debops.roundcube default variables

Sections

Packages and installation
Roundcube user account
Roundcube source and deployment
Database configuration
Cache configuration
LDAP configuration
Roundcube application options
Roundcube configuration file
Configuration file sections
Roundcube plugins
Skins
Other variables
Role-dependent configuration

Packages and installation 

roundcube__required_php_packages

List of PHP packages required by Roundcube. Refer to the official Roundcube documentation for details.

roundcube__required_php_packages:
  - 'iconv'
  - 'openssl'
  - 'session'
  - 'sockets'
  - 'xml'
  # Included in the xml package
  #- 'dom'
  - 'mbstring'
  - 'json'
  - 'intl'

roundcube__optional_php_packages

List of recommended/optional PHP packages for Roundcube. Refer to the official Roundcube documentation for details.

roundcube__optional_php_packages:
  - '{{ "ldap" if roundcube__ldap_enabled | bool else [] }}'
  - '{{ "memcached" if roundcube__memcached_enabled | bool else [] }}'
  - '{{ "redis" if roundcube__redis_enabled | bool else [] }}'
  - 'fileinfo'
  - 'enchant'
  - 'zip'

roundcube__custom_php_packages

List of user defined PHP packages for Roundcube.

roundcube__custom_php_packages: []

roundcube__base_php_packages

List of base PHP packages required by Roundcube.

roundcube__base_php_packages:
  - '{{ roundcube__required_php_packages }}'
  - '{{ roundcube__apt_php_packages }}'
  - '{{ roundcube__optional_php_packages }}'
  - '{{ ["mysql"] if (roundcube__database_map[roundcube__database].dbtype == "mysql") else [] }}'
  - '{{ ["pgsql"] if (roundcube__database_map[roundcube__database].dbtype == "postgresql") else [] }}'
  - '{{ ["sqlite3"] if (roundcube__database_map[roundcube__database].dbtype == "sqlite") else [] }}'

roundcube__apt_php_packages

PHP packages which are installed via APT repository if they are available in a sufficiently new version in the current distribution. The required minimal versions are taken from the file:composer.json.dist of the Roundcube 1.3.0 release. If you install an older version of Roundcube you may want to adjust this list.

roundcube__apt_php_packages: '{{ ["mail-mime", "net-smtp", "pear"]
                                 if ansible_distribution_release in ["stretch", "buster", "sid", "xenial", "yakkety", "zesty", "artful"]
                                 else [] }}'

roundcube__packages

List of additional APT packages (e. g. language dictionaries) that should be installed with Roundcube.

roundcube__packages: []

roundcube__base_packages

APT packages required for the Roundcube installation.

roundcube__base_packages: [ 'curl', 'file', 'unzip', 'aspell', 'aspell-en' ]

Roundcube user account 

roundcube__user

Roundcube system user account.

roundcube__user: 'roundcube'

roundcube__group

Roundcube system user group.

roundcube__group: 'roundcube'

roundcube__home

Path to the home directory of the Roundcube system account.

roundcube__home: '{{ (ansible_local.fhs.home | d("/var/local"))
                     + "/" + roundcube__user }}'

roundcube__comment

The GECOS string set for the Roundcube account.

roundcube__comment: 'Roundcube Webmail'

roundcube__shell

The default shell of the Roundcube account.

roundcube__shell: '/usr/sbin/nologin'

Roundcube source and deployment 

roundcube__git_gpg_key

The GPG key used to sign Roundcube releases.

roundcube__git_gpg_key: '4295 5C9D 6F2A CA9D 3E96  D55F 3E54 28D0 262C 54F8'

roundcube__git_additional_gpg_keys

List of additional GPG keys to add to the Roundcue user account. This might be needed if multiple people/organizations sign git commits or tags in the Roundcube repository, or installation from a private repository is used instead of a public one.

roundcube__git_additional_gpg_keys: []

roundcube__git_repo

Roundcube source repository. You can specify a public or private git repository using the https:// protocol. See Deployment from private or internal git repository for more details.

roundcube__git_repo: 'https://github.com/roundcube/roundcubemail.git'

roundcube__git_dir

Roundcube source directory on the host.

roundcube__git_dir: '{{ roundcube__src + "/"
                        + roundcube__git_repo.split("@"
                                                    if ("@" in roundcube__git_repo)
                                                    else "://")[1] }}'

roundcube__git_version

Roundcube release tag to deploy.

roundcube__git_version: '1.6.0'

roundcube__git_dest

Default path where Roundcube source files will be deployed.

roundcube__git_dest: '{{ roundcube__www + "/sites/" + roundcube__user + "/public" }}'

roundcube__src

Base path for git bare repository with Roundcube source.

roundcube__src: '{{ (ansible_local.fhs.src | d("/usr/local/src"))
                    + "/" + roundcube__user }}'

roundcube__www

Base web root directory for Roundcube website.

roundcube__www: '{{ ansible_local.nginx.www
                    if (ansible_local | d() and ansible_local.nginx | d())
                    else "/srv/www" }}'

roundcube__webserver_user

Roundcube webserver user (needs read-only access to the website code).

roundcube__webserver_user: '{{ ansible_local.nginx.user | d("www-data") }}'

Database configuration 

roundcube__database

Database definition to use from the roundcube__database_map.

roundcube__database: 'sqlite-default'

roundcube__database_user

Database user account to use for Roundcube.

roundcube__database_user: 'roundcube'

roundcube__database_password_path

Path to the database password file.

roundcube__database_password_path: '{{ secret + "/credentials/" + inventory_hostname
                                       + "/roundcube/" + roundcube__database
                                       + "/" + roundcube__database_user + "/password" }}'

roundcube__database_password

Database password for the account given in roundcube__database_user.

roundcube__database_password: '{{ lookup("password", roundcube__database_password_path + " length=30") }}'

roundcube__database_name

Name of the database to use for Roundcube.

roundcube__database_name: '{{ roundcube__database_user
                              if roundcube__database == "postgresql-default"
                              else "roundcubemail" }}'

roundcube__database_map

Database connection definitions. Select the database connection to use in roundcube__database.

roundcube__database_map:

  sqlite-default:
    dbtype: 'sqlite'
    dbname: 'db/roundcube.db'

  mysql-default:
    dbtype: 'mysql'
    dbname: '{{ roundcube__database_name }}'
    dbuser: '{{ roundcube__database_user }}'
    dbpass: '{{ roundcube__database_password }}'
    dbhost: 'localhost'
    dbtableprefix: ''

  postgresql-default:
    dbtype: 'postgresql'
    dbname: '{{ roundcube__database_name }}'
    dbuser: '{{ roundcube__database_user }}'
    dbpass: '{{ roundcube__database_password }}'
    dbhost: 'localhost'
    dbtableprefix: ''

roundcube__database_schema_map

Database type to schema mapping.

roundcube__database_schema_map:
  mysql:      '{{ roundcube__git_dest + "/SQL/mysql.initial.sql" }}'
  postgresql: '{{ roundcube__git_dest + "/SQL/postgres.initial.sql" }}'

roundcube__database_schema

Initial Roundcube database schema loaded by Ansible.

roundcube__database_schema: '{{ roundcube__database_schema_map[roundcube__database_map[roundcube__database].dbtype]
                                if roundcube__database_schema_map[roundcube__database_map[roundcube__database].dbtype] | d()
                                else "" }}'

Cache configuration 

roundcube__memcached_enabled

Enable or disable support for memcached service. It will be enabled automatically if local instance of memcached is detected.

roundcube__memcached_enabled: '{{ True
                                  if (ansible_local | d() and ansible_local.memcached | d() and
                                      (ansible_local.memcached.installed | d()) | bool)
                                  else False }}'

roundcube__memcached_hosts

List of the memcached instances to use by Roundcube. By default only the local instance will be used, if detected. See debops.memcached for more details.

roundcube__memcached_hosts: [ 'localhost:11211' ]

roundcube__redis_enabled

Enable or disable support for redis service. It will be enabled automatically if local instance of redis is detected.

roundcube__redis_enabled: '{{ True
                              if (ansible_local | d() and ansible_local.redis_server | d() and
                                  (ansible_local.redis_server.installed | d()) | bool)
                              else False }}'

roundcube__redis_host

The address of the Redis server instance to use. Currently only a single server is supported by Roundcube. By default the Redis instance on the same host will be used, if it's detected via Ansible local facts.

roundcube__redis_server: 'localhost'

roundcube__redis_port

The TCP port to use for Redis connections.

roundcube__redis_port: '{{ ansible_local.redis_server.port | d("6379") }}'

roundcube__redis_database

The Redis "database" number to use.

roundcube__redis_database: '1'

roundcube__redis_password

Specify the password required for authentication to Redis.

roundcube__redis_password: '{{ ansible_local.redis_server.password | d("") }}'

roundcube__redis_hosts

List of the Redis instances which should be used by Roundcube. Currently only a single instance is supported, but the variable expects a list.

roundcube__redis_hosts: [ '{{ ([roundcube__redis_server,
                                roundcube__redis_port,
                                roundcube__redis_database,
                                roundcube__redis_password])
                              | join(":") }}' ]

roundcube__session_storage

Select the session storage type to use. Currently supported are redis and memcached. The session storage will be selected automatically by detecting available cache services via Ansible local facts. If the variable is empty, session storage will not be configured and will fall back to the db storage type.

roundcube__session_storage: '{{ "redis"
                                if roundcube__redis_enabled | bool
                                else ("memcached"
                                      if roundcube__memcached_enabled | bool
                                      else "") }}'

LDAP configuration 

These variables configure the access to the LDAP address book managed by DebOps. See debops.ldap and debops.slapd role documentation to learn more about managing LDAP infrastructure with DebOps, and Roundcube LDAP Address Books documentation to learn more about configuring LDAP access in Roundcube.

roundcube__ldap_enabled

Enable or disable LDAP integration in Roundcube.

roundcube__ldap_enabled: '{{ ansible_local.ldap.enabled
                             if (ansible_local | d() and ansible_local.ldap | d() and
                                 ansible_local.ldap.enabled is defined)
                             else False }}'

roundcube__ldap_password_enabled

Enable or disable support for changing user passwords using the "password" Roundcube plugin. The plugin will be configured to use LDAP Password Modify Extended Operation (RFC 3062).

If the password change support is disabled, the "password" plugin will be disabled as well. Password change via other mechanisms can be configured separately via Ansible inventory variables.

roundcube__ldap_password_enabled: '{{ roundcube__ldap_enabled }}'

roundcube__ldap_addressbook_name

The name of the LDAP address book. It will be visible on the address book list and as the source of the search results.

roundcube__ldap_addressbook_name: 'LDAP Address Book'

roundcube__ldap_hosts

List of the FQDN addresses of the LDAP directory servers which should be used by Roundcube.

roundcube__ldap_hosts: '{{ ansible_local.ldap.hosts | d([]) }}'

roundcube__ldap_port

The TCP port to use to connect to the LDAP directory.

roundcube__ldap_port: '{{ ansible_local.ldap.port | d("389") }}'

roundcube__ldap_use_tls

Enable or disable support for STARTTLS extension while connecting to the LDAP directory.

roundcube__ldap_use_tls: '{{ ansible_local.ldap.start_tls | d(True) }}'

roundcube__ldap_base_dn

The Base Distinguished Name of the LDAP directory, defined as a YAML list.

roundcube__ldap_base_dn: '{{ ansible_local.ldap.base_dn | d([]) }}'

roundcube__ldap_device_dn

The Distinguished Name of the current host LDAP object, defined as a YAML list. It will be used as a base for the Roundcube application account LDAP object. If the list is empty, the role will not create the account LDAP object automatically.

roundcube__ldap_device_dn: '{{ ansible_local.ldap.device_dn | d([]) }}'

roundcube__ldap_self_rdn

The Relative Distinguished Name of the account LDAP object used by the Roundcube application to access the LDAP directory.

roundcube__ldap_self_rdn: '{{ "uid=" + roundcube__user }}'

roundcube__ldap_self_object_classes

List of the LDAP object classes which will be used to create the LDAP object used by the Roundcube application to access the LDAP directory.

roundcube__ldap_self_object_classes: [ 'account', 'simpleSecurityObject' ]

roundcube__ldap_self_attributes

YAML dictionary that defines the attributes of the LDAP object used by the Roundcube application to access the LDAP directory.

roundcube__ldap_self_attributes:
  uid: '{{ roundcube__ldap_self_rdn.split("=")[1] }}'
  userPassword: '{{ roundcube__ldap_bindpw }}'
  host: '{{ [ansible_fqdn, ansible_hostname] | unique }}'
  description: 'Account used by the "Roundcube" application to access the LDAP directory'

roundcube__ldap_binddn

The Distinguished Name of the account LDAP object used by the Roundcube application to bind to the LDAP directory.

roundcube__ldap_binddn: '{{ ([roundcube__ldap_self_rdn] + roundcube__ldap_device_dn) | join(",") }}'

roundcube__ldap_bindpw

The password stored in the account LDAP object used by the Roundcube application to bind to the LDAP directory.

roundcube__ldap_bindpw: '{{ (lookup("password", secret + "/ldap/credentials/"
                                    + roundcube__ldap_binddn | to_uuid + ".password length=32"))
                            if roundcube__ldap_enabled | bool
                            else "" }}'

roundcube__ldap_people_rdn

The Relative Distinguished Name of the people subtree which contains personal LDAP entries.

roundcube__ldap_people_rdn: '{{ ansible_local.ldap.people_rdn | d([]) }}'

roundcube__ldap_people_dn

The Distinguished Name of the people subtree which will be used for LDAP address book searches.

roundcube__ldap_people_dn: '{{ [roundcube__ldap_people_rdn]
                               + roundcube__ldap_base_dn }}'

roundcube__ldap_groups_rdn

The Relative Distinguished Name of the groups subtree which contains group LDAP entries.

roundcube__ldap_groups_rdn: '{{ ansible_local.ldap.groups_rdn | d([]) }}'

roundcube__ldap_groups_dn

The Distinguished Name of the groups subtree which will be used for LDAP address book searches.

roundcube__ldap_groups_dn: '{{ [roundcube__ldap_groups_rdn]
                               + roundcube__ldap_base_dn }}'

roundcube__ldap_hidden

Show or hide the LDAP address book in the Address Books interface. Hiding the LDAP address book still allows for searching its contents and autocompletion of recipient e-mail addresses.

Since the default LDAP address book configuration disables direct browsing of the contents and is read-only, displaying an entry for it is not very useful. Therefore it will be hidden by default.

roundcube__ldap_hidden: True

roundcube__ldap_field_map

YAML dictionary which defines mapping between Roundcube address book fields and LDAP entry attributes. Some of the fields are not mapped yet because they don't work or there are currently no good LDAP equivalents.

roundcube__ldap_field_map:
  name: 'cn'
  firstname: 'givenName'
  #middlename
  #prefix
  #suffix
  surname: 'sn'
  #nicname
  #maidenname
  #gender
  #spouse
  #organization
  #department
  jobtitle: 'title'
  #assistant
  #manager
  email: 'mail:*'
  'phone:home': 'homePhone'
  'phone:work': 'telephoneNumber'
  'phone:mobile': 'mobile'
  'phone:pager': 'pager'
  'phone:workfax': 'facsimileTelephoneNumber'
  street: 'street'
  zipcode: 'postalCode'
  region: 'st'
  locality: 'l'
  #address
  #birthday
  #anniversary
  #website
  #im
  notes: 'description:*'
  photo: 'jpegPhoto'

Roundcube application options 

roundcube__fqdn

The default DNS address of the RoundCube web application, used in the HTTP server configuration.

roundcube__fqdn: 'webmail.{{ roundcube__domain }}'

roundcube__domain

The DNS domain of the RoundCube installation.

roundcube__domain: '{{ ansible_domain }}'

roundcube__imap_srv_rr

List which contains the result of the DNS query for IMAP server SRV resource records in the host's domain. See RFC 6186 for details.

If there are no resource records, the role checks if a local Dovecot installation is present and uses the host FQDN as the IMAP server address. Finally, imap.<domain> is used as a fallback.

roundcube__imap_srv_rr: '{{ q("debops.debops.dig_srv", "_imaps._tcp." + roundcube__domain,
                              ansible_fqdn
                              if (ansible_local | d() and ansible_local.dovecot | d() and
                                  (ansible_local.dovecot.installed | d()) | bool)
                              else "imap." + roundcube__domain, 993) }}'

roundcube__imap_fqdn

The FQDN address of the IMAP server which stores user mailboxes.

The use of the FQDN instead of localhost is required for X.509 certificate verification and for correct information in system logs.

roundcube__imap_fqdn: '{{ roundcube__imap_srv_rr[0]["target"] }}'

roundcube__imap_port

The TCP port to use for IMAP connections.

roundcube__imap_port: '{{ roundcube__imap_srv_rr[0]["port"] | string }}'

roundcube__imap_server

The IMAP host chosen to perform the log-in. This variable is also called default_server by Roundcube .

Leave blank to show a textbox at login, give a list of hosts to display a pulldown menu or set one host as string. To use SSL/TLS connection, enter hostname with prefix ssl:// or tls:// Supported replacement variables: %n - hostname ($_SERVER['SERVER_NAME']) %t - hostname without the first part %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) %s - domain name after the '@' from e-mail address provided at login screen For example %n = mail.domain.tld, %t = domain.tld

roundcube__imap_server: '{{ ("ssl://"
                             if (roundcube__imap_port == "993")
                             else ("tls://"
                                   if (roundcube__imap_port == "143")
                                   else "tls://"))
                             + roundcube__imap_fqdn
                             + ":" + roundcube__imap_port }}'

roundcube__smtp_srv_rr

List which contains the result of the DNS query for the SMTP (submission) server SRV resource records in the host's domain. See RFC 6186 for details.

If there are no resource records, the role checks if a local Postfix installation is present and uses the host FQDN as the SMTP server address. Finally, smtp.<domain> is used as a fallback.

roundcube__smtp_srv_rr: '{{ q("debops.debops.dig_srv", "_submissions._tcp." + roundcube__domain,
                              ansible_fqdn
                              if (ansible_local | d() and ansible_local.postfix | d() and
                                  (ansible_local.postfix.installed | d()) | bool)
                              else ("smtp." + roundcube__domain), 465) }}'

roundcube__smtp_fqdn

The FQDN address of the SMTP (submission) server which will be used to send e-mail messages.

The use of the FQDN instead of localhost is required for X.509 certificate verification and for correct information in system logs.

roundcube__smtp_fqdn: '{{ roundcube__smtp_srv_rr[0]["target"] }}'

roundcube__smtp_port

The TCP port to use for SMTP connections.

Common values include 25 for unencrypted communication, 587 for STARTTLS, or 465 for SMTP over SSL (aka SMTPS).

roundcube__smtp_port: '{{ roundcube__smtp_srv_rr[0]["port"] | string }}'

roundcube__smtp_server

SMTP server host (for sending mails).

Enter hostname with prefix tls:// to use STARTTLS, or use prefix ssl:// to use the deprecated SSL over SMTP (aka SMTPS) Supported replacement variables: %h - user's IMAP hostname %n - hostname ($_SERVER['SERVER_NAME']) %t - hostname without the first part %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part) %z - IMAP domain (IMAP hostname without the first part) For example %n = mail.domain.tld, %t = domain.tld

roundcube__smtp_server: '{{ ("ssl://"
                             if (roundcube__smtp_port == "465")
                             else ("tls://"
                                   if (roundcube__smtp_port == "587")
                                   else "tls://"))
                             + roundcube__smtp_fqdn
                             + ":" + roundcube__smtp_port }}'

roundcube__smtp_user

SMTP username (if required) if you use %u as the username Roundcube will use the current username for login.

roundcube__smtp_user: '%u'

roundcube__smtp_pass

SMTP password (if required) if you use %p as the password Roundcube will use the current user's password for login.

roundcube__smtp_pass: '%p'

roundcube__sieve_srv_rr

List which contains the result of the DNS query for Sieve server SRV resource records in the host's domain. See RFC 5804 for details.

If there are no resource records, the role checks if a local Dovecot installation is present and uses the host FQDN as the Sieve server address. Finally, sieve.<domain> is used as a fallback.

roundcube__sieve_srv_rr: '{{ q("debops.debops.dig_srv", "_sieve._tcp." + roundcube__domain,
                               ansible_fqdn
                               if (ansible_local | d() and ansible_local.dovecot | d() and
                                   (ansible_local.dovecot.installed | d()) | bool)
                               else ("sieve." + roundcube__domain), 4190) }}'

roundcube__sieve_fqdn

The FQDN address of the Sieve server which allows management of the Sieve filter scripts.

The use of the FQDN instead of localhost is required for X.509 certificate verification and for correct information in system logs.

roundcube__sieve_fqdn: '{{ roundcube__sieve_srv_rr[0]["target"] }}'

roundcube__sieve_port

The TCP port used for Sieve connections.

roundcube__sieve_port: '{{ roundcube__sieve_srv_rr[0]["port"] | string }}'

roundcube__sieve_server

The Sieve host chosen to access the Sieve configuration interface. Replacement variables supported in host name: %h - user's IMAP hostname %n - http hostname ($_SERVER['SERVER_NAME']) %d - domain (http hostname without the first part) For example %n = mail.domain.tld, %d = domain.tld

roundcube__sieve_server: '{{ "tls://" + roundcube__sieve_fqdn }}'

roundcube__product_name

Name your service. This is displayed on the login screen and in the window title

roundcube__product_name: '{{ ansible_local.machine.organization | d("Roundcube") + " Webmail" }}'

roundcube__des_key

Encryption key for the users imap password which is stored in the session record (and the client cookie if remember password is enabled).

roundcube__des_key: '{{ lookup("password", secret + "/credentials/" + inventory_hostname + "/roundcube/des_key chars=hexdigits length=24") }}'

roundcube__username_domain

Specify a domain (realm) to add to usernames without a specified domain. Defining a default domain helps avoid creating separate RoundCube profiles when users use logins with and without a domain specified.

The default is to create a domain based on the host DNS domain.

roundcube__username_domain: '%d'

roundcube__log_driver

Define the log driver. Currently available: syslog, stdout, file.

roundcube__log_driver: 'syslog'

Roundcube configuration file 

These variables define the contents of the config/config.inc.php local configuration file. See roundcube__configuration for more details.

roundcube__original_configuration

The list defines the Roundcube configuration options stored in the config.inc.php.sample configuration file. Modifications to these configuration options should be done using the subsequent variables.

  roundcube__original_configuration:

      # [[[ init
    - name: 'init_config'
      raw: |
        $config = array();
      section: 'init'

  # [[[  sql
- name: 'db_dsnw'
  comment: |
    Database connection string (DSN) for read+write operations
    Format (compatible with PEAR MDB2): db_provider://user:password@host/database
    Currently supported db_providers: mysql, pgsql, sqlite, mssql, sqlsrv, oracle
    For examples see https://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php
    Note: for SQLite use absolute path (Linux): 'sqlite:////full/path/to/sqlite.db?mode=0646'
          or (Windows): 'sqlite:///C:/full/path/to/sqlite.db'
    Note: Various drivers support various additional arguments for connection,
          for Mysql: key, cipher, cert, capath, ca, verify_server_cert,
          for Postgres: application_name, sslmode, sslcert, sslkey,
          sslrootcert, sslcrl, sslcompression, service.
          e.g. 'mysql://roundcube:@localhost/roundcubemail?verify_server_cert=false'
  value: 'mysql://roundcube:pass@localhost/roundcubemail'
  section: 'sql'

- name: 'db_dsnr'
  comment: |
    Database DSN for read-only operations (if empty write database will be used)
    useful for database replication
  value: ''
  section: 'sql'
  state: 'init'

- name: 'db_dsnw_noread'
  comment: 'Disable the use of already established dsnw connections for subsequent reads'
  value: False
  section: 'sql'
  state: 'init'

- name: 'db_persistent'
  comment: |
    use persistent db-connections
    beware this will not "always" work as expected
    see: http://www.php.net/manual/en/features.persistent-connections.php
  value: False
  section: 'sql'
  state: 'init'

- name: 'db_prefix'
  comment: 'You can define specific table (and sequence) names prefix'
  value: ''
  section: 'sql'
  state: 'init'

- name: 'db_table_dsn'
  comment: |
    Mapping of table names and connections to use for ALL operations.
    This can be used in a setup with replicated databases and a DB master
    where read/write access to cache tables should not go to master.
  array:
    - 'cache':          'r'
      'cache_index':    'r'
      'cache_thread':   'r'
      'cache_messages': 'r'
  section: 'sql'
  state: 'init'

- name: 'db_max_allowed_packet'
  comment: |
    It is possible to specify database variable values e.g. some limits here.
    Use them if your server is not MySQL or for better performance.
    For example Roundcube uses max_allowed_packet value (in bytes)
    which limits query size for database cache operations.
  value: null
  section: 'sql'
  state: 'init'

  # [[[ logging
- name: 'log_driver'
  comment: |
    Log driver: 'syslog', 'stdout' or 'file'.
  value: 'file'
  section: 'logging'
  state: 'init'

- name: 'log_date_format'
  comment: |
    Date format for log entries
    (read https://php.net/manual/en/function.date.php for all format characters)
  value: 'd-M-Y H:i:s O'
  section: 'logging'
  state: 'init'

- name: 'log_session_id'
  comment: |
    Length of the session ID to prepend each log line with
    set to 0 to avoid session IDs being logged.
  value: 8
  section: 'logging'
  state: 'init'

- name: 'log_file_ext'
  comment: 'Default extension used for log file name'
  value: '.log'
  section: 'logging'
  state: 'init'

- name: 'syslog_id'
  comment: 'Syslog ident string to use, if using the "syslog" log driver.'
  value: 'roundcube'
  section: 'logging'
  state: 'init'

- name: 'syslog_facility'
  comment: |
    Syslog facility to use, if using the 'syslog' log driver.
    For possible values see installer or https://php.net/manual/en/function.openlog.php
  value: 'LOG_USER'
  quotes: False
  section: 'logging'
  state: 'init'

- name: 'per_user_logging'
  comment: |
    Activate this option if logs should be written to per-user directories.
    Data will only be logged if a directory <log_dir>/<username>/ exists and is writable.
  value: False
  section: 'logging'
  state: 'init'

- name: 'smtp_log'
  comment: 'Log sent messages to <log_dir>/sendmail.log or to syslog'
  value: True
  section: 'logging'
  state: 'init'

- name: 'log_logins'
  comment: 'Log successful/failed logins to <log_dir>/userlogins.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'session_debug'
  comment: |
    Log session debug information/authentication errors to <log_dir>/session.log or to syslog
  value: False
  section: 'logging'
  state: 'init'

- name: 'sql_debug'
  comment: 'Log SQL queries to <log_dir>/sql.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'imap_debug'
  comment: 'Log IMAP conversation to <log_dir>/imap.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'ldap_debug'
  comment: 'Log LDAP conversation to <log_dir>/ldap.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'smtp_debug'
  comment: 'Log SMTP conversation to <log_dir>/smtp.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'memcache_debug'
  comment: 'Log Memcache conversation to <log_dir>/memcache.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'apc_debug'
  comment: 'Log APC conversation to <log_dir>/apc.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

- name: 'redis_debug'
  comment: 'Log Redis conversation to <log_dir>/redis.log or to syslog'
  value: False
  section: 'logging'
  state: 'init'

  # [[[ imap
- name: 'imap_host'
  comment: |
    IMAP host chosen to perform the log-in.
    See defaults.inc.php for the option description.
  value: 'localhost:143'
  section: 'imap'

- name: 'imap_auth_type'
  comment: |
    IMAP authentication method (DIGEST-MD5, CRAM-MD5, LOGIN, PLAIN or null).
    Use 'IMAP' to authenticate with IMAP LOGIN command.
    By default the most secure method (from supported) will be selected.
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_conn_options'
  comment: |
    IMAP socket context options
    See https://php.net/manual/en/context.ssl.php
    The example below enables server certificate validation
    Note: These can be also specified as an array of options indexed by hostname
  array:
    - ssl:
        - verify_peer: True
          verify_depth: 3
          cafile: '/etc/ssl/certs/ca-certificates.crt'
  section: 'imap'
  state: 'init'

- name: 'imap_timeout'
  comment: 'IMAP connection timeout, in seconds. Default: 0 (use default_socket_timeout)'
  value: 0
  section: 'imap'
  state: 'init'

- name: 'imap_auth_cid'
  comment: 'Optional IMAP authentication identifier to be used as authorization proxy'
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_auth_pw'
  comment: 'Optional IMAP authentication password to be used for imap_auth_cid'
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_delimiter'
  comment: |
    If you know your imap's folder delimiter, you can specify it here.
    Otherwise it will be determined automatically
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_vendor'
  comment: |
    If you know your imap's folder vendor, you can specify it here.
    Otherwise it will be determined automatically. Use lower-case
    identifiers, e.g. 'dovecot', 'cyrus', 'gimap', 'hmail', 'uw-imap'.
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_ns_personal'
  comment: |
    If IMAP server doesn't support NAMESPACE extension, but you're
    using shared folders or personal root folder is non-empty, you'll need to
    set these options. All can be strings or arrays of strings.
    Note: Folders need to be ended with directory separator, e.g. "INBOX."
          (special directory "~" is an exception to this rule)
    Note: These can be used also to overwrite server's namespaces
    Note: Set these to FALSE to disable access to specified namespace
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_ns_other'
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_ns_shared'
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_force_caps'
  comment: |
    By default IMAP capabilities are read after connection to IMAP server
    In some cases, e.g. when using IMAP proxy, there's a need to refresh the list
    after login. Set to True if you've got this case.
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_force_lsub'
  comment: |
    By default list of subscribed folders is determined using LIST-EXTENDED
    extension if available. Some servers (dovecot 1.x) returns wrong results
    for shared namespaces in this case. https://github.com/roundcube/roundcubemail/issues/2474
    Enable this option to force LSUB command usage instead.
    Deprecated: Use imap_disabled_caps = array('LIST-EXTENDED')
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_force_ns'
  comment: |
    Some server configurations (e.g. Courier) doesn't list folders in all namespaces
    Enable this option to force listing of folders in all namespaces
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_skip_hidden_folders'
  comment: |
    Some servers return hidden folders (name starting with a dot)
    from user home directory. IMAP RFC does not forbid that.
    Enable this option to hide them and disable possibility to create such.
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_dual_use_folders'
  comment: |
    Some servers do not support folders with both folders and messages inside
    If your server supports that use true, if it does not, use false.
    By default it will be determined automatically (once per user session).
  value: null
  section: 'imap'
  state: 'init'

- name: 'imap_disabled_caps'
  comment: |
    List of disabled imap extensions.
    Use if your IMAP server has broken implementation of some feature
    and you can't remove it from CAPABILITY string on server-side.
    For example UW-IMAP server has broken ESEARCH.
    Note: Because the list is cached, re-login is required after change.
  value: []
  section: 'imap'
  state: 'init'

- name: 'imap_log_session'
  comment: |
    Log IMAP session identifiers after each IMAP login.
    This is used to relate IMAP session with Roundcube user sessions
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_cache'
  comment: |
    Type of IMAP indexes cache. Supported values: 'db', 'apc' and 'memcache' or 'memcached'.
  value: null
  section: 'imap'
  state: 'init'

- name: 'messages_cache'
  comment: |
    Enables messages cache. Only 'db' cache is supported.
    This requires an IMAP server that supports QRESYNC and CONDSTORE
    extensions (RFC7162). See synchronize() in program/lib/Roundcube/rcube_imap_cache.php
    for further info, or if you experience syncing problems.
  value: False
  section: 'imap'
  state: 'init'

- name: 'imap_cache_ttl'
  comment: 'Lifetime of IMAP indexes cache. Possible units: s, m, h, d, w'
  value: '10d'
  section: 'imap'
  state: 'init'

- name: 'messages_cache_ttl'
  comment: 'Lifetime of messages cache. Possible units: s, m, h, d, w'
  value: '10d'
  section: 'imap'
  state: 'init'

- name: 'messages_cache_threshold'
  comment: |
    Maximum cached message size in kilobytes.
    Note: On MySQL this should be less than (max_allowed_packet - 30%)
  value: 50
  section: 'imap'
  state: 'init'

  # [[[ smtp
- name: 'smtp_host'
  comment: |
    SMTP server host (for sending mails).
    See defaults.inc.php for the option description.
  value: 'localhost:587'
  section: 'smtp'

- name: 'smtp_user'
  comment: |
    SMTP username (if required) if you use %u as the username Roundcube
    will use the current username for login
  value: '%u'
  section: 'smtp'

- name: 'smtp_pass'
  comment: |
    SMTP password (if required) if you use %p as the password Roundcube
    will use the current user's password for login
  value: '%p'
  section: 'smtp'

- name: 'smtp_auth_type'
  comment: |
    SMTP AUTH type (DIGEST-MD5, CRAM-MD5, LOGIN, PLAIN or empty to use
    best server supported one)
  value: null
  section: 'smtp'
  state: 'init'

- name: 'smtp_auth_cid'
  comment: |
    Optional SMTP authentication identifier to be used as authorization proxy
  value: null
  section: 'smtp'
  state: 'init'

- name: 'smtp_auth_pw'
  comment: |
    Optional SMTP authentication password to be used for smtp_auth_cid
  value: null
  section: 'smtp'
  state: 'init'

- name: 'smtp_helo_host'
  comment: |
    SMTP HELO host
    Hostname to give to the remote server for SMTP 'HELO' or 'EHLO' messages
    Leave this blank and you will get the server variable 'server_name' or
    localhost if that isn't defined.
  value: ''
  section: 'smtp'
  state: 'init'

- name: 'smtp_timeout'
  comment: |
    SMTP connection timeout, in seconds. Default: 0 (use default_socket_timeout)
    Note: There's a known issue where using ssl connection with
    timeout > 0 causes connection errors (https://bugs.php.net/bug.php?id=54511)
  value: 0
  section: 'smtp'
  state: 'init'

- name: 'smtp_conn_options'
  comment: |
    SMTP socket context options
    See https://php.net/manual/en/context.ssl.php
    The example below enables server certificate validation, and
    requires 'smtp_timeout' to be non zero.
    Note: These can be also specified as an array of options indexed by hostname
  array:
    - ssl:
        - verify_peer: True
          verify_depth: 3
          cafile: '/etc/ssl/certs/ca-certificates.crt'
  section: 'smtp'
  state: 'init'

  # [[[ ldap
- name: 'ldap_cache'
  comment: |
    Type of LDAP cache. Supported values: 'db', 'apc' and 'memcache' or 'memcached'.
  value: 'db'
  section: 'ldap'
  state: 'init'

- name: 'ldap_cache_ttl'
  comment: 'Lifetime of LDAP cache. Possible units: s, m, h, d, w'
  value: '10m'
  section: 'ldap'
  state: 'init'

  # [[[ cache
- name: 'memcache_hosts'
  comment: |
    Use these hosts for accessing memcached
    Define any number of hosts in the form of hostname:port or unix:///path/to/socket.file
    Example: array('localhost:11211', '192.168.1.12:11211', 'unix:///var/tmp/memcached.sock');
  value: null
  section: 'cache'
  state: 'init'

- name: 'memcache_pconnect'
  comment: |
    Controls the use of a persistent connections to memcache servers
    See https://php.net/manual/en/memcache.addserver.php
  value: True
  section: 'cache'
  state: 'init'

- name: 'memcache_timeout'
  comment: |
    Value in seconds which will be used for connecting to the daemon
    See https://php.net/manual/en/memcache.addserver.php
  value: 1
  section: 'cache'
  state: 'init'

- name: 'memcache_retry_interval'
  comment: |
    Controls how often a failed server will be retried (value in seconds).
    Setting this parameter to -1 disables automatic retry.
    See https://php.net/manual/en/memcache.addserver.php
  value: 15
  section: 'cache'
  state: 'init'

- name: 'redis_hosts'
  comment: |
    Use these hosts for accessing Redis.
    Currently only one host is supported. Cluster support may come in a future release.
    You can pass 4 fields, host, port (optional), database (optional) and password (optional).
    Unset fields will be set to the default values host=127.0.0.1, port=6379.
    Examples:
        array('localhost:6379');
        array('192.168.1.1:6379:1:secret');
        array('unix:///var/run/redis/redis-server.sock:1:secret');
  value: null
  section: 'cache'
  state: 'init'

- name: 'memcache_max_allowed_packet'
  comment: 'Maximum size of an object in memcache (in bytes). Default: 2MB'
  value: '2M'
  section: 'cache'
  state: 'init'

- name: 'apc_mac_allowed_packet'
  comment: 'Maximum size of an object in APC cache (in bytes). Default: 2MB'
  value: '2M'
  section: 'cache'
  state: 'init'

- name: 'redis_max_allowed_packet'
  comment: 'Maximum size of an object in Redis cache (in bytes). Default: 2MB'
  value: '2M'
  section: 'cache'
  state: 'init'

  # [[[ system
- name: 'enable_installer'
  comment: |
    THIS OPTION WILL ALLOW THE INSTALLER TO RUN AND CAN EXPOSE SENSITIVE CONFIG DATA.
    ONLY ENABLE IT IF YOU'RE REALLY SURE WHAT YOU'RE DOING!
  value: False
  section: 'system'
  state: 'init'

- name: 'dont_override'
  comment: "Don't allow these settings to be overridden by the user"
  value: []
  section: 'system'
  state: 'init'

- name: 'disabled_actions'
  comment: 'List of disabled UI elements/actions'
  value: []
  section: 'system'
  state: 'init'

- name: 'advanced_prefs'
  comment: |
    Define which settings should be listed under the 'advanced' block
    which is hidden by default
  value: []
  section: 'system'
  state: 'init'

- name: 'support_url'
  comment: |
    Provide an URL where a user can get support for this Roundcube installation
    PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE!
  value: ''
  section: 'system'

- name: 'skin_logo'
  comment: |
    Logo image replacement. Specifies location of the image as:
    - URL relative to the document root of this Roundcube installation
    - full URL with http:// or https:// prefix
    - URL relative to the current skin folder (when starts with a '/')

    An array can be used to specify different logos for specific template files
    The array key specifies the place(s) the logo should be applied to and
    is made up of (up to) 3 parts:
    - skin name prefix (always with colon, can be replaced with *)
    - template name (or * for all templates)
    - logo type - it is used for logos used on multiple templates
      the available types include '[favicon]' for favicon, '[print]' for logo on all print
      templates (e.g. messageprint, contactprint) and '[small]' for small screen logo in supported skins

    Example config for skin_logo

    array(
      // show the image /images/logo_login_small.png for the Login screen in the Elastic skin on small screens
      "elastic:login[small]" => "/images/logo_login_small.png",
      // show the image /images/logo_login.png for the Login screen in the Elastic skin
      "elastic:login" => "/images/logo_login.png",
      // show the image /images/logo_small.png in the Elastic skin
      "elastic:*[small]" => "/images/logo_small.png",
      // show the image /images/larry.png in the Larry skin
      "larry:*" => "/images/larry.png",
      // show the image /images/logo_login.png on the login template in all skins
      "login" => "/images/logo_login.png",
      // show the image /images/logo_print.png for all print type logos in all skins
      "[print]" => "/images/logo_print.png",
    );
  value: null
  section: 'system'
  state: 'init'

- name: 'auto_create_user'
  comment: |
    Automatically create a new Roundcube user when log-in the first time.
    A new user will be created once the IMAP login succeeds.
    Set to false if only registered users can use this service
  value: True
  section: 'system'
  state: 'init'

- name: 'user_aliases'
  comment: 'Enables possibility to log in using email address from user identities'
  value: False
  section: 'system'
  state: 'init'

- name: 'log_dir'
  comment: |
    use this folder to store log files
    must be writeable for the user who runs PHP process (Apache user if mod_php is being used)
    This is used by the 'file' log driver.
  value: "RCUBE_INSTALL_PATH . 'logs/'"
  quotes: False
  section: 'system'
  state: 'init'

- name: 'temp_dir'
  comment: |
    Use this folder to store temp files
    Must be writeable for the user who runs PHP process (Apache user if mod_php is being used)
  value: "RCUBE_INSTALL_PATH . 'temp/'"
  quotes: False
  section: 'system'
  state: 'init'

- name: 'temp_dir_ttl'
  comment: |
    Expire files in temp_dir after 48 hours
    Possible units: s, m, h, d, w
  value: '48h'
  section: 'system'
  state: 'init'

- name: 'force_https'
  comment: |
    Enforce connections over https
    With this option enabled, all non-secure connections will be redirected.
    It can be also a port number, hostname or hostname:port if they are
    different than default HTTP_HOST:443
  value: False
  section: 'system'
  state: 'init'

- name: 'use_https'
  comment: |
    Tell PHP that it should work as under secure connection
    even if it doesn't recognize it as secure ($_SERVER['HTTPS'] is not set)
    e.g. when you're running Roundcube behind a https proxy
    This option is mutually exclusive to 'force_https' and only either one of
    them should be set to true.
  value: False
  section: 'system'
  state: 'init'

- name: 'login_autocomplete'
  comment: |
    Allow browser-autocompletion on login form.
    0 - disabled, 1 - username and host only, 2 - username, host, password
  value: 0
  section: 'system'
  state: 'init'

- name: 'login_lc'
  comment: |
    Forces conversion of logins to lower case.
    0 - disabled, 1 - only domain part, 2 - domain and local part.
    If users authentication is case-insensitive this must be enabled.
    Note: After enabling it all user records need to be updated, e.g. with query:
          UPDATE users SET username = LOWER(username);
  value: 2
  section: 'system'
  state: 'init'

- name: 'login_username_maxlen'
  comment: 'Maximum length (in bytes) of logon username and password.'
  value: 1024
  section: 'system'
  state: 'init'

- name: 'login_password_maxlen'
  value: 1024
  section: 'system'
  state: 'init'

- name: 'login_username_filter'
  comment: |
    Logon username filter. Regular expression for use with preg_match().
    Example: '/^[a-z0-9_@.-]+$/'
  value: null
  section: 'system'
  state: 'init'

- name: 'login_rate_limit'
  comment: |
    Brute-force attacks prevention.
    The value specifies maximum number of failed logon attempts per minute.
  value: 3
  section: 'system'
  state: 'init'

- name: 'skin_include_php'
  comment: 'Includes should be interpreted as PHP files'
  value: False
  section: 'system'
  state: 'init'

- name: 'display_product_info'
  comment: |
    Display product name and software version on login screen
    0 - hide product name and version number,
    1 - show product name only,
    2 - show product name and version number
  value: 1
  section: 'system'
  state: 'init'

- name: 'session_lifetime'
  comment: 'Session lifetime in minutes'
  value: 10
  section: 'system'
  state: 'init'

- name: 'session_domain'
  comment: 'Session domain: .example.org'
  value: ''
  section: 'system'
  state: 'init'

- name: 'session_name'
  comment: |
    Session name. Default: 'roundcube_sessid'
  value: null
  section: 'system'
  state: 'init'

- name: 'session_auth_name'
  comment: |
    Session authentication cookie name. Default: 'roundcube_sessauth'
  value: null
  section: 'system'
  state: 'init'

- name: 'session_path'
  comment: |
    Session path. Defaults to PHP session.cookie_path setting.
  value: null
  section: 'system'
  state: 'init'

- name: 'session_storage'
  comment: |
    Backend to use for session storage. Can either be 'db' (default), 'redis', 'memcache', or 'php'

    If set to 'memcache' or 'memcached', a list of servers need to be specified in 'memcache_hosts'
    Make sure the Memcache extension (https://pecl.php.net/package/memcache) version >= 2.0.0
    or the Memcached extension (https://pecl.php.net/package/memcached) version >= 2.0.0 is installed.

    If set to 'redis', a server needs to be specified in 'redis_hosts'
    Make sure the Redis extension (https://pecl.php.net/package/redis) version >= 2.0.0 is installed.

    Setting this value to 'php' will use the default session save handler configured in PHP
  value: 'db'
  section: 'system'
  state: 'init'

- name: 'proxy_whitelist'
  comment: |
    List of trusted proxies
    X_FORWARDED_* and X_REAL_IP headers are only accepted from these IPs
  value: []
  section: 'system'
  state: 'init'

- name: 'trusted_host_pattern'
  comment: |
    List of trusted host names
    Attackers can modify Host header of the HTTP request causing $_SERVER['SERVER_NAME']
    or $_SERVER['HTTP_HOST'] variables pointing to a different host, that could be used
    to collect user names and passwords. Some server configurations prevent that, but not all.
    An empty list accepts any host name. The list can contain host names
    or PCRE patterns (without // delimiters, that will be added automatically).
  value: []
  section: 'system'
  state: 'init'

- name: 'ip_check'
  comment: 'Check client IP in session authorization'
  value: False
  section: 'system'
  state: 'init'

- name: 'x_frame_options'
  comment: |
    X-Frame-Options HTTP header value sent to prevent from Clickjacking.
    Possible values: sameorigin|deny|allow-from <uri>.
    Set to false in order to disable sending the header.
  value: 'sameorigin'
  section: 'system'
  state: 'init'

- name: 'des_key'
  comment: |
    this key is used to encrypt the users imap password which is stored
    in the session record (and the client cookie if remember password is enabled).
    please provide a string of exactly 24 chars.
    YOUR KEY MUST BE DIFFERENT THAN THE SAMPLE VALUE FOR SECURITY REASONS
  value: 'rcmail-!24ByteDESkey*Str'
  section: 'system'

- name: 'cipher_method'
  comment: |
    Encryption algorithm. You can use any method supported by OpenSSL.
    Default is set for backward compatibility to DES-EDE3-CBC,
    but you can choose e.g. AES-256-CBC which we consider a better choice.
  value: 'DES-EDE3-CBC'
  section: 'system'
  state: 'init'

- name: 'username_domain'
  comment: |
    Automatically add this domain to user names for login
    Only for IMAP servers that require full e-mail addresses for login
    Specify an array with 'host' => 'domain' values to support multiple hosts
    Supported replacement variables:
    %h - user's IMAP hostname
    %n - hostname ($_SERVER['SERVER_NAME'])
    %t - hostname without the first part
    %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
    %z - IMAP domain (IMAP hostname without the first part)
    For example %n = mail.domain.tld, %t = domain.tld
  value: ''
  section: 'system'
  state: 'init'

- name: 'username_domain_forced'
  comment: |
    Force domain configured in username_domain to be used for login.
    Any domain in username will be replaced by username_domain.
  value: False
  section: 'system'
  state: 'init'

- name: 'mail_domain'
  comment: |
    This domain will be used to form e-mail addresses of new users
    Specify an array with 'host' => 'domain' values to support multiple hosts
    Supported replacement variables:
    %h - user's IMAP hostname
    %n - http hostname ($_SERVER['SERVER_NAME'])
    %d - domain (http hostname without the first part)
    %z - IMAP domain (IMAP hostname without the first part)
    For example %n = mail.domain.tld, %t = domain.tld
  value: ''
  section: 'system'
  state: 'init'

- name: 'password_charset'
  comment: |
    Password character set, to change the password for user
    authentication or for password change operations
  value: 'UTF-8'
  section: 'system'
  state: 'init'

- name: 'sendmail_delay'
  comment: 'How many seconds must pass between emails sent by a user'
  value: 0
  section: 'system'
  state: 'init'

- name: 'max_message_size'
  comment: |
    Message size limit. Note that SMTP server(s) may use a different value.
    This limit is verified when user attaches files to a composed message.
    Size in bytes (possible unit suffix: K, M, G)
  value: '100M'
  section: 'system'
  state: 'init'

- name: 'max_recipients'
  comment: |
    Maximum number of recipients per message (including To, Cc, Bcc).
    Default: 0 (no limit)
  value: 0
  section: 'system'
  state: 'init'

- name: 'max_disclosed_recipients'
  comment: |
    Maximum number of recipients per message excluding Bcc header.
    This is a soft limit, which means we only display a warning to the user.
    Default: 5
  value: 5
  section: 'system'
  state: 'init'

- name: 'max_group_members'
  comment: |
    Maximum allowed number of members of an address group. Default: 0 (no limit)
    If 'max_recipients' is set this value should be less or equal
  value: 0
  section: 'system'
  state: 'init'

- name: 'product_name'
  comment: |
    Name your service. This is displayed on the login screen and in the window title
  value: 'Roundcube Webmail'
  section: 'system'

- name: 'useragent'
  comment: 'Add this user-agent to message headers when sending'
  value: "'Roundcube Webmail/'.RCUBE_VERSION"
  quotes: False
  section: 'system'
  state: 'init'

- name: 'include_host_config'
  comment: |
    Try to load host-specific configuration
    See https://github.com/roundcube/roundcubemail/wiki/Configuration:-Multi-Domain-Setup
    for more details
  value: False
  section: 'system'
  state: 'init'

- name: 'generic_message_footer'
  comment: |
    Path to a text file which will be added to each sent message
    Paths are relative to the Roundcube root folder
  value: ''
  section: 'system'
  state: 'init'

- name: 'generic_message_footer_html'
  comment: |
    Path to a text file which will be added to each sent HTML message
    Paths are relative to the Roundcube root folder
  value: ''
  section: 'system'
  state: 'init'

- name: 'http_received_header'
  comment: |
    Add a received header to outgoing mails containing the creators IP and hostname
  value: False
  section: 'system'
  state: 'init'

- name: 'http_received_header_encrypt'
  comment: |
    Whether or not to encrypt the IP address and the host name
    these could, in some circles, be considered as sensitive information;
    however, for the administrator, these could be invaluable help
    when tracking down issues.
  value: False
  section: 'system'
  state: 'init'

- name: 'line_length'
  comment: |
    Number of chars allowed for line when wrapping text.
    Text wrapping is done when composing/sending messages
  value: 72
  section: 'system'
  state: 'init'

- name: 'send_format_flowed'
  comment: 'Send plaintext messages as format=flowed'
  value: True
  section: 'system'
  state: 'init'

- name: 'mdn_use_from'
  comment: |
    According to RFC2298, return receipt envelope sender address must be
    empty. If this option is true, Roundcube will use user's identity as
    envelope sender for MDN responses.
  value: False
  section: 'system'
  state: 'init'

- name: 'identities_level'
  comment: |
    Set identities access level:
    0 - many identities with possibility to edit all params
    1 - many identities with possibility to edit all params but not email address
    2 - one identity with possibility to edit all params
    3 - one identity with possibility to edit all params but not email address
    4 - one identity with possibility to edit only signature
  value: 0
  section: 'system'
  state: 'init'

- name: 'identity_image_size'
  comment: |
    Maximum size of uploaded image in kilobytes
    Images (in html signatures) are stored in database as data URIs
  value: 64
  section: 'system'
  state: 'init'

- name: 'client_mimetypes'
  comment: |
    Mimetypes supported by the browser.
    Attachments of these types will open in a preview window
    Either a comma-separated list or an array: 'text/plain,text/html,text/xml,image/jpeg,image/gif,image/png,application/pdf'
  value: null
  section: 'system'
  state: 'init'

- name: 'mime_magic'
  comment: |
    Path to a local mime magic database file for PHPs finfo extension.
    Set to null if the default path should be used.
  value: null
  section: 'system'
  state: 'init'

- name: 'mime_types'
  comment: |
    Absolute path to a local mime.types mapping table file.
    This is used to derive mime-types from the filename extension or vice versa.
    Such a file is usually part of the apache webserver. If you don't find a file named mime.types on your system,
    download it from https://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
  value: null
  section: 'system'
  state: 'init'

- name: 'im_identify_path'
  comment: |
    Path to imagemagick identify binary (if not set we'll use Imagick or GD extensions)
  value: null
  section: 'system'
  state: 'init'

- name: 'im_convert_path'
  comment: |
    Path to imagemagick convert binary (if not set we'll use Imagick or GD extensions)
  value: null
  section: 'system'
  state: 'init'

- name: 'image_thumbnail_size'
  comment: |
    Size of thumbnails from image attachments displayed below the message content.
    Note: whether images are displayed at all depends on the 'inline_images' option.
    Set to 0 to display images in full size.
  value: 240
  section: 'system'
  state: 'init'

- name: 'contact_photo_size'
  comment: 'Maximum size of uploaded contact photos in pixel'
  value: 160
  section: 'system'
  state: 'init'

- name: 'email_dns_check'
  comment: 'Enable DNS checking for e-mail address validation'
  value: False
  section: 'system'
  state: 'init'

- name: 'no_save_sent_messages'
  comment: |
    Disables saving sent messages in Sent folder (like gmail) (Default: false)
    Note: useful when SMTP server stores sent mail in user mailbox
  value: False
  section: 'system'
  state: 'init'

- name: 'use_secure_urls'
  comment: |
    Improve system security by using special URL with security token.
    This can be set to a number defining token length. Default: 16.
    Warning: This requires http server configuration. Sample:
       RewriteRule ^/roundcubemail/[a-zA-Z0-9]{16}/(.*) /roundcubemail/$1 [PT]
       Alias /roundcubemail /var/www/roundcubemail/
    Note: Use assets_path to not prevent the browser from caching assets
  value: False
  section: 'system'
  state: 'init'

- name: 'assets_path'
  comment: |
    Allows to define separate server/path for image/js/css files
    Warning: If the domain is different cross-domain access to some
    resources need to be allowed
    Sample:
       <FilesMatch ".(eot|ttf|woff)">
       Header set Access-Control-Allow-Origin "*"
       </FilesMatch>
  value: ''
  section: 'system'
  state: 'init'

- name: 'assets_dir'
  comment: |
    While assets_path is for the browser, assets_dir informs
    PHP code about the location of asset files in filesystem
  value: ''
  section: 'system'
  state: 'init'

  # [[[ plugins
- name: 'plugins'
  comment: 'List of active plugins (in plugins/ directory)'
  value: [ 'archive', 'zipdownload' ]
  section: 'plugins'

  # [[[ ui
- name: 'message_sort_col'
  comment: |
    Default messages sort column. Use empty value for default server's sorting,
    or 'arrival', 'date', 'subject', 'from', 'to', 'fromto', 'size', 'cc'
  value: ''
  section: 'ui'
  state: 'init'

- name: 'message_sort_order'
  comment: 'Default messages sort order'
  value: 'DESC'
  section: 'ui'
  state: 'init'

- name: 'list_cols'
  comment: |
    These cols are shown in the message list. Available cols are:
    subject, from, to, fromto, cc, replyto, date, size, status, flag, attachment, priority
  value: [ 'subject', 'status', 'fromto', 'date', 'size', 'flag', 'attachment' ]
  section: 'ui'
  state: 'init'

- name: 'language'
  comment: |
    The default locale setting (leave empty for auto-detection)
    RFC1766 formatted language name like en_US, de_DE, de_CH, fr_FR, pt_BR
  value: null
  section: 'ui'
  state: 'init'

- name: 'date_format'
  comment: 'Use this format for date display (date or strftime format)'
  value: 'Y-m-d'
  section: 'ui'
  state: 'init'

- name: 'date_formats'
  comment: |
    Give this choice of date formats to the user to select from
    Note: do not use ambiguous formats like m/d/Y
  value: [ 'Y-m-d', 'Y/m/d', 'Y.m.d', 'd-m-Y', 'd/m/Y', 'd.m.Y', 'j.n.Y' ]
  section: 'ui'
  state: 'init'

- name: 'time_format'
  comment: 'Use this format for time display (date or strftime format)'
  value: 'H:i'
  section: 'ui'
  state: 'init'

- name: 'time_formats'
  comment: 'Give this choice of time formats to the user to select from'
  value: [ 'G:i', 'H:i', 'g:i a', 'h:i A' ]
  section: 'ui'
  state: 'init'

- name: 'date_short'
  comment: |
    Use this format for short date display (derived from date_format and
    time_format)
  value: 'D H:i'
  section: 'ui'
  state: 'init'

- name: 'date_long'
  comment: |
    Use this format for detailed date/time formatting (derived from
    date_format and time_format)
  value: 'Y-m-d H:i'
  section: 'ui'
  state: 'init'

- name: 'drafts_mbox'
  comment: |
    Store draft message is this mailbox
    Leave blank if draft messages should not be stored
    NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP)
  value: 'Drafts'
  section: 'ui'
  state: 'init'

- name: 'junk_mbox'
  comment: |
    Store spam messages in this mailbox
    NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP)
  value: 'Junk'
  section: 'ui'
  state: 'init'

- name: 'sent_mbox'
  comment: |
    Store sent message is this mailbox
    Leave blank if sent messages should not be stored
    NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP)
  value: 'Sent'
  section: 'ui'
  state: 'init'

- name: 'trash_mbox'
  comment: |
    Move messages to this folder when deleting them
    Leave blank if they should be deleted directly
    NOTE: Use folder names with namespace prefix (INBOX. on Courier-IMAP)
  value: 'Trash'
  section: 'ui'
  state: 'init'

- name: 'create_default_folders'
  comment: |
    Automatically create the above listed default folders on user login
  value: False
  section: 'ui'
  state: 'init'

- name: 'protect_default_folders'
  comment: |
    Protect the default folders from renames, deletes, and subscription changes
  value: True
  section: 'ui'
  state: 'init'

- name: 'show_real_foldernames'
  comment: |
    Disable localization of the default folder names listed above
  value: False
  section: 'ui'
  state: 'init'

- name: 'quota_zero_as_unlimited'
  comment: |
    If in your system 0 quota means no limit set this option to true
  value: False
  section: 'ui'
  state: 'init'

- name: 'enable_spellcheck'
  comment: |
    Make use of the built-in spell checker. It is based on GoogieSpell.
  value: True
  section: 'ui'
  state: 'init'

- name: 'spellcheck_engine'
  comment: |
    Set the spell checking engine. Possible values:
    - 'googie'  - the default (also used for connecting to Nox Spell Server, see 'spellcheck_uri' setting)
    - 'pspell'  - requires the PHP Pspell module and aspell installed
    - 'enchant' - requires the PHP Enchant module
    - 'atd'     - install your own After the Deadline server or check with
                  the people at http://www.afterthedeadline.com before using their API
    Since Google shut down their public spell checking service, the default settings
    connect to https://spell.roundcube.net/ which is a hosted service provided by Roundcube.
    You can connect to any other googie-compliant service by setting 'spellcheck_uri' accordingly.
  value: 'googie'
  section: 'ui'
  state: 'init'

- name: 'spellcheck_uri'
  comment: |
    For locally installed Nox Spell Server or After the Deadline services,
    please specify the URI to call it.
    Get Nox Spell Server from http://orangoo.com/labs/?page_id=72 or
    the After the Deadline package from http://www.afterthedeadline.com.
    Leave empty to use the public API of service.afterthedeadline.com
  value: ''
  section: 'ui'
  state: 'init'

- name: 'spellcheck_languages'
  comment: |
    These languages can be selected for spell checking.
    Configure as a PHP style hash array: array('en'=>'English', 'de'=>'Deutsch');
    Leave empty for default set of available language.
  value: null
  section: 'ui'
  state: 'init'

- name: 'spellcheck_ignore_caps'
  comment: |
    Makes that words with all letters capitalized will be ignored (e.g. GOOGLE)
  value: False
  section: 'ui'
  state: 'init'

- name: 'spellcheck_ignore_nums'
  comment: |
    Makes that words with numbers will be ignored (e.g. g00gle)
  value: False
  section: 'ui'
  state: 'init'

- name: 'spellcheck_ignore_syms'
  comment: |
    Makes that words with symbols will be ignored (e.g. g@@gle)
  value: False
  section: 'ui'
  state: 'init'

- name: 'sig_max_lines'
  comment: |
    Number of lines at the end of a message considered to contain the signature.
    Increase this value if signatures are not properly detected and colored
  value: 15
  section: 'ui'
  state: 'init'

- name: 'max_pagesize'
  comment: |
    Don't let users set pagesize to more than this value if set
  value: 200
  section: 'ui'
  state: 'init'

- name: 'min_refresh_interval'
  comment: |
    Minimal value of user's 'refresh_interval' setting (in seconds)
  value: 60
  section: 'ui'
  state: 'init'

- name: 'undo_timeout'
  comment: |
    Specifies for how many seconds the Undo button will be available
    after object delete action. Currently used with supporting address book sources.
    Setting it to 0, disables the feature.
  value: 0
  section: 'ui'
  state: 'init'

- name: 'compose_responses_static'
  comment: |
    A static list of canned responses which are immutable for the user
  array:
    - [ 'name': 'Canned Response 1', 'text': 'Static Response One' ]
    - [ 'name': 'Canned Response 2', 'text': 'Static Response Two' ]
  section: 'ui'
  state: 'init'

- name: 'keyservers'
  comment: |
    List of HKP key servers for PGP public key lookups in Enigma/Mailvelope
    Default: array("keys.fedoraproject.org", "keybase.io")
  value: []
  section: 'ui'
  state: 'init'

  # [[[ addressbook
- name: 'address_book_type'
  comment: |
    This indicates which type of address book to use. Possible choices:
    'sql' - built-in sql addressbook enabled (default),
    ''    - built-in sql addressbook disabled.
            Still LDAP or plugin-added addressbooks will be available.
            BC Note: The value can actually be anything except 'sql', it does not matter.
  value: 'sql'
  section: 'addressbook'
  state: 'init'

- name: 'ldap_public'
  comment: |
    In order to enable public ldap search, configure an array like the Verisign
    example further below. if you would like to test, simply uncomment the example.
    Array key must contain only safe characters, ie. a-zA-Z0-9_
  value: []
  section: 'addressbook'
  state: 'init'

- name: 'ldap_public_verisign'
  option: [ 'ldap_public', 'Verisign' ]
  comment: |
    If you are going to use LDAP for individual address books, you will need to
    set 'user_specific' to true and use the variables to generate the appropriate DNs to access it.

    The recommended directory structure for LDAP is to store all the address book entries
    under the users main entry, e.g.:

     o=root
      ou=people
       uid=user@domain
     mail=contact@contactdomain

    So the base_dn would be uid=%fu,ou=people,o=root
    The bind_dn would be the same as based_dn or some super user login.
  array:
    - name: 'Verisign.com'
      # Replacement variables supported in host names:
      # %h - user's IMAP hostname
      # %n - hostname ($_SERVER['SERVER_NAME'])
      # %t - hostname without the first part
      # %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
      # %z - IMAP domain (IMAP hostname without the first part)
      # For example %n = mail.domain.tld, %t = domain.tld
      hosts: [ 'directory.verisign.com' ]
      port: 389
      use_tls: False
      ldap_version: 3  # using LDAPv3
      # The timeout (in seconds) for connect + bind arrempts. This is only
      # supported in PHP >= 5.3.0 with OpenLDAP 2.x
      network_timeout: 10
      # If true the base_dn, bind_dn and bind_pass default to the user's IMAP login.
      user_specific: False
      # When 'user_specific' is enabled following variables can be used in base_dn/bind_dn config:
      # %fu - The full username provided, assumes the username is an email
      #       address, uses the username_domain value if not an email address.
      # %u  - The username prior to the '@'.
      # %d  - The domain name after the '@'.
      # %dc - The domain name hierarchal string e.g. "dc=test,dc=domain,dc=com"
      # %dn - DN found by ldap search when search_filter/search_base_dn are used
      base_dn: ''
      bind_dn: ''
      bind_pass: ''
      # It's possible to bind for an individual address book
      # The login name is used to search for the DN to bind with
      search_base_dn: ''
      search_filter: ''  # e.g. '(& (objectClass=posixAccount) (uid=%u) )'
      # DN and password to bind as before searching for bind DN, if anonymous search is not allowed
      search_bind_dn: ''
      search_bind_pw: ''
      # Base DN and filter used for resolving the user's domain root DN which feeds the %dc variables
      # Leave empty to skip this lookup and derive the root DN from the username domain
      domain_base_dn: ''
      domain_filter: ''
      # Optional map of replacement strings => attributes used when binding for an individual address book
      search_bind_attrib: []  # e.g. array('%udc' => 'ou')
      # Default for %dn variable if search doesn't return DN value
      search_dn_default: ''
      # Optional authentication identifier to be used as SASL authorization proxy
      # bind_dn need to be empty
      auth_cid: ''
      # SASL authentication method (for proxy auth), e.g. DIGEST-MD5
      auth_method: ''
      # Indicates if the addressbook shall be hidden from the list.
      # With this option enabled you can still search/view contacts.
      hidden: False
      # Indicates if the addressbook shall not list contacts but only allows searching.
      searchonly: False
      # Indicates if we can write to the LDAP directory or not.
      # If writable is true then these fields need to be populated:
      # LDAP_Object_Classes, required_fields, LDAP_rdn
      writable: False
      # To create a new contact these are the object classes to specify
      # (or any other classes you wish to use).
      LDAP_Object_Classes: [ 'top', 'inetOrgPerson' ]
      # The RDN field that is used for new entries, this field needs
      # to be one of the search_fields, the base of base_dn is appended
      # to the RDN to insert into the LDAP directory.
      LDAP_rdn: 'cn'
      # The required fields needed to build a new contact as required by
      # the object classes (can include additional fields not required by the object classes).
      required_fields: [ 'cn', 'sn', 'mail' ]
      search_fields: [ 'mail', 'cn' ]  # Fields to search in
      # Mapping of contact fields to directory attributes
      #   1. for every attribute one can specify the number of values (limit) allowed.
      #      default is 1, a wildcard * means unlimited
      #   2. another possible parameter is separator character for composite fields
      #   3. it's possible to define field format for write operations, e.g. for date fields
      #      example: 'birthday:date[YmdHis\\Z]'
      fieldmap:
        # Roundcube        LDAP:limit
        - 'name':          'cn'
          'surname':       'sn'
          'firstname':     'givenName'
          'jobtitle':      'title'
          'email':         'mail:*'
          'phone:home':    'homePhone'
          'phone:work':    'telephoneNumber'
          'phone:mobile':  'mobile'
          'phone:pager':   'pager'
          'phone:workfax': 'facsimileTelephoneNumber'
          'street':        'street'
          'zipcode':       'postalCode'
          'region':        'st'
          'locality':      'l'
          # If you country is a complex object, you need to configure 'sub_fields' below
          'country':       'c'
          'organization':  'o'
          'department':    'ou'
          'notes':         'description'
          'photo':         'jpegPhoto'
          # These currently don't work
          #'manager':      'manager'
          #'assistant':    'secretary'
      # Map of contact sub-objects (attribute name => objectClass(es)), e.g. 'c' => 'country'
      sub_fields: []
      # Generate values for the following LDAP attributes automatically when creating a new record
      autovalues:
        - 'uid':  'md5(microtime())'               # You may specify PHP code snippets which are then eval'ed
          'mail': '{givenname}.{sn}@mydomain.com'  # or composite strings with placeholders for existing attributes
      sort: 'cn'    # The field to sort the listing by.
      scope: 'sub'  # Search mode sub|base | list
      # Used for basic listing (if not empty) and will be &'d with search queries. Example: status=act
      filter: '(objectClass=inetOrgPerson)'
      fuzzy_search: True  # Server allows wildcard search
      # Enable Virtual List View to more efficiently fetch paginated data (if server supports it)
      vlv: False
      # Use Virtual List View functions for autocompletion searches (if server supports it)
      vlv_search: False
      # With VLV, we also use numSubOrdinates to query the total number of
      # records. Set this filter to get all numSubOrdinates attributes for
      # counting
      numsub_filter: '(objectClass=organizationalUnit)'
      # Root DN to search config entries (e.g. vlv indexes)
      config_root_dn: 'cn=config'
      # Enables you to limit the count of entries fetched. Setting this to 0 means no limit.
      sizelimit: '0'
      # Sets the number of seconds how long is spend on the search. Setting this to 0 means no limit.
      timelimit: '0'
      # Sets the LDAP_OPT_REFERRALS option. Mostly used in multi-domain Active Directory setups
      referrals: False
      # Sets the LDAP_OPT_DEREF option. One of: LDAP_DEREF_NEVER, LDAP_DEREF_SEARCHING, LDAP_DEREF_FINDING, LDAP_DEREF_ALWAYS
      # Used where addressbook contains aliases to objects elsewhere in the LDAP tree.
      dereference: 0

      # Definition for contact groups (uncomment if no groups are supported)
      # for the groups base_dn, the user replacements %fu, %u, %d and %dc work as for base_dn (see above)
      # if the groups base_dn is empty, the contact base_dn is used for the groups as well
      # -> in this case, assure that groups and contacts are separated due to the concernig filters!
      groups:
        - 'base_dn': ''
          'scope': 'sub'  # Search mode: sub|base | list
          'filter': '(objectClass=groupOfNames)'
          'object_classes': [ 'top', 'groupOfNames' ]  # Object classes to be assigned to new groups
          'member_attr':   'member'           # Name of the default member attribute, e.g. uniqueMember
          'name_attr':     'cn'               # Attribute to be used as group name
          'email_attr':    'mail'             # Group email address attribute (e.g. for mailing lists)
          'member_filter': '(objectClass=*)'  # Optional filter to use when querying for group members
          'vlv': False                        # Use VLV controls to list groups
          'class_member_attr':                # Mapping of group object class to member attribute used in these objects
            - 'groupOfNames': 'member'
              'groupOfUniqueNames': 'uniqueMember'

      # This configuration replaces the regular groups listing in the directory tree with
      # a hard-conoded list of groups, each listing entries with the configured base DN and filter.
      # if the 'groups' option from above is set, it'll be shown as the first entry with the name 'Groups'
      group_filters:
        - departments:
            - 'name':      'Company Departments'
              'scope':     'list'
              'base_dn':   'ou=Groups,dc=mydomain,dc=com'
              'filter':    '(| (objectclass=groupOfUniqueNames) (objectclass=groupOfURLs) )'
              'name_attr': 'cn'
        - customers:
            - 'name':      'Customers'
              'scope':     'sub'
              'base_dn':   'ou=Customers,dc=mydomain,dc=com'
              'filter':    '(objectClass=inetOrgPerson)'
              'name_attr': 'sn'
  section: 'addressbook'
  state: 'init'

- name: 'autocomplete_addressbooks'
  comment: |
    An ordered array of the ids of the addressbooks that should be searched
    when populating address autocomplete fields server-side. ex: array('sql','Verisign');
  value: [ 'sql' ]
  section: 'addressbook'
  state: 'init'

- name: 'autocomplete_min_length'
  comment: |
    The minimum number of characters required to be typed in an autocomplete field
    before address books will be searched. Most useful for LDAP directories that
    may need to do lengthy results building given overly-broad searches
  value: 1
  section: 'addressbook'
  state: 'init'

- name: 'autocomplete_threads'
  comment: |
    Number of parallel autocomplete requests.
    If there's more than one address book, n parallel (async) requests will be created,
    where each request will search in one address book. By default (0), all address
    books are searched in one request.
  value: 0
  section: 'addressbook'
  state: 'init'

- name: 'autocomplete_max'
  comment: 'Max. number of entries in autocomplete popup. Default: 15.'
  value: 15
  section: 'addressbook'
  state: 'init'

- name: 'address_template'
  comment: |
    Show address fields in this order
    Available placeholders: {street}, {locality}, {zipcode}, {country}, {region}
  value: '{street}<br/>{locality} {zipcode}<br/>{country} {region}'
  section: 'addressbook'
  state: 'init'

- name: 'addressbook_search_mode'
  comment: |
    Matching mode for addressbook search (including autocompletion)
    0 - partial (*abc*), default
    1 - strict (abc)
    2 - prefix (abc*)
    Note: For LDAP sources fuzzy_search must be enabled to use 'partial' or 'prefix' mode
  value: 0
  section: 'addressbook'
  state: 'init'

- name: 'contactlist_fields'
  comment: |
    List of fields used on contacts list and for autocompletion searches
    Warning: These are field names not LDAP attributes (see 'fieldmap' setting)!
  value: [ 'name', 'firstname', 'surname', 'email' ]
  section: 'addressbook'
  state: 'init'

- name: 'contact_search_name'
  comment: |
    Template of contact entry on the autocompletion list.
    You can use contact fields as: name, email, organization, department, etc.
    See program/steps/addressbook/func.inc for a list
  value: '{name} <{email}>'
  section: 'addressbook'
  state: 'init'

  # [[[ userprefs
- name: 'default_charset'
  comment: 'Use this charset as fallback for message decoding'
  value: 'ISO-8859-1'
  section: 'userprefs'
  state: 'init'

- name: 'skin'
  comment: 'Skin name: folder from skins/'
  value: 'elastic'
  section: 'userprefs'

- name: 'skins_allowed'
  comment: 'Limit skins available/shown in the settings section'
  value: []
  section: 'userprefs'
  state: 'init'

- name: 'standard_windows'
  comment: |
    Enables using standard browser windows (that can be handled as tabs)
    instead of popup windows
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'mail_pagesize'
  comment: 'Show up to X items in messages list view'
  value: 50
  section: 'userprefs'
  state: 'init'

- name: 'addressbook_pagesize'
  comment: 'Show up to X items in contacts list view'
  value: 50
  section: 'userprefs'
  state: 'init'

- name: 'addressbook_sort_col'
  comment: |
    Sort contacts by this col (preferably either one of name, firstname, surname)
  value: 'surname'
  section: 'userprefs'
  state: 'init'

- name: 'addressbook_name_listing'
  comment: |
    The way how contact names are displayed in the list.
    0: prefix firstname middlename surname suffix (only if display name is not set)
    1: firstname middlename surname
    2: surname firstname middlename
    3: surname, firstname middlename
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'timezone'
  comment: |
    Use this timezone to display date/time
    Valid timezone identifiers are listed here: php.net/manual/en/timezones.php
    'auto' will use the browser's timezone settings
  value: 'auto'
  section: 'userprefs'
  state: 'init'

- name: 'prefer_html'
  comment: 'Prefer displaying HTML messages'
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'show_images'
  comment: |
    Display remote resources (inline images, styles)
    0 - Never, always ask
    1 - Ask if sender is not in address book
    2 - Always allow
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'message_extwin'
  comment: 'Open messages in new window'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'compose_extwin'
  comment: 'Open message compose form in new window'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'htmleditor'
  comment: |
    Compose html formatted messages by default
     0 - never,
     1 - always,
     2 - on reply to HTML message,
     3 - on forward or reply to HTML message
     4 - always, except when replying to plain text message
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'compose_save_localstorage'
  comment: |
    Save copies of compose messages in the browser's local storage
    for recovery in case of browser crashes and session timeout.
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'prettydate'
  comment: 'Show pretty dates as standard'
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'draft_autosave'
  comment: 'Save compose message every 300 seconds (5min)'
  value: 300
  section: 'userprefs'
  state: 'init'

- name: 'layout'
  comment: |
    Interface layout. Default: 'widescreen'.
     'widescreen' - three columns
     'desktop'    - two columns, preview on bottom
     'list'       - two columns, no preview
  value: 'widescreen'
  section: 'userprefs'
  state: 'init'

- name: 'mail_read_time'
  comment: |
    Mark as read when viewing a message (delay in seconds)
    Set to -1 if messages should not be marked as read
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'logout_purge'
  comment: 'Clear Trash on logout'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'logout_expunge'
  comment: 'Compact INBOX on logout'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'inline_images'
  comment: 'Display attached images below the message body'
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'mime_param_folding'
  comment: |
    Encoding of long/non-ascii attachment names:
    0 - Full RFC 2231 compatible
    1 - RFC 2047 for 'name' and RFC 2231 for 'filename' parameter (Thunderbird's default)
    2 - Full 2047 compatible
  value: 1
  section: 'userprefs'
  state: 'init'

- name: 'skip_deleted'
  comment: |
    Set true if deleted messages should not be displayed
    This will make the application run slower
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'read_when_deleted'
  comment: |
    Set true to Mark deleted messages as read as well as deleted
    False means that a message's read status is not affected by marking it as deleted
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'flag_for_deletion'
  comment: |
    Set to true to never delete messages immediately
    Use 'Purge' to remove messages marked as deleted
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'refresh_interval'
  comment: |
    Default interval for auto-refresh requests (in seconds)
    These are requests for system state updates e.g. checking for new messages, etc.
    Setting it to 0 disables the feature.
  value: 60
  section: 'userprefs'
  state: 'init'

- name: 'check_all_folders'
  comment: 'If true all folders will be checked for recent messages'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'display_next'
  comment: |
    If true, after message/contact delete/move, the next message/contact will be displayed
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'default_list_mode'
  comment: |
    Default messages listing mode. One of 'threads' or 'list'.
  value: 'list'
  section: 'userprefs'
  state: 'init'

- name: 'autoexpand_threads'
  comment: |
    0 - Do not expand threads
    1 - Expand all threads automatically
    2 - Expand only threads with unread messages
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'reply_mode'
  comment: |
    When replying:
    -1 - don't cite the original message
    0  - place cursor below the original message
    1  - place cursor above original message (top posting)
    2  - place cursor above original message (top posting), but do not indent the quote
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'strip_existing_sig'
  comment: 'When replying strip original signature from message'
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'show_sig'
  comment: |
    Show signature:
    0 - Never
    1 - Always
    2 - New messages only
    3 - Forwards and Replies only
  value: 1
  section: 'userprefs'
  state: 'init'

- name: 'sig_below'
  comment: |
    By default the signature is placed depending on cursor position (reply_mode).
    Sometimes it might be convenient to start the reply on top but keep
    the signature below the quoted text (sig_below = true).
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'sig_separator'
  comment: |
    Enables adding of standard separator to the signature
  value: True
  section: 'userprefs'
  state: 'init'

- name: 'force_7bit'
  comment: |
    Use MIME encoding (quoted-printable) for 8bit characters in message body
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'search_mods'
  comment: |
    Defaults of the search field configuration.
    The array can contain a per-folder list of header fields which should be considered when searching
    The entry with key '*' stands for all folders which do not have a specific list set.
    Please note that folder names should to be in sync with $config['*_mbox'] options
    Example: array('*' => array('subject'=>1, 'from'=>1), 'Sent' => array('subject'=>1, 'to'=>1));
  value: null
  section: 'userprefs'
  state: 'init'

- name: 'addressbook_search_mods'
  comment: |
    Defaults of the addressbook search field configuration.
    Example: array('name'=>1, 'firstname'=>1, 'surname'=>1, 'email'=>1, '*'=>1);
  value: null
  section: 'userprefs'
  state: 'init'

- name: 'delete_junk'
  comment: 'Directly delete messages in Junk instead of moving to Trash'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'mdn_requests'
  comment: |
    Behavior if a received message requests a message delivery notification (read receipt)
    0 = ask the user, 1 = send automatically, 2 = ignore (never send or ask)
    3 = send automatically if sender is in addressbook, otherwise ask the user
    4 = send automatically if sender is in addressbook, otherwise ignore
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'mdn_default'
  comment: 'Return receipt checkbox default state'
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'dsn_default'
  comment: |
    Delivery Status Notification checkbox default state
  value: 0
  section: 'userprefs'
  state: 'init'

- name: 'reply_same_folder'
  comment: |
    Place replies in the folder of the message being replied to
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'forward_attachment'
  comment: |
    Sets default mode of Forward feature to "forward as attachment"
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'default_addressbook'
  comment: |
    Defines address book (internal index) to which new contacts will be added
    By default it is the first writeable addressbook.
    Note: Use '0' for built-in address book.
  value: null
  section: 'userprefs'
  state: 'init'

- name: 'spellcheck_before_send'
  comment: 'Enables spell checking before sending a message.'
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'autocomplete_single'
  comment: |
    Skip alternative email addresses in autocompletion (show one address per contact)
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'default_font'
  comment: |
    Default font for composed HTML message.
    Supported values: Andale Mono, Arial, Arial Black, Book Antiqua, Courier New,
    Georgia, Helvetica, Impact, Tahoma, Terminal, Times New Roman, Trebuchet MS, Verdana
  value: 'Verdana'
  section: 'userprefs'
  state: 'init'

- name: 'default_font_size'
  comment: |
    Default font size for composed HTML message.
    Supported sizes: 8pt, 10pt, 12pt, 14pt, 18pt, 24pt, 36pt
  value: '10pt'
  section: 'userprefs'
  state: 'init'

- name: 'message_show_email'
  comment: |
    Enables display of email address with name instead of a name (and address in title)
  value: False
  section: 'userprefs'
  state: 'init'

- name: 'reply_all_mode'
  comment: |
    Default behavior of Reply-All button:
    0 - Reply-All always
    1 - Reply-List if mailing list is detected
  value: 0
  section: 'userprefs'
  state: 'init'

roundcube__default_configuration

This list defines Roundcube configuration options which are defined by the role and override the original configuration options.

roundcube__default_configuration:

  - name: 'db_dsnw'
    value: '{{ "sqlite:///" + roundcube__git_dest + "/"
                            + roundcube__database_map[roundcube__database].dbname | d()
                            + "?mode=640" }}'
    state: '{{ "present"
               if (roundcube__database_map[roundcube__database].dbtype == "sqlite")
               else "ignore" }}'

  - name: 'db_dsnw'
    value: '{{ "mysql://" + roundcube__database_map[roundcube__database].dbuser | d() + ":"
                          + roundcube__database_map[roundcube__database].dbpass | d() + "@"
                          + roundcube__database_map[roundcube__database].dbhost | d() + "/"
                          + roundcube__database_map[roundcube__database].dbname | d() }}'
    state: '{{ "present"
               if (roundcube__database_map[roundcube__database].dbtype == "mysql")
               else "ignore" }}'

  - name: 'db_dsnw'
    value: '{{ "pgsql://" + roundcube__database_map[roundcube__database].dbuser | d() + ":"
                          + roundcube__database_map[roundcube__database].dbpass | d() + "@"
                          + roundcube__database_map[roundcube__database].dbhost | d() + "/"
                          + roundcube__database_map[roundcube__database].dbname | d() }}'
    state: '{{ "present"
               if (roundcube__database_map[roundcube__database].dbtype == "postgresql")
               else "ignore" }}'

  - name: 'log_driver'
    comment: |
      Log driver: "syslog", "stdout" or "file"
    value: '{{ roundcube__log_driver }}'

  - name: 'imap_host'
    value: '{{ roundcube__imap_server }}'

    # Enable use of memcached to cache IMAP indexes, if local memcached
    # instance is detected
  - name: 'imap_cache'
    value: 'memcached'
    state: '{{ "present" if roundcube__memcached_enabled | bool else "ignore" }}'

    # Enable message caching in the database if the IMAP server is remote
  - name: 'messages_cache'
    value: True
    state: '{{ "ignore"
               if (ansible_local | d() and ansible_local.dovecot | d() and
                   (ansible_local.dovecot.installed | d()) | bool)
               else "present" }}'

  - name: 'smtp_host'
    value: '{{ roundcube__smtp_server }}'

  - name: 'smtp_user'
    value: '{{ roundcube__smtp_user }}'

  - name: 'smtp_pass'
    value: '{{ roundcube__smtp_pass }}'

    # Enable use of memcached to cache LDAP data, if local memcached instance
    # is detected
  - name: 'ldap_cache'
    value: 'memcached'
    state: '{{ "present" if roundcube__memcached_enabled | bool else "ignore" }}'

    # Enable support for memcached on localhost if it's detected
  - name: 'memcache_hosts'
    value: '{{ roundcube__memcached_hosts }}'
    state: '{{ "present" if roundcube__memcached_enabled | bool else "ignore" }}'

    # Enable support for Redis on localhost if it's detected
  - name: 'redis_hosts'
    value: '{{ roundcube__redis_hosts }}'
    state: '{{ "present" if roundcube__redis_enabled | bool else "ignore" }}'

  - name: 'skin_logo'
    value: '{{ roundcube__skin_logo }}'

    # Ensure that all communication to the client is encrypted
  - name: 'force_https'
    value: True

    # Configure preferred session storage backend
  - name: 'session_storage'
    value: '{{ roundcube__session_storage }}'
    state: '{{ "present" if roundcube__session_storage | d() else "ignore" }}'

  - name: 'des_key'
    value: '{{ roundcube__des_key }}'

    # Roundcube developers consider this a better choice
  - name: 'cipher_method'
    value: 'AES-256-CBC'

  - name: 'username_domain'
    value: '{{ roundcube__username_domain }}'

    # Slow down potential bots
  - name: 'sendmail_delay'
    value: 5

  - name: 'product_name'
    value: '{{ roundcube__product_name }}'

    # Use the system-wide MIME database from the 'mime-support' APT package
  - name: 'mime_types'
    value: '/etc/mime.types'

    # Help mitigate mails to non-existent DNS domains
  - name: 'email_dns_check'
    value: True

  - name: 'plugins'
    value: '{{ roundcube__combined_plugins | debops.debops.parse_kv_items
               | selectattr("state", "equalto", "enabled")
               | map(attribute="name") | list | unique }}'

    # Create Special Folders automatically. This will ensure that the Junk
    # folder is present and selected in the preferences.
  - name: 'create_default_folders'
    value: True

    # Set minimum refresh interval available to users to 5 minutes, to lower
    # the IMAP server load.
  - name: 'min_refresh_interval'
    value: 300

    # Enable autocompletion for the LDAP address book.
  - name: 'autocomplete_addressbooks'
    value: '{{ (["sql"] + (["People"] if roundcube__ldap_enabled | bool else []))
               | flatten }}'
    state: '{{ "present" if roundcube__ldap_enabled | bool else "ignore" }}'

    # Set the default number of autocompletion characters for lower sever load.
  - name: 'autocomplete_min_length'
    value: 3

    # Only pick single e-mail address in autocomplete, this reduces the number
    # of entries shown to the user.
  - name: 'autocomplete_single'
    value: True

    # Configure the access to the default LDAP address book managed by DebOps.
    # Roundcube will use user credentials to login to the LDAP directory.
  - name: 'ldap_public_people'
    option: [ 'ldap_public', 'People' ]
    section: 'addressbook'
    state: '{{ "present" if roundcube__ldap_enabled | bool else "ignore" }}'
    array:
      - name: '{{ roundcube__ldap_addressbook_name }}'
        hosts: '{{ (["tls://"] if roundcube__ldap_use_tls else [""])
                   | product(roundcube__ldap_hosts) | map("join")
                   | product([roundcube__ldap_port]) | map("join") }}'
        ldap_version: 3
        user_specific: True
        base_dn: '{{ roundcube__ldap_people_dn | join(",") }}'
        bind_dn: '{{ "uid=%u," + roundcube__ldap_people_dn | join(",") }}'
        bind_pass: ''
        search_base_dn: '{{ roundcube__ldap_base_dn | join(",") }}'
        search_filter: '(&
                          (objectClass=mailRecipient)
                          (|
                            (uid=%u)
                            (mail=%fu)
                          )
                        )'
        search_bind_dn: '{{ roundcube__ldap_binddn }}'
        search_bind_pw: '{{ roundcube__ldap_bindpw }}'
        filter: '(objectClass=inetOrgPerson)'
        scope: 'sub'
        searchonly: True
        vlv: False
        sort: 'sn'
        search_fields: [ 'sn', 'cn', 'mail', 'telephoneNumber' ]
        hidden: '{{ roundcube__ldap_hidden }}'
        writable: False
        groups:
          - base_dn: '{{ roundcube__ldap_groups_dn | join(",") }}'
            filter: '(objectClass=groupOfNames)'
            object_classes: [ 'groupOfNames' ]
        fieldmap: [ '{{ roundcube__ldap_field_map }}' ]

    # Set the default mail charset to Unicode
  - name: 'default_charset'
    value: 'UTF-8'

  - name: 'skin'
    value: '{{ roundcube__skin_folder }}'

    # Don't prefer HTML message view by default
  - name: 'prefer_html'
    value: False

    # Refresh the mail status in longer intervals (15 minutes) by default, to
    # make the IMAP server load lower.
  - name: 'refresh_interval'
    value: 900

    # Delete spam messages without moving them to Trash first
  - name: 'delete_junk'
    value: True

    # Forward e-mails as attachments by default
  - name: 'forward_attachment'
    value: True

    # Display the sender e-mail address by default to help users detect forged
    # senders
  - name: 'message_show_email'
    value: True

    # Better support for mailing lists
  - name: 'reply_all_mode'
    value: 1

  - name: 'swipe_actions'
    comment: |
      Configuration for the 'swipe' Roundcube plugin
    array:
      - messagelist:
          - left:  'swipe-read'
            right: 'move'
            down:  'checkmail'
      - contactlist:
          - left:  'none'
            right: 'compose'
            down:  'none'

  - name: 'enable_spellcheck'
    value: True
    state: 'present'

  - name: 'spellcheck_engine'
    value: 'enchant'
    state: 'present'

  - name: 'spellcheck_ignore_caps'
    value: True
    state: 'present'

  - name: 'spellcheck_ignore_nums'
    value: True
    state: 'present'

  - name: 'spellcheck_ignore_syms'
    value: True
    state: 'present'

roundcube__configuration

This list defines Roundcube configuration options which should be present on all hosts in the Ansible inventory.

roundcube__configuration: []

roundcube__group_configuration

This list defines Roundcube configuration options which should be present on hosts in a specific Ansible inventory group.

roundcube__group_configuration: []

roundcube__host_configuration

This list defines Roundcube configuration options which should be present on specific hosts in the Ansible inventory.

roundcube__host_configuration: []

roundcube__combined_configuration

This variable combines all Roundcube configuration lists and is used in role tasks and templates.

roundcube__combined_configuration: '{{ roundcube__original_configuration
                                       + roundcube__default_configuration
                                       + roundcube__configuration
                                       + roundcube__group_configuration
                                       + roundcube__host_configuration }}'

Configuration file sections 

These variables define the sections in the Roundcube config/config.inc.php configuration file. See roundcube__configuration_sections for more details.

roundcube__default_configuration_sections

The list of the default configuration sections defined by the role.

roundcube__default_configuration_sections:

  - name: 'init'
    state: 'hidden'

  - name: 'sql'
    title: 'SQL DATABASE'

  - name: 'logging'
    title: 'LOGGING/DEBUGGING'

  - name: 'imap'

  - name: 'smtp'

  - name: 'ldap'

  - name: 'cache'
    title: 'CACHE(S)'

  - name: 'system'

  - name: 'plugins'

  - name: 'ui'
    title: 'USER INTERFACE'

  - name: 'addressbook'
    title: 'ADDRESSBOOK SETTINGS'

  - name: 'userprefs'
    title: 'USER PREFERENCES'

  - name: 'unknown'
    title: 'OTHER OPTIONS'

roundcube__configuration_sections

List of configuration sections defined by the user.

roundcube__configuration_sections: []

roundcube__combined_configuration_sections

Variable which combines all of the configuration section lists and is used in role tasks and templates.

roundcube__combined_configuration_sections: '{{ roundcube__default_configuration_sections
                                                + roundcube__configuration_sections }}'

Roundcube plugins 

The variables below contain configuration of Roundcube plugins installed using PHP Composer. See roundcube__plugins for more details.

roundcube__default_plugins

List of Roundcube plugins configured by the role.

roundcube__default_plugins:

    # Plugin that adds a new button to the toolbar to move messages to a (user
    # selectable) archive folder.
  - name: 'archive'
    state: 'enabled'

    # This is a core plugin which provides support for handling attachments
    # through the filesystem. It might be required by other plugins.
  - name: 'filesystem_attachments'
    state: 'enabled'

    # This plugin provides jQuery library and features for other plugins.
  - name: 'jqueryui'
    state: 'enabled'

    # This plugin adds an option to download all attachments to a message in
    # one zip file, when a message has multiple attachments. The plugin also
    # allows the download of a selection of messages in 1 zip file.
  - name: 'zipdownload'
    state: 'enabled'
    options:

      - name: 'zipdownload_attachments'
        comment: |
          Zip attachments
          Only show the link when there are more than this many attachments
          -1 to prevent downloading of attachments as zip
        value: 1

      - name: 'zipdownload_selection'
        comment: |
          Zip selection of mail messages
          This option enables downloading of multiple messages as one zip archive.
          The number or string value specifies maximum total size of all messages
          in the archive (not the size of the archive itself).
        value: '50MB'

      - name: 'zipdownload_charset'
        comment: |
          Charset to use for filenames inside the zip
        value: 'UTF-8'

    # This entry installs the libraries required for LDAP support in Roundcube.
    # It's not a real plugin.
  - name: 'ldap_support'
    package: 'kolab/net_ldap3'
    state: '{{ "present" if roundcube__ldap_enabled | bool else "ignore" }}'

    # This plugin adds right-click context menus to various parts of the
    # Roundcube interface.
  - name: 'contextmenu'
    package: 'johndoh/contextmenu{{ ":3.2.1"
              if roundcube__git_version is version("1.5", "<") else "" }}'
    state: 'enabled'

    # This plugin provides a toolbar button and folder menu option which
    # calculates and displays the sizes of the message folders.
  - name: 'show_folder_size'
    package: 'jfcherng/show-folder-size'
    state: 'enabled'
    options:

      - name: 'auto_show_folder_size'
        comment: |
          Automatically show the folder size without clicking on the toolbar button.
          This could be a serious performance penalty if there are many users
        value: False

      - name: 'show_mailboxoptions_button'
        comment: 'Show mailbox options button'
        value: True

      - name: 'show_toolbar_button'
        comment: 'Show the toolbar button'
        value: False

    # This plugin adds a button on the main toolbar which opens the
    # Nextcloud/ownCloud instance at specified URL.
  - name: 'cloud_button'
    package: 'san4op/cloud_button'
    state: 'enabled'
    options:

      - name: 'cloud_button_url'
        comment: 'URL to cloud storage'
        value: '{{ "https://cloud." + ansible_domain + "/" }}'

    # This plugin uses the LDAP directory to create the user identity at login.
    # Roundcube 1.4.x might need to be patched for this to work correctly.
    # See: https://github.com/roundcube/roundcubemail/issues/7667
  - name: 'new_user_identity'
    state: '{{ "enabled" if roundcube__ldap_enabled | bool else "ignore" }}'
    options:

      - name: 'new_user_identity_addressbook'
        comment: |
          The id of the address book to use to automatically set a
          user's full name in their new identity. (This should be an
          string, which refers to the $config['ldap_public'] array.)
        value: 'People'

      - name: 'new_user_identity_match'
        comment: |
          When automatically setting a user's full name in their
          new identity, match the user's login name against this field.
        value: 'mail'

      - name: 'new_user_identity_onlogin'
        comment: |
          Determine whether to import user's identities on each login.
          New user identity will be created for each e-mail address
          present in address book, but not assigned to any identity.
        value: True

  - name: 'password'
    state: '{{ "enabled" if roundcube__ldap_password_enabled | bool else "absent" }}'
    options:

      - name: 'password_driver'
        comment: |
          Password Plugin options
          -----------------------
          A driver to use for password change. Default: "sql".
          See README file for list of supported driver names.
        value: '{{ "ldap_exop" if roundcube__ldap_password_enabled | bool else "sql" }}'

      - name: 'password_strength_driver'
        comment: |
          A driver to use for checking password strength. Default: null (disabled).
          See README file for list of supported driver names.
        value: null

      - name: 'password_confirm_current'
        comment: |
          Determine whether current password is required to change password.
          Default: false.
        value: True

      - name: 'password_minimum_length'
        comment: |
          Require the new password to be a certain length.
          set to blank to allow passwords of any length
        value: 0

      - name: 'password_minimum_score'
        comment: |
          Require the new password to have at least the specified strength score.
          Note: Password strength is scored from 1 (week) to 5 (strong).
        value: 0

      - name: 'password_log'
        comment: |
          Enables logging of password changes into logs/password
        value: False

      - name: 'password_login_exceptions'
        comment: |
          Comma-separated list of login exceptions for which password change
          will be not available (no Password tab in Settings)
        value: null

      - name: 'password_hosts'
        comment: |
          Array of hosts that support password changing.
          Listed hosts will feature a Password option in Settings; others will not.
          Example: array('mail.example.com', 'mail2.example.org');
          Default is NULL (all hosts supported).
        value: null

      - name: 'password_force_save'
        comment: |
          Enables saving the new password even if it matches the old password. Useful
          for upgrading the stored passwords after the encryption scheme has changed.
        value: False

      - name: 'password_force_new_user'
        comment: |
          Enables forcing new users to change their password at their first login.
        value: False

      - name: 'password_algorithm'
        comment: |
          Default password hashing/crypting algorithm.
          Possible options: des-crypt, ext-des-crypt, md5-crypt, blowfish-crypt,
          sha256-crypt, sha512-crypt, md5, sha, smd5, ssha, ssha512, samba, ad, dovecot, clear.
          For details see password::hash_password() method.
        value: 'clear'

      - name: 'password_algorithm_prefix'
        comment: |
          Password prefix (e.g. {CRYPT}, {SHA}) for passwords generated
          using password_algorithm above. Default: empty.
        value: ''

      - name: 'password_dovecotpw'
        comment: |
          Path for dovecotpw/doveadm-pw (if not in the $PATH).
          Used for password_algorithm = 'dovecot'.
          $config['password_dovecotpw'] = '/usr/local/sbin/dovecotpw'; // for dovecot-1.x
        value: '/usr/bin/doveadm pw'  # for dovecot-2.x

      - name: 'password_dovecotpw_method'
        comment: |
          Dovecot password scheme.
          Used for password_algorithm = 'dovecot'.
        value: 'CRAM-MD5'

      - name: 'password_dovecotpw_with_method'
        comment: |
          Enables use of password with method prefix, e.g. {MD5}$1$LUiMYWqx$fEkg/ggr/L6Mb2X7be4i1/
          when using password_algorithm=dovecot
        value: False

      - name: 'password_blowfish_cost'
        comment: |
          Iteration count parameter for Blowfish-based hashing algo.
          It must be between 4 and 31. Default: 12.
          Be aware, the higher the value, the longer it takes to generate the password hashes.
        value: 12

      - name: 'password_crypt_rounds'
        comment: |
          Number of rounds for the sha256 and sha512 crypt hashing algorithms.
          Must be at least 1000. If not set, then the number of rounds is left up
          to the crypt() implementation. On glibc this defaults to 5000.
          Be aware, the higher the value, the longer it takes to generate the password hashes.
        value: 50000

      - name: 'password_disabled'
        comment: |
          This option temporarily disables the password change functionality.
          Use it when the users database server is in maintenance mode or sth like that.
          You can set it to TRUE/FALSE or a text describing the reason
          which will replace the default.
        value: False

      - name: 'password_username_format'
        comment: |
          Various drivers/setups use different format of the username.
          This option allows you to force specified format use. Default: '%u'.
          Supported variables:
              %u - full username,
              %l - the local part of the username (in case the username is an email address)
              %d - the domain part of the username (in case the username is an email address)
          Note: This may no apply to some drivers implementing their own rules, e.g. sql.
        value: '%u'

      - name: 'password_db_dsn'
        comment: |
          SQL Driver options
          ------------------
          PEAR database DSN for performing the query. By default
          Roundcube DB settings are used.
          Supported replacement variables:
          %h - user's IMAP hostname
          %n - hostname ($_SERVER['SERVER_NAME'])
          %t - hostname without the first part
          %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
          %z - IMAP domain (IMAP hostname without the first part)
        value: ''

      - name: 'password_query'
        comment: |
          The SQL query used to change the password.
          The query can contain the following macros that will be expanded as follows:
               %p is replaced with the plaintext new password
               %P is replaced with the encrypted/hashed new password
                  according to configured password_method
               %o is replaced with the old (current) password
               %O is replaced with the encrypted/hashed old (current) password
                  according to configured password_method
               %h is replaced with the imap host (from the session info)
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username
                  (in case the username is an email address)
               %d is replaced with the domain part of the username
                  (in case the username is an email address)
          Deprecated macros:
               %c is replaced with the crypt version of the new password, MD5 if available
                  otherwise DES. More hash function can be enabled using the password_crypt_hash
                  configuration parameter.
               %D is replaced with the dovecotpw-crypted version of the new password
               %n is replaced with the hashed version of the new password
               %q is replaced with the hashed password before the change
          Escaping of macros is handled by this module.
          Default: "SELECT update_passwd(%c, %u)"
        value: 'SELECT update_passwd(%c, %u)'

      - name: 'password_crypt_hash'
        comment: |
          By default the crypt() function which is used to create the %c
          parameter uses the md5 algorithm (deprecated, use %P).
          You can choose between: des, md5, blowfish, sha256, sha512.
        value: 'md5'

      - name: 'password_idn_ascii'
        comment: |
          By default domains in variables are using unicode.
          Enable this option to use punycoded names
        value: False

      - name: 'password_hash_algorithm'
        comment: |
          Using a password hash for %n and %q variables (deprecated, use %P).
          Determine which hashing algorithm should be used to generate
          the hashed new and current password for using them within the
          SQL query. Requires PHP's 'hash' extension.
        value: 'sha1'

      - name: 'password_hash_base64'
        comment: |
          You can also decide whether the hash should be provided
          as hex string or in base64 encoded format.
        value: False

      - name: 'password_pop_host'
        comment: |
          Poppassd Driver options
          -----------------------
          The host which changes the password (default: localhost)
          Supported replacement variables:
            %n - hostname ($_SERVER['SERVER_NAME'])
            %t - hostname without the first part
            %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
            %h - IMAP host
            %z - IMAP domain without first part
            %s - domain name after the '@' from e-mail address provided at login screen
        value: 'localhost'

      - name: 'password_pop_port'
        comment: |
          TCP port used for poppassd connections (default: 106)
        value: 106

      - name: 'password_saslpasswd_args'
        comment: |
          SASL Driver options
          -------------------
          Additional arguments for the saslpasswd2 call
        value: ''

      - name: 'password_ldap_host'
        comment: |
          LDAP, LDAP_SIMPLE and LDAP_EXOP Driver options
          -----------------------------------
          LDAP server name to connect to.
          You can provide one or several hosts in an array in which case the hosts are tried from left to right.
          Example: array('ldap1.example.com', 'ldap2.example.com');
          Default: 'localhost'
        value: '{{ (roundcube__ldap_hosts | first)
                   if roundcube__ldap_hosts | d()
                   else "" }}'

      - name: 'password_ldap_port'
        comment: |
          LDAP server port to connect to
          Default: '389'
        value: '{{ roundcube__ldap_port }}'

      - name: 'password_ldap_starttls'
        comment: |
          TLS is started after connecting
          Using TLS for password modification is recommended.
          Default: false
        value: '{{ roundcube__ldap_use_tls | bool }}'

      - name: 'password_ldap_version'
        comment: |
          LDAP version
          Default: '3'
        value: '3'

      - name: 'password_ldap_basedn'
        comment: |
          LDAP base name (root directory)
          Example: 'dc=example,dc=com'
        value: '{{ roundcube__ldap_base_dn | join(",") }}'

      - name: 'password_ldap_method'
        comment: |
          LDAP connection method
          There are two connection methods for changing a user's LDAP password.
          'user': use user credential (recommended, require password_confirm_current=true)
          'admin': use admin credential (this mode require password_ldap_adminDN and password_ldap_adminPW)
          Default: 'user'
        value: 'user'

      - name: 'password_ldap_adminDN'
        comment: |
          LDAP Admin DN
          Used only in admin connection mode
          Default: null
        value: null

      - name: 'password_ldap_adminPW'
        comment: |
          LDAP Admin Password
          Used only in admin connection mode
          Default: null
        value: null

      - name: 'password_ldap_userDN_mask'
        comment: |
          LDAP user DN mask
          The user's DN is mandatory and as we only have his login,
          we need to re-create his DN using a mask
          '%login' will be replaced by the current roundcube user's login
          '%name' will be replaced by the current roundcube user's name part
          '%domain' will be replaced by the current roundcube user's domain part
          '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com"
          Example: 'uid=%login,ou=people,dc=example,dc=com'
        value: 'uid=%login,ou=people,dc=example,dc=com'
        state: 'comment'  # use searches instead

      - name: 'password_ldap_searchDN'
        comment: |
          LDAP search DN
          The DN roundcube should bind with to find out user's DN
          based on his login. Note that you should comment out the default
          password_ldap_userDN_mask setting for this to take effect.
          Use this if you cannot specify a general template for user DN with
          password_ldap_userDN_mask. You need to perform a search based on
          users login to find his DN instead. A common reason might be that
          your users are placed under different ou's like engineering or
          sales which cannot be derived from their login only.
        value: '{{ roundcube__ldap_binddn }}'

      - name: 'password_ldap_searchPW'
        comment: |
          LDAP search password
          If password_ldap_searchDN is set, the password to use for
          binding to search for user's DN. Note that you should comment out the default
          password_ldap_userDN_mask setting for this to take effect.
          Warning: Be sure to set appropriate permissions on this file so this password
          is only accessible to roundcube and don't forget to restrict roundcube's access to
          your directory as much as possible using ACLs. Should this password be compromised
          you want to minimize the damage.
        value: '{{ roundcube__ldap_bindpw }}'

      - name: 'password_ldap_search_base'
        comment: |
          LDAP search base
          If password_ldap_searchDN is set, the base to search in using the filter below.
          Note that you should comment out the default password_ldap_userDN_mask setting
          for this to take effect.
        value: '{{ roundcube__ldap_base_dn | join(",") }}'

      - name: 'password_ldap_search_filter'
        comment: |
          LDAP search filter
          If password_ldap_searchDN is set, the filter to use when
          searching for user's DN. Note that you should comment out the default
          password_ldap_userDN_mask setting for this to take effect.
          '%login' will be replaced by the current roundcube user's login
          '%name' will be replaced by the current roundcube user's name part
          '%domain' will be replaced by the current roundcube user's domain part
          '%dc' will be replaced by domain name hierarchal string e.g. "dc=test,dc=domain,dc=com"
          Example: '(uid=%login)'
          Example: '(&(objectClass=posixAccount)(uid=%login))'
        value: '(&
                  (objectClass=mailRecipient)
                  (|
                    (uid=%name)
                    (mail=%login)
                  )
                )'

      - name: 'password_ldap_encodage'
        comment: |
          LDAP password hash type
          Standard LDAP encryption type which must be one of: crypt,
          ext_des, md5crypt, blowfish, md5, sha, smd5, ssha, ad, cram-md5 (dovecot style) or clear.
          Set to 'default' if you want to use method specified in password_algorithm option above.
          Multiple password Values can be generated by concatenating encodings with a +. E.g. 'cram-md5+crypt'
          Default: 'crypt'.
        value: 'clear'  # default: crypt

      - name: 'password_ldap_pwattr'
        comment: |
          LDAP password attribute
          Name of the ldap's attribute used for storing user password
          Default: 'userPassword'
        value: 'userPassword'

      - name: 'password_ldap_force_replace'
        comment: |
          LDAP password force replace
          Force LDAP replace in cases where ACL allows only replace not read
          See https://pear.php.net/package/Net_LDAP2/docs/latest/Net_LDAP2/Net_LDAP2_Entry.html#methodreplace
          Default: true
        value: True

      - name: 'password_ldap_lchattr'
        comment: |
          LDAP Password Last Change Date
          Some places use an attribute to store the date of the last password change
          The date is measured in "days since epoch" (an integer value)
          Whenever the password is changed, the attribute will be updated if set (e.g. shadowLastChange)
        value: ''

      - name: 'password_ldap_samba_pwattr'
        comment: |
          LDAP Samba password attribute, e.g. sambaNTPassword
          Name of the LDAP's Samba attribute used for storing user password
        value: ''

      - name: 'password_ldap_samba_lchattr'
        comment: |
          LDAP Samba Password Last Change Date attribute, e.g. sambaPwdLastSet
          Some places use an attribute to store the date of the last password change
          The date is measured in "seconds since epoch" (an integer value)
          Whenever the password is changed, the attribute will be updated if set
        value: ''

      - name: 'password_ldap_ppolicy_cmd'
        comment: |
          LDAP PPolicy Driver options
          -----------------------------------
          LDAP Change password command - filename of the perl script
          Example: 'change_ldap_pass.pl'
        value: 'change_ldap_pass.pl'

      - name: 'password_ldap_ppolicy_uri'
        comment: |
          LDAP URI
          Example: 'ldap://ldap.example.com/ ldaps://ldap2.example.com:636/'
        value: 'ldap://localhost/'

      - name: 'password_ldap_ppolicy_basedn'
        comment: |
          LDAP base name (root directory)
          Example: 'dc=example,dc=com'
        value: 'dc=example,dc=com'

      - name: 'password_ldap_ppolicy_searchDN'
        value: 'cn=someuser,dc=example,dc=com'

      - name: 'password_ldap_ppolicy_searchPW'
        value: 'secret'

      - name: 'password_ldap_policy_search_filter'
        comment: |
          LDAP search filter
          Example: '(uid=%login)'
          Example: '(&(objectClass=posixAccount)(uid=%login))'
        value: '(uid=%login)'

      - name: 'password_ldap_ppolicy_cafile'
        comment: |
          CA Certificate file if in URI is LDAPS connection
        value: '/etc/ssl/certs/ca-certificates.crt'

      - name: 'password_directadmin_host'
        comment: |
          DirectAdmin Driver options
          --------------------------
          The host which changes the password
          Use 'ssl://host' instead of 'tcp://host' when running DirectAdmin over SSL.
          The host can contain the following macros that will be expanded as follows:
              %h is replaced with the imap host (from the session info)
              %d is replaced with the domain part of the username (if the username is an email)
        value: 'tcp://localhost'

      - name: 'password_directadmin_port'
        comment: |
          TCP port used for DirectAdmin connections
        value: 2222

      - name: 'password_vpopmaild_host'
        comment: |
          vpopmaild Driver options
          -----------------------
          The host which changes the password
        value: 'localhost'

      - name: 'password_vpopmaild_port'
        comment: |
          TCP port used for vpopmaild connections
        value: 89

      - name: 'password_vpopmaild_timeout'
        comment: |
          Timeout used for the connection to vpopmaild (in seconds)
        value: 10

      - name: 'password_cpanel_host'
        comment: |
          cPanel Driver options
          --------------------------
          The cPanel Host name
        value: 'host.domain.com'

      - name: 'password_cpanel_username'
        comment: |
          The cPanel admin username
        value: 'username'

      - name: 'password_cpanel_password'
        comment: |
          The cPanel admin password
        value: 'password'

      - name: 'password_cpanel_hash'
        comment: |
          The cPanel admin hash
          If you prefer to use a hash (Remote Access Key) instead of plain password, enter it below.
          Hash takes precedence over password auth.
          You can generate a Remote Access Key in WHM -> Clusters -> Remote Access Key
        value: ''

      - name: 'password_cpanel_port'
        comment: |
          The cPanel port to use
        value: 2087

      - name: 'password_cpanel_webmail_host'
        comment: |
          cPanel Webmail Driver options
          -----------------------------
          The cPanel Host name
        value: 'host.domain.com'

      - name: 'password_cpanel_webmail_port'
        comment: |
          The cPanel port to use
        value: 2096

      - name: 'password_ximss_host'
        comment: |
          XIMSS (Communigate server) Driver options
          -----------------------------------------
          Host name of the Communigate server
        value: 'mail.example.com'

      - name: 'password_ximss_port'
        comment: |
          XIMSS port on Communigate server
        value: 11024

      - name: 'password_chpasswd_cmd'
        comment: |
          chpasswd Driver options
          ---------------------
          Command to use (see "Sudo setup" in README)
        value: 'sudo /usr/sbin/chpasswd 2> /dev/null'

      - name: 'xmail_host'
        comment: |
          XMail Driver options
          ---------------------
        value: 'localhost'

      - name: 'xmail_user'
        value: 'YourXmailControlUser'

      - name: 'xmail_pass'
        value: 'YourXmailControlPass'

      - name: 'xmail_port'
        value: 6017

      - name: 'hmailserver_remote_dcom'
        comment: |
          hMail Driver options
          -----------------------
          Remote hMailServer configuration
          true:  HMailserver is on a remote box (php.ini: com.allow_dcom = true)
          false: Hmailserver is on same box as PHP
        value: False

      - name: 'hmailserver_server'
        comment: 'Windows credentials'
        array:
          - Server: 'localhost'
          - Username: 'administrator'
          - Password: 'password'

      - name: 'password_pw_usermod_cmd'
        comment: |
          pw_usermod Driver options
          --------------------------
          Use comma delimited exlist to disable password change for users.
          See "Sudo setup" in README file.
        value: 'sudo /usr/sbin/pw usermod -h 0 -n'

      - name: 'password_dbmail_args'
        comment: |
          DBMail Driver options
          -------------------
          Additional arguments for the dbmail-users call
        value: '-p sha512'

      - name: 'password_expect_bin'
        comment: |
          Expect Driver options
          ---------------------
          Location of expect binary
        value: '/usr/bin/expect'

      - name: 'password_expect_script'
        comment: |
          Location of expect script (see helpers/passwd-expect)
        value: ''

      - name: 'password_expect_params'
        comment: |
          Arguments for the expect script. See the helpers/passwd-expect file for details.
          This is probably a good starting default:
            -telent -host localhost -output /tmp/passwd.log -log /tmp/passwd.log
        value: ''

      - name: 'password_smb_host'
        comment: |
          smb Driver options
          ---------------------
          Samba host (default: localhost)
          Supported replacement variables:
          %n - hostname ($_SERVER['SERVER_NAME'])
          %t - hostname without the first part
          %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
        value: 'localhost'

      - name: 'password_smb_cmd'
        comment: |
          Location of smbpasswd binary (default: /usr/bin/smbpasswd)
        value: '/usr/bin/smbpasswd'

      - name: 'password_gearman_host'
        comment: |
          gearman driver options
          ---------------------
          Gearman host (default: localhost)
        value: 'localhost'

      - name: 'password_plesk_host'
        comment: |
          Plesk/PPA Driver options
          --------------------
          You need to allow RCP for IP of roundcube-server in Plesk/PPA Panel

          Plesk RCP Host
        value: '10.0.0.5'

      - name: 'password_plesk_user'
        comment: 'Plesk RPC Username'
        value: 'admin'

      - name: 'password_plesk_pass'
        comment: 'Plesk RPC Password'
        value: 'password'

      - name: 'password_plesk_rpc_port'
        comment: 'Plesk RPC Port'
        value: '8443'

      - name: 'password_plesk_rpc_path'
        comment: 'Plesk RPC Path'
        value: 'enterprise/control/agent.php'

      - name: 'password_kpasswd_cmd'
        comment: |
          kasswd Driver options
          ---------------------
          Command to use
        value: '/usr/bin/kpasswd'

      - name: 'password_modoboa_api_token'
        comment: |
          Modoboa Driver options
          ---------------------
          put token number from Modoboa server
        value: ''

  - name: 'help'
    state: 'enabled'
    options:

      - name: 'help_source'
        comment: |
          Help content iframe source
          %l will be replaced by the language code resolved using the 'help_language_map' option
          If you are serving roundcube via https, then change this URL to https also.
        value: 'https://docs.roundcube.net/doc/help/1.1/%l/'

      - name: 'help_index_map'
        comment: |
          Map task/action combinations to deep-links
          Use '<task>/<action>' or only '<task>' strings as keys
          The values will be appended to the 'help_source' URL
        array:
          - 'login':                'login.html'
            'mail':                 'mail/index.html'
            'mail/compose':         'mail/compose.html'
            'addressbook':          'addressbook/index.html'
            'settings':             'settings/index.html'
            'settings/preferences': 'settings/preferences.html'
            'settings/folders':     'settings/folders.html'
            'settings/identities':  'settings/identities.html'

      - name: 'help_language_map'
        comment: |
          Map to translate Roundcube language codes into help document languages
          The '*' entry will be used as default
        array:
          - '*': 'en_US'

      - name: 'help_about_url'
        comment: |
          Enter an absolute URL to a page displaying information about this webmail
          Alternatively, create a HTML file under <this-plugin-dir>/content/about.html
        value: null

      - name: 'help_license_url'
        comment: |
          Enter an absolute URL to a page displaying information about this webmail
          Alternatively, put your license text to <this-plugin-dir>/content/license.html
        value: null

      - name: 'help_open_extwin'
        comment: 'Determine whether to open the elp in a new window'
        value: False

      - name: 'help_csrf_info'
        comment: 'URL to additional information about CSRF protection'
        value: null

  - name: 'markasjunk'
    state: 'enabled'
    options:

      - name: 'markasjunk_learning_driver'
        comment: |
          Learning driver
          Use an external process such as sa-learn to learn from spam/ham messages. Default: null.
          Please see the README for more information
        value: null

      - name: 'markasjunk_ham_mbox'
        comment: |
          Ham mailbox
          Mailbox messages should be moved to when they are marked as ham. null = INBOX
          set to FALSE to disable message moving
        value: null

      - name: 'markasjunk_spam_mbox'
        comment: |
          Spam mailbox
          Mailbox messages should be moved to when they are marked as spam.
          null = the mailbox assigned as the spam folder in Roundcube settings
          set to FALSE to disable message moving
        value: null

      - name: 'markasjunk_read_spam'
        comment: 'Mark messages as read when reporting them as spam'
        value: True  # original: False

      - name: 'markasjunk_unread_ham'
        comment: 'Mark messages as unread when reporting them as ham'
        value: True  # original: False

      - name: 'markasjunk_spam_flag'
        comment: |
          Add flag to messages marked as spam (flag will be removed when marking as ham)
          If you do not want to use message flags set this to false
        value: 'Junk'

      - name: 'markasjunk_ham_flag'
        comment: |
          Add flag to messages marked as ham (flag will be removed when marking as spam)
          If you do not want to use message flags set this to false
        value: 'NonJunk'

      - name: 'markasjunk_debug'
        comment: 'Write output from spam/ham commands to the log for debug'
        value: False

      - name: 'markasjunk_toolbar'
        comment: |
          The mark as spam/ham icon can either be displayed on the toolbar or as part of the mark messages menu.
          Set to False to use Mark menu instead of the toolbar. Default: true.
        value: True

      - name: 'markasjunk_move_spam'
        comment: |
          Learn any message moved to the spam mailbox as spam (not just when the button is pressed)
        value: True  # original: False

      - name: 'markasjunk_move_ham'
        comment: |
          Learn any message moved from the spam mailbox to the ham mailbox as ham (not just when the button is pressed)
        value: True  # original: False

      - name: 'markasjunk_permanently_remove'
        comment: |
          Some drivers create new copies of the target message(s), in this case the original message(s) will be deleted
          Rather than deleting the message(s) (moving to Trash) setting this option true will cause the original message(s) to be permanently removed
        value: False

      - name: 'markasjunk_spam_only'
        comment: 'Display only a mark as spam button'
        value: False

      - name: 'markasjunk_allowed_hosts'
        comment: |
          Activate markasjunk for selected mail hosts only. If this is not set all mail hosts are allowed.
          Example: $config['markasjunk_allowed_hosts'] = array('mail1.domain.tld', 'mail2.domain.tld');
        value: null

      - name: 'markasjunk_host_config'
        comment: |
          Load specific config for different mail hosts
          Example: $config['markasjunk_host_config'] = array(
             'mail1.domain.tld' => 'mail1_config.inc.php',
             'mail2.domain.tld' => 'mail2_config.inc.php',
          );
        value: null

      - name: 'markasjunk_spam_cmd'
        comment: |
          cmd_learn Driver options
          ------------------------
          The command used to learn that a message is spam
          The command can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %i is replaced with the email address from the user's default identity
               %s is replaced with the email address the message is from
               %f is replaced with the path to the message file
               %h:<header name> is replaced with the content of that header from the message (lower case) eg: %h:x-dspam-signature
          If you do not want to run the command set this to null
        value: null

      - name: 'markasjunk_ham_cmd'
        comment: |
          The command used to learn that a message is ham
          The command can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %i is replaced with the email address from the user's default identity
               %s is replaced with the email address the message is from
               %f is replaced with the path to the message file
               %h:<header name> is replaced with the content of that header from the message (lower case) eg: %h:x-dspam-signature
          If you do not want to run the command set this to null
        value: null

      - name: 'markasjunk_spam_dir'
        comment: |
          dir_learn Driver options
          ------------------------
          The full path of the directory used to store spam (must be writable by webserver)
        value: null

      - name: 'markasjunk_ham_dir'
        comment: |
          The full path of the directory used to store ham (must be writable by webserver)
        value: null

      - name: 'markasjunk_filename'
        comment: |
          The filename prefix
          The filename can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %t is replaced with the type of message (spam/ham)
        value: null

      - name: 'markasjunk_email_spam'
        comment: |
          email_learn Driver options
          --------------------------
          The email address that spam messages will be sent to
          The address can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %i is replaced with the email address from the user's default identity
          If you do not want to send an email set this to null
        value: null

      - name: 'markasjunk_email_ham'
        comment: |
          The email address that ham messages will be sent to
          The address can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %i is replaced with the email address from the user's default identity
          If you do not want to send an email set this to null
        value: null

      - name: 'markasjunk_email_attach'
        comment: 'Should the spam/ham message be sent as an attachment'
        value: True

      - name: 'markasjunk_email_subject'
        comment: |
          The email subject (when sending as attachment)
          The subject can contain the following macros that will be expanded as follows:
               %u is replaced with the username (from the session info)
               %l is replaced with the local part of the username (if the username is an email address)
               %d is replaced with the domain part of the username (if the username is an email address or default mail domain if not)
               %t is replaced with the type of message (spam/ham)
        value: 'learn this message as %t'

      - name: 'markasjunk_sauserprefs_config'
        comment: |
          sa_blacklist Driver options
          ---------------------------
          Path to SAUserPrefs config file
        value: '../sauserprefs/config.inc.php'

      - name: 'markasjunk_amacube_config'
        comment: |
          amavis_blacklist Driver options
          ---------------------------
          Path to amacube config file
        value: '../amacube/config.inc.php'

      - name: 'markasjunk_spam_patterns'
        comment: |
          edit_headers Driver options
          ---------------------------
          Patterns to match and replace headers for spam messages
          Replacement method uses preg_replace - http://www.php.net/manual/function.preg-replace.php
          WARNING: Be sure to match the entire header line, including the name of the header, also use ^ and $ and the 'm' flag
          see the README for an example
          TEST CAREFULLY BEFORE USE ON REAL MESSAGES
        array:
          - patterns:     []
            replacements: []

      - name: 'markasjunk_ham_patterns'
        comment: |
          Patterns to match and replace headers for spam messages
          Replacement method uses preg_replace - http://www.php.net/manual/function.preg-replace.php
          WARNING: Be sure to match the entire header line, including the name of the header, also use ^ and $ and the 'm' flag
          see the README for an example
          TEST CAREFULLY BEFORE USE ON REAL MESSAGES
        array:
          - patterns:     []
            replacements: []

    # This plugin adds additional commands in the header of the message if
    # Roundcube detects it's a mailing list message.
  - name: 'listcommands'
    package: 'cor/listcommands'
    state: 'enabled'

    # This plugin provides support for swipe gestures on mobile devices in the
    # Elastic skin.
  - name: 'swipe'
    package: 'johndoh/swipe:0.1.0'
    state: 'enabled'

    # This plugin includes additional information in Dovecot connections to
    # provide better logging capabilities.
  - name: 'dovecot_ident'
    package: 'cor/dovecot-ident'
    state: 'enabled'

    # This plugin adds support for parsing vCard attachments in e-mail
    # messages.
  - name: 'vcard_attachments'
    state: 'enabled'

    # This plugin adds support for generating Identicon avatars for contacts
    # without images.
  - name: 'identicon'
    state: 'enabled'

  - name: 'managesieve'
    state: 'enabled'
    options:

      - name: 'managesieve_host'
        comment: |
          managesieve server address, default is localhost.
          Replacement variables supported in host name:
          %h - user's IMAP hostname
          %n - http hostname ($_SERVER['SERVER_NAME'])
          %d - domain (http hostname without the first part)
          For example %n = mail.domain.tld, %d = domain.tld
        value: '{{ roundcube__sieve_server }}'

      - name: 'managesieve_auth_type'
        comment: |
          Authentication method. Can be CRAM-MD5, DIGEST-MD5, PLAIN, LOGIN, EXTERNAL
          or none. Optional, defaults to best method supported by server.
        value: null

      - name: 'managesieve_auth_cid'
        comment: |
          Optional managesieve authentication identifier to be used as authorization proxy.
          Authenticate as a different user but act on behalf of the logged in user.
          Works with PLAIN and DIGEST-MD5 auth.
        value: null

      - name: 'managesieve_auth_pw'
        comment: |
          Optional managesieve authentication password to be used for imap_auth_cid
        value: null

      - name: 'managesieve_conn_options'
        comment: |
          Connection scket context options
          See https://php.net/manual/en/context.ssl.php
          The example below enables server certificate validation
        array:
          - ssl:
              - verify_peer: True
                verify_depth: 3
                cafile: '/etc/ssl/certs/ca-certificates.crt'
        state: 'comment'

      - name: 'managesieve_default'
        comment: |
          A file with default script content (eg. spam filter)
        value: '/etc/dovecot/sieve/global'

      - name: 'managesieve_script_name'
        comment: |
          The name of the script which will be used when there's no user script
        value: 'managesieve'

      - name: 'managesieve_mbox_encoding'
        comment: |
          Sieve RFC says that we should use UTF-8 encoding for mailbox names,
          but some implementations does not convert UTF-8 to modified UTF-7.
          Defaults to UTF7-IMAP
        value: 'UTF-8'

      - name: 'managesieve_replace_delimiter'
        comment: |
          I need this because my dovecot (with listescape plugin) uses
          ':' delimiter, but creates folders with dot delimiter
        value: ''

      - name: 'managesieve_disabled_extensions'
        comment: |
          Disabled sieve extensions (body, copy, date, editheader, encoded-character,
          envelope, environment, ereject, fileinto, ihave, imap4flags, index,
          mailbox, mboxmetadata, regex, reject, relational, servermetadata,
          spamtest, spamtestplus, subaddress, vacation, variables, virustest, etc.
          Note: not all extensions are implemented
        value: []

      - name: 'managesieve_debug'
        comment: |
          Enables debugging of conversation with sieve server. Logs it into <log_dir>/sieve
        value: False

      - name: 'managesieve_kolab_master'
        comment: |
          Enables features described in http://wiki.kolab.org/KEP:14
        value: False

      - name: 'managesieve_filename_extension'
        comment: |
          Script name extension used for scripts including. Dovecot uses '.sieve',
          Cyrus uses '.siv'. Doesn't matter if you have managesieve_kolab_master disabled.
        value: '.sieve'

      - name: 'managesieve_filename_exceptions'
        comment: |
          List of reserved script names (without extension).
          Scripts listed here will be not presented to the user.
        value: []

      - name: 'managesieve_domains'
        comment: |
          List of domains limiting destination emails in redirect action
          If not empty, user will need to select domain from a list
        value: []

      - name: 'managesieve_default_headers'
        comment: |
          Default list of entries in header selector
        value: [ 'Subject', 'From', 'To' ]

      - name: 'managesieve_vacation'
        comment: |
          Enables separate management interface for vacation responses (out-of-office)
          0 - no separate section (default),
          1 - add Vacation section,
          2 - add Vacation section, but hide Filters section
        value: 1

      - name: 'managesieve_forward'
        comment: |
          Enables separate management interface for setting forwards (redirect to and copy to)
          0 - no separate section (default),
          1 - add Forward section,
          2 - add Forward section, but hide Filters section
        value: 1

      - name: 'managesieve_vacation_interval'
        comment: |
          Default vacation interval (in days).
          Note: If server supports vacation-seconds extension it is possible
          to define interval in seconds here (as a string), e.g. "3600s".
        value: 0

      - name: 'managesieve_vacation_addresses_init'
        comment: |
          Some servers require vacation :addresses to be filled with all
          user addresses (aliases). This option enables automatic filling
          of these on initial vacation form creation.
        value: True

      - name: 'managesieve_vacation_from_init'
        comment: |
          Sometimes you want to always reply with mail email address
          This option enables automatic filling of :from field on initial
          vacation form creation.
        value: True

      - name: 'managesieve_notify_methods'
        comment: |
          Supported methods of notify extension. Default: 'mailto'
        value: [ 'mailto' ]

      - name: 'managesieve_raw_editor'
        comment: 'Enables scripts RAW editor feature'
        value: True

      - name: 'managesieve_disabled_actions'
        comment: |
          Disabled actions
          Prevent user from performing specific actions:
          list_sets, enable_disable_set, delete_set, new_set, download_set, new_rule, delete_rule
          Note: disabling list_sets removes the Filter sets widget from the UI and means
                the set defined in managesieve_script_name will always be used (and activated)
        value: []

      - name: 'managesieve_allowed_hosts'
        comment: |
          List of hosts that support managesieve.
          Activate managesieve for selected hosts only. If this is not set all hosts are allowed.
          Example: $config['managesieve_allowed_hosts'] = array('host1.mydomain.com','host2.mydomain.com');
        value: null

roundcube__plugins

List of Roundcube plugins configured on all hosts in the Ansible inventory.

roundcube__plugins: []

roundcube__group_plugins

List of Roundcube plugins configured on hosts in a specific Ansible inventory group.

roundcube__group_plugins: []

roundcube__host_plugins

List of Roundcube plugins configured on specific hosts in the Ansible inventory.

roundcube__host_plugins: []

roundcube__combined_plugins

Varlabie which combines all Roundcube plugin lists and is used in role tasks and templates.

roundcube__combined_plugins: '{{ roundcube__default_plugins
                                 + roundcube__plugins
                                 + roundcube__group_plugins
                                 + roundcube__host_plugins }}'

Skins 

roundcube__skin_folder

skin name: folder from /skins Currently available:

classic
elastic [default] (mobile-ready, requires nodejs dependency, due to CSS-LESS syntax)
larry

roundcube__skin_folder: 'elastic'

roundcube__skin_logo

Logo image replacement. Specifies location of the image as:

URL relative to the document root of this Roundcube installation
full URL with http:// or https:// prefix
URL relative to the current skin folder (when starts with a '/')

roundcube__skin_logo: null

Other variables 

roundcube__max_file_size

Maximum upload size, in MB.

roundcube__max_file_size: '30'

Role-dependent configuration 

roundcube__keyring__dependent_gpg_user

The UNIX account which will be used to install additional GPG keys by the debops.keyring role.

roundcube__keyring__dependent_gpg_user: '{{ roundcube__user }}'

roundcube__keyring__dependent_gpg_keys

GPG key configuration for the debops.keyring Ansible role.

roundcube__keyring__dependent_gpg_keys:

  - user: '{{ roundcube__user }}'
    group: '{{ roundcube__group }}'
    home: '{{ roundcube__home }}'
    id: '{{ roundcube__git_gpg_key }}'

  - '{{ roundcube__git_additional_gpg_keys }}'

roundcube__ldap__dependent_tasks

Configuration for the debops.ldap Ansible role.

roundcube__ldap__dependent_tasks:

  - name: 'Create roundcube account for {{ roundcube__ldap_device_dn | join(",") }}'
    dn: '{{ roundcube__ldap_binddn }}'
    objectClass: '{{ roundcube__ldap_self_object_classes }}'
    attributes: '{{ roundcube__ldap_self_attributes }}'
    no_log: '{{ debops__no_log | d(True) }}'
    state: '{{ "present" if roundcube__ldap_password_enabled and
                            roundcube__ldap_device_dn | d() else "ignore" }}'

roundcube__nginx__dependent_servers

nginx server configuration managed by the debops.nginx role.

roundcube__nginx__dependent_servers:

  - name: '{{ roundcube__fqdn }}'
    filename: 'debops.roundcube'
    by_role: 'debops.roundcube'
    type: 'php'
    root: '{{ roundcube__git_dest }}'
    webroot_create: False
    access_policy: '{{ roundcube__nginx_access_policy }}'
    index: 'index.php'

    options: |
      autoindex off;
      client_max_body_size {{ roundcube__max_file_size }}M;
      client_body_buffer_size 128k;

    location_list:
      - pattern: '/'
        options: |
          try_files $uri $uri/ @roundcube;

      - pattern: '@roundcube'
        options: |
          rewrite ^/favicon\.ico$ skins/{{ roundcube__skin_folder }}/images/favicon.ico last;

      - pattern: '~ ^/?(installer|[A-Z0-9]+$)'
        options: |
          deny all;

      - pattern: '~ ^/?(\.git|\.tx|SQL|bin|config|logs|temp|tests|program\/(include|lib|localization|steps))'
        options: |
          deny all;

      - pattern: '~ /(README\.md|composer\.json-dist|composer\.json|package\.xml|Dockerfile)$'
        options: |
          deny all;

    php_options: |
      fastcgi_intercept_errors        on;
      fastcgi_ignore_client_abort     off;
      fastcgi_connect_timeout         60;
      fastcgi_send_timeout            180;
      fastcgi_read_timeout            180;
      fastcgi_buffer_size             128k;
      fastcgi_buffers               4 256k;
      fastcgi_busy_buffers_size       256k;
      fastcgi_temp_file_write_size    256k;

    php_upstream: 'php_roundcube'

roundcube__nginx_access_policy

Name of the "nginx access policy" for Roundcube webpage. See debops.nginx Ansible role for more details.

roundcube__nginx_access_policy: ''

roundcube__nginx__dependent_upstreams

PHP upstream server configuration managed by the debops.nginx role.

roundcube__nginx__dependent_upstreams:

  - name: 'php_roundcube'
    by_role: 'debops.roundcube'
    enabled: True
    type: 'php'
    php_pool: 'roundcube'

roundcube__php__dependent_packages

List of PHP packages to install using the debops.php role.

roundcube__php__dependent_packages:
  - '{{ roundcube__base_php_packages }}'
  - '{{ roundcube__optional_php_packages }}'
  - '{{ roundcube__custom_php_packages }}'

roundcube__php__dependent_pools

PHP pools managed by the debops.php role.

roundcube__php__dependent_pools:
  name: 'roundcube'
  by_role: 'debops.roundcube'
  user: '{{ roundcube__user }}'
  group: '{{ roundcube__group }}'
  owner: '{{ roundcube__user }}'
  home: '{{ roundcube__home }}'

  php_values:
    ## https://secure.php.net/manual/en/info.configuration.php#ini.upload-max-filesize
    upload_max_filesize:        '{{ roundcube__max_file_size }}M'

    ## https://secure.php.net/manual/en/ini.core.php#ini.post-max-size
    post_max_size:              '{{ roundcube__max_file_size }}M'

    ## https://github.com/roundcube/roundcubemail/wiki/Install-Requirements
    file_uploads:               'on'
    mbstring.func_overload:     'off'
    memory_limit:               '64M'
    magic_quotes_runtime:       'off'
    magic_quotes_sybase:        'off'
    session.auto_start:         'off'
    suhosin.session.encrypt:    'off'

roundcube__nodejs__npm_dependent_packages

Configuration for the debops.nodejs Ansible role.

roundcube__nodejs__npm_dependent_packages:
  # Dependency for the 'elastic' skin to compile the CSS files
  - 'less'
  - 'tslib'