Services configuration

The services section controls which listeners are started and how each one behaves at the network level. Each service is a named block under services:. A missing key or enabled: false means the listener is not started.

---

Common fields

All services share the following fields:

Key	Default	Description
enabled	false	Start this listener on startup.
port	see table	TCP port to bind.
ssl_mode	—	TLS mode: ssl = implicit TLS; starttls = plain with STARTTLS upgrade; no = plain only.
haproxy_protocol	false	Extract real client IP from HAProxy PROXY header. Uses general.haproxy for timeout and trusted nets.
xclient_protocol	false	Accept XCLIENT command from trusted relays. Uses general.xclient for trusted nets.
auth_allow_cleartext	true	When false, reject AUTH (IMAP/Submission) or USER/PASS (POP3) unless the connection is TLS-protected.
ssl	—	Per-service SSL override. Same fields as general.ssl. If set, overrides only the specified fields.

Renamed with an inverted sense

auth_allow_cleartext replaces the pre-beta disable_plaintext_auth, and the meaning is flipped: auth_allow_cleartext: false is what disable_plaintext_auth: true used to say. The old key is still accepted on its own. Setting both keys on one listener refuses startup — even when their values agree — because a config carrying both is one edit away from meaning the opposite of what it says.

---

Listeners

Key	Port	ssl_mode	Protocol doc
imaps	993	ssl	IMAP.md
imap	143	starttls	IMAP.md
submission	587	starttls	SUBMISSION.md
submissions	465	ssl	SUBMISSION.md
pop3	110	starttls	POP3.md
pop3s	995	ssl	POP3.md
lmtp	24	no	LMTP.md

---

Examples

Minimal: IMAPS only

services:
  imaps:
    enabled: true
    port: 993
    ssl_mode: ssl

IMAP + IMAPS behind HAProxy

services:
  imaps:
    enabled: true
    port: 993
    ssl_mode: ssl
    haproxy_protocol: true
  imap:
    enabled: true
    port: 143
    ssl_mode: starttls
    haproxy_protocol: true
    auth_allow_cleartext: false

Full mail server (IMAP + Submission + POP3)

services:
  imaps:
    enabled: true
    port: 993
    ssl_mode: ssl
  imap:
    enabled: true
    port: 143
    ssl_mode: starttls
    auth_allow_cleartext: false
  submission:
    enabled: true
    port: 587
    ssl_mode: starttls
    auth_allow_cleartext: false
  submissions:
    enabled: true
    port: 465
    ssl_mode: ssl
    auth_allow_cleartext: false
  pop3s:
    enabled: true
    port: 995
    ssl_mode: ssl

LMTP backend node (yarilo-lmtp)

services:
  lmtp:
    enabled: true
    port: 24
    ssl_mode: no

Accepts preamble connections from yarilo-lmtp-login only. See LMTP.md for architecture and lmtp_login_service config.

---

Per-service TLS certificate override

services:
  imaps:
    enabled: true
    port: 993
    ssl_mode: ssl
    ssl:
      ssl_server_cert_file: /etc/ssl/mail.example.com/cert.pem
      ssl_server_key_file:  /etc/ssl/mail.example.com/key.pem