Presets

This page lists what each preset sets, so you can pick a starting point and know what your config file is overriding.

Choose a preset

Select a preset with a flag. With no flag, the server uses the built-in defaults.

ricochet                    # defaults
ricochet --development
ricochet --production
ricochet --high-capacity

Passing more than one is an error. The .deb install runs --production from /opt/ricochet/run.sh.

What each preset sets

Each preset starts from the defaults and changes only the cells shown in bold.

Setting	Default	Development	Production	High-capacity
Storage budget (storage.max_storage_gb)	10 GB	1 GB	50 GB	100 GB
Connection cap (performance.max_concurrent_connections)	10,000	100	10,000	50,000
Database pool (database.pool_size)	25	25	50	25
TLS to PostgreSQL (database.sslmode)	require	disable	require	require
Forwarding (features.enable_forwarding)	off	off	off	on
Push workers (performance.worker_threads)	4	4	4	8
Service announcements	every 60 min	every 1 min	every 60 min	every 60 min
Health check and heartbeat	every 5 min	every 30 s	every 5 min	every 5 min
Cleanup and capacity sample	every 5 min	every 1 min	every 5 min	every 5 min
Log level	INFO	DEBUG	INFO	INFO

These are the same in every preset:

Setting	Value
Messages per mailbox (storage.max_messages_per_mailbox)	1,000
Folders per owner (storage.max_mailboxes_per_owner)	100
Mailboxes server-wide (storage.max_mailboxes)	100,000
Retention (storage.retention_days)	30 days
Authentication (features.enable_authentication)	off
Rate limits (rate_limiting)	off
Admission control (admission_control)	on, 64 in flight per peer
Relay service (features.enable_relay_service)	on
Ops listener (ops)	on, 127.0.0.1:9090

Every row is enforced, not just reported.

A few notes:

• Authentication is an allow-list, so no preset turns it on. Turning it on with nobody listed would refuse every peer. Set features.enable_authentication: true and list peers in security.trusted_peers. See Trusted peers.
• Forwarding in the high-capacity preset is on but unusable until you list trusted peers: only a trusted peer may forward. The server logs a warning at startup when forwarding is on and trusted_peers is empty.
• Rate limits are off by design. Throughput is governed by admission control. See Admission & rate limits.
• Log level follows --development only. There is no logging key in the config file.

Layer a config file on top

The config file is applied over the preset you choose. A key the file leaves out keeps the preset’s value, feature flags included. A flag you set, to true or false, is applied as written.

/etc/ricochet/config.yaml

# On top of --production: a bigger budget and a region label.
server:
  region: eu-west
storage:
  max_storage_gb: 200

Then command-line flags override both. The order is: preset, then config file, then RICOCHET_PG_PASSWORD, then flags.

Caution

For most numeric keys a zero or a missing value means “keep the preset’s value”. You cannot set those to zero from the file. The keys where zero has a meaning of its own, such as admission_control.max_in_flight_per_peer and ops.port, say so in config.yaml.

Check what took effect

/ops/limits on the ops listener reports the effective limits after presets, file and derivations:

curl -s http://127.0.0.1:9090/ops/limits

It returns the admission settings (including whether maxInFlight was derived from the pool size), every rate-limit bucket with an explicit enabled field, and the storage limits. See Metrics & the ops view.