Harden smtpwebhook delivery and service runtime

config.js

@@ -3,17 +3,38 @@ const AWS = require('aws-sdk');
 
 dotenv.config();
 
+function integerFromEnv(name, fallback) {
+  const value = process.env[name];
+  if (value === undefined || value === '') return fallback;
+  return Number(value);
+}
+
 module.exports = {
-  WEBHOOK_URL: process.env.WEBHOOK_URL || 'https://enkhprqr4n2t.x.pipedream.net/',
-  PORT: process.env.PORT || 25,
-  MAX_FILE_SIZE: process.env.MAX_FILE_SIZE || 5 * 1024 * 1024,
+  WEBHOOK_URL: process.env.WEBHOOK_URL,
+  PORT: integerFromEnv('PORT', 25),
+  MAX_FILE_SIZE: integerFromEnv('MAX_FILE_SIZE', 5 * 1024 * 1024),
+  MAX_MESSAGE_SIZE: integerFromEnv('MAX_MESSAGE_SIZE', 25 * 1024 * 1024),
+  MAX_SMTP_CLIENTS: integerFromEnv('MAX_SMTP_CLIENTS', 50),
+  SMTP_SOCKET_TIMEOUT: integerFromEnv('SMTP_SOCKET_TIMEOUT', 5 * 60 * 1000),
+  SMTP_CLOSE_TIMEOUT: integerFromEnv('SMTP_CLOSE_TIMEOUT', 10 * 1000),
+  SMTP_ALLOWED_IPS: (process.env.SMTP_ALLOWED_IPS || '')
+    .split(',')
+    .map(ip => ip.trim())
+    .filter(Boolean),
   BUCKET_NAME: process.env.S3_BUCKET_NAME,
   SMTP_SECURE: process.env.SMTP_SECURE === 'true',
-  WEBHOOK_CONCURRENCY: process.env.WEBHOOK_CONCURRENCY || 5,
+  TLS_KEY_PATH: process.env.TLS_KEY_PATH,
+  TLS_CERT_PATH: process.env.TLS_CERT_PATH,
+  WEBHOOK_CONCURRENCY: integerFromEnv('WEBHOOK_CONCURRENCY', 5),
+  WEBHOOK_QUEUE_RETRIES: integerFromEnv('WEBHOOK_QUEUE_RETRIES', 10),
+  WEBHOOK_QUEUE_RETRY_DELAY: integerFromEnv('WEBHOOK_QUEUE_RETRY_DELAY', 60 * 1000),
+  WEBHOOK_QUEUE_TIMEOUT: integerFromEnv('WEBHOOK_QUEUE_TIMEOUT', 35 * 1000),
+  SPOOL_DIR: process.env.SPOOL_DIR || '/var/lib/smtpwebhook/spool',
+  LOG_DIR: process.env.LOG_DIR || '/var/lib/smtpwebhook/logs',
 
   s3: new AWS.S3({
     region: process.env.AWS_REGION,
     accessKeyId: process.env.AWS_ACCESS_KEY_ID,
     secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY
   })
-};
+};