Merge branch 'master' into AdminLTE-3
Dimitri Huisman
3 years ago
committed by
GitHub
commit
00276d8b70
@ -1,5 +1,12 @@
|
||||
#!/bin/bash
|
||||
|
||||
tee >(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu learn_ham /dev/stdin) \
|
||||
>(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 11 fuzzy_del /dev/stdin) \
|
||||
| rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 13 fuzzy_add /dev/stdin
|
||||
RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }}|cut -d\ -f1)"
|
||||
if [[ $? -ne 0 ]]
|
||||
then
|
||||
echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
tee >(rspamc -h $RSPAMD_HOST -P mailu learn_ham /dev/stdin) \
|
||||
>(rspamc -h $RSPAMD_HOST -P mailu -f 11 fuzzy_del /dev/stdin) \
|
||||
| rspamc -h $RSPAMD_HOST -P mailu -f 13 fuzzy_add /dev/stdin
|
||||
|
||||
@ -1,5 +1,13 @@
|
||||
#!/bin/bash
|
||||
|
||||
tee >(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu learn_spam /dev/stdin) \
|
||||
>(rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 13 fuzzy_del /dev/stdin) \
|
||||
| rspamc -h {{ ANTISPAM_WEBUI_ADDRESS }} -P mailu -f 11 fuzzy_add /dev/stdin
|
||||
RSPAMD_HOST="$(getent hosts {{ ANTISPAM_WEBUI_ADDRESS }}|cut -d\ -f1)"
|
||||
if [[ $? -ne 0 ]]
|
||||
then
|
||||
echo "Failed to lookup {{ ANTISPAM_WEBUI_ADDRESS }}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
tee >(rspamc -h $RSPAMD_HOST -P mailu learn_spam /dev/stdin) \
|
||||
>(rspamc -h $RSPAMD_HOST -P mailu -f 13 fuzzy_del /dev/stdin) \
|
||||
| rspamc -h $RSPAMD_HOST -P mailu -f 11 fuzzy_add /dev/stdin
|
||||
|
||||
@ -1,13 +1,11 @@
|
||||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
|
||||
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
|
||||
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
|
||||
8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
|
||||
iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
|
||||
zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
|
||||
MIIBiAKCAYEAtQlUSOKGjpdXJ154qmMEa1pEs+9CdSxWiZFkiXBJb0lTafOh8cfF
|
||||
2IkcWSwzxWwjW4Ad26UQQFh1poGf2QBzVk2vuKCekYzPAs/WqH8VwiXBiWR5R9lh
|
||||
v/+CkEBYuQOzAhXLN6ZGdPPa2sjdI49rlaIqyLJE4D0TI/VHYmC/vEwqkJUgaGrS
|
||||
19LhHZimnmouvrnyBPyf00czXlMow0RnmYeHVZ7W5hu7t9TH9o3QAN/GKiFfxFj+
|
||||
RkdLM7beQdS0He5YeTaElM5l1YT5d5gHFbOzEQyKHd10ux+bgVcgUeVbBnI1SAIC
|
||||
w53yc1PkDAiRijSP5j5aWq1djtJPheS13o35HyIf0cHzkNYhKfX5JWPj/cbgdM+C
|
||||
FL1bnRc8sL5oxmkDoGJhiNZIf4n2WtS8Zu28gUgat6S+vCm/4yavIc/T1g6UiNKE
|
||||
X41HPbsma/QWUwOL6S+b2qr+7rKqjI5TzVek8vBMellEV4mBvfQU3NDSQ4WvxbTq
|
||||
ZEOgLPA178nrAgEC
|
||||
-----END DH PARAMETERS-----
|
||||
|
||||
@ -1,63 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-admin
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-admin
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: admin
|
||||
image: mailu/admin:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
volumeMounts:
|
||||
- name: maildata
|
||||
mountPath: /data
|
||||
subPath: maildata
|
||||
- name: maildata
|
||||
mountPath: /dkim
|
||||
subPath: dkim
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
memory: 500Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 500Mi
|
||||
cpu: 500m
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: admin
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-admin
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-admin
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
@ -1,175 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mailu-config
|
||||
namespace: mailu-mailserver
|
||||
data:
|
||||
# Mailu main configuration file
|
||||
#
|
||||
# Most configuration variables can be modified through the Web interface,
|
||||
# these few settings must however be configured before starting the mail
|
||||
# server and require a restart upon change.
|
||||
|
||||
###################################
|
||||
# Common configuration variables
|
||||
###################################
|
||||
|
||||
# Set this to the path where Mailu data and configuration is stored
|
||||
ROOT: "/mailu"
|
||||
|
||||
# Mailu version to run (1.0, 1.1, etc. or master)
|
||||
VERSION: "master"
|
||||
|
||||
# Set to a randomly generated 16 bytes string
|
||||
SECRET_KEY: "MySup3rS3cr3tPas"
|
||||
|
||||
# Address where listening ports should bind
|
||||
BIND_ADDRESS4: "127.0.0.1"
|
||||
#BIND_ADDRESS6: "::1"
|
||||
|
||||
# Main mail domain
|
||||
DOMAIN: "example.com"
|
||||
|
||||
# Hostnames for this server, separated with comas
|
||||
HOSTNAMES: "mail.example.com"
|
||||
|
||||
# Postmaster local part (will append the main mail domain)
|
||||
POSTMASTER: "admin"
|
||||
|
||||
# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
|
||||
TLS_FLAVOR: "cert"
|
||||
|
||||
# Authentication rate limit (per source IP address)
|
||||
AUTH_RATELIMIT: "10/minute;1000/hour"
|
||||
|
||||
# Opt-out of statistics, replace with "True" to opt out
|
||||
DISABLE_STATISTICS: "False"
|
||||
|
||||
###################################
|
||||
# Kubernetes configuration
|
||||
###################################
|
||||
|
||||
# Use Kubernetes Ingress Controller to handle all actions on port 80 and 443
|
||||
# This way we can make use of the advantages of the cert-manager deployment
|
||||
KUBERNETES_INGRESS: "true"
|
||||
|
||||
# POD_ADDRESS_RANGE is normally provided by default with Kubernetes
|
||||
# Only use this value when you are using Flannel, Calico or a special kind of CNI
|
||||
# Provide the IPs of your network interface or bridge which is used for VXLAN network traffic
|
||||
# POD_ADDRESS_RANGE: 10.2.0.0/16,10.1.6.0/24
|
||||
|
||||
###################################
|
||||
# Optional features
|
||||
###################################
|
||||
|
||||
# Expose the admin interface (value: true, false)
|
||||
ADMIN: "true"
|
||||
# Run the admin interface in debug mode
|
||||
#DEBUG: "True"
|
||||
|
||||
# Choose which webmail to run if any (values: roundcube, rainloop, none)
|
||||
WEBMAIL: "roundcube"
|
||||
|
||||
# Dav server implementation (value: radicale, none)
|
||||
WEBDAV: "radicale"
|
||||
|
||||
# Antivirus solution (value: clamav, none)
|
||||
ANTIVIRUS: "clamav"
|
||||
|
||||
###################################
|
||||
# Mail settings
|
||||
###################################
|
||||
|
||||
# Message size limit in bytes
|
||||
# Default: accept messages up to 50MB
|
||||
MESSAGE_SIZE_LIMIT: "50000000"
|
||||
|
||||
# Will relay all outgoing mails if configured
|
||||
#RELAYHOST=
|
||||
|
||||
# This part is needed for the XCLIENT login for postfix. This should be the POD ADDRESS range
|
||||
FRONT_ADDRESS: "front.mailu-mailserver.svc.cluster.local"
|
||||
|
||||
# This value is needed by the webmail to find the correct imap backend
|
||||
IMAP_ADDRESS: "imap.mailu-mailserver.svc.cluster.local"
|
||||
|
||||
# This value is used by Dovecot to find the Redis server in the cluster
|
||||
REDIS_ADDRESS: "redis.mailu-mailserver.svc.cluster.local"
|
||||
|
||||
# Fetchmail delay
|
||||
FETCHMAIL_DELAY: "600"
|
||||
|
||||
# Recipient delimiter, character used to delimiter localpart from custom address part
|
||||
# e.g. localpart+custom@domain;tld
|
||||
RECIPIENT_DELIMITER: "+"
|
||||
|
||||
# DMARC rua and ruf email
|
||||
DMARC_RUA: "root"
|
||||
DMARC_RUF: "root"
|
||||
|
||||
# Welcome email, enable and set a topic and body if you wish to send welcome
|
||||
# emails to all users.
|
||||
WELCOME: "false"
|
||||
WELCOME_SUBJECT: "Welcome to your new email account"
|
||||
WELCOME_BODY: "Welcome to your new email account, if you can read this, then it is configured properly!"
|
||||
|
||||
###################################
|
||||
# Web settings
|
||||
###################################
|
||||
|
||||
# Path to the admin interface if enabled
|
||||
# Kubernetes addition: You need to change ALL the ingresses, when you want this URL to be different!!!
|
||||
WEB_ADMIN: "/admin"
|
||||
|
||||
# Path to the webmail if enabled
|
||||
# Currently, this is not used, because we intended to use a different subdomain: webmail.example.com
|
||||
# This option can be added in a feature release
|
||||
WEB_WEBMAIL: "/webmail"
|
||||
|
||||
# Website name
|
||||
SITENAME: "Mailu"
|
||||
|
||||
# Linked Website URL
|
||||
WEBSITE: "https://example.com"
|
||||
|
||||
# Registration reCaptcha settings (warning, this has some privacy impact)
|
||||
# RECAPTCHA_PUBLIC_KEY=
|
||||
# RECAPTCHA_PRIVATE_KEY=
|
||||
|
||||
# Domain registration, uncomment to enable
|
||||
# DOMAIN_REGISTRATION=true
|
||||
|
||||
###################################
|
||||
# Advanced settings
|
||||
###################################
|
||||
|
||||
# Create an admin account if it does not exist yet. It will also create the email domain for the account.
|
||||
# INITIAL_ADMIN_ACCOUNT: "admin"
|
||||
# INITIAL_ADMIN_DOMAIN: "example.com"
|
||||
# INITIAL_ADMIN_PW: "s3cr3t"
|
||||
|
||||
# Docker-compose project name, this will prepended to containers names.
|
||||
COMPOSE_PROJECT_NAME: "mailu"
|
||||
|
||||
# Default password scheme used for newly created accounts and changed passwords
|
||||
# (value: SHA512-CRYPT, SHA256-CRYPT, MD5-CRYPT, CRYPT)
|
||||
PASSWORD_SCHEME: "SHA512-CRYPT"
|
||||
|
||||
# Header to take the real ip from
|
||||
#REAL_IP_HEADER:
|
||||
|
||||
# IPs for nginx set_real_ip_from (CIDR list separated by commas)
|
||||
#REAL_IP_FROM:
|
||||
|
||||
# Host settings
|
||||
HOST_IMAP: "imap.mailu-mailserver.svc.cluster.local"
|
||||
HOST_POP3: "imap.mailu-mailserver.svc.cluster.local"
|
||||
HOST_SMTP: "smtp.mailu-mailserver.svc.cluster.local"
|
||||
HOST_AUTHSMTP: "smtp.mailu-mailserver.svc.cluster.local"
|
||||
HOST_WEBMAIL: "webmail.mailu-mailserver.svc.cluster.local"
|
||||
HOST_ADMIN: "admin.mailu-mailserver.svc.cluster.local"
|
||||
HOST_WEBDAV: "webdav.mailu-mailserver.svc.cluster.local:5232"
|
||||
HOST_ANTISPAM_MILTER: "antispam.mailu-mailserver.svc.cluster.local:11332"
|
||||
HOST_ANTISPAM_WEBUI: "antispam.mailu-mailserver.svc.cluster.local:11334"
|
||||
HOST_ANTIVIRUS: "antivirus.mailu-mailserver.svc.cluster.local:3310"
|
||||
HOST_REDIS: "redis.mailu-mailserver.svc.cluster.local"
|
||||
@ -1,39 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-fetchmail
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-fetchmail
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: fetchmail
|
||||
image: mailu/fetchmail:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
volumeMounts:
|
||||
- name: maildata
|
||||
mountPath: /data
|
||||
subPath: maildata
|
||||
ports:
|
||||
- containerPort: 5232
|
||||
- containerPort: 80
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
@ -1,148 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: mailu-front
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
k8s-app: mail-loadbalancer
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: mail-loadbalancer
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: mail-loadbalancer
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
spec:
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/node
|
||||
operator: Exists
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/node: ""
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Always
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- name: front
|
||||
image: mailu/nginx:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
ports:
|
||||
- name: pop3
|
||||
containerPort: 110
|
||||
hostPort: 110
|
||||
protocol: TCP
|
||||
- name: pop3s
|
||||
containerPort: 995
|
||||
hostPort: 995
|
||||
protocol: TCP
|
||||
- name: imap
|
||||
containerPort: 143
|
||||
hostPort: 143
|
||||
protocol: TCP
|
||||
- name: imaps
|
||||
containerPort: 993
|
||||
hostPort: 993
|
||||
protocol: TCP
|
||||
- name: smtp
|
||||
containerPort: 25
|
||||
hostPort: 25
|
||||
protocol: TCP
|
||||
- name: smtps
|
||||
containerPort: 465
|
||||
hostPort: 465
|
||||
protocol: TCP
|
||||
- name: smtpd
|
||||
containerPort: 587
|
||||
hostPort: 587
|
||||
protocol: TCP
|
||||
# internal services (not exposed externally)
|
||||
- name: smtp-auth
|
||||
containerPort: 10025
|
||||
protocol: TCP
|
||||
- name: imap-auth
|
||||
containerPort: 10143
|
||||
protocol: TCP
|
||||
- name: auth
|
||||
containerPort: 8000
|
||||
protocol: TCP
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 200Mi
|
||||
cpu: 200m
|
||||
volumes:
|
||||
- name: certs
|
||||
secret:
|
||||
items:
|
||||
- key: tls.crt
|
||||
path: cert.pem
|
||||
- key: tls.key
|
||||
path: key.pem
|
||||
secretName: letsencrypt-certs-all
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: front
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
k8s-app: mail-loadbalancer
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
spec:
|
||||
selector:
|
||||
k8s-app: mail-loadbalancer
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
ports:
|
||||
- name: pop3
|
||||
port: 110
|
||||
protocol: TCP
|
||||
- name: pop3s
|
||||
port: 995
|
||||
protocol: TCP
|
||||
- name: imap
|
||||
port: 143
|
||||
protocol: TCP
|
||||
- name: imaps
|
||||
port: 993
|
||||
protocol: TCP
|
||||
- name: smtp
|
||||
port: 25
|
||||
protocol: TCP
|
||||
- name: smtps
|
||||
port: 465
|
||||
protocol: TCP
|
||||
- name: smtpd
|
||||
port: 587
|
||||
protocol: TCP
|
||||
- name: smtp-auth
|
||||
port: 10025
|
||||
protocol: TCP
|
||||
- name: imap-auth
|
||||
port: 10143
|
||||
protocol: TCP
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
@ -1,84 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-imap
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-imap
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: imap
|
||||
image: mailu/dovecot:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: maildata
|
||||
subPath: maildata
|
||||
- mountPath: /mail
|
||||
name: maildata
|
||||
subPath: mailstate
|
||||
- mountPath: /overrides
|
||||
name: maildata
|
||||
subPath: overrides
|
||||
ports:
|
||||
- name: imap-auth
|
||||
containerPort: 2102
|
||||
- name: imap-transport
|
||||
containerPort: 2525
|
||||
- name: pop3
|
||||
containerPort: 110
|
||||
- name: imap-default
|
||||
containerPort: 143
|
||||
- name: sieve
|
||||
containerPort: 4190
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: imap
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-imap
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: imap-auth
|
||||
port: 2102
|
||||
protocol: TCP
|
||||
- name: imap-transport
|
||||
port: 2525
|
||||
protocol: TCP
|
||||
- name: pop3
|
||||
port: 110
|
||||
protocol: TCP
|
||||
- name: imap-default
|
||||
port: 143
|
||||
protocol: TCP
|
||||
- name: sieve
|
||||
port: 4190
|
||||
protocol: TCP
|
||||
@ -1,25 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mailu-ingress
|
||||
namespace: mailu-mailserver
|
||||
annotations:
|
||||
kubernetes.io/tls-acme: "true"
|
||||
certmanager.k8s.io/cluster-issuer: letsencrypt-stage
|
||||
labels:
|
||||
app: mailu
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- "mail.example.com"
|
||||
secretName: letsencrypt-certs-all # If unsure how to generate these, check out https://github.com/ployst/docker-letsencrypt
|
||||
rules:
|
||||
- host: "mail.example.com"
|
||||
http:
|
||||
paths:
|
||||
- path: "/"
|
||||
backend:
|
||||
serviceName: front
|
||||
servicePort: 80
|
||||
@ -1,27 +0,0 @@
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: redis-hdd
|
||||
namespace: mailu-mailserver
|
||||
annotations:
|
||||
volume.beta.kubernetes.io/storage-class: "glusterblock-hdd"
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: mail-storage
|
||||
namespace: mailu-mailserver
|
||||
annotations:
|
||||
volume.beta.kubernetes.io/storage-class: "gluster-heketi-hdd"
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 100Gi
|
||||
@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: mailu-mailserver
|
||||
@ -1,60 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-redis
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mailu-redis
|
||||
role: mail
|
||||
tier: backend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-redis
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:5-alpine
|
||||
imagePullPolicy: Always
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: redisdata
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
name: redis
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
memory: 200Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 300Mi
|
||||
cpu: 200m
|
||||
volumes:
|
||||
- name: redisdata
|
||||
persistentVolumeClaim:
|
||||
claimName: redis-hdd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-redis
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-redis
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: redis
|
||||
port: 6379
|
||||
protocol: TCP
|
||||
@ -1,115 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-security
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-security
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: antispam
|
||||
image: mailu/rspamd:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 200Mi
|
||||
cpu: 200m
|
||||
ports:
|
||||
- name: antispam
|
||||
containerPort: 11332
|
||||
protocol: TCP
|
||||
- name: antispam-http
|
||||
containerPort: 11334
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: filter
|
||||
subPath: filter
|
||||
mountPath: /var/lib/rspamd
|
||||
- name: filter
|
||||
mountPath: /dkim
|
||||
subPath: dkim
|
||||
- name: filter
|
||||
mountPath: /etc/rspamd/override.d
|
||||
subPath: rspamd-overrides
|
||||
- name: antivirus
|
||||
image: mailu/clamav:master
|
||||
imagePullPolicy: Always
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 1000m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
ports:
|
||||
- name: antivirus
|
||||
containerPort: 3310
|
||||
protocol: TCP
|
||||
volumeMounts:
|
||||
- name: filter
|
||||
subPath: filter
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: filter
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: antispam
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-antispam
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-security
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: antispam
|
||||
port: 11332
|
||||
protocol: TCP
|
||||
- name: antispam-http
|
||||
protocol: TCP
|
||||
port: 11334
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: antivirus
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-antivirus
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-security
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: antivirus
|
||||
port: 3310
|
||||
protocol: TCP
|
||||
@ -1,80 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-smtp
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-smtp
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: smtp
|
||||
image: mailu/postfix:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
resources:
|
||||
requests:
|
||||
memory: 2Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 500m
|
||||
volumeMounts:
|
||||
- mountPath: /queue
|
||||
name: maildata
|
||||
subPath: mailqueue
|
||||
- mountPath: /overrides
|
||||
name: maildata
|
||||
subPath: overrides
|
||||
ports:
|
||||
- name: smtp
|
||||
containerPort: 25
|
||||
protocol: TCP
|
||||
- name: smtp-ssl
|
||||
containerPort: 465
|
||||
protocol: TCP
|
||||
- name: smtp-starttls
|
||||
containerPort: 587
|
||||
protocol: TCP
|
||||
- name: smtp-auth
|
||||
containerPort: 10025
|
||||
protocol: TCP
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: smtp
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-smtp
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
- name: smtp
|
||||
port: 25
|
||||
protocol: TCP
|
||||
- name: smtp-ssl
|
||||
port: 465
|
||||
protocol: TCP
|
||||
- name: smtp-starttls
|
||||
port: 587
|
||||
protocol: TCP
|
||||
- name: smtp-auth
|
||||
port: 10025
|
||||
protocol: TCP
|
||||
@ -1,63 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-webdav
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-webdav
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
containers:
|
||||
- name: radicale
|
||||
image: mailu/radicale:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: maildata
|
||||
subPath: dav
|
||||
ports:
|
||||
- containerPort: 5232
|
||||
- containerPort: 80
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: webdav
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-webdav
|
||||
role: mail
|
||||
tier: backend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-webdav
|
||||
role: mail
|
||||
tier: backend
|
||||
ports:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
- name: http-ui
|
||||
port: 5232
|
||||
protocol: TCP
|
||||
@ -1,57 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mailu-roundcube
|
||||
namespace: mailu-mailserver
|
||||
spec:
|
||||
replicas: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mailu-roundcube
|
||||
role: mail
|
||||
tier: frontend
|
||||
spec:
|
||||
containers:
|
||||
- name: roundcube
|
||||
image: mailu/roundcube:master
|
||||
imagePullPolicy: Always
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mailu-config
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 200Mi
|
||||
cpu: 200m
|
||||
volumeMounts:
|
||||
- mountPath: /data
|
||||
name: maildata
|
||||
subPath: webmail
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumes:
|
||||
- name: maildata
|
||||
persistentVolumeClaim:
|
||||
claimName: mail-storage
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: webmail
|
||||
namespace: mailu-mailserver
|
||||
labels:
|
||||
app: mailu-roundcube
|
||||
role: mail
|
||||
tier: frontend
|
||||
spec:
|
||||
selector:
|
||||
app: mailu-roundcube
|
||||
role: mail
|
||||
tier: frontend
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
@ -1,55 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: default-http-backend
|
||||
labels:
|
||||
app: default-http-backend
|
||||
namespace: kube-ingress
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: default-http-backend
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: default-http-backend
|
||||
spec:
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- name: default-http-backend
|
||||
# Any image is permissible as long as:
|
||||
# 1. It serves a 404 page at /
|
||||
# 2. It serves 200 on a /healthz endpoint
|
||||
image: gcr.io/google_containers/defaultbackend:1.4
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 5
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
resources:
|
||||
limits:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 20Mi
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: default-http-backend
|
||||
namespace: kube-ingress
|
||||
labels:
|
||||
app: default-http-backend
|
||||
spec:
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: default-http-backend
|
||||
@ -1,127 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
# keep it under 24 chars
|
||||
name: ingress-lb
|
||||
namespace: kube-ingress
|
||||
labels:
|
||||
k8s-app: ingress-lb
|
||||
component: ingress-controller
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
k8s-app: ingress-lb
|
||||
component: ingress-controller
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
- name: https
|
||||
protocol: TCP
|
||||
port: 443
|
||||
targetPort: 443
|
||||
---
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: udp-services
|
||||
namespace: kube-ingress
|
||||
|
||||
---
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: tcp-services
|
||||
namespace: kube-ingress
|
||||
data:
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
enable-vts-status: "true"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-ingress-lb-conf
|
||||
namespace: kube-ingress
|
||||
---
|
||||
apiVersion: apps/v1beta2
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: ingress-controller
|
||||
namespace: kube-ingress
|
||||
annotations:
|
||||
prometheus.io/port: "10254"
|
||||
prometheus.io/scrape: "true"
|
||||
labels:
|
||||
k8s-app: ingress-lb
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
spec:
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: ingress-lb
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: ingress-lb
|
||||
component: ingress-controller
|
||||
type: nginx
|
||||
spec:
|
||||
serviceAccount: kube-nginx-ingress
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.kubernetes.io/master
|
||||
operator: DoesNotExist
|
||||
containers:
|
||||
- name: nginx-ingress-lb
|
||||
image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.16.2
|
||||
args:
|
||||
- /nginx-ingress-controller
|
||||
- --default-backend-service=$(POD_NAMESPACE)/default-http-backend
|
||||
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
|
||||
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
|
||||
- --annotations-prefix=ingress.kubernetes.io
|
||||
- --enable-ssl-passthrough
|
||||
# use downward API
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
- name: https
|
||||
containerPort: 443
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 1
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
hostNetwork: true
|
||||
nodeSelector:
|
||||
node-role.kubernetes.io/node: ""
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
restartPolicy: Always
|
||||
terminationGracePeriodSeconds: 60
|
||||
@ -1,129 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kube-ingress
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: kube-nginx-ingress
|
||||
namespace: kube-ingress
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: kube-nginx-ingress
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- "extensions"
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- "extensions"
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: kube-nginx-ingress
|
||||
namespace: kube-ingress
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
resourceNames:
|
||||
- "ingress-controller-leader-nginx"
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: kube-nginx-ingress
|
||||
namespace: kube-ingress
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: kube-nginx-ingress
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kube-nginx-ingress
|
||||
namespace: kube-ingress
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kube-nginx-ingress
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kube-nginx-ingress
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kube-nginx-ingress
|
||||
namespace: kube-ingress
|
||||
@ -0,0 +1 @@
|
||||
Add sending quotas per user
|
||||
@ -0,0 +1 @@
|
||||
Allow specific users to send emails from any address using the WILDCARD_SENDERS setting
|
||||
@ -0,0 +1 @@
|
||||
Make smtp_tls_policy_maps easily configurable
|
||||
@ -0,0 +1 @@
|
||||
Hebrew translation has been completed.
|
||||
@ -0,0 +1,5 @@
|
||||
Add support for ECDSA certificates when letsencrypt is used. This means dropping compatibility for android < 4.1.1
|
||||
Add LETSENCRYPT_SHORTCHAIN to your configuration to avoid sending ISRG Root X1 (this will break compatibility with android < 7.1.1)
|
||||
Disable AUTH command on port 25
|
||||
Disable TLS tickets, reconfigure the cache to improve Forward Secrecy
|
||||
Prevent clear-text credentials from being sent to relays
|
||||
@ -0,0 +1,3 @@
|
||||
Webmail and Radicale (webdav) were not useable with domains with special characters such as umlauts.
|
||||
Webmail and radicale now use punycode for logging in.
|
||||
Punycode was not used in the HTTP headers. This resulted in illegal non-ASCII HTTP headers.
|
||||
@ -1,51 +1,71 @@
|
||||
ARG ARCH=""
|
||||
ARG QEMU=other
|
||||
|
||||
# NOTE: only add file if building for arm
|
||||
FROM ${ARCH}php:7.4-apache as build_arm
|
||||
FROM ${ARCH}alpine:3.14
|
||||
ONBUILD COPY --from=balenalib/rpi-alpine:3.14 /usr/bin/qemu-arm-static /usr/bin/qemu-arm-static
|
||||
|
||||
FROM ${ARCH}php:7.4-apache as build_other
|
||||
# Shared later between dovecot postfix nginx rspamd rainloop and roundloop
|
||||
RUN apk add --no-cache \
|
||||
python3 py3-pip \
|
||||
&& pip3 install socrate==0.2.0
|
||||
|
||||
FROM build_${QEMU}
|
||||
#Shared layer between rainloop and roundcube
|
||||
RUN apt-get update && apt-get install -y \
|
||||
python3 curl python3-pip git python3-multidict \
|
||||
&& rm -rf /var/lib/apt/lists \
|
||||
&& echo "ServerSignature Off" >> /etc/apache2/apache2.conf
|
||||
# https://www.rainloop.net/docs/system-requirements/
|
||||
# Rainloop:
|
||||
# cURL Builtin
|
||||
# iconv php7-iconv
|
||||
# json php7-json
|
||||
# libxml php7-xml
|
||||
# dom php7-dom
|
||||
# openssl php7-openssl
|
||||
# DateTime Builtin
|
||||
# PCRE Builtin
|
||||
# SPL Builtin
|
||||
# Recommended:
|
||||
# php7-fpm FastCGI Process Manager
|
||||
# Optional PHP extension (for contacts):
|
||||
# php7-pdo Accessing databases in PHP
|
||||
# php7-pdo_sqlite Access to SQLite 3 databases
|
||||
RUN apk add --no-cache \
|
||||
nginx \
|
||||
php7 php7-fpm php7-curl php7-iconv php7-json php7-xml php7-dom php7-openssl php7-pdo php7-pdo_sqlite \
|
||||
&& rm /etc/nginx/http.d/default.conf \
|
||||
&& rm /etc/php7/php-fpm.d/www.conf \
|
||||
&& mkdir -p /run/nginx \
|
||||
&& mkdir -p /var/www/rainloop
|
||||
|
||||
# Shared layer between nginx, dovecot, postfix, postgresql, rspamd, unbound, rainloop, roundcube
|
||||
RUN pip3 install socrate
|
||||
# nginx / PHP config files
|
||||
COPY config/nginx-rainloop.conf /etc/nginx/http.d/rainloop.conf
|
||||
COPY config/php-rainloop.conf /etc/php7/php-fpm.d/rainloop.conf
|
||||
|
||||
# Rainloop login
|
||||
COPY login/include.php /var/www/rainloop/include.php
|
||||
COPY login/sso.php /var/www/rainloop/sso.php
|
||||
|
||||
# Parsed en moved at startup
|
||||
COPY defaults/php.ini /defaults/php.ini
|
||||
COPY defaults/application.ini /defaults/application.ini
|
||||
COPY defaults/default.ini /defaults/default.ini
|
||||
|
||||
# Install Rainloop from source
|
||||
ENV RAINLOOP_URL https://github.com/RainLoop/rainloop-webmail/releases/download/v1.16.0/rainloop-community-1.16.0.zip
|
||||
|
||||
RUN apt-get update && apt-get install -y \
|
||||
unzip python3-jinja2 \
|
||||
&& rm -rf /var/www/html/ \
|
||||
&& mkdir /var/www/html \
|
||||
&& cd /var/www/html \
|
||||
RUN apk add --no-cache \
|
||||
curl unzip \
|
||||
&& cd /var/www/rainloop \
|
||||
&& curl -L -O ${RAINLOOP_URL} \
|
||||
&& unzip -q *.zip \
|
||||
&& rm -f *.zip \
|
||||
&& rm -rf data/ \
|
||||
&& find . -type d -exec chmod 755 {} \; \
|
||||
&& find . -type f -exec chmod 644 {} \; \
|
||||
&& chown -R www-data: * \
|
||||
&& apt-get purge -y unzip \
|
||||
&& rm -rf /var/lib/apt/lists
|
||||
|
||||
COPY include.php /var/www/html/include.php
|
||||
COPY sso.php /var/www/html/sso.php
|
||||
COPY php.ini /php.ini
|
||||
|
||||
COPY application.ini /application.ini
|
||||
COPY default.ini /default.ini
|
||||
&& chown -R nginx:nginx /var/www/rainloop \
|
||||
&& apk del unzip
|
||||
|
||||
COPY start.py /start.py
|
||||
|
||||
EXPOSE 80/tcp
|
||||
VOLUME ["/data"]
|
||||
|
||||
CMD /start.py
|
||||
CMD php-fpm7 && /start.py
|
||||
|
||||
HEALTHCHECK CMD curl -f -L http://localhost/ || exit 1
|
||||
|
||||
@ -0,0 +1,38 @@
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
|
||||
root /var/www/rainloop;
|
||||
|
||||
# /dev/stdout (Default), <path>, off
|
||||
access_log off;
|
||||
|
||||
# /dev/stderr (Default), <path>, debug, info, notice, warn, error, crit, alert, emerg
|
||||
error_log /dev/stderr warn;
|
||||
|
||||
index index.php;
|
||||
|
||||
location / {
|
||||
try_files $uri /index.php?$query_string;
|
||||
}
|
||||
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||||
|
||||
fastcgi_intercept_errors on;
|
||||
fastcgi_index index.php;
|
||||
|
||||
fastcgi_keep_conn on;
|
||||
include /etc/nginx/fastcgi_params;
|
||||
fastcgi_pass unix:/var/run/php7-fpm.sock;
|
||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||||
}
|
||||
|
||||
location ~ /\.ht {
|
||||
deny all;
|
||||
}
|
||||
|
||||
location ^~ /data {
|
||||
deny all;
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,101 @@
|
||||
; Start a new pool named 'rainloop'.
|
||||
; the variable $pool can be used in any directive and will be replaced by the
|
||||
; pool name ('rainloop' here)
|
||||
[rainloop]
|
||||
|
||||
; Redirect worker stdout and stderr into main error log. If not set, stdout and
|
||||
; stderr will be redirected to /dev/null according to FastCGI specs.
|
||||
; Default value: no.
|
||||
catch_workers_output = 1
|
||||
|
||||
; Unix user/group of processes
|
||||
; Note: The user is mandatory. If the group is not set, the default user's group
|
||||
; will be used.
|
||||
user = nginx
|
||||
group = nginx
|
||||
|
||||
; The address on which to accept FastCGI requests.
|
||||
; Valid syntaxes are:
|
||||
; 'ip.add.re.ss:port' - to listen on a TCP socket to a specific IPv4 address on
|
||||
; a specific port;
|
||||
; '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
|
||||
; a specific port;
|
||||
; 'port' - to listen on a TCP socket to all addresses
|
||||
; (IPv6 and IPv4-mapped) on a specific port;
|
||||
; '/path/to/unix/socket' - to listen on a unix socket.
|
||||
; Note: This value is mandatory.
|
||||
listen = /var/run/php7-fpm.sock
|
||||
|
||||
; Set permissions for unix socket, if one is used. In Linux, read/write
|
||||
; permissions must be set in order to allow connections from a web server. Many
|
||||
; BSD-derived systems allow connections regardless of permissions.
|
||||
; Default Values: user and group are set as the running user
|
||||
; mode is set to 0660
|
||||
listen.owner = nginx
|
||||
listen.group = nginx
|
||||
listen.mode = 0660
|
||||
|
||||
; Choose how the process manager will control the number of child processes.
|
||||
; Possible Values:
|
||||
; static - a fixed number (pm.max_children) of child processes;
|
||||
; dynamic - the number of child processes are set dynamically based on the
|
||||
; following directives. With this process management, there will be
|
||||
; always at least 1 children.
|
||||
; pm.max_children - the maximum number of children that can
|
||||
; be alive at the same time.
|
||||
; pm.start_servers - the number of children created on startup.
|
||||
; pm.min_spare_servers - the minimum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is less than this
|
||||
; number then some children will be created.
|
||||
; pm.max_spare_servers - the maximum number of children in 'idle'
|
||||
; state (waiting to process). If the number
|
||||
; of 'idle' processes is greater than this
|
||||
; number then some children will be killed.
|
||||
; ondemand - no children are created at startup. Children will be forked when
|
||||
; new requests will connect. The following parameter are used:
|
||||
; pm.max_children - the maximum number of children that
|
||||
; can be alive at the same time.
|
||||
; pm.process_idle_timeout - The number of seconds after which
|
||||
; an idle process will be killed.
|
||||
; Note: This value is mandatory.
|
||||
pm = ondemand
|
||||
|
||||
; The number of child processes to be created when pm is set to 'static' and the
|
||||
; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
|
||||
; This value sets the limit on the number of simultaneous requests that will be
|
||||
; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
|
||||
; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
|
||||
; CGI. The below defaults are based on a server without much resources. Don't
|
||||
; forget to tweak pm.* to fit your needs.
|
||||
; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
|
||||
; Note: This value is mandatory.
|
||||
pm.max_children = 5
|
||||
|
||||
; The number of child processes created on startup.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Default Value: min_spare_servers + (max_spare_servers - min_spare_servers) / 2
|
||||
; pm.start_servers = 2
|
||||
|
||||
; The desired minimum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
; pm.min_spare_servers = 1
|
||||
|
||||
; The desired maximum number of idle server processes.
|
||||
; Note: Used only when pm is set to 'dynamic'
|
||||
; Note: Mandatory when pm is set to 'dynamic'
|
||||
; pm.max_spare_servers = 3
|
||||
|
||||
; This sets the maximum time in seconds a script is allowed to run before it is
|
||||
; terminated by the parser. This helps prevent poorly written scripts from tying up
|
||||
; the server. The default setting is 30s.
|
||||
; Note: Used only when pm is set to 'ondemand'
|
||||
pm.process_idle_timeout = 10s
|
||||
|
||||
; The number of requests each child process should execute before respawning.
|
||||
; This can be useful to work around memory leaks in 3rd party libraries. For endless
|
||||
; request processing specify '0'.
|
||||
; Equivalent to PHP_FCGI_MAX_REQUESTS. Default value: 0.
|
||||
; Noted: Used only when pm is set to 'ondemand'
|
||||
pm.max_requests = 200
|
||||
Loading…
Reference in New Issue