) admin-editable in the panel.   (W) write-only secret (never returned).

[pps]                                          # (A) PPS connection
# Base URL of the PPS admin service (REST APIs live on the admin port, default 10000).
base_url = "https://pps.example.com:10000"
# API user (admin account with an API Role that has the Quarantine module enabled).
username = "admin"
password = "secret"                            # (W) plaintext on disk (0600); rotate via panel.
# PPS admin certs are frequently self-signed. false skips TLS verification, or set a path
# to a CA bundle to verify against it.
verify_tls = false
timeout = 120                                  # seconds per PPS call (5..600)
# Mutual TLS client cert — only if PPS/nginx requires one ("400 No required SSL
# certificate"). Leave BOTH empty otherwise (the file must exist if set).
client_cert = ""                               # path to a combined cert+key PEM, or a cert with client_key
client_key = ""

[quarantine]                                   # (A)
default_folder = "Quarantine"                  # folder shown on first load (per-user overridable)
# Full folder list — the API cannot enumerate folders, so this is the source of truth for
# the switcher, the Move dropdown, and the delete/report targets. Names MUST match PPS
# exactly (case- and space-sensitive) and may not contain commas.
folders = ["Quarantine", "Attachment Defense", "Debugging - Josef", "Deleted"]
deleted_folder = "Deleted"                     # where Delete sends messages
default_limit = 200                            # UI default row count, 1..1000 (per-user overridable)
# The search API requires a from/rcpt/subject filter — a bare wildcard means "everything
# in the folder". Change if your PPS doesn't treat this as match-all (e.g. "rcpt=@you.com").
list_query = "from=*"
default_days_back = 7                          # startdate window (API alone only returns last 24h)
chunk_size = 25                                # localguids per PPS POST when the worker batches
default_sort_field = "subject"                 # subject|date|from|rcpt (per-user overridable)
default_sort_dir = "asc"                       # asc|desc (per-user overridable)

[quarantine.report_release]                    # (A) "Report & Release" pipeline
# Steps run in the FIXED order move -> release; pick either or both.
# move relocates the mail to move_target; release then delivers it from there.
# Deleting is NOT part of this pipeline — Delete is its own action/button.
steps = ["move", "release"]
move_target = "Debugging - Josef"              # must be one of `folders`
# Seconds to wait between steps on the same message so PPS's eventually-consistent
# backend settles. After the wait the worker re-reads where the messages actually are
# (by their stable guid) instead of reusing handles from before the move. 0..3600;
# 0 disables both the wait and the re-read. A waiting job is parked back on the queue,
# so it blocks neither the HTTP request nor other queued jobs.
step_delay_seconds = 60

[app]                                          # (S) restart required for changes here
# Session signing key: >= 32 chars. Generate with:
#   python -c "import secrets; print(secrets.token_urlsafe(48))"
secret_key = "change-me-to-a-random-string"
listen = "127.0.0.1"
port = 8080
db_path = "jobs.db"                            # SQLite: job queue + per-user prefs
log_level = "INFO"                             # (A, live) DEBUG for full request tracing
worker_log = "worker.log"                      # audit log: one line per message acted on
app_log = "app.log"                            # application log (errors visible in the panel)
cookie_secure = true                           # false only for plain-http localhost dev

[auth]                                         # authentication
# (S) "oidc" for production Okta, "static" for local dev. NOT editable in the panel.
mode = "oidc"
# (A) shown to users who authenticate but aren't on the allowed list.
denied_message = "Your account is not authorised to use the PPS Quarantine Manager. Contact IT."

# (A) allowed users. role is "admin" or "user".
[[auth.users]]
email = "alice@example.com"
role = "admin"

[[auth.users]]
email = "bob@example.com"
role = "user"

# (S) DEV ONLY — the shared account used when mode = "static". Ignored under oidc.
[auth.static]
username = "admin"
password = "admin"
email = "dev-admin@example.invalid"
role = "admin"

[okta]                                         # (S) entire section, restart-only, never in panel
issuer = "https://example.okta.com/oauth2/default"
client_id = "0oaEXAMPLE"
client_secret = "EXAMPLE-SECRET"               # (W)
# Must EXACTLY match the redirect URI registered in the Okta app.
redirect_uri = "https://ppsq.internal.example.com/authorize"