No OneTemporary
Actions

Size

39 KB

Referenced Files

None

订阅者

None

View Options

	diff --git a/data/Dockerfiles/postfix/Dockerfile b/data/Dockerfiles/postfix/Dockerfile
	index bda6e07f..a45ce12b 100644
	--- a/data/Dockerfiles/postfix/Dockerfile
	+++ b/data/Dockerfiles/postfix/Dockerfile
	@@ -1,62 +1,62 @@
	-FROM debian:bullseye-slim
	+FROM debian:bookworm-slim
	LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"

	ARG DEBIAN_FRONTEND=noninteractive
	ENV LC_ALL C

	RUN dpkg-divert --local --rename --add /sbin/initctl \
	&& ln -sf /bin/true /sbin/initctl \
	&& dpkg-divert --local --rename --add /usr/bin/ischroot \
	&& ln -sf /bin/true /usr/bin/ischroot

	# Add groups and users before installing Postfix to not break compatibility
	RUN groupadd -g 102 postfix \
	&& groupadd -g 103 postdrop \
	&& useradd -g postfix -u 101 -d /var/spool/postfix -s /usr/sbin/nologin postfix \
	&& apt-get update && apt-get install -y --no-install-recommends \
	ca-certificates \
	curl \
	dirmngr \
	dnsutils \
	gnupg \
	libsasl2-modules \
	mariadb-client \
	perl \
	postfix \
	postfix-mysql \
	postfix-pcre \
	redis-tools \
	sasl2-bin \
	sudo \
	supervisor \
	syslog-ng \
	syslog-ng-core \
	syslog-ng-mod-redis \
	tzdata \
	&& rm -rf /var/lib/apt/lists/* \
	&& touch /etc/default/locale \
	&& printf '#!/bin/bash\n/usr/sbin/postconf -c /opt/postfix/conf "$@"' > /usr/local/sbin/postconf \
	&& chmod +x /usr/local/sbin/postconf

	COPY supervisord.conf /etc/supervisor/supervisord.conf
	COPY syslog-ng.conf /etc/syslog-ng/syslog-ng.conf
	COPY syslog-ng-redis_slave.conf /etc/syslog-ng/syslog-ng-redis_slave.conf
	COPY postfix.sh /opt/postfix.sh
	COPY rspamd-pipe-ham /usr/local/bin/rspamd-pipe-ham
	COPY rspamd-pipe-spam /usr/local/bin/rspamd-pipe-spam
	COPY whitelist_forwardinghosts.sh /usr/local/bin/whitelist_forwardinghosts.sh
	COPY stop-supervisor.sh /usr/local/sbin/stop-supervisor.sh
	COPY docker-entrypoint.sh /docker-entrypoint.sh

	RUN chmod +x /opt/postfix.sh \
	/usr/local/bin/rspamd-pipe-ham \
	/usr/local/bin/rspamd-pipe-spam \
	/usr/local/bin/whitelist_forwardinghosts.sh \
	/usr/local/sbin/stop-supervisor.sh
	RUN rm -rf /tmp/* /var/tmp/*

	EXPOSE 588

	ENTRYPOINT ["/docker-entrypoint.sh"]

	CMD exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
	diff --git a/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf b/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf
	index 558305ec..cb1d1aa0 100644
	--- a/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf
	+++ b/data/Dockerfiles/postfix/syslog-ng-redis_slave.conf
	@@ -1,53 +1,53 @@
	-@version: 3.28
	+@version: 3.38
	@include "scl.conf"
	options {
	chain_hostnames(off);
	flush_lines(0);
	use_dns(no);
	dns_cache(no);
	use_fqdn(no);
	owner("root"); group("adm"); perm(0640);
	stats_freq(0);
	bad_hostname("^gconfd$");
	};
	source s_src {
	unix-stream("/dev/log");
	internal();
	};
	destination d_stdout { pipe("/dev/stdout"); };
	destination d_redis_ui_log {
	redis(
	host("`REDIS_SLAVEOF_IP`")
	persist-name("redis1")
	port(`REDIS_SLAVEOF_PORT`)
	command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
	);
	};
	destination d_redis_f2b_channel {
	redis(
	host("`REDIS_SLAVEOF_IP`")
	persist-name("redis2")
	port(`REDIS_SLAVEOF_PORT`)
	command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
	);
	};
	filter f_mail { facility(mail); };
	# start
	# overriding warnings are still displayed when the entrypoint runs its initial check
	# warnings logged by postfix-mailcow to syslog are hidden to reduce repeating msgs
	# Some other warnings are ignored
	filter f_ignore {
	not match("overriding earlier entry" value("MESSAGE"));
	not match("TLS SNI from checks.mailcow.email" value("MESSAGE"));
	not match("no SASL support" value("MESSAGE"));
	not facility (local0, local1, local2, local3, local4, local5, local6, local7);
	};
	# end
	log {
	source(s_src);
	filter(f_ignore);
	destination(d_stdout);
	filter(f_mail);
	destination(d_redis_ui_log);
	destination(d_redis_f2b_channel);
	};
	diff --git a/data/Dockerfiles/postfix/syslog-ng.conf b/data/Dockerfiles/postfix/syslog-ng.conf
	index a1ccd07e..0990f1c0 100644
	--- a/data/Dockerfiles/postfix/syslog-ng.conf
	+++ b/data/Dockerfiles/postfix/syslog-ng.conf
	@@ -1,53 +1,53 @@
	-@version: 3.28
	+@version: 3.38
	@include "scl.conf"
	options {
	chain_hostnames(off);
	flush_lines(0);
	use_dns(no);
	dns_cache(no);
	use_fqdn(no);
	owner("root"); group("adm"); perm(0640);
	stats_freq(0);
	bad_hostname("^gconfd$");
	};
	source s_src {
	unix-stream("/dev/log");
	internal();
	};
	destination d_stdout { pipe("/dev/stdout"); };
	destination d_redis_ui_log {
	redis(
	host("redis-mailcow")
	persist-name("redis1")
	port(6379)
	command("LPUSH" "POSTFIX_MAILLOG" "$(format-json time=\"$S_UNIXTIME\" priority=\"$PRIORITY\" program=\"$PROGRAM\" message=\"$MESSAGE\")\n")
	);
	};
	destination d_redis_f2b_channel {
	redis(
	host("redis-mailcow")
	persist-name("redis2")
	port(6379)
	command("PUBLISH" "F2B_CHANNEL" "$(sanitize $MESSAGE)")
	);
	};
	filter f_mail { facility(mail); };
	# start
	# overriding warnings are still displayed when the entrypoint runs its initial check
	# warnings logged by postfix-mailcow to syslog are hidden to reduce repeating msgs
	# Some other warnings are ignored
	filter f_ignore {
	not match("overriding earlier entry" value("MESSAGE"));
	not match("TLS SNI from checks.mailcow.email" value("MESSAGE"));
	not match("no SASL support" value("MESSAGE"));
	not facility (local0, local1, local2, local3, local4, local5, local6, local7);
	};
	# end
	log {
	source(s_src);
	filter(f_ignore);
	destination(d_stdout);
	filter(f_mail);
	destination(d_redis_ui_log);
	destination(d_redis_f2b_channel);
	};
	diff --git a/data/conf/postfix/anonymize_headers.pcre b/data/conf/postfix/anonymize_headers.pcre
	index 061a4bc0..1a59d53a 100644
	--- a/data/conf/postfix/anonymize_headers.pcre
	+++ b/data/conf/postfix/anonymize_headers.pcre
	@@ -1,20 +1,20 @@
	if /^\sReceived:.Authenticated sender.*$Postcow$/
	#/^Received: from .? $[\w-.] \[.?\]$\s+$Authenticated sender: (.+)$\s+by.+$Postcow$ with (E?SMTPS?A?) id ([A-F0-9]+).+;.?/
	-/^Received: from .? $[\w-.] \[.?\]$(.\|\n.)$Authenticated sender: (.+)$\s+by.+$Postcow$ with (.)/
	+/^Received: from .? $[\w\-.] \[.?\]$(.\|\n.)$Authenticated sender: (.+)$\s+by.+$Postcow$ with (.)/
	REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with $3
	endif
	if /^\sReceived: from. $.dovecot-mailcow.mailcow-network.$.$Postcow$/
	/^Received: from.* (.\|\n.)$(.+) (.+)$\s+by (.+) $Postcow$ with (.*)/
	REPLACE Received: from sieve (sieve $3) by $4 (Postcow) with $5
	endif
	if /^\sReceived: from. $.rspamd-mailcow.mailcow-network.$.$Postcow$/
	/^Received: from.* (.\|\n.)$(.+) (.+)$\s+by (.+) $Postcow$ with (.*)/
	REPLACE Received: from rspamd (rspamd $3) by $4 (Postcow) with $5
	endif
	/^\s*X-Enigmail/ IGNORE
	# Not removing Mailer by default, might be signed
	#/^\s*X-Mailer/ IGNORE
	/^\s*X-Originating-IP/ IGNORE
	/^\s*X-Forward/ IGNORE
	# Not removing UA by default, might be signed
	#/^\s*User-Agent/ IGNORE
	diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf
	index 6cced666..6a87f2ec 100644
	--- a/data/conf/postfix/main.cf
	+++ b/data/conf/postfix/main.cf
	@@ -1,175 +1,175 @@
	# --------------------------------------------------------------------------
	# Please create a file "extra.cf" for persistent overrides to main.cf
	# --------------------------------------------------------------------------
	biff = no
	append_dot_mydomain = no
	smtpd_tls_cert_file = /etc/ssl/mail/cert.pem
	smtpd_tls_key_file = /etc/ssl/mail/key.pem
	tls_server_sni_maps = hash:/opt/postfix/conf/sni.map
	smtpd_tls_received_header = yes
	smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
	smtpd_relay_restrictions = permit_mynetworks,
	permit_sasl_authenticated,
	defer_unauth_destination
	smtpd_forbid_bare_newline = yes
	# alias maps are auto-generated in postfix.sh on startup
	alias_maps = hash:/etc/aliases
	alias_database = hash:/etc/aliases
	relayhost =
	mynetworks_style = subnet
	mailbox_size_limit = 0
	recipient_delimiter = +
	inet_interfaces = all
	inet_protocols = all
	bounce_queue_lifetime = 1d
	broken_sasl_auth_clients = yes
	disable_vrfy_command = yes
	maximal_backoff_time = 1800s
	maximal_queue_lifetime = 5d
	delay_warning_time = 4h
	message_size_limit = 104857600
	milter_default_action = tempfail
	milter_protocol = 6
	minimal_backoff_time = 300s
	plaintext_reject_code = 550
	postscreen_access_list = permit_mynetworks,
	cidr:/opt/postfix/conf/custom_postscreen_whitelist.cidr,
	cidr:/opt/postfix/conf/postscreen_access.cidr,
	tcp:127.0.0.1:10027
	postscreen_bare_newline_enable = no
	postscreen_blacklist_action = drop
	postscreen_cache_cleanup_interval = 24h
	postscreen_cache_map = proxy:btree:$data_directory/postscreen_cache
	postscreen_dnsbl_action = enforce
	postscreen_dnsbl_threshold = 6
	postscreen_dnsbl_ttl = 5m
	postscreen_greet_action = enforce
	postscreen_greet_banner = $smtpd_banner
	postscreen_greet_ttl = 2d
	postscreen_greet_wait = 3s
	postscreen_non_smtp_command_enable = no
	postscreen_pipelining_enable = no
	proxy_read_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_transport_maps.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_mbr_access_maps.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_in_policy.cf,
	$sender_dependent_default_transport_maps,
	$smtp_tls_policy_maps,
	$local_recipient_maps,
	$mydestination,
	$virtual_alias_maps,
	$virtual_alias_domains,
	$virtual_mailbox_maps,
	$virtual_mailbox_domains,
	$relay_recipient_maps,
	$relay_domains,
	$canonical_maps,
	$sender_canonical_maps,
	$sender_bcc_maps,
	$recipient_bcc_maps,
	$recipient_canonical_maps,
	$relocated_maps,
	$transport_maps,
	$mynetworks,
	$smtpd_sender_login_maps,
	$smtp_sasl_password_maps
	queue_run_delay = 300s
	relay_domains = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_relay_domain_maps.cf
	relay_recipient_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf
	sender_dependent_default_transport_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sender_dependent_default_transport_maps.cf
	smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
	smtp_tls_cert_file = /etc/ssl/mail/cert.pem
	smtp_tls_key_file = /etc/ssl/mail/key.pem
	smtp_tls_loglevel = 1
	smtp_dns_support_level = dnssec
	smtp_tls_security_level = dane
	smtpd_data_restrictions = reject_unauth_pipelining, permit
	smtpd_delay_reject = yes
	smtpd_error_sleep_time = 10s
	smtpd_forbid_bare_newline = yes
	smtpd_hard_error_limit = ${stress?1}${stress:5}
	smtpd_helo_required = yes
	smtpd_proxy_timeout = 600s
	smtpd_recipient_restrictions = check_recipient_mx_access proxy:mysql:/opt/postfix/conf/sql/mysql_mbr_access_maps.cf,
	permit_sasl_authenticated,
	permit_mynetworks,
	check_recipient_access proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_in_policy.cf,
	reject_invalid_helo_hostname,
	reject_unauth_destination
	smtpd_sasl_auth_enable = yes
	smtpd_sasl_authenticated_header = yes
	smtpd_sasl_path = inet:dovecot:10001
	smtpd_sasl_type = dovecot
	smtpd_sender_login_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_sender_acl.cf
	smtpd_sender_restrictions = reject_authenticated_sender_login_mismatch,
	permit_mynetworks,
	permit_sasl_authenticated,
	reject_unlisted_sender,
	reject_unknown_sender_domain
	smtpd_soft_error_limit = 3
	smtpd_tls_auth_only = yes
	smtpd_tls_dh1024_param_file = /etc/ssl/mail/dhparams.pem
	smtpd_tls_eecdh_grade = auto
	smtpd_tls_exclude_ciphers = ECDHE-RSA-RC4-SHA, RC4, aNULL, DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA
	smtpd_tls_loglevel = 1

	# Mandatory protocols and ciphers are used when a connections is enforced to use TLS
	# Does _not_ apply to enforced incoming TLS settings per mailbox
	-smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	-lmtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	-smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	+smtp_tls_mandatory_protocols = >=TLSv1.2
	+lmtp_tls_mandatory_protocols = >=TLSv1.2
	+smtpd_tls_mandatory_protocols = >=TLSv1.2
	smtpd_tls_mandatory_ciphers = high

	-smtp_tls_protocols = !SSLv2, !SSLv3
	-lmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	-smtpd_tls_protocols = !SSLv2, !SSLv3
	+smtp_tls_protocols = >=TLSv1.2
	+lmtp_tls_protocols = >=TLSv1.2
	+smtpd_tls_protocols = >=TLSv1.2

	smtpd_tls_security_level = may
	tls_preempt_cipherlist = yes
	tls_ssl_options = NO_COMPRESSION, NO_RENEGOTIATION
	virtual_alias_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_alias_maps.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_resource_maps.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_spamalias_maps.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_alias_domain_maps.cf
	virtual_gid_maps = static:5000
	virtual_mailbox_base = /var/vmail/
	virtual_mailbox_domains = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_domains_maps.cf
	# -- moved to rspamd on 2021-06-01
	#recipient_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_recipient_bcc_maps.cf
	#sender_bcc_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sender_bcc_maps.cf
	recipient_canonical_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_recipient_canonical_maps.cf
	recipient_canonical_classes = envelope_recipient
	virtual_mailbox_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf
	virtual_minimum_uid = 104
	virtual_transport = lmtp:inet:dovecot:24
	virtual_uid_maps = static:5000
	smtpd_milters = inet:rspamd:9900
	non_smtpd_milters = inet:rspamd:9900
	milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
	mydestination = localhost.localdomain, localhost
	smtp_address_preference = any
	smtp_sender_dependent_authentication = yes
	smtp_sasl_auth_enable = yes
	smtp_sasl_password_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_sasl_passwd_maps_sender_dependent.cf
	smtp_sasl_security_options =
	smtp_sasl_mechanism_filter = plain, login
	smtp_tls_policy_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_policy_override_maps.cf
	smtp_header_checks = pcre:/opt/postfix/conf/anonymize_headers.pcre
	mail_name = Postcow
	# local_transport map catches local destinations and prevents routing local dests when the next map would route "*"
	# Use custom_transport.pcre for custom transports
	transport_maps = pcre:/opt/postfix/conf/custom_transport.pcre,
	pcre:/opt/postfix/conf/local_transport,
	proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,
	proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf
	smtp_sasl_auth_soft_bounce = no
	postscreen_discard_ehlo_keywords = silent-discard, dsn, chunking
	smtpd_discard_ehlo_keywords = chunking, silent-discard
	-compatibility_level = 2
	+compatibility_level = 3.7
	smtputf8_enable = no
	# Define protocols for SMTPS and submission service
	-submission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	-smtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
	+submission_smtpd_tls_mandatory_protocols = >=TLSv1.2
	+smtps_smtpd_tls_mandatory_protocols = >=TLSv1.2
	parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks,qmqpd_authorized_clients

	# DO NOT EDIT ANYTHING BELOW #
	# Overrides #
	diff --git a/docker-compose.yml b/docker-compose.yml
	index 1a058887..49b454ec 100644
	--- a/docker-compose.yml
	+++ b/docker-compose.yml
	@@ -1,666 +1,666 @@
	services:

	unbound-mailcow:
	image: mailcow/unbound:1.22
	environment:
	- TZ=${TZ}
	- SKIP_UNBOUND_HEALTHCHECK=${SKIP_UNBOUND_HEALTHCHECK:-n}
	volumes:
	- ./data/hooks/unbound:/hooks:Z
	- ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro,Z
	restart: always
	tty: true
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.254
	aliases:
	- unbound

	mysql-mailcow:
	image: mariadb:10.5
	depends_on:
	- unbound-mailcow
	- netfilter-mailcow
	stop_grace_period: 45s
	volumes:
	- mysql-vol-1:/var/lib/mysql/
	- mysql-socket-vol-1:/var/run/mysqld/
	- ./data/conf/mysql/:/etc/mysql/conf.d/:ro,Z
	environment:
	- TZ=${TZ}
	- MYSQL_ROOT_PASSWORD=${DBROOT}
	- MYSQL_DATABASE=${DBNAME}
	- MYSQL_USER=${DBUSER}
	- MYSQL_PASSWORD=${DBPASS}
	- MYSQL_INITDB_SKIP_TZINFO=1
	restart: always
	ports:
	- "${SQL_PORT:-127.0.0.1:13306}:3306"
	networks:
	mailcow-network:
	aliases:
	- mysql

	redis-mailcow:
	image: redis:7-alpine
	volumes:
	- redis-vol-1:/data/
	restart: always
	depends_on:
	- netfilter-mailcow
	ports:
	- "${REDIS_PORT:-127.0.0.1:7654}:6379"
	environment:
	- TZ=${TZ}
	sysctls:
	- net.core.somaxconn=4096
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.249
	aliases:
	- redis

	clamd-mailcow:
	image: mailcow/clamd:1.66
	restart: always
	depends_on:
	unbound-mailcow:
	condition: service_healthy
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- TZ=${TZ}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	volumes:
	- ./data/conf/clamav/:/etc/clamav/:Z
	- clamd-db-vol-1:/var/lib/clamav
	networks:
	mailcow-network:
	aliases:
	- clamd

	rspamd-mailcow:
	image: mailcow/rspamd:1.96
	stop_grace_period: 30s
	depends_on:
	- dovecot-mailcow
	environment:
	- TZ=${TZ}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	volumes:
	- ./data/hooks/rspamd:/hooks:Z
	- ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
	- ./data/conf/rspamd/override.d/:/etc/rspamd/override.d:Z
	- ./data/conf/rspamd/local.d/:/etc/rspamd/local.d:Z
	- ./data/conf/rspamd/plugins.d/:/etc/rspamd/plugins.d:Z
	- ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro,Z
	- ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z
	- ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z
	- rspamd-vol-1:/var/lib/rspamd
	restart: always
	hostname: rspamd
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- rspamd

	php-fpm-mailcow:
	image: mailcow/phpfpm:1.88
	command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
	depends_on:
	- redis-mailcow
	volumes:
	- ./data/hooks/phpfpm:/hooks:Z
	- ./data/web:/web:z
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
	- ./data/conf/rspamd/custom/:/rspamd_custom_maps:z
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	- ./data/conf/sogo/:/etc/sogo/:z
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
	- ./data/conf/phpfpm/sogo-sso/:/etc/sogo-sso/:z
	- ./data/conf/phpfpm/php-fpm.d/pools.conf:/usr/local/etc/php-fpm.d/z-pools.conf:Z
	- ./data/conf/phpfpm/php-conf.d/opcache-recommended.ini:/usr/local/etc/php/conf.d/opcache-recommended.ini:Z
	- ./data/conf/phpfpm/php-conf.d/upload.ini:/usr/local/etc/php/conf.d/upload.ini:Z
	- ./data/conf/phpfpm/php-conf.d/other.ini:/usr/local/etc/php/conf.d/zzz-other.ini:Z
	- ./data/conf/dovecot/global_sieve_before:/global_sieve/before:z
	- ./data/conf/dovecot/global_sieve_after:/global_sieve/after:z
	- ./data/assets/templates:/tpls:z
	- ./data/conf/nginx/:/etc/nginx/conf.d/:z
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
	- IMAP_PORT=${IMAP_PORT:-143}
	- IMAPS_PORT=${IMAPS_PORT:-993}
	- POP_PORT=${POP_PORT:-110}
	- POPS_PORT=${POPS_PORT:-995}
	- SIEVE_PORT=${SIEVE_PORT:-4190}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
	- SUBMISSION_PORT=${SUBMISSION_PORT:-587}
	- SMTPS_PORT=${SMTPS_PORT:-465}
	- SMTP_PORT=${SMTP_PORT:-25}
	- API_KEY=${API_KEY:-invalid}
	- API_KEY_READ_ONLY=${API_KEY_READ_ONLY:-invalid}
	- API_ALLOW_FROM=${API_ALLOW_FROM:-invalid}
	- COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
	- SKIP_SOLR=${SKIP_SOLR:-y}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	- SKIP_SOGO=${SKIP_SOGO:-n}
	- ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
	- MASTER=${MASTER:-y}
	- DEV_MODE=${DEV_MODE:-n}
	- DEMO_MODE=${DEMO_MODE:-n}
	- WEBAUTHN_ONLY_TRUSTED_VENDORS=${WEBAUTHN_ONLY_TRUSTED_VENDORS:-n}
	- CLUSTERMODE=${CLUSTERMODE:-}
	restart: always
	networks:
	mailcow-network:
	aliases:
	- phpfpm

	sogo-mailcow:
	image: mailcow/sogo:1.123
	environment:
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	- LOG_LINES=${LOG_LINES:-9999}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
	- ACL_ANYONE=${ACL_ANYONE:-disallow}
	- ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480}
	- SKIP_SOGO=${SKIP_SOGO:-n}
	- MASTER=${MASTER:-y}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	volumes:
	- ./data/hooks/sogo:/hooks:Z
	- ./data/conf/sogo/:/etc/sogo/:z
	- ./data/web/inc/init_db.inc.php:/init_db.inc.php:z
	- ./data/conf/sogo/custom-favicon.ico:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z
	- ./data/conf/sogo/custom-theme.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/theme.js:z
	- ./data/conf/sogo/custom-sogo.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js:z
	- mysql-socket-vol-1:/var/run/mysqld/
	- sogo-web-vol-1:/sogo_web
	- sogo-userdata-backup-vol-1:/sogo_backup
	labels:
	ofelia.enabled: "true"
	ofelia.job-exec.sogo_sessions.schedule: "@every 1m"
	ofelia.job-exec.sogo_sessions.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool -v expire-sessions $${SOGO_EXPIRE_SESSION} \|\| exit 0\""
	ofelia.job-exec.sogo_ealarms.schedule: "@every 1m"
	ofelia.job-exec.sogo_ealarms.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-ealarms-notify -p /etc/sogo/sieve.creds \|\| exit 0\""
	ofelia.job-exec.sogo_eautoreply.schedule: "@every 5m"
	ofelia.job-exec.sogo_eautoreply.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool update-autoreply -p /etc/sogo/sieve.creds \|\| exit 0\""
	ofelia.job-exec.sogo_backup.schedule: "@every 24h"
	ofelia.job-exec.sogo_backup.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool backup /sogo_backup ALL \|\| exit 0\""
	restart: always
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
	aliases:
	- sogo

	dovecot-mailcow:
	image: mailcow/dovecot:1.29
	depends_on:
	- mysql-mailcow
	- netfilter-mailcow
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	cap_add:
	- NET_BIND_SERVICE
	volumes:
	- ./data/hooks/dovecot:/hooks:Z
	- ./data/conf/dovecot:/etc/dovecot:z
	- ./data/assets/ssl:/etc/ssl/mail/:ro,z
	- ./data/conf/sogo/:/etc/sogo/:z
	- ./data/conf/phpfpm/sogo-sso/:/etc/phpfpm/:z
	- vmail-vol-1:/var/vmail
	- vmail-index-vol-1:/var/vmail_index
	- crypt-vol-1:/mail_crypt/
	- ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
	- ./data/assets/templates:/templates:z
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	environment:
	- DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-}
	- DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-}
	- MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-}
	- DOVEADM_REPLICA_PORT=${DOVEADM_REPLICA_PORT:-}
	- LOG_LINES=${LOG_LINES:-9999}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
	- MAILDIR_GC_TIME=${MAILDIR_GC_TIME:-7200}
	- ACL_ANYONE=${ACL_ANYONE:-disallow}
	- SKIP_SOLR=${SKIP_SOLR:-y}
	- MAILDIR_SUB=${MAILDIR_SUB:-}
	- MASTER=${MASTER:-y}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
	ports:
	- "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
	- "${IMAP_PORT:-143}:143"
	- "${IMAPS_PORT:-993}:993"
	- "${POP_PORT:-110}:110"
	- "${POPS_PORT:-995}:995"
	- "${SIEVE_PORT:-4190}:4190"
	restart: always
	tty: true
	labels:
	ofelia.enabled: "true"
	ofelia.job-exec.dovecot_imapsync_runner.schedule: "@every 1m"
	ofelia.job-exec.dovecot_imapsync_runner.no-overlap: "true"
	ofelia.job-exec.dovecot_imapsync_runner.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu nobody /usr/local/bin/imapsync_runner.pl \|\| exit 0\""
	ofelia.job-exec.dovecot_trim_logs.schedule: "@every 1m"
	ofelia.job-exec.dovecot_trim_logs.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu vmail /usr/local/bin/trim_logs.sh \|\| exit 0\""
	ofelia.job-exec.dovecot_quarantine.schedule: "@every 20m"
	ofelia.job-exec.dovecot_quarantine.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu vmail /usr/local/bin/quarantine_notify.py \|\| exit 0\""
	ofelia.job-exec.dovecot_clean_q_aged.schedule: "@every 24h"
	ofelia.job-exec.dovecot_clean_q_aged.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu vmail /usr/local/bin/clean_q_aged.sh \|\| exit 0\""
	ofelia.job-exec.dovecot_maildir_gc.schedule: "@every 30m"
	ofelia.job-exec.dovecot_maildir_gc.command: "/bin/bash -c \"source /source_env.sh ; /usr/local/bin/gosu vmail /usr/local/bin/maildir_gc.sh\""
	ofelia.job-exec.dovecot_sarules.schedule: "@every 24h"
	ofelia.job-exec.dovecot_sarules.command: "/bin/bash -c \"/usr/local/bin/sa-rules.sh\""
	ofelia.job-exec.dovecot_fts.schedule: "@every 24h"
	ofelia.job-exec.dovecot_fts.command: "/usr/bin/curl http://solr:8983/solr/dovecot-fts/update?optimize=true"
	ofelia.job-exec.dovecot_repl_health.schedule: "@every 5m"
	ofelia.job-exec.dovecot_repl_health.command: "/bin/bash -c \"/usr/local/bin/gosu vmail /usr/local/bin/repl_health.sh\""
	ulimits:
	nproc: 65535
	nofile:
	soft: 20000
	hard: 40000
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.250
	aliases:
	- dovecot

	postfix-mailcow:
	- image: mailcow/postfix:1.74
	+ image: mailcow/postfix:1.75
	depends_on:
	mysql-mailcow:
	condition: service_started
	unbound-mailcow:
	condition: service_healthy
	volumes:
	- ./data/hooks/postfix:/hooks:Z
	- ./data/conf/postfix:/opt/postfix/conf:z
	- ./data/assets/ssl:/etc/ssl/mail/:ro,z
	- postfix-vol-1:/var/spool/postfix
	- crypt-vol-1:/var/lib/zeyple
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- SPAMHAUS_DQS_KEY=${SPAMHAUS_DQS_KEY:-}
	cap_add:
	- NET_BIND_SERVICE
	ports:
	- "${SMTP_PORT:-25}:25"
	- "${SMTPS_PORT:-465}:465"
	- "${SUBMISSION_PORT:-587}:587"
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	ipv4_address: ${IPV4_NETWORK:-172.22.1}.253
	aliases:
	- postfix

	memcached-mailcow:
	image: memcached:alpine
	restart: always
	environment:
	- TZ=${TZ}
	networks:
	mailcow-network:
	aliases:
	- memcached

	nginx-mailcow:
	depends_on:
	- sogo-mailcow
	- php-fpm-mailcow
	- redis-mailcow
	image: nginx:mainline-alpine
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
	envsubst < /etc/nginx/conf.d/templates/listen_ssl.template > /etc/nginx/conf.d/listen_ssl.active &&
	envsubst < /etc/nginx/conf.d/templates/sogo.template > /etc/nginx/conf.d/sogo.active &&
	. /etc/nginx/conf.d/templates/server_name.template.sh > /etc/nginx/conf.d/server_name.active &&
	. /etc/nginx/conf.d/templates/sites.template.sh > /etc/nginx/conf.d/sites.active &&
	. /etc/nginx/conf.d/templates/sogo_eas.template.sh > /etc/nginx/conf.d/sogo_eas.active &&
	nginx -qt &&
	until ping phpfpm -c1 > /dev/null; do sleep 1; done &&
	until ping sogo -c1 > /dev/null; do sleep 1; done &&
	until ping redis -c1 > /dev/null; do sleep 1; done &&
	until ping rspamd -c1 > /dev/null; do sleep 1; done &&
	exec nginx -g 'daemon off;'"
	environment:
	- HTTPS_PORT=${HTTPS_PORT:-443}
	- HTTP_PORT=${HTTP_PORT:-80}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- TZ=${TZ}
	- SKIP_SOGO=${SKIP_SOGO:-n}
	- ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
	- ADDITIONAL_SERVER_NAMES=${ADDITIONAL_SERVER_NAMES:-}
	volumes:
	- ./data/web:/web:ro,z
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
	- ./data/assets/ssl/:/etc/ssl/mail/:ro,z
	- ./data/conf/nginx/:/etc/nginx/conf.d/:z
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
	- sogo-web-vol-1:/usr/lib/GNUstep/SOGo/
	ports:
	- "${HTTPS_BIND:-}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
	- "${HTTP_BIND:-}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
	restart: always
	networks:
	mailcow-network:
	aliases:
	- nginx

	acme-mailcow:
	depends_on:
	nginx-mailcow:
	condition: service_started
	unbound-mailcow:
	condition: service_healthy
	image: mailcow/acme:1.88
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- LOG_LINES=${LOG_LINES:-9999}
	- ACME_CONTACT=${ACME_CONTACT:-}
	- ADDITIONAL_SAN=${ADDITIONAL_SAN}
	- AUTODISCOVER_SAN=${AUTODISCOVER_SAN:-y}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
	- COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
	- DIRECTORY_URL=${DIRECTORY_URL:-}
	- ENABLE_SSL_SNI=${ENABLE_SSL_SNI:-n}
	- SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
	- SKIP_HTTP_VERIFICATION=${SKIP_HTTP_VERIFICATION:-n}
	- ONLY_MAILCOW_HOSTNAME=${ONLY_MAILCOW_HOSTNAME:-n}
	- LE_STAGING=${LE_STAGING:-n}
	- TZ=${TZ}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
	- SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
	volumes:
	- ./data/web/.well-known/acme-challenge:/var/www/acme:z
	- ./data/assets/ssl:/var/lib/acme/:z
	- ./data/assets/ssl-example:/var/lib/ssl-example/:ro,Z
	- mysql-socket-vol-1:/var/run/mysqld/
	restart: always
	networks:
	mailcow-network:
	aliases:
	- acme

	netfilter-mailcow:
	image: mailcow/netfilter:1.59
	stop_grace_period: 30s
	restart: always
	privileged: true
	environment:
	- TZ=${TZ}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
	- SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
	- SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- MAILCOW_REPLICA_IP=${MAILCOW_REPLICA_IP:-}
	- DISABLE_NETFILTER_ISOLATION_RULE=${DISABLE_NETFILTER_ISOLATION_RULE:-n}
	network_mode: "host"
	volumes:
	- /lib/modules:/lib/modules:ro

	watchdog-mailcow:
	image: mailcow/watchdog:2.03
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	tmpfs:
	- /tmp
	volumes:
	- rspamd-vol-1:/var/lib/rspamd
	- mysql-socket-vol-1:/var/run/mysqld/
	- postfix-vol-1:/var/spool/postfix
	- ./data/assets/ssl:/etc/ssl/mail/:ro,z
	restart: always
	depends_on:
	- postfix-mailcow
	- dovecot-mailcow
	- mysql-mailcow
	- acme-mailcow
	- redis-mailcow

	environment:
	- IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
	- LOG_LINES=${LOG_LINES:-9999}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- DBROOT=${DBROOT}
	- USE_WATCHDOG=${USE_WATCHDOG:-n}
	- WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL:-}
	- WATCHDOG_NOTIFY_BAN=${WATCHDOG_NOTIFY_BAN:-y}
	- WATCHDOG_NOTIFY_START=${WATCHDOG_NOTIFY_START:-y}
	- WATCHDOG_SUBJECT=${WATCHDOG_SUBJECT:-Watchdog ALERT}
	- WATCHDOG_NOTIFY_WEBHOOK=${WATCHDOG_NOTIFY_WEBHOOK:-}
	- WATCHDOG_NOTIFY_WEBHOOK_BODY=${WATCHDOG_NOTIFY_WEBHOOK_BODY:-}
	- WATCHDOG_EXTERNAL_CHECKS=${WATCHDOG_EXTERNAL_CHECKS:-n}
	- WATCHDOG_MYSQL_REPLICATION_CHECKS=${WATCHDOG_MYSQL_REPLICATION_CHECKS:-n}
	- WATCHDOG_VERBOSE=${WATCHDOG_VERBOSE:-n}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
	- IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- IP_BY_DOCKER_API=${IP_BY_DOCKER_API:-0}
	- CHECK_UNBOUND=${CHECK_UNBOUND:-1}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	- SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
	- SKIP_SOGO=${SKIP_SOGO:-n}
	- HTTPS_PORT=${HTTPS_PORT:-443}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	- EXTERNAL_CHECKS_THRESHOLD=${EXTERNAL_CHECKS_THRESHOLD:-1}
	- NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}
	- UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}
	- REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}
	- MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}
	- MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}
	- SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}
	- POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}
	- CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}
	- DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}
	- DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}
	- PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}
	- RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}
	- FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}
	- ACME_THRESHOLD=${ACME_THRESHOLD:-1}
	- RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}
	- OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}
	- MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}
	- MAILQ_CRIT=${MAILQ_CRIT:-30}
	networks:
	mailcow-network:
	aliases:
	- watchdog

	dockerapi-mailcow:
	image: mailcow/dockerapi:2.08
	security_opt:
	- label=disable
	restart: always
	dns:
	- ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- DBROOT=${DBROOT}
	- TZ=${TZ}
	- REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
	- REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	networks:
	mailcow-network:
	aliases:
	- dockerapi


	##### Will be removed soon #####
	solr-mailcow:
	image: mailcow/solr:1.8.2
	restart: always
	depends_on:
	- netfilter-mailcow
	volumes:
	- solr-vol-1:/opt/solr/server/solr/dovecot-fts/data
	ports:
	- "${SOLR_PORT:-127.0.0.1:18983}:8983"
	environment:
	- TZ=${TZ}
	- SOLR_HEAP=${SOLR_HEAP:-1024}
	- SKIP_SOLR=${SKIP_SOLR:-y}
	networks:
	mailcow-network:
	aliases:
	- solr
	################################

	olefy-mailcow:
	image: mailcow/olefy:1.13
	restart: always
	environment:
	- TZ=${TZ}
	- OLEFY_BINDADDRESS=0.0.0.0
	- OLEFY_BINDPORT=10055
	- OLEFY_TMPDIR=/tmp
	- OLEFY_PYTHON_PATH=/usr/bin/python3
	- OLEFY_OLEVBA_PATH=/usr/bin/olevba
	- OLEFY_LOGLVL=20
	- OLEFY_MINLENGTH=500
	- OLEFY_DEL_TMP=1
	networks:
	mailcow-network:
	aliases:
	- olefy

	ofelia-mailcow:
	image: mcuadros/ofelia:latest
	restart: always
	command: daemon --docker
	environment:
	- TZ=${TZ}
	depends_on:
	- sogo-mailcow
	- dovecot-mailcow
	labels:
	ofelia.enabled: "true"
	security_opt:
	- label=disable
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	networks:
	mailcow-network:
	aliases:
	- ofelia

	ipv6nat-mailcow:
	depends_on:
	- unbound-mailcow
	- mysql-mailcow
	- redis-mailcow
	- clamd-mailcow
	- rspamd-mailcow
	- php-fpm-mailcow
	- sogo-mailcow
	- dovecot-mailcow
	- postfix-mailcow
	- memcached-mailcow
	- nginx-mailcow
	- acme-mailcow
	- netfilter-mailcow
	- watchdog-mailcow
	- dockerapi-mailcow
	- solr-mailcow
	environment:
	- TZ=${TZ}
	image: robbertkl/ipv6nat
	security_opt:
	- label=disable
	restart: always
	privileged: true
	network_mode: "host"
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- /lib/modules:/lib/modules:ro

	networks:
	mailcow-network:
	driver: bridge
	driver_opts:
	com.docker.network.bridge.name: br-mailcow
	enable_ipv6: true
	ipam:
	driver: default
	config:
	- subnet: ${IPV4_NETWORK:-172.22.1}.0/24
	- subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}

	volumes:
	vmail-vol-1:
	vmail-index-vol-1:
	mysql-vol-1:
	mysql-socket-vol-1:
	redis-vol-1:
	rspamd-vol-1:
	solr-vol-1:
	postfix-vol-1:
	crypt-vol-1:
	sogo-web-vol-1:
	sogo-userdata-backup-vol-1:
	clamd-db-vol-1:

File Metadata

Mime Type: text/x-diff
Expires: 9月 11 Thu, 1:55 PM (16 h, 39 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 5608
默认替代文本: (39 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions