No OneTemporary
Actions

Size

27 KB

Referenced Files

None

订阅者

None

View Options

	diff --git a/.gitignore b/.gitignore
	index 798d9603..e535c710 100644
	--- a/.gitignore
	+++ b/.gitignore
	@@ -1,24 +1,23 @@
	rebuild-images.sh
	data/conf/sogo/sieve.creds
	data/conf/dovecot/dovecot-master.passwd
	mailcow.conf
	mailcow.conf_backup
	-data/conf/nginx/listen*active
	-data/conf/nginx/server_name.active
	+data/conf/nginx/*.active
	data/conf/postfix/sql
	data/conf/dovecot/sql
	data/conf/nextcloud-*.bak
	data/web/inc/vars.local.inc.php
	data/assets/ssl/*
	.vscode/*
	data/web/.well-known/acme-challenge
	data/web/nextcloud/
	data/conf/rspamd/local.d/*
	data/conf/rspamd/override.d/*
	!data/conf/nginx/dynmaps.conf
	!data/conf/nginx/site.conf
	!data/conf/nginx/meta_exporter.conf
	data/conf/nginx/*.conf
	data/conf/nginx/*.custom
	data/conf/nginx/*.bak
	data/conf/dovecot/extra.conf
	diff --git a/data/conf/nginx/site.conf b/data/conf/nginx/site.conf
	index b84d3205..e617f77f 100644
	--- a/data/conf/nginx/site.conf
	+++ b/data/conf/nginx/site.conf
	@@ -1,362 +1,362 @@
	server_tokens off;
	proxy_cache_path /tmp levels=1:2 keys_zone=sogo:10m inactive=24h max_size=1g;
	server_names_hash_bucket_size 64;

	map $http_x_forwarded_proto $client_req_scheme {
	default $scheme;
	https https;
	}

	server {
	include /etc/nginx/mime.types;
	charset utf-8;
	override_charset on;

	add_header Strict-Transport-Security "max-age=15768000; includeSubDomains";
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";
	add_header X-Robots-Tag none;
	add_header X-Download-Options noopen;
	add_header X-Frame-Options "SAMEORIGIN";
	add_header X-Permitted-Cross-Domain-Policies none;

	index index.php index.html;

	include /etc/nginx/conf.d/listen_plain.active;
	include /etc/nginx/conf.d/server_name.active;

	error_log /var/log/nginx/error.log;
	access_log /var/log/nginx/access.log;
	absolute_redirect off;
	root /web;

	location ~ ^/api/v1/(.*)$ {
	try_files $uri $uri/ /json_api.php?query=$1;
	}

	location ^~ /.well-known/acme-challenge/ {
	allow all;
	default_type "text/plain";
	}

	# If behind reverse proxy, forwards the correct IP
	set_real_ip_from 10.0.0.0/8;
	set_real_ip_from 172.16.0.0/12;
	set_real_ip_from 192.168.0.0/16;
	set_real_ip_from fc00::/7;
	real_ip_header X-Forwarded-For;
	real_ip_recursive on;

	rewrite ^/.well-known/caldav$ /SOGo/dav/ permanent;
	rewrite ^/.well-known/carddav$ /SOGo/dav/ permanent;

	location ^~ /principals {
	return 301 /SOGo/dav;
	}

	location ~ \.php$ {
	try_files $uri =404;
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	fastcgi_index index.php;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	fastcgi_param PATH_INFO $fastcgi_path_info;
	fastcgi_param PHP_VALUE "max_execution_time = 1200
	max_input_time = 1200
	memory_limit = 64M";
	fastcgi_read_timeout 1200;
	}

	location /rspamd/ {
	proxy_pass http://rspamd:11334/;
	proxy_set_header Host $http_host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_redirect off;
	}

	location ~* ^/Autodiscover/Autodiscover.xml {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autodiscover.php =404;
	}

	location ~* ^/Autodiscover/Autodiscover.json {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autodiscover-json.php =404;
	}

	location ~ /(?:m\|M)ail/(?:c\|C)onfig-v1.1.xml {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autoconfig.php =404;
	}

	location ^~ /Microsoft-Server-ActiveSync {
	- proxy_pass http://sogo:20000/SOGo/Microsoft-Server-ActiveSync;
	+ include /etc/nginx/conf.d/sogo_eas.active;
	proxy_connect_timeout 1000;
	proxy_next_upstream timeout error;
	proxy_send_timeout 1000;
	proxy_read_timeout 1000;
	proxy_buffer_size 8k;
	proxy_buffers 4 32k;
	proxy_temp_file_write_size 64k;
	proxy_busy_buffers_size 64k;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $http_host;
	proxy_set_header x-webobjects-server-protocol HTTP/1.0;
	proxy_set_header x-webobjects-remote-host $remote_addr;
	proxy_set_header x-webobjects-server-name $server_name;
	proxy_set_header x-webobjects-server-url $client_req_scheme://$http_host;
	proxy_set_header x-webobjects-server-port $server_port;
	client_body_buffer_size 128k;
	client_max_body_size 0;
	}

	location ^~ /SOGo {
	- proxy_pass http://sogo:20000;
	+ include /etc/nginx/conf.d/sogo.active;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $http_host;
	proxy_set_header x-webobjects-server-protocol HTTP/1.0;
	proxy_set_header x-webobjects-remote-host $remote_addr;
	proxy_set_header x-webobjects-server-name $server_name;
	proxy_set_header x-webobjects-server-url $client_req_scheme://$http_host;
	proxy_set_header x-webobjects-server-port $server_port;
	client_body_buffer_size 128k;
	client_max_body_size 0;
	break;
	}

	location /SOGo.woa/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location /.woa/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location /SOGo/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location (^/SOGo/so/ControlPanel/Products/[^/]UI/Resources/.\.(jpg\|png\|gif\|css\|js)$ {
	proxy_pass http://sogo:9192/$1.SOGo/Resources/$2;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
	}

	include /etc/nginx/conf.d/site.*.custom;
	}

	server {
	include /etc/nginx/mime.types;
	charset utf-8;
	override_charset on;

	ssl on;
	ssl_certificate /etc/ssl/mail/cert.pem;
	ssl_certificate_key /etc/ssl/mail/key.pem;
	ssl_protocols TLSv1.2;
	ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
	ssl_prefer_server_ciphers on;
	ssl_session_cache shared:SSL:50m;
	ssl_session_timeout 1d;
	ssl_session_tickets off;

	add_header Strict-Transport-Security "max-age=15768000; includeSubDomains";
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";
	add_header X-Robots-Tag none;
	add_header X-Download-Options noopen;
	add_header X-Frame-Options "SAMEORIGIN";
	add_header X-Permitted-Cross-Domain-Policies none;

	index index.php index.html;

	include /etc/nginx/conf.d/listen_ssl.active;
	include /etc/nginx/conf.d/server_name.active;

	error_log /var/log/nginx/error.log;
	access_log /var/log/nginx/access.log;
	absolute_redirect off;
	root /web;

	location ~ ^/api/v1/(.*)$ {
	try_files $uri $uri/ /json_api.php?query=$1;
	}

	location ^~ /.well-known/acme-challenge/ {
	allow all;
	default_type "text/plain";
	}

	# If behind reverse proxy, forwards the correct IP
	set_real_ip_from 10.0.0.0/8;
	set_real_ip_from 172.16.0.0/12;
	set_real_ip_from 192.168.0.0/16;
	set_real_ip_from fc00::/7;
	real_ip_header X-Forwarded-For;
	real_ip_recursive on;

	rewrite ^/.well-known/caldav$ /SOGo/dav/ permanent;
	rewrite ^/.well-known/carddav$ /SOGo/dav/ permanent;

	location ^~ /principals {
	return 301 /SOGo/dav;
	}

	location ~ \.php$ {
	try_files $uri =404;
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	fastcgi_index index.php;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	fastcgi_param PATH_INFO $fastcgi_path_info;
	fastcgi_param PHP_VALUE "max_execution_time = 1200
	max_input_time = 1200
	memory_limit = 64M";
	fastcgi_read_timeout 1200;
	}

	location /rspamd/ {
	proxy_pass http://rspamd:11334/;
	proxy_set_header Host $http_host;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_redirect off;
	}

	location ~* ^/Autodiscover/Autodiscover.xml {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autodiscover.php =404;
	}

	location ~* ^/Autodiscover/Autodiscover.json {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autodiscover-json.php =404;
	}

	location ~ /(?:m\|M)ail/(?:c\|C)onfig-v1.1.xml {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
	fastcgi_pass phpfpm:9000;
	include /etc/nginx/fastcgi_params;
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	try_files /autoconfig.php =404;
	}

	location ^~ /Microsoft-Server-ActiveSync {
	- proxy_pass http://sogo:20000/SOGo/Microsoft-Server-ActiveSync;
	+ include /etc/nginx/conf.d/templates/sogo_proxy.template;
	proxy_connect_timeout 1000;
	proxy_next_upstream timeout error;
	proxy_send_timeout 1000;
	proxy_read_timeout 1000;
	proxy_buffer_size 8k;
	proxy_buffers 4 32k;
	proxy_temp_file_write_size 64k;
	proxy_busy_buffers_size 64k;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $http_host;
	proxy_set_header x-webobjects-server-protocol HTTP/1.0;
	proxy_set_header x-webobjects-remote-host $remote_addr;
	proxy_set_header x-webobjects-server-name $server_name;
	proxy_set_header x-webobjects-server-url $client_req_scheme://$http_host;
	proxy_set_header x-webobjects-server-port $server_port;
	client_body_buffer_size 128k;
	client_max_body_size 0;
	}

	location ^~ /SOGo {
	- proxy_pass http://sogo:20000;
	+ include /etc/nginx/conf.d/sogo.active;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header Host $http_host;
	proxy_set_header x-webobjects-server-protocol HTTP/1.0;
	proxy_set_header x-webobjects-remote-host $remote_addr;
	proxy_set_header x-webobjects-server-name $server_name;
	proxy_set_header x-webobjects-server-url $client_req_scheme://$http_host;
	proxy_set_header x-webobjects-server-port $server_port;
	client_body_buffer_size 128k;
	client_max_body_size 0;
	break;
	}

	location /SOGo.woa/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location /.woa/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location /SOGo/WebServerResources/ {
	proxy_pass http://sogo:9192/WebServerResources/;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/WebServerResources/;
	allow all;
	}

	location (^/SOGo/so/ControlPanel/Products/[^/]UI/Resources/.\.(jpg\|png\|gif\|css\|js)$ {
	proxy_pass http://sogo:9192/$1.SOGo/Resources/$2;
	proxy_set_header Host $http_host;
	proxy_cache sogo;
	proxy_cache_valid 200 1d;
	proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
	#alias /usr/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
	}

	include /etc/nginx/conf.d/site.*.custom;
	}
	diff --git a/data/conf/nginx/templates/sogo.template b/data/conf/nginx/templates/sogo.template
	new file mode 100644
	index 00000000..2c084389
	--- /dev/null
	+++ b/data/conf/nginx/templates/sogo.template
	@@ -0,0 +1 @@
	+proxy_pass http://${IPV4_NETWORK}.248:20000;
	diff --git a/data/conf/nginx/templates/sogo_eas.template b/data/conf/nginx/templates/sogo_eas.template
	new file mode 100644
	index 00000000..3cea9f98
	--- /dev/null
	+++ b/data/conf/nginx/templates/sogo_eas.template
	@@ -0,0 +1 @@
	+proxy_pass http://${IPV4_NETWORK}.248:20000/SOGo/Microsoft-Server-ActiveSync;
	diff --git a/data/conf/nginx/templates/sogo_proxy.template b/data/conf/nginx/templates/sogo_proxy.template
	new file mode 100644
	index 00000000..e69de29b
	diff --git a/docker-compose.yml b/docker-compose.yml
	index df77ba9c..8bdde1a7 100644
	--- a/docker-compose.yml
	+++ b/docker-compose.yml
	@@ -1,408 +1,412 @@
	version: '2.1'
	services:

	unbound-mailcow:
	image: mailcow/unbound:1.1
	build: ./data/Dockerfiles/unbound
	command: /usr/sbin/unbound
	environment:
	- TZ=${TZ}
	volumes:
	- ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	networks:
	mailcow-network:
	- ipv4_address: ${IPV4_NETWORK}.254
	+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.254
	aliases:
	- unbound

	mysql-mailcow:
	image: mariadb:10.2
	volumes:
	- mysql-vol-1:/var/lib/mysql/
	- ./data/conf/mysql/:/etc/mysql/conf.d/:ro
	environment:
	- TZ=${TZ}
	- MYSQL_ROOT_PASSWORD=${DBROOT}
	- MYSQL_DATABASE=${DBNAME}
	- MYSQL_USER=${DBUSER}
	- MYSQL_PASSWORD=${DBPASS}
	restart: always
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	ports:
	- "${SQL_PORT:-127.0.0.1:13306}:3306"
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	networks:
	mailcow-network:
	aliases:
	- mysql

	redis-mailcow:
	image: redis:alpine
	volumes:
	- redis-vol-1:/data/
	restart: always
	environment:
	- TZ=${TZ}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	networks:
	mailcow-network:
	- ipv4_address: ${IPV4_NETWORK}.249
	+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.249
	aliases:
	- redis

	clamd-mailcow:
	image: mailcow/clamd:1.8
	build: ./data/Dockerfiles/clamd
	restart: always
	environment:
	- TZ=${TZ}
	- SKIP_CLAMD=${SKIP_CLAMD:-n}
	volumes:
	- ./data/conf/clamav/:/etc/clamav/
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	networks:
	mailcow-network:
	aliases:
	- clamd

	rspamd-mailcow:
	image: mailcow/rspamd:1.17
	build: ./data/Dockerfiles/rspamd
	stop_grace_period: 30s
	depends_on:
	- nginx-mailcow
	environment:
	- TZ=${TZ}
	volumes:
	- ./data/conf/rspamd/custom/:/etc/rspamd/custom:ro
	- ./data/conf/rspamd/override.d/:/etc/rspamd/override.d:rw
	- ./data/conf/rspamd/local.d/:/etc/rspamd/local.d:ro
	- ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro
	- rspamd-sock:/rspamd-sock
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	hostname: rspamd
	networks:
	mailcow-network:
	aliases:
	- rspamd

	php-fpm-mailcow:
	image: mailcow/phpfpm:1.11
	build: ./data/Dockerfiles/phpfpm
	command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
	depends_on:
	- redis-mailcow
	volumes:
	- ./data/web:/web:rw
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro
	- rspamd-sock:/rspamd-sock
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro
	- ./data/conf/phpfpm/php-fpm.d/www.conf:/usr/local/etc/php-fpm.d/www.conf
	- ./data/conf/phpfpm/php-fpm.d/system.conf:/usr/local/etc/php-fpm.d/system.conf
	- ./data/conf/phpfpm/php-conf.d/opcache-recommended.ini:/usr/local/etc/php/conf.d/opcache-recommended.ini
	- ./data/conf/phpfpm/php-conf.d/upload.ini:/usr/local/etc/php/conf.d/upload.ini
	environment:
	- LOG_LINES=${LOG_LINES}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- IMAP_PORT=${IMAP_PORT:-143}
	- IMAPS_PORT=${IMAPS_PORT:-993}
	- POP_PORT=${POP_PORT:-110}
	- POPS_PORT=${POPS_PORT:-995}
	- SIEVE_PORT=${SIEVE_PORT:-4190}
	- SUBMISSION_PORT=${SUBMISSION_PORT:-587}
	- SMTPS_PORT=${SMTPS_PORT:-465}
	- SMTP_PORT=${SMTP_PORT:-25}
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- phpfpm

	sogo-mailcow:
	image: mailcow/sogo:1.16
	build: ./data/Dockerfiles/sogo
	environment:
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	- LOG_LINES=${LOG_LINES}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	volumes:
	- ./data/conf/sogo/:/etc/sogo/
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
	aliases:
	- sogo

	dovecot-mailcow:
	image: mailcow/dovecot:1.21
	build: ./data/Dockerfiles/dovecot
	cap_add:
	- NET_BIND_SERVICE
	volumes:
	- ./data/conf/dovecot:/usr/local/etc/dovecot
	- ./data/assets/ssl:/etc/ssl/mail/:ro
	- ./data/conf/sogo/:/etc/sogo/
	- vmail-vol-1:/var/vmail
	- crypt-vol-1:/mail_crypt/
	- rspamd-sock:/rspamd-sock
	environment:
	- LOG_LINES=${LOG_LINES}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- TZ=${TZ}
	ports:
	- "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
	- "${IMAP_PORT:-143}:143"
	- "${IMAPS_PORT:-993}:993"
	- "${POP_PORT:-110}:110"
	- "${POPS_PORT:-995}:995"
	- "${SIEVE_PORT:-4190}:4190"
	restart: always
	ulimits:
	nproc: 65535
	nofile:
	soft: 20000
	hard: 40000
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	hostname: ${MAILCOW_HOSTNAME}
	networks:
	mailcow-network:
	aliases:
	- dovecot

	postfix-mailcow:
	image: mailcow/postfix:1.14
	build: ./data/Dockerfiles/postfix
	volumes:
	- ./data/conf/postfix:/opt/postfix/conf
	- ./data/assets/ssl:/etc/ssl/mail/:ro
	- postfix-vol-1:/var/spool/postfix
	- crypt-vol-1:/var/lib/zeyple
	environment:
	- LOG_LINES=${LOG_LINES}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	cap_add:
	- NET_BIND_SERVICE
	ports:
	- "${SMTP_PORT:-25}:25"
	- "${SMTPS_PORT:-465}:465"
	- "${SUBMISSION_PORT:-587}:587"
	restart: always
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	hostname: ${MAILCOW_HOSTNAME}
	networks:
	mailcow-network:
	aliases:
	- postfix

	memcached-mailcow:
	image: memcached:alpine
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- memcached

	nginx-mailcow:
	depends_on:
	- sogo-mailcow
	- php-fpm-mailcow
	- redis-mailcow
	image: nginx:mainline-alpine
	command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
	envsubst < /etc/nginx/conf.d/templates/listen_ssl.template > /etc/nginx/conf.d/listen_ssl.active &&
	envsubst < /etc/nginx/conf.d/templates/server_name.template > /etc/nginx/conf.d/server_name.active &&
	+ envsubst < /etc/nginx/conf.d/templates/sogo.template > /etc/nginx/conf.d/sogo.active &&
	+ envsubst < /etc/nginx/conf.d/templates/sogo_eas.template > /etc/nginx/conf.d/sogo_eas.active &&
	nginx -qt &&
	until ping phpfpm -c1 > /dev/null; do sleep 1; done &&
	until ping sogo -c1 > /dev/null; do sleep 1; done &&
	until ping redis -c1 > /dev/null; do sleep 1; done &&
	exec nginx -g 'daemon off;'"
	environment:
	- HTTPS_PORT=${HTTPS_PORT:-443}
	- HTTP_PORT=${HTTP_PORT:-80}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	+ - IPV4_NETWORK=
	volumes:
	- ./data/web:/web:ro
	- ./data/conf/rspamd/dynmaps:/dynmaps:ro
	- ./data/assets/ssl/:/etc/ssl/mail/:ro
	- ./data/conf/nginx/:/etc/nginx/conf.d/:rw
	- ./data/conf/rspamd/meta_exporter:/meta_exporter:ro
	ports:
	- "${HTTPS_BIND:-0.0.0.0}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
	- "${HTTP_BIND:-0.0.0.0}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
	restart: always
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	networks:
	mailcow-network:
	aliases:
	- nginx

	acme-mailcow:
	depends_on:
	- nginx-mailcow
	- mysql-mailcow
	image: mailcow/acme:1.28
	build: ./data/Dockerfiles/acme
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	environment:
	- LOG_LINES=${LOG_LINES}
	- ADDITIONAL_SAN=${ADDITIONAL_SAN}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
	- SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
	volumes:
	- ./data/web/.well-known/acme-challenge:/var/www/acme:rw
	- ./data/assets/ssl:/var/lib/acme/:rw
	- ./data/assets/ssl-example:/var/lib/ssl-example/:ro
	restart: always
	networks:
	mailcow-network:
	aliases:
	- acme

	netfilter-mailcow:
	image: mailcow/netfilter:1.11
	build: ./data/Dockerfiles/netfilter
	stop_grace_period: 30s
	depends_on:
	- dovecot-mailcow
	- postfix-mailcow
	- sogo-mailcow
	- php-fpm-mailcow
	- redis-mailcow
	restart: always
	privileged: true
	environment:
	- TZ=${TZ}
	- - IPV4_NETWORK=${IPV4_NETWORK}
	+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
	- SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
	network_mode: "host"
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	dns:
	- - ${IPV4_NETWORK}.254
	+ - ${IPV4_NETWORK:-172.22.1}.254
	volumes:
	- /lib/modules:/lib/modules:ro

	watchdog-mailcow:
	image: mailcow/watchdog:1.14
	# Debug
	#command: /watchdog.sh
	build: ./data/Dockerfiles/watchdog
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	volumes:
	- vmail-vol-1:/vmail:ro
	- rspamd-sock:/rspamd-sock
	restart: always
	environment:
	- LOG_LINES=${LOG_LINES}
	- TZ=${TZ}
	- DBNAME=${DBNAME}
	- DBUSER=${DBUSER}
	- DBPASS=${DBPASS}
	- USE_WATCHDOG=${USE_WATCHDOG:-n}
	- WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL}
	- MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
	networks:
	mailcow-network:
	aliases:
	- watchdog

	dockerapi-mailcow:
	image: mailcow/dockerapi:1.8
	restart: always
	build: ./data/Dockerfiles/dockerapi
	sysctls:
	- net.ipv6.conf.all.disable_ipv6=${SYSCTL_IPV6_DISABLED:-0}
	oom_score_adj: -10
	environment:
	- TZ=${TZ}
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- ./data/conf/rspamd/override.d/worker-controller-password.inc:/access.inc:rw
	networks:
	mailcow-network:
	aliases:
	- dockerapi

	ipv6nat:
	image: robbertkl/ipv6nat
	restart: always
	privileged: true
	network_mode: "host"
	volumes:
	- /var/run/docker.sock:/var/run/docker.sock:ro
	- /lib/modules:/lib/modules:ro

	networks:
	mailcow-network:
	driver: bridge
	enable_ipv6: true
	ipam:
	driver: default
	config:
	- - subnet: ${IPV4_NETWORK}.0/24
	- - subnet: ${IPV6_NETWORK}
	+ - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
	+ - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}

	volumes:
	vmail-vol-1:
	mysql-vol-1:
	redis-vol-1:
	rspamd-vol-1:
	postfix-vol-1:
	crypt-vol-1:
	rspamd-sock:

File Metadata

Mime Type: text/x-diff
Expires: 9月 11 Thu, 1:59 PM (18 h, 43 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 5626
默认替代文本: (27 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions