Classification

[X] Solution
[ ] Deliverability issue
[ ] Crash/Hang/Data loss
[ ] Serious bug
[ ] Minor bug
[ ] Vulnerability
[ ] Feature/Enhancement
[ ] Documentation

Reproducibility

[X] Always

Docker information

docker --version
Docker version 19.03.1, build 74b1e89

Description

Hello I delete sensitive information, but most information is usable: cat mailserverupdate.sh

! /bin/bash

##################

Update traefik image from docker hub

##################

###################################################################

local variables

################################################################### unset username # user name for regitry unset password # user password for regitry

MAILSERVER_DOCKER_TAG=1.1-stable

CurrentReg="reg.srv.int.com"

echo -n " Please, enter username for docker repository server (jenkinsuser?): "

read username

prompt=" Please, enter password: "

while IFS= read -p "$prompt" -r -s -n 1 char

do

if [[ $char == $'\0' ]]

then

break

fi

prompt='*'

password+="$char"

done

echo

echo $username

echo $password

docker login -u $username -p $password $CurrentReg

docker login -u jenkins -p Pass $CurrentReg

echo "Current mail server docker tag is:"${MAILSERVER_DOCKER_TAG}

echo "clean up docker" docker system prune -a -f

echo Download hardware/mailserver:${MAILSERVER_DOCKER_TAG} image from docker hub docker pull hardware/mailserver:${MAILSERVER_DOCKER_TAG} echo "Push hardware/mailserver:${MAILSERVER_DOCKER_TAG} to $CurrentReg " docker tag hardware/mailserver:${MAILSERVER_DOCKER_TAG} $CurrentReg/codinsula/it/mailserver docker push $CurrentReg/codinsula/it/mailserver

echo Download hardware/mailserver:1.1-stable image from docker hub

docker pull hardware/mailserver:1.1-stable

echo "Push hardware/mailserver:1.1-stable to $CurrentReg "

docker tag hardware/mailserver:1.1-stable $CurrentReg/codinsula/it/mailserver

docker push $CurrentReg/codinsula/it/mailserver

echo Download hardware/postfixadmin image from docker hub docker pull hardware/postfixadmin echo "Push hardware/postfixadmin to $CurrentReg " docker tag hardware/postfixadmin $CurrentReg/codinsula/it/postfixadmin docker push $CurrentReg/codinsula/it/postfixadmin

echo "Download hardware/rainloop image form docker hub" docker pull hardware/rainloop echo "Push consul to $CurrentReg " docker tag hardware/rainloop $CurrentReg/codinsula/it/rainloop docker push $CurrentReg/codinsula/it/rainloop

echo ".... Done. " echo "Finish"

cat ./start.sh

/bin/bash

mkdir -p /external/services/mailserver/{mail,rainloop}

echo "Create the overlay network that will be used for our stack (mailnetwork):" docker network create --driver overlay mailserver_network

echo Deploy the Mailserver Stack:

env $(cat .env | grep ^[A-Z] | xargs) docker stack deploy --compose-file mailserver-compose.yml mailserver

echo Waiting 5 sec. sleep 5

echo Stacks review:

docker stack ls

echo ..Done ?..

$cat .env

This file is used to define environment variables to be used

for variable substitution in your docker compose file.

https://docs.docker.com/compose/env-file/

MANDATORY

/!\ if this variables are unset, the mail server will not start.

Your domain name (eg. domain.tld)

MAILSERVER_DOMAIN=ll.com

MariaDB/PostgreSQL database password

DATABASE_USER_PASSWORD=M@ilP@ssw0rd!

Rspamd WebUI and controller password

RSPAMD_PASSWORD=M@ilP@ssw0rd! DATABASEIP=10.18.28.10 REDISIP=10.18.28.12 #

NOT MANDATORY

Your mailserver hostname (eg. mail for mail.domain.tld)

MAILSERVER_HOSTNAME=mail

Mailserver version

1.1-stable : Stable version (v1.1-stable github branch)

1.1-latest : Latest development build (master github branch)

Latest development builds have been validated through

the CI automation system but they are not meant for

deployment in production.

1.1-stable and 1.1-latest are rebuilt weekly on the docker hub but if you

have any problem with a new build you can switch to 1.1-stable-fallback

The fallback tag is rebuilt monthly.

MAILSERVER_DOCKER_TAG=1.1-stable

Docker volumes parent folder

VOLUMES_ROOT_PATH=/external/services/mailserver

Docker containers restart mode

https://docs.docker.com/compose/compose-file/#restart

RESTART_MODE=unless-stopped

cat ./mailserver-compose.yml version: "3"

IPv4 only

docker network create http_network

IPv4/IPv6 network

docker network create http_network --ipv6 --subnet "fd00:0000:0000:0000::/64"

Refer to https://github.com/hardware/mailserver/#ipv6-support for more information.

networks:

http_network:

external: true

traefiknet:
external: true mail_network: external: false

services: mailserver: image: reg.srv.int.com/codinsula/it/mailserver hostname: ${MAILSERVER_HOSTNAME} deploy: replicas: 1 labels:

- traefik.enable=true

- traefik.frontend.rule=Host:spam.${MAILSERVER_DOMAIN}

- traefik.port=11334

- traefik.docker.network=traefiknet

    - "traefik.backend.loadbalancer.stickiness=false"
    - "traefik.backend.loadbalancer.swarm=true"
    - "traefik.backend=spam_mailserver"
    - "traefik.docker.network=traefiknet"
    - "traefik.entrypoints=https"
    - "traefik.frontend.passHostHeader=true"
    - "traefik.frontend.rule=Host:spam.${MAILSERVER_DOMAIN}"
    - "traefik.port=11334"
ports:
  - "25:25"       # SMTP                - Required
  - "110:110"     # POP3       STARTTLS - Optional - For webmails/desktop clients
  - "143:143"     # IMAP       STARTTLS - Optional - For webmails/desktop clients
  - "465:465"     # SMTPS      SSL/TLS  - Optional - Enabled for compatibility reason, otherwise disabled
  - "587:587"     # Submission STARTTLS - Optional - For webmails/desktop clients
  - "993:993"     # IMAPS      SSL/TLS  - Optional - For webmails/desktop clients
  - "995:995"     # POP3S      SSL/TLS  - Optional - For webmails/desktop clients
  - "4190:4190"   # SIEVE      STARTTLS - Optional - Recommended for mail filtering
extra_hosts:                               # Required for external database (on other server or for local databases on host without docker)
  - "mariadb:${DATABASEIP}"                # Replace with IP address of MariaDB server
  - "redis:${REDISIP}"                     # Replace with IP address of Redis server
environment:
  - DOMAIN=${MAILSERVER_DOMAIN}
  - DBPASS=${DATABASE_USER_PASSWORD}       # MariaDB database password (required)
  - RSPAMD_PASSWORD=${RSPAMD_PASSWORD}     # Rspamd WebUI password (required)
# - ADD_DOMAINS=aa.tld, www.bb.tld...      # Add additional domains separated by commas (needed for dkim keys etc.)
# - DEBUG_MODE=true                        # Enable Postfix, Dovecot, Rspamd and Unbound verbose logging
# - ENABLE_POP3=true                       # Enable POP3 protocol
# - ENABLE_FETCHMAIL=true                  # Enable fetchmail forwarding
# - DISABLE_RATELIMITING=false             # Enable ratelimiting policy
# - DISABLE_CLAMAV=true                    # Disable virus scanning
# - DISABLE_SIGNING=true                   # Disable DKIM/ARC signing
# - DISABLE_GREYLISTING=true               # Disable greylisting policy
#
# Full list : https://github.com/hardware/mailserver#environment-variables
#
volumes:
  - ${VOLUMES_ROOT_PATH}/mail:/var/mail
networks:
  - mail_network
  - traefiknet

Administration interface

https://github.com/hardware/postfixadmin

http://postfixadmin.sourceforge.net/

Configuration : https://github.com/hardware/mailserver/wiki/Postfixadmin-initial-configuration

postfixadmin: image: reg.srv.int.com/codinsula/it/postfixadmin hostname: ${MAILSERVER_HOSTNAME} deploy: replicas: 1 labels:

"traefik.backend.loadbalancer.stickiness=false"
"traefik.backend.loadbalancer.swarm=true"
"traefik.backend=postfix_mailserver"
"traefik.docker.network=traefiknet"
"traefik.entrypoints=https"
"traefik.frontend.passHostHeader=true"
traefik.frontend.rule=Host:postfixadmin.${MAILSERVER_DOMAIN}
traefik.port=8888 environment:
- DOMAIN=${MAILSERVER_DOMAIN}
- DBHOST=${DATABASEIP}
- DBPASS=${DATABASE_USER_PASSWORD} depends_on:
- mailserver networks:
- mail_network
- traefiknet
  - http_network
Webmail (Optional)

https://github.com/hardware/rainloop

https://www.rainloop.net/

Configuration : https://github.com/hardware/mailserver/wiki/Rainloop-initial-configuration

rainloop: image: reg.srv.int.com/codinsula/it/rainloop

restart: ${RESTART_MODE}

deploy: replicas: 1 labels:
traefik.enable=true
"traefik.backend.loadbalancer.stickiness=false"
"traefik.backend.loadbalancer.swarm=true"
"traefik.backend=webmailserver"
"traefik.docker.network=traefiknet"
"traefik.entrypoints=https"
"traefik.frontend.passHostHeader=true"
traefik.port=8888
traefik.frontend.rule=Host:webmail.${MAILSERVER_DOMAIN} volumes:
- ${VOLUMES_ROOT_PATH}/rainloop:/rainloop/data depends_on:
- mailserver
  - mariadb
  
  ports:
  
  networks:
- mail_network
- traefiknet
  - http_network
Alternative webmail (Optional)

https://github.com/hardware/afterlogic-webmail-lite

https://afterlogic.org/webmail-lite

Configuration : https://github.com/hardware/mailserver/wiki/AfterLogic-Webmail-Lite-initial-configuration

afterlogic-webmail-lite:

image: hardware/afterlogic-webmail-lite

restart: ${RESTART_MODE}

labels:

- traefik.enable=true

- traefik.port=8888

- traefik.frontend.rule=Host:webmail.${MAILSERVER_DOMAIN}

- traefik.docker.network=http_network

volumes:

- ${VOLUMES_ROOT_PATH}/afterlogic-webmail-lite:/afterlogic-webmail-lite/data

depends_on:

- mailserver

- mariadb

networks:

- mail_network

- http_network

Authoritative DNS server (Optional)

https://github.com/hardware/nsd-dnssec

https://www.nlnetlabs.nl/projects/nsd/

Configuration : https://github.com/hardware/mailserver/wiki/NSD-initial-configuration

nsd:

image: hardware/nsd-dnssec

restart: ${RESTART_MODE}

ports:

- "53:53"

- "53:53/udp"

volumes:

- ${VOLUMES_ROOT_PATH}/nsd/conf:/etc/nsd

- ${VOLUMES_ROOT_PATH}/nsd/zones:/zones

- ${VOLUMES_ROOT_PATH}/nsd/db:/var/db/nsd

Database

https://github.com/docker-library/mariadb

https://mariadb.org/

mariadb:

image: mariadb:10.2

restart: ${RESTART_MODE}

Info : These variables are ignored when the volume already exists (if databases was created before).

environment:

- MYSQL_RANDOM_ROOT_PASSWORD=yes

- MYSQL_DATABASE=postfix

- MYSQL_USER=postfix

- MYSQL_PASSWORD=${DATABASE_USER_PASSWORD}

volumes:

- ${VOLUMES_ROOT_PATH}/mysql/db:/var/lib/mysql

networks:

- mail_network

Database

https://github.com/docker-library/redis

https://redis.io/

redis:

image: redis:4.0-alpine

restart: ${RESTART_MODE}

command: redis-server --appendonly yes

volumes:

- ${VOLUMES_ROOT_PATH}/redis/db:/data

networks:

- mail_network

hardware / mailserver

Docker swarm #395

Classification

Reproducibility

Docker information

Description

! /bin/bash

Update traefik image from docker hub

local variables

echo -n " Please, enter username for docker repository server (jenkinsuser?): "

read username

prompt=" Please, enter password: "

while IFS= read -p "$prompt" -r -s -n 1 char

do

if [[ $char == $'\0' ]]

then

break

fi

prompt='*'

password+="$char"

done

echo

echo $username

echo $password

docker login -u $username -p $password $CurrentReg

echo Download hardware/mailserver:1.1-stable image from docker hub

docker pull hardware/mailserver:1.1-stable

echo "Push hardware/mailserver:1.1-stable to $CurrentReg "

docker tag hardware/mailserver:1.1-stable $CurrentReg/codinsula/it/mailserver

docker push $CurrentReg/codinsula/it/mailserver

/bin/bash

This file is used to define environment variables to be used

for variable substitution in your docker compose file.

MANDATORY

/!\ if this variables are unset, the mail server will not start.

Your domain name (eg. domain.tld)

MariaDB/PostgreSQL database password

Rspamd WebUI and controller password

NOT MANDATORY

Your mailserver hostname (eg. mail for mail.domain.tld)

Mailserver version

1.1-stable : Stable version (v1.1-stable github branch)

1.1-latest : Latest development build (master github branch)

Latest development builds have been validated through

the CI automation system but they are not meant for

deployment in production.

1.1-stable and 1.1-latest are rebuilt weekly on the docker hub but if you

have any problem with a new build you can switch to 1.1-stable-fallback

The fallback tag is rebuilt monthly.

Docker volumes parent folder

Docker containers restart mode

IPv4 only

docker network create http_network

IPv4/IPv6 network

docker network create http_network --ipv6 --subnet "fd00:0000:0000:0000::/64"

Refer to https://github.com/hardware/mailserver/#ipv6-support for more information.

http_network:

external: true

- traefik.enable=true

- traefik.frontend.rule=Host:spam.${MAILSERVER_DOMAIN}

- traefik.port=11334

- traefik.docker.network=traefiknet

Administration interface

Configuration : https://github.com/hardware/mailserver/wiki/Postfixadmin-initial-configuration

- http_network

Webmail (Optional)

Configuration : https://github.com/hardware/mailserver/wiki/Rainloop-initial-configuration

restart: ${RESTART_MODE}

- mariadb

ports:

- http_network

Alternative webmail (Optional)

Configuration : https://github.com/hardware/mailserver/wiki/AfterLogic-Webmail-Lite-initial-configuration

afterlogic-webmail-lite:

image: hardware/afterlogic-webmail-lite

restart: ${RESTART_MODE}

labels:

- traefik.enable=true

- traefik.port=8888

- traefik.frontend.rule=Host:webmail.${MAILSERVER_DOMAIN}