Configuration - NitroMTA

nitromta setup writes the configuration, with every setting it leaves at its default commented out and each explained beside it. For the host name and return path domain the installation guide uses:

sudo -u nitromta nitromta setup --config /etc/nitromta/config.toml \
  --hostname mta.example.com --return-path-domain bounces.example.com

it writes:

# NitroMTA's configuration, as `nitromta setup` wrote it. Each commented
# setting is at its default.

[store]
# The SQLite database; its directory holds its write-ahead log too.
path = "/var/lib/nitromta/store.db"
# The installation's keys, which seal the secrets in policy: a file of its
# own, apart from the store and its backups, which only its owner may read.
keys = "/etc/nitromta/keys"
# Free space kept on the store's disk; new mail is refused below it.
# reserve_mib = 1024
# Bytes of mail waiting for their commit before new mail is refused.
# pending_mib = 512
# How long finished mail is kept, for bounces and complaints that come
# after it.
# feedback_window_seconds = 604800

[submission]
# SMTP submission, for applications, with STARTTLS and a login.
listen = "0.0.0.0:587"
hostname = "mta.example.com"
certificate = "/etc/nitromta/tls.crt"
key = "/etc/nitromta/tls.key"
# max_message_bytes = 40000000
# max_recipients = 50
# How long mail is tried before it expires.
# lifetime_seconds = 259200

# The SES v2 API, for applications that call it, on its own certificate.
# [ses]
# listen = "0.0.0.0:443"
# certificate = "/etc/nitromta/tls.crt"
# key = "/etc/nitromta/tls.key"
# region = "us-east-1"

[admin]
# The native API, for the CLI: the engine's own user, or root, alone.
socket = "/run/nitromta/admin.sock"

# Bounces and complaints, at the return path's domain's MX.
[feedback]
listen = "0.0.0.0:25"
hostname = "mta.example.com"
certificate = "/etc/nitromta/tls.crt"
key = "/etc/nitromta/tls.key"

[delivery]
# The name an egress greets with when it names none.
helo = "mta.example.com"
# Return paths are made under this domain, which bounces go to.
return_path_domain = "bounces.example.com"
# The key return paths are made with: this installation's own.
return_path_key = "<64 hex digits, generated by setup>"
# Keys from before a rotation: bounces to return paths made with them are
# still taken, for as long as their mail may still bounce.
# previous_return_path_keys = []
# Mail goes only over TLS: a receiver that does not offer STARTTLS is
# tried again until the mail expires. False lets it go in the clear to
# such a receiver.
# require_tls = true
# The resolver lookups go through, as an address and port; the system's
# when absent. DANE needs one that validates DNSSEC, such as a local
# unbound.
# resolver = "127.0.0.1:53"
# mta_sts = true
# dane = true

# [operator]
# Health and metrics, in Prometheus's text format.
# listen = "127.0.0.1:9090"

# [log]
# level = "info"
# format = "json"

# [scheduler]
# How long a stop waits for attempts under way.
# drain_seconds = 20
# retry_first_seconds = 60
# retry_max_seconds = 3600

The engine reads the configuration as it starts, and nitromta doctor checks it. Policy, the accounts, identities and egresses mail is sent with, is not configuration: it is given through the admin socket and kept in the store, as installation shows.