Quotas

Quotas regulate resource consumption on the server, ensuring fair allocation of storage and object capacity across accounts and tenants. They define limits on the amount of data an account may hold, as well as the number of objects of a given kind it may create. Quotas can be enforced per account or, in multi-tenant deployments, per tenant.

Stalwart supports two broad categories of quota. Disk-usage quotas control the total storage consumed by an account's data, while object quotas cap the number of distinct items (messages, mailboxes, calendar events, address book entries, and similar) that an account can hold.

Per-account limits are carried on the Account object (found in the WebUI under Management › Directory › Groups, Management › Directory › Accounts) via its quotas field, which is a map from a StorageQuota key to a numeric limit. Per-tenant limits are carried on the Tenant object (found in the WebUI under Management › Directory › Tenants) via its quotas field, which maps a TenantStorageQuota key to a numeric limit.

Disk Usage Quotas

The total amount of disk space an account may consume is expressed through the maxDiskQuota entry in the account's quotas map, in bytes. Tenants expose an equivalent entry on their quotas map, capping total storage across the tenant's members.

Quota values are held exclusively on the Account and Tenant objects; the server does not read disk-quota attributes from external directories. Even when authentication is delegated to LDAP or SQL, quotas must be configured through the Account object (or the Tenant object for tenant-wide caps) from the WebUI or the JMAP API.

Object Quotas

Object quotas cap the number of items of each kind that can be stored under an account or tenant. The available keys are defined by the StorageQuota enum on the Account object, and by the TenantStorageQuota enum on the Tenant object. Relevant StorageQuota values include maxEmails, maxMailboxes, maxCalendars, maxCalendarEvents, maxAddressBooks, maxContactCards, maxFiles, maxEmailIdentities, maxEmailSubmissions, maxSieveScripts, maxPushSubscriptions, maxAppPasswords, and maxApiKeys.

A value set under an account's quotas map overrides the server-wide default for that key. The defaults themselves live on the service-specific singletons rather than on the Account object: mail-related caps such as maxMessages, maxMailboxes, maxSubmissions, and maxIdentities are defined on the Email singleton, calendar caps such as maxCalendars and maxEvents on the Calendar singleton, address-book caps such as maxAddressBooks and maxContacts on the AddressBook singleton, and file-storage caps such as maxFiles on the FileStorage singleton. Consult those objects for the server-wide default applied when an account does not set its own value.

To restrict the number of calendars and address books that a single account may create, set the relevant entries on the account's quotas field:

{
  "quotas": {
    "maxCalendars": 300,
    "maxAddressBooks": 500
  }
}

Default maximum numbers of per-account app passwords and API keys are also controlled globally through maxAppPasswords and maxApiKeys on the Authentication singleton (found in the WebUI under Settings › Authentication › General).