mirror of
https://github.com/Mailu/Mailu.git
synced 2024-12-12 10:45:38 +02:00
Merge branch 'master' into fix-docker-prefix
This commit is contained in:
Daniel Huber
commit
b4f6f6b354
@ -22,3 +22,5 @@ Other contributors:
|
||||
- "SunMar" - Dutch translation
|
||||
- "Marty Hou" - Chinese Simple translation
|
||||
- [Thomas Sänger](https://github.com/HorayNarea) - German translation
|
||||
- [Tim Mohlmann](https://github.com/muhlemmer) - [Contributions](https://github.com/Mailu/Mailu/commits?author=muhlemmer)
|
||||
- [Ionut Filip](https://github.com/ionutfilip) - [Contributions](https://github.com/Mailu/Mailu/commits?author=ionutfilip)
|
||||
|
||||
103
CHANGELOG.md
103
CHANGELOG.md
@ -5,6 +5,109 @@ Notable changes to this project are documented in the current file. For more
|
||||
details about individual changes, see the Git log. You should read this before
|
||||
upgrading Freposte.io as some changes will include useful notes.
|
||||
|
||||
v1.6.0 - unreleased
|
||||
-------------------
|
||||
|
||||
- Global: Architecture of the central container ([#56](https://github.com/Mailu/Mailu/issues/56), [#108](https://github.com/Mailu/Mailu/issues/108))
|
||||
- Global: Serve documentation with docker ([#601](https://github.com/Mailu/Mailu/issues/601), [#608](https://github.com/Mailu/Mailu/issues/608))
|
||||
- Global: Travis-CI automated test build ([#602](https://github.com/Mailu/Mailu/issues/602))
|
||||
- Global: Abstract db access from Postfix and Dovecot ([#612](https://github.com/Mailu/Mailu/issues/612))
|
||||
- Global: Refactor the admin architecture and configuration management ([#670](https://github.com/Mailu/Mailu/issues/670))
|
||||
- Feature: Used quota in admin interface ([#216](https://github.com/Mailu/Mailu/issues/216))
|
||||
- Feature: User Signup ([#281](https://github.com/Mailu/Mailu/issues/281), [#340](https://github.com/Mailu/Mailu/issues/340))
|
||||
- Feature: Client setup page ([#342](https://github.com/Mailu/Mailu/issues/342))
|
||||
- Feature: Administration setup page ([#343](https://github.com/Mailu/Mailu/issues/343))
|
||||
- Feature: Visual notice whether the mx record points to mailu server ([#356](https://github.com/Mailu/Mailu/issues/356))
|
||||
- Feature: Option for vacation start ([#362](https://github.com/Mailu/Mailu/issues/362))
|
||||
- Feature: Enable enigma in Roundcube ([#391](https://github.com/Mailu/Mailu/issues/391))
|
||||
- Feature: Allow more charcaters as a valid email address ([#443](https://github.com/Mailu/Mailu/issues/443))
|
||||
- Feature: IDNA support ([#446](https://github.com/Mailu/Mailu/issues/446))
|
||||
- Feature: Disable user account ([#449](https://github.com/Mailu/Mailu/issues/449))
|
||||
- Feature: Use fuzzy hashes in rpamd ([#456](https://github.com/Mailu/Mailu/issues/456), [#527](https://github.com/Mailu/Mailu/issues/527))
|
||||
- Feature: Enable “doveadm -A” command ([#458](https://github.com/Mailu/Mailu/issues/458))
|
||||
- Feature: Remove the Service Status page ([#463](https://github.com/Mailu/Mailu/issues/463))
|
||||
- Feature: Automated Releases ([#487](https://github.com/Mailu/Mailu/issues/487))
|
||||
- Feature: Support for ARC ([#495](https://github.com/Mailu/Mailu/issues/495))
|
||||
- Feature: Add posibilty to run webmail on root ([#501](https://github.com/Mailu/Mailu/issues/501))
|
||||
- Feature: Upgrade docker-compose.yml to version 3 ([#539](https://github.com/Mailu/Mailu/issues/539))
|
||||
- Feature: Documentation to deploy mailu on a docker swarm ([#551](https://github.com/Mailu/Mailu/issues/551))
|
||||
- Feature: Add full-text search support ([#552](https://github.com/Mailu/Mailu/issues/552))
|
||||
- Feature: Add optional Maildir-Compression ([#553](https://github.com/Mailu/Mailu/issues/553))
|
||||
- Feature: Preserve rspamd history on container restart ([#561](https://github.com/Mailu/Mailu/issues/561))
|
||||
- Feature: FAQ ([#564](https://github.com/Mailu/Mailu/issues/564), [#677](https://github.com/Mailu/Mailu/issues/677))
|
||||
- Feature: Kubernetes support ([#576](https://github.com/Mailu/Mailu/issues/576))
|
||||
- Feature: Option to bounce or reject email when recipient is unknown ([#583](https://github.com/Mailu/Mailu/issues/583), [#626](https://github.com/Mailu/Mailu/issues/626))
|
||||
- Feature: implement healthchecks for all containers ([#631](https://github.com/Mailu/Mailu/issues/631))
|
||||
- Feature: Option to send front logs to journald or syslog ([#584](https://github.com/Mailu/Mailu/issues/584), [#661](https://github.com/Mailu/Mailu/issues/661))
|
||||
- Feature: Support bcrypt and PBKDF2 ([#647](https://github.com/Mailu/Mailu/issues/647), [#667](https://github.com/Mailu/Mailu/issues/667))
|
||||
- Feature: enable http2 ([#674](https://github.com/Mailu/Mailu/issues/674))
|
||||
- Feature: Unbound DNS as optional service ([#681](https://github.com/Mailu/Mailu/issues/681))
|
||||
- Feature: Re-write test suite ([#682](https://github.com/Mailu/Mailu/issues/682))
|
||||
- Feature: Docker image prefixes ([#702](https://github.com/Mailu/Mailu/issues/702))
|
||||
- Feature: Add authentication method “login” for Outlook ([#704](https://github.com/Mailu/Mailu/issues/704))
|
||||
- Feature: Allow extending nginx config with overrides ([#713](https://github.com/Mailu/Mailu/issues/713))
|
||||
- Feature: Dynamic attachment size limit ([#731](https://github.com/Mailu/Mailu/issues/731))
|
||||
- Feature: Certificate watcher for external certs to reload nginx ([#732](https://github.com/Mailu/Mailu/issues/732))
|
||||
- Feature: Kubernetes
|
||||
- Enhancement: Use pre-defined dhparam ([#322](https://github.com/Mailu/Mailu/issues/322))
|
||||
- Enhancement: Disable ssl_session_tickets ([#329](https://github.com/Mailu/Mailu/issues/329))
|
||||
- Enhancement: max attachment size in roundcube ([#338](https://github.com/Mailu/Mailu/issues/338))
|
||||
- Enhancement: Use x-forwarded-proto with redirects ([#347](https://github.com/Mailu/Mailu/issues/347))
|
||||
- Enhancement: Added adress verification before accepting mails for delivery ([#353](https://github.com/Mailu/Mailu/issues/353))
|
||||
- Enhancement: Reverse proxy - Real ip header and mail-letsencrypt ([#358](https://github.com/Mailu/Mailu/issues/358))
|
||||
- Enhancement: Parametrize hosts ([#373](https://github.com/Mailu/Mailu/issues/373))
|
||||
- Enhancement: Expose ports in dockerfiles ([#392](https://github.com/Mailu/Mailu/issues/392))
|
||||
- Enhancement: Added webmail-imap dependency in docker-compose ([#403](https://github.com/Mailu/Mailu/issues/403))
|
||||
- Enhancement: Add environment variables to allow running outside of docker-compose ([#429](https://github.com/Mailu/Mailu/issues/429))
|
||||
- Enhancement: Add original Delivered-To header to received messages ([#433](https://github.com/Mailu/Mailu/issues/433))
|
||||
- Enhancement: Use HOST_ADMIN in "Forwarding authentication server" ([#436](https://github.com/Mailu/Mailu/issues/436), [#437](https://github.com/Mailu/Mailu/issues/437))
|
||||
- Enhancement: Use POD_ADDRESS_RANGE for Dovecot ([#448](https://github.com/Mailu/Mailu/issues/448))
|
||||
- Enhancement: Using configurable filenames for TLS certs ([#468](https://github.com/Mailu/Mailu/issues/468))
|
||||
- Enhancement: Don't require BootstrapCDN (GDPR-compliance) ([#477](https://github.com/Mailu/Mailu/issues/477))
|
||||
- Enhancement: Use dynamic client_max_body_size for webmail ([#502](https://github.com/Mailu/Mailu/issues/502))
|
||||
- Enhancement: New logo design ([#509](https://github.com/Mailu/Mailu/issues/509))
|
||||
- Enhancement: New manifests for Kubernetes ([#544](https://github.com/Mailu/Mailu/issues/544))
|
||||
- Enhancement: Pin Alpine image ([#548](https://github.com/Mailu/Mailu/issues/548), [#557](https://github.com/Mailu/Mailu/issues/557))
|
||||
- Enhancement: Use safer cipher in roundcube ([#597](https://github.com/Mailu/Mailu/issues/597))
|
||||
- Enhancement: Improve sender checks ([#633](https://github.com/Mailu/Mailu/issues/633))
|
||||
- Enhancement: Use PHP 7.2 for rainloop and roundcube ([#606](https://github.com/Mailu/Mailu/issues/606), [#642](https://github.com/Mailu/Mailu/issues/642))
|
||||
- Enhancement: Multi-version documentation ([#664](https://github.com/Mailu/Mailu/issues/664))
|
||||
- Enhancement: Contribution documentation ([#700](https://github.com/Mailu/Mailu/issues/700))
|
||||
- Enhancement: Move Mailu Docker network to a fixed subnet ([#727](https://github.com/Mailu/Mailu/issues/727))
|
||||
- Enhancement: Added regex validation for alias username ([#764](https://github.com/Mailu/Mailu/issues/764))
|
||||
- Enhancement: Update documentation
|
||||
- Upstream: Update Roundcube
|
||||
- Upstream: Update Rainloop
|
||||
- Bug: Rainloop fails with "domain not allowed" ([#93](https://github.com/Mailu/Mailu/issues/93))
|
||||
- Bug: Announces fail ([#309](https://github.com/Mailu/Mailu/issues/309))
|
||||
- Bug: Authentication issues with rspamd admin ui ([#315](https://github.com/Mailu/Mailu/issues/315))
|
||||
- Bug: front hangup on restart ([#341](https://github.com/Mailu/Mailu/issues/341))
|
||||
- Bug: Display the proper user quota when set to 0/infinity ([#345](https://github.com/Mailu/Mailu/issues/345))
|
||||
- Bug: Domain details button "Regenerate keys" when no keys are generated yet ([#346](https://github.com/Mailu/Mailu/issues/346))
|
||||
- Bug: Relayed Domains: access denied error ([#351](https://github.com/Mailu/Mailu/issues/351))
|
||||
- Bug: Do not deny HTTP access upon TLS error when the flavor is mail ([#352](https://github.com/Mailu/Mailu/issues/352))
|
||||
- Bug: php_zip extension missing in Roundcube webmail ([#364](https://github.com/Mailu/Mailu/issues/364))
|
||||
- Bug: RoundCube webmail .htaccess assumes PHP 5 ([#366](https://github.com/Mailu/Mailu/issues/366))
|
||||
- Bug: No quota shows "0 Bytes" in user list ([#368](https://github.com/Mailu/Mailu/issues/368))
|
||||
- Bug: RELAYNETS not honored when login is different from sender ([#369](https://github.com/Mailu/Mailu/issues/369))
|
||||
- Bug: Request Entity Too Large ([#371](https://github.com/Mailu/Mailu/issues/371))
|
||||
- Bug: Pass the full host to the backend ([#372](https://github.com/Mailu/Mailu/issues/372))
|
||||
- Bug: Can't send from an email account that has forwarding ([#390](https://github.com/Mailu/Mailu/issues/390))
|
||||
- Bug: SSL protocol error roundcube/imap ([#411](https://github.com/Mailu/Mailu/issues/411), [#414](https://github.com/Mailu/Mailu/issues/414))
|
||||
- Bug: Unable to send from alternative domains ([#415](https://github.com/Mailu/Mailu/issues/415))
|
||||
- Bug: Webadmin redirect ignores host port ([#419](https://github.com/Mailu/Mailu/issues/419))
|
||||
- Bug: Disable esld when signing with dkim ([#435](https://github.com/Mailu/Mailu/issues/435))
|
||||
- Bug: DKIM missing when using identities ([#462](https://github.com/Mailu/Mailu/issues/462))
|
||||
- Bug: Moving mails from Junk to Trash flags them as ham ([#474](https://github.com/Mailu/Mailu/issues/474))
|
||||
- Bug: Cannot set the "keep emails" for fetched accounts ([#479](https://github.com/Mailu/Mailu/issues/479))
|
||||
- Bug: CVE-2018-8740 ([#482](https://github.com/Mailu/Mailu/issues/482))
|
||||
- Bug: Hide administration header in sidebar for normal users ([#505](https://github.com/Mailu/Mailu/issues/505))
|
||||
- Bug: Return correct status codes from auth rate limiter failure ([#513](https://github.com/Mailu/Mailu/issues/513))
|
||||
- Bug: Domain edit page shows "Create" button ([#523](https://github.com/Mailu/Mailu/issues/523))
|
||||
- Bug: Hostname resolving in start.py should retry on failure [docker swarm] ([#555](https://github.com/Mailu/Mailu/issues/555))
|
||||
- Bug: Error when trying to log in with an account without domain ([#585](https://github.com/Mailu/Mailu/issues/585))
|
||||
- Bug: Fix rainloop permissions ([#637](https://github.com/Mailu/Mailu/issues/637))
|
||||
|
||||
v1.5.1 - 2017-11-21
|
||||
-------------------
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
This project is open source, and your contributions are all welcome. There are mostly three different ways one can contribute to the project:
|
||||
|
||||
1. use Mailu, either on test or on production instances, and report meaningful bugs when you find some;
|
||||
2. contribute code and/or configuration to the repository (see [the development guidelines](https://mailu.io/contributors/guide.html) for details);
|
||||
3. contribute localization to your native language (see [the localization docs](https://mailu.io/contributors/localization.html) for details);
|
||||
2. contribute code and/or configuration to the repository (see [the development guidelines](https://mailu.io/master/contributors/guide.html) for details);
|
||||
3. contribute localization to your native language (see [the localization docs](https://mailu.io/master/contributors/localization.html) for details);
|
||||
|
||||
Either way, keep in mind that the code you write or the translation you produce muts be licensed under the same conditions as the project itself. Additionally, all contributors are considered equal co-authors of the project.
|
||||
|
||||
@ -136,7 +136,7 @@ class TokenForm(flask_wtf.FlaskForm):
|
||||
|
||||
|
||||
class AliasForm(flask_wtf.FlaskForm):
|
||||
localpart = fields.StringField(_('Alias'), [validators.DataRequired()])
|
||||
localpart = fields.StringField(_('Alias'), [validators.DataRequired(), validators.Regexp(LOCALPART_REGEX)])
|
||||
wildcard = fields.BooleanField(
|
||||
_('Use SQL LIKE Syntax (e.g. for catch-all aliases)'))
|
||||
destination = DestinationField(_('Destination'))
|
||||
|
||||
@ -53,7 +53,7 @@ configure your email client
|
||||
</tr>
|
||||
<tr>
|
||||
<th>{% trans %}Username{% endtrans %}</th>
|
||||
<td><pre>{{ current_user or "******" }}</pre></td>
|
||||
<td><pre>{{ current_user if current_user.is_authenticated else "******" }}</pre></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th>{% trans %}Password{% endtrans %}</th>
|
||||
|
||||
@ -7,6 +7,7 @@ postmaster_address = {{ POSTMASTER }}@{{ DOMAIN }}
|
||||
hostname = {{ HOSTNAMES.split(",")[0] }}
|
||||
submission_host = {{ FRONT_ADDRESS }}
|
||||
|
||||
{% if DISABLE_FTS_LUCENE != 'true' %}
|
||||
###############
|
||||
# Full-text search
|
||||
###############
|
||||
@ -20,6 +21,7 @@ plugin {
|
||||
|
||||
fts_lucene = whitespace_chars=@.
|
||||
}
|
||||
{% endif %}
|
||||
|
||||
###############
|
||||
# Mailboxes
|
||||
@ -64,6 +66,7 @@ plugin {
|
||||
###############
|
||||
# Authentication
|
||||
###############
|
||||
auth_username_chars =
|
||||
auth_mechanisms = plain login
|
||||
disable_plaintext_auth = no
|
||||
|
||||
|
||||
4
docs/_templates/page.html
vendored
Normal file
4
docs/_templates/page.html
vendored
Normal file
@ -0,0 +1,4 @@
|
||||
{%- extends "layout.html" %}
|
||||
{% block body %}
|
||||
{{ body|replace("VERSION_TAG", version) }}
|
||||
{% endblock %}
|
||||
@ -3,6 +3,10 @@
|
||||
# these few settings must however be configured before starting the mail
|
||||
# server and require a restart upon change.
|
||||
|
||||
# Set this to `true` to disable full text search by lucene (value: true, false)
|
||||
# This is a workaround for the bug in issue #751 (indexer-worker crashes)
|
||||
DISABLE_FTS_LUCENE=false
|
||||
|
||||
###################################
|
||||
# Common configuration variables
|
||||
###################################
|
||||
|
||||
143
docs/compose/traefik/docker-compose.yml
Normal file
143
docs/compose/traefik/docker-compose.yml
Normal file
@ -0,0 +1,143 @@
|
||||
version: '2'
|
||||
|
||||
services:
|
||||
|
||||
# This would normally not be here, but where you define your system services
|
||||
traefik:
|
||||
image: traefik:alpine
|
||||
command: --docker
|
||||
restart: always
|
||||
ports:
|
||||
- "80:80"
|
||||
- "443:443"
|
||||
volumes:
|
||||
- "/var/run/docker.sock:/var/run/docker.sock"
|
||||
- "/data/traefik/acme.json:/acme.json"
|
||||
- "/data/traefik/traefik.toml:/traefik.toml"
|
||||
# This may be needed (plus defining mailu_default external: true) if traefik lives elsewhere
|
||||
# networks:
|
||||
# - mailu_default
|
||||
|
||||
certdumper:
|
||||
restart: always
|
||||
image: mailu/traefik-certdumper:$VERSION
|
||||
environment:
|
||||
# Make sure this is the same as the main=-domain in traefik.toml
|
||||
# !!! Also don’t forget to add "TRAEFIK_DOMAIN=[...]" to your .env!
|
||||
- DOMAIN=$TRAEFIK_DOMAIN
|
||||
volumes:
|
||||
- "/data/traefik:/traefik"
|
||||
- "$ROOT/certs:/output"
|
||||
|
||||
front:
|
||||
image: mailu/nginx:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
logging:
|
||||
driver: $LOG_DRIVER
|
||||
labels: # Traefik labels for simple reverse-proxying
|
||||
- "traefik.enable=true"
|
||||
- "traefik.port=80"
|
||||
- "traefik.frontend.rule=Host:$TRAEFIK_DOMAIN"
|
||||
- "traefik.docker.network=mailu_default"
|
||||
ports:
|
||||
- "$BIND_ADDRESS4:110:110"
|
||||
- "$BIND_ADDRESS4:143:143"
|
||||
- "$BIND_ADDRESS4:993:993"
|
||||
- "$BIND_ADDRESS4:995:995"
|
||||
- "$BIND_ADDRESS4:25:25"
|
||||
- "$BIND_ADDRESS4:465:465"
|
||||
- "$BIND_ADDRESS4:587:587"
|
||||
- "$BIND_ADDRESS6:110:110"
|
||||
- "$BIND_ADDRESS6:143:143"
|
||||
- "$BIND_ADDRESS6:993:993"
|
||||
- "$BIND_ADDRESS6:995:995"
|
||||
- "$BIND_ADDRESS6:25:25"
|
||||
- "$BIND_ADDRESS6:465:465"
|
||||
- "$BIND_ADDRESS6:587:587"
|
||||
volumes:
|
||||
- "$ROOT/overrides/nginx:/overrides"
|
||||
- /data/traefik/ssl/$TRAEFIK_DOMAIN.crt:/certs/cert.pem
|
||||
- /data/traefik/ssl/$TRAEFIK_DOMAIN.key:/certs/key.pem
|
||||
|
||||
redis:
|
||||
image: redis:alpine
|
||||
restart: always
|
||||
volumes:
|
||||
- "$ROOT/redis:/data"
|
||||
|
||||
imap:
|
||||
image: mailu/dovecot:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/mail:/mail"
|
||||
- "$ROOT/overrides:/overrides"
|
||||
depends_on:
|
||||
- front
|
||||
|
||||
smtp:
|
||||
image: mailu/postfix:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/overrides:/overrides"
|
||||
depends_on:
|
||||
- front
|
||||
|
||||
antispam:
|
||||
image: mailu/rspamd:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/filter:/var/lib/rspamd"
|
||||
- "$ROOT/dkim:/dkim"
|
||||
- "$ROOT/overrides/rspamd:/etc/rspamd/override.d"
|
||||
depends_on:
|
||||
- front
|
||||
|
||||
antivirus:
|
||||
image: mailu/$ANTIVIRUS:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/filter:/data"
|
||||
|
||||
webdav:
|
||||
image: mailu/$WEBDAV:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/dav:/data"
|
||||
|
||||
admin:
|
||||
image: mailu/admin:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/data:/data"
|
||||
- "$ROOT/dkim:/dkim"
|
||||
depends_on:
|
||||
- redis
|
||||
|
||||
webmail:
|
||||
image: "mailu/$WEBMAIL:$VERSION"
|
||||
restart: always
|
||||
env_file: .env
|
||||
volumes:
|
||||
- "$ROOT/webmail:/data"
|
||||
depends_on:
|
||||
- imap
|
||||
|
||||
fetchmail:
|
||||
image: mailu/fetchmail:$VERSION
|
||||
restart: always
|
||||
env_file: .env
|
||||
|
||||
networks:
|
||||
default:
|
||||
driver: bridge
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: $SUBNET
|
||||
33
docs/compose/traefik/traefik.toml
Normal file
33
docs/compose/traefik/traefik.toml
Normal file
@ -0,0 +1,33 @@
|
||||
# This is just boilerplate stuff you probably have in your own config
|
||||
logLevel = "INFO"
|
||||
defaultEntryPoints = ["https","http"]
|
||||
|
||||
[entryPoints]
|
||||
[entryPoints.http]
|
||||
address = ":80"
|
||||
[entryPoints.http.redirect]
|
||||
entryPoint = "https"
|
||||
[entryPoints.https]
|
||||
address = ":443"
|
||||
[entryPoints.https.tls]
|
||||
|
||||
[docker]
|
||||
endpoint = "unix:///var/run/docker.sock"
|
||||
watch = true
|
||||
exposedByDefault = false
|
||||
|
||||
# Make sure we get acme.json saved, and onHostRule enabled
|
||||
[acme]
|
||||
email = "your@mail.tld"
|
||||
storage = "acme.json"
|
||||
entryPoint = "https"
|
||||
onHostRule = true
|
||||
|
||||
[acme.httpChallenge]
|
||||
entryPoint = "http"
|
||||
|
||||
# This should include all of your mail domains, and main= should be your $TRAEFIK_DOMAIN
|
||||
[[acme.domains]]
|
||||
main = "mail.your.doma.in"
|
||||
sans = ["web.mail.your.doma.in", "smtp.mail.doma.in", "imap.mail.doma.in"]
|
||||
|
||||
@ -184,7 +184,7 @@ directory structure.
|
||||
|
||||
If you do no posses the resources, but want to become an involved tester/reviewer.
|
||||
Please contact `muhlemmer on Matrix`_.
|
||||
He can provide access to a testing server, if a thrust relation can be established.
|
||||
He can provide access to a testing server, if a trust relation can be established.
|
||||
|
||||
.. _`muhlemmer on Matrix`: https://matrix.to/#/@muhlemmer:matrix.org
|
||||
|
||||
|
||||
@ -5,21 +5,32 @@ The demo server is for demonstration and test purposes only. Please be
|
||||
respectful and keep the demo server functional for others to be able to try it
|
||||
out.
|
||||
|
||||
The server is reset every day at 3am, french time. If you find the server is
|
||||
unusable, you can still ask for someone to reset it manually on our Matrix
|
||||
chat channel. Please do not open tickets everytime the server is down. Please
|
||||
do not open tickets if the server is quite slow: it *is* slow because the
|
||||
machine is a cheap leased server.
|
||||
If you find the server is unusable, you can ask for someone to reset it manually on our Matrix
|
||||
chat channel. Please do not open tickets every time the server is down.
|
||||
Please do not open tickets if the server is quite slow: it *is* slow because the
|
||||
services have only limited resources available.
|
||||
|
||||
Keep in mind that the demo server is also used for some automated tests and runs
|
||||
the latest unstable version. If you find actual bugs when using the demo
|
||||
server, please report these!
|
||||
Keep in mind that the demo server runs the latest unstable (master) version.
|
||||
If you find actual bugs when using the demo server, please report these!
|
||||
|
||||
Functionality
|
||||
-------------
|
||||
|
||||
- The server is reset every day at 3am, UTC.
|
||||
- You can send mail from any client to the server.
|
||||
However, the stmp server is made incapable of relaying the e-mail to the destination server.
|
||||
As such, the mail will never arrive. This is to prevent abuse of the server.
|
||||
- The server is capable of receiving mail for any configured domains.
|
||||
- The server exposes IMAP, POP3 and SMTP as usual for connection with mail clients such as Thunderbird.
|
||||
- The containers have limited (throttled) CPU, this means it can respond slow during heavy operations.
|
||||
- The containers have limited memory available and will be killed when exceeded.
|
||||
This is to prevent people from doing nasty things to the server as a whole.
|
||||
|
||||
Connecting to the server
|
||||
------------------------
|
||||
|
||||
* Server name : ``test.mailu.io``
|
||||
* IP address : ``51.15.169.20``
|
||||
* IP address : ``173.249.45.89``
|
||||
* Webmail : https://test.mailu.io/webmail/
|
||||
* Admin UI : https://test.mailu.io/admin/
|
||||
* Admin login : ``admin@test.mailu.io``
|
||||
|
||||
@ -8,6 +8,7 @@ In such a configuration, one would usually run a frontend reverse proxy to serve
|
||||
There are basically three options, from the most to the least recommended one:
|
||||
|
||||
- have Mailu Web frontend listen locally and use your own Web frontend on top of it
|
||||
- use ``Traefik`` in another container as central system-reverse-proxy
|
||||
- override Mailu Web frontend configuration
|
||||
- disable Mailu Web frontend completely and use your own
|
||||
|
||||
@ -114,11 +115,87 @@ Depending on how you access the front server, you might want to add a ``proxy_re
|
||||
|
||||
This will stop redirects (301 and 302) sent by the Webmail, nginx front and admin interface from sending you to ``localhost``.
|
||||
|
||||
Use Traefik in another container as central system-reverse-proxy
|
||||
--------------------------------------------------------------------
|
||||
|
||||
`Traefik`_ is a popular reverse-proxy aimed at containerized systems.
|
||||
As such, many may wish to integrate Mailu into a system which already uses Traefik as its sole ingress/reverse-proxy.
|
||||
|
||||
As the ``mailu/front`` container uses Nginx not only for ``HTTP`` forwarding, but also for the mail-protocols like ``SMTP``, ``IMAP``, etc, we need to keep this
|
||||
container around even when using another ``HTTP`` reverse-proxy. Furthermore, Traefik is neither able to forward non-HTTP, nor can it easily forward HTTPS-to-HTTPS.
|
||||
This, however, means 3 things:
|
||||
|
||||
- ``mailu/front`` needs to listen internally on ``HTTP`` rather than ``HTTPS``
|
||||
- ``mailu/front`` is not exposed to the outside world on ``HTTP``
|
||||
- ``mailu/front`` still needs ``SSL`` certificates (here, we assume ``letsencrypt``) for a well-behaved mail service
|
||||
|
||||
This makes the setup with Traefik a bit harder: Traefik saves its certificates in a proprietary *JSON* file, which is not readable by Nginx in the ``front``-container.
|
||||
To solve this, your ``acme.json`` needs to be exposed to the host or a ``docker-volume``. It will then be read by a script in another container,
|
||||
which will dump the certificates as ``PEM`` files, readable for Nginx. The ``front`` container will automatically reload Nginx whenever these certificates change.
|
||||
|
||||
To set this up, first set ``TLS_FLAVOR=mail`` in your ``.env``. This tells ``mailu/front`` not to try to request certificates using ``letsencrypt``,
|
||||
but to read provided certificates, and use them only for mail-protocols, not for ``HTTP``.
|
||||
Next, in your ``docker-compose.yml``, comment out the ``port`` lines of the ``front`` section for port ``…:80`` and ``…:440``.
|
||||
Add the respective Traefik labels for your domain/configuration, like
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
labels:
|
||||
- "traefik.enable=true"
|
||||
- "traefik.port=80"
|
||||
- "traefik.frontend.rule=Host:$TRAEFIK_DOMAIN"
|
||||
|
||||
.. note:: Please don’t forget to add ``TRAEFIK_DOMAIN=[...]`` TO YOUR ``.env``
|
||||
|
||||
If your Traefik is configured to automatically request certificates from *letsencrypt*, then you’ll have a certificate for ``mail.your.doma.in`` now. However,
|
||||
``mail.your.doma.in`` might only be the location where you want the Mailu web-interfaces to live — your mail should be sent/received from ``your.doma.in``,
|
||||
and this is the ``DOMAIN`` in your ``.env``?
|
||||
To support that use-case, Traefik can request ``SANs`` for your domain. Lets add something like
|
||||
|
||||
.. code-block:: guess
|
||||
|
||||
[acme]
|
||||
[[acme.domains]]
|
||||
main = "your.doma.in" # this is the same as $TRAEFIK_DOMAIN!
|
||||
sans = ["mail.your.doma.in", "webmail.your.doma.in", "smtp.your.doma.in"]
|
||||
|
||||
to your ``traefik.toml``. You might need to clear your ``acme.json``, if a certificate for one of these domains already exists.
|
||||
|
||||
You will need some solution which dumps the certificates in ``acme.json``, so you can include them in the ``mailu/front`` container.
|
||||
One such example is ``mailu/traefik-certdumper``, which has been adapted for use in Mailu. You can add it to your ``docker-compose.yml`` like:
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
certdumper:
|
||||
restart: always
|
||||
image: mailu/traefik-certdumper:$VERSION
|
||||
environment:
|
||||
# Make sure this is the same as the main=-domain in traefik.toml
|
||||
# !!! Also don’t forget to add "TRAEFIK_DOMAIN=[...]" to your .env!
|
||||
- DOMAIN=$TRAEFIK_DOMAIN
|
||||
volumes:
|
||||
- "/data/traefik:/traefik"
|
||||
- "$ROOT/certs:/output"
|
||||
|
||||
|
||||
|
||||
Assuming you have ``volume-mounted`` your ``acme.json`` put to ``/data/traefik`` on your host. The dumper will then write out ``/data/traefik/ssl/your.doma.in.crt``
|
||||
and ``/data/traefik/ssl/your.doma.in.key`` whenever ``acme.json`` is updated. Yay! Now let’s mount this to our ``front`` container like:
|
||||
|
||||
.. code-block:: yaml
|
||||
|
||||
volumes:
|
||||
- "$ROOT/overrides/nginx:/overrides"
|
||||
- /data/traefik/ssl/$TRAEFIK_DOMAIN.crt:/certs/cert.pem
|
||||
- /data/traefik/ssl/$TRAEFIK_DOMAIN.key:/certs/key.pem
|
||||
|
||||
.. _`Traefik`: https://traefik.io/
|
||||
|
||||
Override Mailu configuration
|
||||
----------------------------
|
||||
|
||||
If you do not have the resources for running a separate reverse proxy, you could override Mailu reverse proxy configuration by using a Docker volume. Simply store your configuration file (Nginx format), in ``/mailu/nginx.conf`` for instance.
|
||||
If you do not have the resources for running a separate reverse proxy, you could override Mailu reverse proxy configuration by using a Docker volume.
|
||||
Simply store your configuration file (Nginx format), in ``/mailu/nginx.conf`` for instance.
|
||||
|
||||
Then modify your ``docker-compose.yml`` file and change the ``front`` section to add a mount:
|
||||
|
||||
@ -135,7 +212,10 @@ Then modify your ``docker-compose.yml`` file and change the ``front`` section to
|
||||
- "$ROOT/certs:/certs"
|
||||
- "$ROOT/nginx.conf:/etc/nginx/nginx.conf"
|
||||
|
||||
You can use our default configuration file as a sane base for your configuration.
|
||||
You can also download the example configuration files:
|
||||
|
||||
- :download:`compose/traefik/docker-compose.yml`
|
||||
- :download:`compose/traefik/traefik.toml`
|
||||
|
||||
Disable completely Mailu reverse proxy
|
||||
--------------------------------------
|
||||
|
||||
2
optional/traefik-certdumper/.dockerignore
Normal file
2
optional/traefik-certdumper/.dockerignore
Normal file
@ -0,0 +1,2 @@
|
||||
README.md
|
||||
Dockerfile
|
||||
11
optional/traefik-certdumper/Dockerfile
Normal file
11
optional/traefik-certdumper/Dockerfile
Normal file
@ -0,0 +1,11 @@
|
||||
FROM alpine:3.8
|
||||
|
||||
RUN apk --no-cache add inotify-tools jq openssl util-linux bash docker
|
||||
# while not strictly documented, this script seems to always(?) support previous acme.json versions too
|
||||
RUN wget https://raw.githubusercontent.com/containous/traefik/master/contrib/scripts/dumpcerts.sh -O dumpcerts.sh
|
||||
|
||||
VOLUME ["/traefik"]
|
||||
VOLUME ["/output"]
|
||||
|
||||
COPY run.sh /
|
||||
ENTRYPOINT ["/run.sh"]
|
||||
21
optional/traefik-certdumper/LICENSE
Normal file
21
optional/traefik-certdumper/LICENSE
Normal file
@ -0,0 +1,21 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2018 Sven Dowideit
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
27
optional/traefik-certdumper/README.md
Normal file
27
optional/traefik-certdumper/README.md
Normal file
@ -0,0 +1,27 @@
|
||||
# Single-domain traefik-certdumper for mailu
|
||||
|
||||
This is based on the work by Sven Dowideit on https://github.com/SvenDowideit/traefik-certdumper
|
||||
|
||||
## Fork?
|
||||
This is a slight modification that is less flexible, but is adapted to the
|
||||
usecase in mailu. If you wish to deploy mailu behind a traefik, you face many
|
||||
problems. One of these is that you need to get the certificates into mailu in a
|
||||
very defined manner. This will copy the certificate for the **Main:**-domain
|
||||
given in the DOMAIN-environment onto `output`.
|
||||
|
||||
If your output happens to be mailu-front-`/certs`, the certificate-watcher in
|
||||
the front-container will catch it and reload nginx. This works for mailu
|
||||
`TLS_FLAVOR=[mail, cert]`
|
||||
|
||||
|
||||
```
|
||||
certdumper:
|
||||
restart: always
|
||||
image: Mailu/traefik-certdumper:$VERSION
|
||||
environment:
|
||||
- DOMAIN=$DOMAIN
|
||||
volumes:
|
||||
# your traefik data-volume is probably declared outside of the mailu composefile
|
||||
- /data/traefik:/traefik
|
||||
- $ROOT/certs/:/output/
|
||||
```
|
||||
30
optional/traefik-certdumper/run.sh
Executable file
30
optional/traefik-certdumper/run.sh
Executable file
@ -0,0 +1,30 @@
|
||||
#!/bin/bash
|
||||
|
||||
function dump() {
|
||||
echo "$(date) Dumping certificates"
|
||||
bash dumpcerts.sh /traefik/acme.json /tmp/work/ || return
|
||||
|
||||
for crt_file in $(ls /tmp/work/certs/*); do
|
||||
pem_file=$(echo $crt_file | sed 's/certs/pem/g' | sed 's/.crt/-public.pem/g')
|
||||
echo "openssl x509 -inform PEM -in $crt_file > $pem_file"
|
||||
openssl x509 -inform PEM -in $crt_file > $pem_file
|
||||
done
|
||||
for key_file in $(ls /tmp/work/private/*); do
|
||||
pem_file=$(echo $key_file | sed 's/private/pem/g' | sed 's/.key/-private.pem/g')
|
||||
echo "openssl rsa -in $key_file -text > $pem_file"
|
||||
openssl rsa -in $key_file -text > $pem_file
|
||||
done
|
||||
|
||||
echo "$(date) Copying certificates"
|
||||
cp -v /tmp/work/pem/${DOMAIN}-private.pem /output/key.pem
|
||||
cp -v /tmp/work/pem/${DOMAIN}-public.pem /output/cert.pem
|
||||
}
|
||||
|
||||
mkdir -p /tmp/work/pem /tmp/work/certs
|
||||
# run once on start to make sure we have any old certs
|
||||
dump
|
||||
|
||||
while true; do
|
||||
inotifywait -e modify /traefik/acme.json && \
|
||||
dump
|
||||
done
|
||||
@ -36,7 +36,7 @@ docker-compose -p mailu up -d
|
||||
|
||||
Before you can use Mailu, you must create the primary administrator user account. This should be {{ postmaster }}@{{ domain }}. Use the following command, changing PASSWORD to your liking:
|
||||
|
||||
<pre><code>docker-compose -p mailu exec admin python manage.py admin {{ postmaster }} {{ domain }} PASSWORD
|
||||
<pre><code>docker-compose -p mailu exec admin flask mailu admin {{ postmaster }} {{ domain }} PASSWORD
|
||||
</pre></code>
|
||||
|
||||
<p>Login to the admin interface to change the password for a safe one, at
|
||||
|
||||
@ -45,7 +45,7 @@ Command for removing docker stack is
|
||||
|
||||
Before you can use Mailu, you must create the primary administrator user account. This should be {{ postmaster }}@{{ domain }}. Use the following command, changing PASSWORD to your liking:
|
||||
|
||||
<pre><code>docker exec $(docker ps | grep admin | cut -d ' ' -f1) python manage.py admin {{ postmaster }} {{ domain }} PASSWORD
|
||||
<pre><code>docker exec $(docker ps | grep admin | cut -d ' ' -f1) flask mailu admin {{ postmaster }} {{ domain }} PASSWORD
|
||||
</pre></code>
|
||||
|
||||
<p>Login to the admin interface to change the password for a safe one, at
|
||||
|
||||
@ -30,6 +30,10 @@ services:
|
||||
image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-local}
|
||||
build: ../optional/radicale
|
||||
|
||||
traefik-certdumper:
|
||||
image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX}traefik-certdumper:${MAILU_VERSION:-local}
|
||||
build: ../optional/traefik-certdumper
|
||||
|
||||
admin:
|
||||
image: ${DOCKER_ORG:-mailu}/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-local}
|
||||
build: ../core/admin
|
||||
|
||||
Loading…
Reference in New Issue
Block a user