From 047f228fe362c488618a9f2818663a0d4589ab14 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 25 Sep 2026 23:49:17 +0200 Subject: [PATCH] mailu: every container asks the module's own resolver, pinned where they can find it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 2024.06's admin refuses to serve behind a resolver that does not validate DNSSEC — found live as an unhealthy admin, 454s on submission and a 500 webmail, with the runtime's forwarder validating nothing. The unbound this module always shipped becomes reachable: pinned at the predecessor's own address on the module network (the subnet the mesh adopted), and named as dns by the nine containers that resolve anything. Stands on mesh-host #26, which gave the vocabulary these two fields. --- modules/mailu/module.json | 38 +++++++++++++++++++++++++++++++++----- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/modules/mailu/module.json b/modules/mailu/module.json index 71a4ddf..8012d3b 100644 --- a/modules/mailu/module.json +++ b/modules/mailu/module.json @@ -294,7 +294,8 @@ "/var/lib/mailu/mailu.env", "/var/lib/mailu/secret.env" ], - "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified" + "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", + "ip": "192.168.203.254" }, { "id": "redis", @@ -322,7 +323,10 @@ "/services/mailu/data/data:/data", "/services/mailu/data/dkim:/dkim" ], - "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified" + "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", + "dns": [ + "192.168.203.254" + ] }, { "id": "imap", @@ -336,6 +340,9 @@ "volumes": [ "/services/mailu/data/mail:/mail", "/services/mailu/data/overrides/dovecot:/overrides:ro" + ], + "dns": [ + "192.168.203.254" ] }, { @@ -350,6 +357,9 @@ "volumes": [ "/services/mailu/data/mailqueue:/queue", "/services/mailu/data/overrides/postfix:/overrides:ro" + ], + "dns": [ + "192.168.203.254" ] }, { @@ -364,6 +374,9 @@ "volumes": [ "/services/mailu/data/filter:/var/lib/rspamd", "/services/mailu/data/overrides/rspamd:/etc/rspamd/override.d:ro" + ], + "dns": [ + "192.168.203.254" ] }, { @@ -374,6 +387,9 @@ "network": "mailu", "volumes": [ "/services/mailu/data/clamav:/var/lib/clamav" + ], + "dns": [ + "192.168.203.254" ] }, { @@ -390,7 +406,10 @@ "/services/mailu/data/webmail:/data", "/services/mailu/data/overrides/roundcube:/overrides:ro" ], - "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified" + "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", + "dns": [ + "192.168.203.254" + ] }, { "id": "webdav", @@ -405,7 +424,10 @@ "volumes": [ "/services/mailu/data/dav:/data" ], - "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified" + "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", + "dns": [ + "192.168.203.254" + ] }, { "id": "fetchmail", @@ -420,7 +442,10 @@ "volumes": [ "/services/mailu/data/data/fetchmail:/data" ], - "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified" + "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified", + "dns": [ + "192.168.203.254" + ] }, { "id": "front", @@ -445,6 +470,9 @@ "volumes": [ "/services/mailu/data/certs:/certs", "/services/mailu/data/overrides/nginx:/overrides:ro" + ], + "dns": [ + "192.168.203.254" ] }, {