jschoubben
32dec5f0c2
ADR 0086. mesh-controller mounts its six own secrets and names them with _FILE twins, so no credential of its own reaches its environment. The 35 containers that still read a secret through an env-file carry secrets-in-environment with the reason; converting each where its software accepts a path is the per-module work of issue 041.
437 lines
14 KiB
JSON
437 lines
14 KiB
JSON
{
|
|
"module": "mailu",
|
|
"version": "1",
|
|
"capabilities": [
|
|
"container-runtime"
|
|
],
|
|
"requires": [
|
|
"postgres-database",
|
|
"route"
|
|
],
|
|
"contributes": {
|
|
"postgres-database": {
|
|
"name": "mailu"
|
|
},
|
|
"route": {
|
|
"label": "mail",
|
|
"port": 7080
|
|
}
|
|
},
|
|
"binds": {
|
|
"postgres-database": "/var/lib/mailu/database.json",
|
|
"route": "/var/lib/mailu/route.json"
|
|
},
|
|
"secrets": {
|
|
"postgres-database": "/var/lib/mailu/database.secret"
|
|
},
|
|
"emits": [
|
|
"module.mailu.user.created",
|
|
"module.mailu.user.deleted",
|
|
"module.mailu.alias.created",
|
|
"module.mailu.alias.deleted"
|
|
],
|
|
"listens": [
|
|
{
|
|
"port": 25,
|
|
"protocol": "tcp",
|
|
"from": "anywhere",
|
|
"why": "mail from other mail servers",
|
|
"fixed": true
|
|
},
|
|
{
|
|
"port": 465,
|
|
"protocol": "tcp",
|
|
"from": "anywhere",
|
|
"why": "submission over TLS",
|
|
"fixed": true
|
|
},
|
|
{
|
|
"port": 587,
|
|
"protocol": "tcp",
|
|
"from": "anywhere",
|
|
"why": "submission",
|
|
"fixed": true
|
|
},
|
|
{
|
|
"port": 993,
|
|
"protocol": "tcp",
|
|
"from": "anywhere",
|
|
"why": "IMAP over TLS",
|
|
"fixed": true
|
|
},
|
|
{
|
|
"port": 7080,
|
|
"protocol": "tcp",
|
|
"from": "mesh",
|
|
"why": "the web interface (admin, webmail, admin API), behind the route proxy"
|
|
}
|
|
],
|
|
"own-secrets": {
|
|
"secret-key": "/var/lib/mailu/secret-key.secret",
|
|
"admin": "/var/lib/mailu/admin.secret",
|
|
"api-token": "/var/lib/mailu/api-token.secret",
|
|
"broker": "/var/lib/mesh/mailu/broker"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh/mailu",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mailu",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "config-env",
|
|
"type": "file",
|
|
"path": "/var/lib/mailu/mailu.env",
|
|
"mode": "0644",
|
|
"content": "DOMAIN=novox.be\nHOSTNAMES=mail.novox.be\nPOSTMASTER=admin\nSITENAME=Novox\nWEBSITE=https://novox.be\nTLS_FLAVOR=cert\nSUBNET=192.168.203.0/24\nCOMPOSE_PROJECT_NAME=mailu\nHOST_ADMIN=mailu-admin\nHOST_ANTISPAM=mailu-antispam:11332\nHOST_IMAP=mailu-imap\nHOST_SMTP=mailu-smtp\nHOST_WEBMAIL=mailu-webmail\nHOST_WEBDAV=mailu-webdav:5232\nHOST_REDIS=mailu-redis\nHOST_FRONT=mailu-front\nREDIS_ADDRESS=mailu-redis\nANTIVIRUS=clamav\nWEBMAIL=roundcube\nWEBDAV=radicale\nFETCHMAIL_ENABLED=True\nFETCHMAIL_DELAY=600\nADMIN=true\nWEB_ADMIN=/admin\nWEB_WEBMAIL=/webmail\nWEBROOT_REDIRECT=/webmail\nWEBMAIL_ADDRESS=webmail\nAPI=true\nWEB_API=/api\nAUTH_RATELIMIT_IP=6000/hour\nAUTH_RATELIMIT_USER=1000/day\nCREDENTIAL_ROUNDS=12\nPASSWORD_SCHEME=PBKDF2\nDISABLE_STATISTICS=True\nMESSAGE_SIZE_LIMIT=50000000\nMESSAGE_RATELIMIT=200/day\nRECIPIENT_DELIMITER=+\nPOSTFIX_MYNETWORKS=127.0.0.0/8 [::1]/128\nRELAYNETS=\nRELAYHOST=\nREJECT_UNLISTED_RECIPIENT=\nDB_FLAVOR=postgresql\nINITIAL_ADMIN_ACCOUNT=admin\nINITIAL_ADMIN_DOMAIN=novox.be\nINITIAL_ADMIN_MODE=ifmissing\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nPOP3_PORT=110\nPOP3S_PORT=995\nIMAP_PORT=143\nIMAPS_PORT=993\nHTTP_PORT=7080\nHTTPS_PORT=7443\nAUTOMX_PORT=4243\nAMX_SMTP_ADDRESS=mail.novox.be\nAMX_SMTP_PORT=587\nAMX_IMAP_ADDRESS=mail.novox.be\nAMX_IMAP_PORT=143\nAMX_MAIL_DOMAINS=novox.be\nDMARC_RUA=admin\nDMARC_RUF=admin\nLETSENCRYPT_SHORTCHAIN=True\nTZ=Etc/UTC\nLOG_LEVEL=INFO\nWELCOME=false\nREAL_IP_HEADER=X-Real-IP\nREAL_IP_FROM=\nCOMPRESSION=\nCOMPRESS_LEVEL=\nCOMPRESSION_LEVEL=\nBIND_ADDRESS4=127.0.0.1\nBIND_ADDRESS6=::1\nMAILU_VERSION=1.9\nDOCKER_ORG=mailu\nDOCKER_PREFIX=\n"
|
|
},
|
|
{
|
|
"id": "secret-env",
|
|
"type": "file",
|
|
"path": "/var/lib/mailu/secret.env",
|
|
"mode": "0600",
|
|
"content": "SECRET_KEY=${secret:secret-key}\n"
|
|
},
|
|
{
|
|
"id": "database-env",
|
|
"type": "file",
|
|
"path": "/var/lib/mailu/database.env",
|
|
"mode": "0600",
|
|
"content": "DB_FLAVOR=postgresql\nDB_HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nDB_USER=${bound:postgres-database:as}\nDB_NAME=${bound:postgres-database:as}\nDB_PW=${secret:postgres-database}\n"
|
|
},
|
|
{
|
|
"id": "admin-env",
|
|
"type": "file",
|
|
"path": "/var/lib/mailu/admin.env",
|
|
"mode": "0600",
|
|
"content": "INITIAL_ADMIN_PW=${secret:admin}\nAPI_TOKEN=${secret:api-token}\n"
|
|
},
|
|
{
|
|
"id": "data-certs",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/certs",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-data",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/data",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-dkim",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/dkim",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-mail",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/mail",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-mailqueue",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/mailqueue",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-filter",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/filter",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-redis",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/redis",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-webmail",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/webmail",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-dav",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/dav",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-fetchmail",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/data/fetchmail",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-overrides-nginx",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/overrides/nginx",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-overrides-dovecot",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/overrides/dovecot",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-overrides-postfix",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/overrides/postfix",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-overrides-rspamd",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/overrides/rspamd",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "data-overrides-roundcube",
|
|
"type": "directory",
|
|
"path": "/services/mailu/data/overrides/roundcube",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "net",
|
|
"type": "network",
|
|
"name": "mailu"
|
|
},
|
|
{
|
|
"id": "resolver",
|
|
"type": "container",
|
|
"name": "mailu-resolver",
|
|
"image": "ghcr.io/mailu/unbound@sha256:142aaad82ad1b0d5b59a5f1303778dba61a3e0a540f5d969c48862bcc99f6f5d",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "redis",
|
|
"type": "container",
|
|
"name": "mailu-redis",
|
|
"image": "redis@sha256:1db42ccef14898aa29bae778452d567534b59c107129cbc1163fb552de184d3c",
|
|
"network": "mailu",
|
|
"volumes": [
|
|
"/services/mailu/data/redis:/data"
|
|
]
|
|
},
|
|
{
|
|
"id": "admin",
|
|
"type": "container",
|
|
"name": "mailu-admin",
|
|
"image": "ghcr.io/mailu/admin@sha256:dcac20e9cbdad560faef9653b1b5ac0d9266f4098dc00f0e7f0d35f4e70ed8f1",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env",
|
|
"/var/lib/mailu/database.env",
|
|
"/var/lib/mailu/admin.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/data:/data",
|
|
"/services/mailu/data/dkim:/dkim"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "imap",
|
|
"type": "container",
|
|
"name": "mailu-imap",
|
|
"image": "ghcr.io/mailu/dovecot@sha256:46d18ba51032be8ebd6841aa49c1ef8762c729038c5fd86a081b5b884d478af9",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/mail:/mail",
|
|
"/services/mailu/data/overrides/dovecot:/overrides:ro"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "smtp",
|
|
"type": "container",
|
|
"name": "mailu-smtp",
|
|
"image": "ghcr.io/mailu/postfix@sha256:bbf882880f68849511710b35237a933f3fe80c4b28bf48ff20205dbd1f1433d7",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/mailqueue:/queue",
|
|
"/services/mailu/data/overrides/postfix:/overrides:ro"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "antispam",
|
|
"type": "container",
|
|
"name": "mailu-antispam",
|
|
"image": "ghcr.io/mailu/rspamd@sha256:e87ab93dd252cc69499caa5317dd10d445fd4291a7ecf6bca09793c7d475a0c8",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/filter:/var/lib/rspamd",
|
|
"/services/mailu/data/overrides/rspamd:/etc/rspamd/override.d:ro"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "antivirus",
|
|
"type": "container",
|
|
"name": "mailu-antivirus",
|
|
"image": "ghcr.io/mailu/clamav@sha256:01d30483e4a8a20a54566addb1f9b00ebb51e8a103f9226602379c412cf5fb62",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/filter:/data"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "webmail",
|
|
"type": "container",
|
|
"name": "mailu-webmail",
|
|
"image": "ghcr.io/mailu/roundcube@sha256:19ccc9c21b2420dabb893ffa707ef90785c785e53dcb6bb9f98da01598412c43",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/webmail:/data",
|
|
"/services/mailu/data/overrides/roundcube:/overrides:ro"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "webdav",
|
|
"type": "container",
|
|
"name": "mailu-webdav",
|
|
"image": "ghcr.io/mailu/radicale@sha256:e13cbad3791c0a6841b5d387e57e49a117808dcef87b8c9969f671ae9c3b67c0",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/dav:/data"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "fetchmail",
|
|
"type": "container",
|
|
"name": "mailu-fetchmail",
|
|
"image": "ghcr.io/mailu/fetchmail@sha256:7dcd1392882925d612ab2d0230d437f0c660989d572283c48b0d0f2d491adce7",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/data/fetchmail:/data"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "front",
|
|
"type": "container",
|
|
"name": "mailu-front",
|
|
"image": "ghcr.io/mailu/nginx@sha256:09f28ab6d36367fcacc7994f7021f132ac845bdc05f04bf80906102d11aaa057",
|
|
"network": "mailu",
|
|
"env-file": [
|
|
"/var/lib/mailu/mailu.env",
|
|
"/var/lib/mailu/secret.env"
|
|
],
|
|
"ports": [
|
|
"25",
|
|
"465",
|
|
"587",
|
|
"993",
|
|
"7080:80"
|
|
],
|
|
"volumes": [
|
|
"/services/mailu/data/certs:/certs",
|
|
"/services/mailu/data/overrides/nginx:/overrides:ro"
|
|
],
|
|
"secrets-in-environment": "the image reads its configuration from the environment only; converting to a file is the per-module work of issue 041"
|
|
},
|
|
{
|
|
"id": "runtime-config",
|
|
"type": "file",
|
|
"path": "/var/lib/mesh/mailu/config.json",
|
|
"mode": "0600",
|
|
"content": "{}\n",
|
|
"merge": "json"
|
|
},
|
|
{
|
|
"id": "runtime",
|
|
"type": "container",
|
|
"name": "mesh-mailu",
|
|
"network": "mailu",
|
|
"volumes": [
|
|
"/var/lib/mesh/mailu/broker:/run/secrets/broker:ro",
|
|
"/var/lib/mailu/api-token.secret:/run/secrets/api-token:ro",
|
|
"/var/lib/mesh/mailu/config.json:/run/config/config.json:ro",
|
|
"/var/run/docker.sock:/var/run/docker.sock"
|
|
],
|
|
"env": {
|
|
"MESH_BROKER_FILE": "/run/secrets/broker",
|
|
"MESH_MAILU_URL": "http://mailu-admin/api/v1",
|
|
"MESH_MAILU_API_KEY_FILE": "/run/secrets/api-token",
|
|
"MESH_MAILU_IMAP_CONTAINER": "mailu-imap",
|
|
"MESH_MAILU_CONFIG_FILE": "/run/config/config.json"
|
|
},
|
|
"restart-on": [
|
|
"runtime-config"
|
|
],
|
|
"artifact": "runtime"
|
|
}
|
|
],
|
|
"build": {
|
|
"on": [
|
|
{
|
|
"arg": "BUILD_BASE",
|
|
"module": "mesh-tools",
|
|
"artifact": "build"
|
|
},
|
|
{
|
|
"arg": "RUNTIME_BASE",
|
|
"module": "mesh-tools",
|
|
"artifact": "runtime"
|
|
}
|
|
],
|
|
"artifacts": [
|
|
{
|
|
"name": "runtime",
|
|
"kind": "image",
|
|
"from": "Dockerfile"
|
|
}
|
|
]
|
|
}
|
|
}
|