No OneTemporary
Actions

Size

31 KB

Referenced Files

None

订阅者

None

View Options

	diff --git a/data/Dockerfiles/netfilter/server.py b/data/Dockerfiles/netfilter/server.py
	index 517b91ac..7b0548fc 100644
	--- a/data/Dockerfiles/netfilter/server.py
	+++ b/data/Dockerfiles/netfilter/server.py
	@@ -1,472 +1,472 @@
	#!/usr/bin/env python2

	import re
	import os
	import time
	import atexit
	import signal
	import ipaddress
	from random import randint
	from threading import Thread
	from threading import Lock
	import redis
	import json
	import iptc

	while True:
	try:
	r = redis.StrictRedis(host=os.getenv('IPV4_NETWORK', '172.22.1') + '.249', decode_responses=True, port=6379, db=0)
	r.ping()
	except Exception as ex:
	print '%s - trying again in 3 seconds' % (ex)
	time.sleep(3)
	else:
	break

	pubsub = r.pubsub()

	RULES = {}
	RULES[1] = 'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed'
	RULES[2] = '-login: Disconnected $auth failed, .+$: user=.*, method=.+, rip=([0-9a-f\.:]+),'
	RULES[3] = '-login: Aborted login $no auth .+$: user=.+, rip=([0-9a-f\.:]+), lip.+'
	RULES[4] = '-login: Aborted login $tried to use disallowed .+$: user=.+, rip=([0-9a-f\.:]+), lip.+'
	RULES[5] = 'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked'
	RULES[6] = 'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)'

	bans = {}
	log = {}
	quit_now = False
	lock = Lock()

	def refreshF2boptions():
	global f2boptions
	global quit_now
	if not r.get('F2B_OPTIONS'):
	f2boptions = {}
	f2boptions['ban_time'] = int
	f2boptions['max_attempts'] = int
	f2boptions['retry_window'] = int
	f2boptions['netban_ipv4'] = int
	f2boptions['netban_ipv6'] = int
	f2boptions['ban_time'] = r.get('F2B_BAN_TIME') or 1800
	f2boptions['max_attempts'] = r.get('F2B_MAX_ATTEMPTS') or 10
	f2boptions['retry_window'] = r.get('F2B_RETRY_WINDOW') or 600
	f2boptions['netban_ipv4'] = r.get('F2B_NETBAN_IPV4') or 24
	f2boptions['netban_ipv6'] = r.get('F2B_NETBAN_IPV6') or 64
	r.set('F2B_OPTIONS', json.dumps(f2boptions, ensure_ascii=False))
	else:
	try:
	f2boptions = {}
	f2boptions = json.loads(r.get('F2B_OPTIONS'))
	except ValueError, e:
	print 'Error loading F2B options: F2B_OPTIONS is not json'
	quit_now = True

	if r.exists('F2B_LOG'):
	r.rename('F2B_LOG', 'NETFILTER_LOG')

	def mailcowChainOrder():
	global lock
	global quit_now
	while not quit_now:
	time.sleep(10)
	with lock:
	filter4_table = iptc.Table(iptc.Table.FILTER)
	filter6_table = iptc.Table6(iptc.Table6.FILTER)
	filter4_table.refresh()
	filter6_table.refresh()
	for f in [filter4_table, filter6_table]:
	forward_chain = iptc.Chain(f, 'FORWARD')
	input_chain = iptc.Chain(f, 'INPUT')
	for chain in [forward_chain, input_chain]:
	target_found = False
	for position, item in enumerate(chain.rules):
	if item.target.name == 'MAILCOW':
	target_found = True
	if position != 0:
	log['time'] = int(round(time.time()))
	log['priority'] = 'crit'
	log['message'] = 'Error in ' + chain.name + ' chain order, restarting container'
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	quit_now = True
	if not target_found:
	log['time'] = int(round(time.time()))
	log['priority'] = 'crit'
	log['message'] = 'Error in ' + chain.name + ' chain: MAILCOW target not found, restarting container'
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	quit_now = True

	def ban(address):
	global lock
	refreshF2boptions()
	BAN_TIME = int(f2boptions['ban_time'])
	MAX_ATTEMPTS = int(f2boptions['max_attempts'])
	RETRY_WINDOW = int(f2boptions['retry_window'])
	NETBAN_IPV4 = '/' + str(f2boptions['netban_ipv4'])
	NETBAN_IPV6 = '/' + str(f2boptions['netban_ipv6'])
	WHITELIST = r.hgetall('F2B_WHITELIST')

	ip = ipaddress.ip_address(address.decode('ascii'))
	if type(ip) is ipaddress.IPv6Address and ip.ipv4_mapped:
	ip = ip.ipv4_mapped
	address = str(ip)
	if ip.is_private or ip.is_loopback:
	return

	self_network = ipaddress.ip_network(address.decode('ascii'))
	if WHITELIST:
	for wl_key in WHITELIST:
	wl_net = ipaddress.ip_network(wl_key.decode('ascii'), False)
	if wl_net.overlaps(self_network):
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	log['message'] = 'Address %s is whitelisted by rule %s' % (self_network, wl_net)
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print 'Address %s is whitelisted by rule %s' % (self_network, wl_net)
	return

	net = ipaddress.ip_network((address + (NETBAN_IPV4 if type(ip) is ipaddress.IPv4Address else NETBAN_IPV6)).decode('ascii'), strict=False)
	net = str(net)

	if not net in bans or time.time() - bans[net]['last_attempt'] > RETRY_WINDOW:
	bans[net] = { 'attempts': 0 }
	active_window = RETRY_WINDOW
	else:
	active_window = time.time() - bans[net]['last_attempt']

	bans[net]['attempts'] += 1
	bans[net]['last_attempt'] = time.time()

	active_window = time.time() - bans[net]['last_attempt']

	if bans[net]['attempts'] >= MAX_ATTEMPTS:
	log['time'] = int(round(time.time()))
	log['priority'] = 'crit'
	log['message'] = 'Banning %s' % net
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print 'Banning %s for %d minutes' % (net, BAN_TIME / 60)
	if type(ip) is ipaddress.IPv4Address:
	with lock:
	chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), 'MAILCOW')
	rule = iptc.Rule()
	rule.src = net
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule not in chain.rules:
	chain.insert_rule(rule)
	else:
	with lock:
	chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
	rule = iptc.Rule6()
	rule.src = net
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule not in chain.rules:
	chain.insert_rule(rule)
	r.hset('F2B_ACTIVE_BANS', '%s' % net, log['time'] + BAN_TIME)
	else:
	log['time'] = int(round(time.time()))
	log['priority'] = 'warn'
	log['message'] = '%d more attempts in the next %d seconds until %s is banned' % (MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net)
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print '%d more attempts in the next %d seconds until %s is banned' % (MAX_ATTEMPTS - bans[net]['attempts'], RETRY_WINDOW, net)

	def unban(net):
	global lock
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	if not net in bans:
	log['message'] = '%s is not banned, skipping unban and deleting from queue (if any)' % net
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print '%s is not banned, skipping unban and deleting from queue (if any)' % net
	r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
	return
	log['message'] = 'Unbanning %s' % net
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print 'Unbanning %s' % net
	if type(ipaddress.ip_network(net.decode('ascii'))) is ipaddress.IPv4Network:
	with lock:
	chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), 'MAILCOW')
	rule = iptc.Rule()
	rule.src = net
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule in chain.rules:
	chain.delete_rule(rule)
	else:
	with lock:
	chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
	rule = iptc.Rule6()
	rule.src = net
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule in chain.rules:
	chain.delete_rule(rule)
	r.hdel('F2B_ACTIVE_BANS', '%s' % net)
	r.hdel('F2B_QUEUE_UNBAN', '%s' % net)
	if net in bans:
	del bans[net]

	def quit(signum, frame):
	global quit_now
	quit_now = True

	def clear():
	global lock
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	log['message'] = 'Clearing all bans'
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print 'Clearing all bans'
	for net in bans.copy():
	unban(net)
	with lock:
	filter4_table = iptc.Table(iptc.Table.FILTER)
	filter6_table = iptc.Table6(iptc.Table6.FILTER)
	for filter_table in [filter4_table, filter6_table]:
	filter_table.autocommit = False
	forward_chain = iptc.Chain(filter_table, "FORWARD")
	input_chain = iptc.Chain(filter_table, "INPUT")
	mailcow_chain = iptc.Chain(filter_table, "MAILCOW")
	if mailcow_chain in filter_table.chains:
	for rule in mailcow_chain.rules:
	mailcow_chain.delete_rule(rule)
	for rule in forward_chain.rules:
	if rule.target.name == 'MAILCOW':
	forward_chain.delete_rule(rule)
	for rule in input_chain.rules:
	if rule.target.name == 'MAILCOW':
	input_chain.delete_rule(rule)
	filter_table.delete_chain("MAILCOW")
	filter_table.commit()
	filter_table.refresh()
	filter_table.autocommit = True
	r.delete('F2B_ACTIVE_BANS')
	r.delete('F2B_PERM_BANS')
	pubsub.unsubscribe()

	def watch():
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	log['message'] = 'Watching Redis channel F2B_CHANNEL'
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	pubsub.subscribe('F2B_CHANNEL')
	print 'Subscribing to Redis channel F2B_CHANNEL'

	while not quit_now:
	for item in pubsub.listen():
	for rule_id, rule_regex in RULES.iteritems():
	if item['data'] and item['type'] == 'message':
	result = re.search(rule_regex, item['data'])
	if result:
	addr = result.group(1)
	ip = ipaddress.ip_address(addr.decode('ascii'))
	if ip.is_private or ip.is_loopback:
	continue
	print '%s matched rule id %d' % (addr, rule_id)
	log['time'] = int(round(time.time()))
	log['priority'] = 'warn'
	log['message'] = '%s matched rule id %d' % (addr, rule_id)
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	ban(addr)

	def snat4(snat_target):
	global lock
	global quit_now

	def get_snat4_rule():
	rule = iptc.Rule()
	rule.src = os.getenv('IPV4_NETWORK', '172.22.1') + '.0/24'
	rule.dst = '!' + rule.src
	target = rule.create_target("SNAT")
	target.to_source = snat_target
	return rule

	while not quit_now:
	time.sleep(10)
	with lock:
	try:
	table = iptc.Table('nat')
	table.refresh()
	chain = iptc.Chain(table, 'POSTROUTING')
	table.autocommit = False
	if get_snat4_rule() not in chain.rules:
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	log['message'] = 'Added POSTROUTING rule for source network ' + get_snat4_rule().src + ' to SNAT target ' + snat_target
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	chain.insert_rule(get_snat4_rule())
	table.commit()
	- else:
	- for position, item in enumerate(chain.rules):
	- if item == get_snat4_rule():
	- if position != 0:
	- chain.delete_rule(get_snat4_rule())
	- table.commit()
	+ #else:
	+ # for position, item in enumerate(chain.rules):
	+ # if item == get_snat4_rule():
	+ # if position != 0:
	+ # chain.delete_rule(get_snat4_rule())
	+ # table.commit()
	table.autocommit = True
	except:
	print 'Error running SNAT4, retrying...'

	def snat6(snat_target):
	global lock
	global quit_now

	def get_snat6_rule():
	rule = iptc.Rule6()
	rule.src = os.getenv('IPV6_NETWORK', 'fd4d:6169:6c63:6f77::/64')
	rule.dst = '!' + rule.src
	target = rule.create_target("SNAT")
	target.to_source = snat_target
	return rule

	while not quit_now:
	time.sleep(10)
	with lock:
	try:
	table = iptc.Table6('nat')
	table.refresh()
	chain = iptc.Chain(table, 'POSTROUTING')
	table.autocommit = False
	if get_snat6_rule() not in chain.rules:
	log['time'] = int(round(time.time()))
	log['priority'] = 'info'
	log['message'] = 'Added POSTROUTING rule for source network ' + get_snat6_rule().src + ' to SNAT target ' + snat_target
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	chain.insert_rule(get_snat6_rule())
	table.commit()
	else:
	for position, item in enumerate(chain.rules):
	if item == get_snat6_rule():
	if position != 0:
	chain.delete_rule(get_snat6_rule())
	table.commit()
	table.autocommit = True
	except:
	print 'Error running SNAT6, retrying...'

	def autopurge():
	while not quit_now:
	time.sleep(10)
	refreshF2boptions()
	BAN_TIME = f2boptions['ban_time']
	MAX_ATTEMPTS = f2boptions['max_attempts']
	QUEUE_UNBAN = r.hgetall('F2B_QUEUE_UNBAN')
	if QUEUE_UNBAN:
	for net in QUEUE_UNBAN:
	unban(str(net))
	for net in bans.copy():
	if bans[net]['attempts'] >= MAX_ATTEMPTS:
	if time.time() - bans[net]['last_attempt'] > BAN_TIME:
	unban(net)

	def initChain():
	# Is called before threads start, no locking
	print "Initializing mailcow netfilter chain"
	# IPv4
	if not iptc.Chain(iptc.Table(iptc.Table.FILTER), "MAILCOW") in iptc.Table(iptc.Table.FILTER).chains:
	iptc.Table(iptc.Table.FILTER).create_chain("MAILCOW")
	for c in ['FORWARD', 'INPUT']:
	chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), c)
	rule = iptc.Rule()
	rule.src = '0.0.0.0/0'
	rule.dst = '0.0.0.0/0'
	target = iptc.Target(rule, "MAILCOW")
	rule.target = target
	if rule not in chain.rules:
	chain.insert_rule(rule)
	# IPv6
	if not iptc.Chain(iptc.Table6(iptc.Table6.FILTER), "MAILCOW") in iptc.Table6(iptc.Table6.FILTER).chains:
	iptc.Table6(iptc.Table6.FILTER).create_chain("MAILCOW")
	for c in ['FORWARD', 'INPUT']:
	chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), c)
	rule = iptc.Rule6()
	rule.src = '::/0'
	rule.dst = '::/0'
	target = iptc.Target(rule, "MAILCOW")
	rule.target = target
	if rule not in chain.rules:
	chain.insert_rule(rule)
	# Apply blacklist
	BLACKLIST = r.hgetall('F2B_BLACKLIST')
	if BLACKLIST:
	for bl_key in BLACKLIST:
	if type(ipaddress.ip_network(bl_key.decode('ascii'), strict=False)) is ipaddress.IPv4Network:
	chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), 'MAILCOW')
	rule = iptc.Rule()
	rule.src = bl_key
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule not in chain.rules:
	log['time'] = int(round(time.time()))
	log['priority'] = 'crit'
	log['message'] = 'Blacklisting host/network %s' % bl_key
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	chain.insert_rule(rule)
	r.hset('F2B_PERM_BANS', '%s' % bl_key, int(round(time.time())))
	else:
	chain = iptc.Chain(iptc.Table6(iptc.Table6.FILTER), 'MAILCOW')
	rule = iptc.Rule6()
	rule.src = bl_key
	target = iptc.Target(rule, "REJECT")
	rule.target = target
	if rule not in chain.rules:
	log['time'] = int(round(time.time()))
	log['priority'] = 'crit'
	log['message'] = 'Blacklisting host/network %s' % bl_key
	r.lpush('NETFILTER_LOG', json.dumps(log, ensure_ascii=False))
	print log['message']
	chain.insert_rule(rule)
	r.hset('F2B_PERM_BANS', '%s' % bl_key, int(round(time.time())))

	if __name__ == '__main__':

	# In case a previous session was killed without cleanup
	clear()
	# Reinit MAILCOW chain
	initChain()

	watch_thread = Thread(target=watch)
	watch_thread.daemon = True
	watch_thread.start()

	if os.getenv('SNAT_TO_SOURCE') and os.getenv('SNAT_TO_SOURCE') is not 'n':
	try:
	snat_ip = os.getenv('SNAT_TO_SOURCE').decode('ascii')
	snat_ipo = ipaddress.ip_address(snat_ip)
	if type(snat_ipo) is ipaddress.IPv4Address:
	snat4_thread = Thread(target=snat4,args=(snat_ip,))
	snat4_thread.daemon = True
	snat4_thread.start()
	except ValueError:
	print os.getenv('SNAT_TO_SOURCE') + ' is not a valid IPv4 address'

	if os.getenv('SNAT6_TO_SOURCE') and os.getenv('SNAT6_TO_SOURCE') is not 'n':
	try:
	snat_ip = os.getenv('SNAT6_TO_SOURCE').decode('ascii')
	snat_ipo = ipaddress.ip_address(snat_ip)
	if type(snat_ipo) is ipaddress.IPv6Address:
	snat6_thread = Thread(target=snat6,args=(snat_ip,))
	snat6_thread.daemon = True
	snat6_thread.start()
	except ValueError:
	print os.getenv('SNAT6_TO_SOURCE') + ' is not a valid IPv6 address'

	autopurge_thread = Thread(target=autopurge)
	autopurge_thread.daemon = True
	autopurge_thread.start()

	mailcowchainwatch_thread = Thread(target=mailcowChainOrder)
	mailcowchainwatch_thread.daemon = True
	mailcowchainwatch_thread.start()

	signal.signal(signal.SIGTERM, quit)
	atexit.register(clear)

	while not quit_now:
	time.sleep(0.5)
	diff --git a/docker-compose.yml b/docker-compose.yml
	index 8942fe6e..d5c0cfa8 100644
	--- a/docker-compose.yml
	+++ b/docker-compose.yml
	@@ -1,421 +1,421 @@
	version: '2.1'
	services:

	unbound-mailcow:
	image: mailcow/unbound:1.4
	build: ./data/Dockerfiles/unbound
	command: /usr/sbin/unbound
	environment:
	- TZ=${TZ}
	volumes:
	- ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro
	restart: always
	tty: true
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.254
	aliases:
	- unbound

	mysql-mailcow:
	image: mariadb:10.2
	volumes:
	- mysql-vol-1:/var/lib/mysql/
	- mysql-socket-vol-1:/var/run/mysqld/
	- ./data/conf/mysql/:/etc/mysql/conf.d/:ro
	environment:
	- TZ=${TZ}
	- MYSQL_ROOT_PASSWORD=${DBROOT}
	- MYSQL_DATABASE=${DBNAME}
	- MYSQL_USER=${DBUSER}
	- MYSQL_PASSWORD=${DBPASS}
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	ports:
	- "${SQL_PORT:-127.0.0.1:13306}:3306"
	networks:
	mailcow-network:
	aliases:
	- mysql

	redis-mailcow:
	image: redis:4-alpine
	volumes:
	- redis-vol-1:/data/
	restart: always
	environment:
	- TZ=${TZ}
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.249
	aliases:
	- redis

	clamd-mailcow:
	image: mailcow/clamd:1.15
	build: ./data/Dockerfiles/clamd
	restart: always
	tty: true
	environment:
	- TZ=${TZ}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	volumes:
	- ./data/conf/clamav/:/etc/clamav/
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- clamd

	rspamd-mailcow:
	image: mailcow/rspamd:1.31
	build: ./data/Dockerfiles/rspamd
	stop_grace_period: 30s
	depends_on:
	- nginx-mailcow
	environment:
	- TZ=${TZ}
	volumes:
	- ./data/conf/rspamd/custom/:/etc/rspamd/custom
	- ./data/conf/rspamd/override.d/:/etc/rspamd/override.d
	- ./data/conf/rspamd/local.d/:/etc/rspamd/local.d
	- ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro
	- rspamd-vol-1:/var/lib/rspamd
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	hostname: rspamd
	networks:
	mailcow-network:
	aliases:
	- rspamd

	php-fpm-mailcow:
	image: mailcow/phpfpm:1.24
	build: ./data/Dockerfiles/phpfpm
	command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
	depends_on:
	- redis-mailcow
	volumes:
	- ./data/web:/web:rw
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	- ./data/conf/sogo/:/etc/sogo/
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro
	- ./data/conf/phpfpm/php-fpm.d/pools.conf:/usr/local/etc/php-fpm.d/z-pools.conf
	- ./data/conf/phpfpm/php-conf.d/opcache-recommended.ini:/usr/local/etc/php/conf.d/opcache-recommended.ini
	- ./data/conf/phpfpm/php-conf.d/upload.ini:/usr/local/etc/php/conf.d/upload.ini
	- ./data/conf/phpfpm/php-conf.d/other.ini:/usr/local/etc/php/conf.d/zzz-other.ini
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- IMAP_PORT=${IMAP_PORT:-143}
	- IMAPS_PORT=${IMAPS_PORT:-993}
	- POP_PORT=${POP_PORT:-110}
	- POPS_PORT=${POPS_PORT:-995}
	- SIEVE_PORT=${SIEVE_PORT:-4190}
	- SUBMISSION_PORT=${SUBMISSION_PORT:-587}
	- SMTPS_PORT=${SMTPS_PORT:-465}
	- SMTP_PORT=${SMTP_PORT:-25}
	- API_KEY=${API_KEY:-invalid}
	- API_ALLOW_FROM=${API_ALLOW_FROM:-invalid}
	- COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- phpfpm

	sogo-mailcow:
	image: mailcow/sogo:1.44
	build: ./data/Dockerfiles/sogo
	environment:
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	- LOG_LINES=${LOG_LINES:-9999}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	volumes:
	- ./data/conf/sogo/:/etc/sogo/
	- ./data/web/inc/init_db.inc.php:/init_db.inc.php
	- ./data/conf/sogo/custom-sogo.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js
	- mysql-socket-vol-1:/var/run/mysqld/
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
	aliases:
	- sogo

	dovecot-mailcow:
	image: mailcow/dovecot:1.46
	build: ./data/Dockerfiles/dovecot
	cap_add:
	- NET_BIND_SERVICE
	volumes:
	- ./data/conf/dovecot:/usr/local/etc/dovecot
	- ./data/assets/ssl:/etc/ssl/mail/:ro
	- ./data/conf/sogo/:/etc/sogo/
	- vmail-vol-1:/var/vmail
	- vmail-attachments-vol-1:/var/attachments
	- crypt-vol-1:/mail_crypt/
	- ./data/conf/rspamd/custom/:/etc/rspamd/custom
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	- MAILDIR_GC_TIME=${MAILDIR_GC_TIME:-1440}
	ports:
	- "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
	- "${IMAP_PORT:-143}:143"
	- "${IMAPS_PORT:-993}:993"
	- "${POP_PORT:-110}:110"
	- "${POPS_PORT:-995}:995"
	- "${SIEVE_PORT:-4190}:4190"
	restart: always
	tty: true
	ulimits:
	nproc: 65535
	nofile:
	soft: 20000
	hard: 40000
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	hostname: ${MAILCOW_HOSTNAME}
	networks:
	mailcow-network:
	aliases:
	- dovecot

	postfix-mailcow:
	image: mailcow/postfix:1.27
	build: ./data/Dockerfiles/postfix
	volumes:
	- ./data/conf/postfix:/opt/postfix/conf
	- ./data/assets/ssl:/etc/ssl/mail/:ro
	- postfix-vol-1:/var/spool/postfix
	- crypt-vol-1:/var/lib/zeyple
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	cap_add:
	- NET_BIND_SERVICE
	ports:
	- "${SMTP_PORT:-25}:25"
	- "${SMTPS_PORT:-465}:465"
	- "${SUBMISSION_PORT:-587}:587"
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	hostname: ${MAILCOW_HOSTNAME}
	networks:
	mailcow-network:
	aliases:
	- postfix

	memcached-mailcow:
	image: memcached:alpine
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- memcached

	nginx-mailcow:
	depends_on:
	- sogo-mailcow
	- php-fpm-mailcow
	- redis-mailcow
	image: nginx:mainline-alpine
	command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
	envsubst < /etc/nginx/conf.d/templates/listen_ssl.template > /etc/nginx/conf.d/listen_ssl.active &&
	envsubst < /etc/nginx/conf.d/templates/server_name.template > /etc/nginx/conf.d/server_name.active &&
	envsubst < /etc/nginx/conf.d/templates/sogo.template > /etc/nginx/conf.d/sogo.active &&
	envsubst < /etc/nginx/conf.d/templates/sogo_eas.template > /etc/nginx/conf.d/sogo_eas.active &&
	nginx -qt &&
	until ping phpfpm -c1 > /dev/null; do sleep 1; done &&
	until ping sogo -c1 > /dev/null; do sleep 1; done &&
	until ping redis -c1 > /dev/null; do sleep 1; done &&
	until ping rspamd -c1 > /dev/null; do sleep 1; done &&
	exec nginx -g 'daemon off;'"
	environment:
	- HTTPS_PORT=${HTTPS_PORT:-443}
	- HTTP_PORT=${HTTP_PORT:-80}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- TZ=${TZ}
	volumes:
	- ./data/web:/web:ro
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro
	- ./data/assets/ssl/:/etc/ssl/mail/:ro
	- ./data/conf/nginx/:/etc/nginx/conf.d/:rw
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro
	volumes_from:
	- sogo-mailcow
	ports:
	- "${HTTPS_BIND:-0.0.0.0}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
	- "${HTTP_BIND:-0.0.0.0}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- nginx

	acme-mailcow:
	depends_on:
	- nginx-mailcow
	image: mailcow/acme:1.45
	build: ./data/Dockerfiles/acme
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- ADDITIONAL_SAN=${ADDITIONAL_SAN}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
	- SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
	- LE_STAGING=${LE_STAGING:-n}
	- TZ=${TZ}
	volumes:
	- ./data/web/.well-known/acme-challenge:/var/www/acme:rw
	- ./data/assets/ssl:/var/lib/acme/:rw
	- ./data/assets/ssl-example:/var/lib/ssl-example/:ro
	- mysql-socket-vol-1:/var/run/mysqld/
	restart: always
	networks:
	mailcow-network:
	aliases:
	- acme

	netfilter-mailcow:
	- image: mailcow/netfilter:1.19
	+ image: mailcow/netfilter:1.20
	build: ./data/Dockerfiles/netfilter
	stop_grace_period: 30s
	depends_on:
	- dovecot-mailcow
	- postfix-mailcow
	- sogo-mailcow
	- php-fpm-mailcow
	- redis-mailcow
	restart: always
	privileged: true
	environment:
	- TZ=${TZ}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
	- SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
	- SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
	network_mode: "host"
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	volumes:
	- /lib/modules:/lib/modules:ro

	watchdog-mailcow:
	image: mailcow/watchdog:1.29
	# Debug
	#command: /watchdog.sh
	build: ./data/Dockerfiles/watchdog
	oom_kill_disable: true
	volumes:
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	restart: always
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- USE_WATCHDOG=${USE_WATCHDOG:-n}
	- WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IP_BY_DOCKER_API=${IP_BY_DOCKER_API:-0}
	- CHECK_UNBOUND=${CHECK_UNBOUND:-1}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	- SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
	- HTTPS_PORT=${HTTPS_PORT:-443}
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- watchdog

	dockerapi-mailcow:
	image: mailcow/dockerapi:1.23
	restart: always
	build: ./data/Dockerfiles/dockerapi
	oom_kill_disable: true
	environment:
	- TZ=${TZ}
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- ./data/conf/rspamd/override.d/worker-controller-password.inc:/access.inc:rw
	- vmail-vol-1:/var/vmail:ro
	networks:
	mailcow-network:
	aliases:
	- dockerapi

	ipv6nat:
	image: robbertkl/ipv6nat
	restart: always
	privileged: true
	network_mode: "host"
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- /lib/modules:/lib/modules:ro

	networks:
	mailcow-network:
	driver: bridge
	enable_ipv6: true
	ipam:
	driver: default
	config:
	- subnet: ${IPV4_NETWORK:-172.22.1}.0/24
	- subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}

	volumes:
	# Storage for email files
	vmail-vol-1:
	# Storage for attachments (deduplicated)
	vmail-attachments-vol-1:
	mysql-vol-1:
	mysql-socket-vol-1:
	redis-vol-1:
	rspamd-vol-1:
	postfix-vol-1:
	crypt-vol-1:

File Metadata

Mime Type: text/x-diff
Expires: 9月 9 Tue, 5:39 AM (3 h, 18 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 5295
默认替代文本: (31 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions