# Mail storage quotas

Bongo applies one optional mail-storage quota to each user Store. The limit
covers message objects in all of that user's mailboxes. Contacts, calendars,
configuration documents, authentication databases, Queue files, and Web state
are not charged to the mail quota.

The configured limit and current logical message size are stored in the same
per-user SQLite database as the mailbox metadata. SQLite triggers perform the
final check atomically, so concurrent SMTP delivery, IMAP APPEND, COPY, MOVE,
and Store writes cannot jointly cross a hard limit. A zero internal limit means
that no administrative quota root exists and is displayed as `unlimited` by
the administration tool.

## Administration

Show a user's usage and limit:

```console
bongo-admin user quota alice
```

Set a limit using bytes or a binary size suffix:

```console
bongo-admin user quota alice 10G
```

Remove the administrative limit:

```console
bongo-admin user quota alice unlimited
```

Accepted suffixes are `K`, `M`, `G`, `T`, and `P`, optionally followed by
`iB` or `B`. Lowering the limit below current usage is permitted, but every
operation which would increase charged storage remains rejected until enough
mail has been removed or the limit has been raised.

## Protocol behaviour

IMAP advertises `QUOTA` and `QUOTA=RES-STORAGE` and implements the RFC 9208
`GETQUOTA`, `GETQUOTAROOT`, `DELETED-STORAGE`, and `[OVERQUOTA]` responses.
The single quota root is the empty string and governs every mailbox in the
authenticated user's Store. Bongo does not advertise `QUOTASET`; only a local
administrator can change a limit. IMAP reports STORAGE in units of 1024
octets, while `bongo-admin` reports exact logical bytes.

POP3 has no standardized quota query command, and Cyrus POP3 follows the same
model. Bongo therefore does not invent a POP3 capability. POP3 accesses the
same quota-controlled Store: `DELE` only marks a message during the session,
`RSET` cancels those marks, and a successful `QUIT` performs the Store deletes
which release quota. A disconnected or failed POP3 update transaction releases
no quota.

Local SMTP/Queue delivery receives the Store's quota result and handles it as
the existing quota-exceeded delivery status. External collection goes through
the same delivery path. Deleting mail through IMAP, POP3, or the Web interface
therefore affects one shared usage value.

The accounting value is the sum of stored logical message sizes. It is not a
filesystem free-space promise: filesystem allocation, metadata, SQLite files,
hard links, compression, snapshots, and Queue space can differ. Normal disk
space monitoring and Queue reserve settings remain necessary.

Relevant standards are [RFC 9208](https://www.rfc-editor.org/rfc/rfc9208.html)
and [RFC 1939](https://www.rfc-editor.org/rfc/rfc1939.html).