mirror of
https://github.com/docker-mailserver/docker-mailserver.git
synced 2025-08-19 09:09:04 +02:00
Merge remote-tracking branch 'origin/master' into gl/check-on-restart
This commit is contained in:
georglauterbach
commit
8076124077
5 changed files with 70 additions and 19 deletions
|
|
@ -31,6 +31,7 @@ All notable changes to this project will be documented in this file. The format
|
|||
|
||||
- **Internal:**
|
||||
- Add password confirmation to several `setup` CLI subcommands ([#4072](https://github.com/docker-mailserver/docker-mailserver/pull/4072))
|
||||
- `debug getmail` subcommand to `setup` ([#4346](https://github.com/docker-mailserver/docker-mailserver/pull/4346))
|
||||
|
||||
### Updates
|
||||
|
||||
|
|
|
|||
|
|
@ -41,17 +41,13 @@ services:
|
|||
hostname: smtp.relay-service.test
|
||||
environment:
|
||||
# WORKAROUND: Bypass security checks from the mail-client (dms-sender container)
|
||||
# (avoids needing valid DNS for this example)
|
||||
# (avoids needing expected DNS records to run this example)
|
||||
- PERMIT_DOCKER=connected-networks
|
||||
# TLS is required when relaying to dms-relay via ports 587 / 465
|
||||
# (dms-relay will then relay the mail to dms-destination over port 25)
|
||||
- SSL_TYPE=manual
|
||||
- SSL_KEY_PATH=/tmp/tls/key.pem
|
||||
- SSL_CERT_PATH=/tmp/tls/cert.pem
|
||||
# WORKAROUND: `links` is required due to lack of properly configured DNS.
|
||||
# (resolves destination.test to the IP of the dms-destination container)
|
||||
links:
|
||||
- "dms-destination:destination.test"
|
||||
configs:
|
||||
- source: dms-accounts-relay
|
||||
target: /tmp/docker-mailserver/postfix-accounts.cf
|
||||
|
|
@ -64,8 +60,14 @@ services:
|
|||
dms-destination:
|
||||
image: mailserver/docker-mailserver:latest # :14.0
|
||||
hostname: mail.destination.test
|
||||
# Same workaround for purposes of the example, with the target recipient provisioned to accept mail
|
||||
# WORKAROUND: dms-relay must be able to resolve DNS for `@destination.test` to the IP of this container:
|
||||
# Normally a MX record would direct mail to the MTA (eg: `mail.destination.test`)
|
||||
networks:
|
||||
default:
|
||||
aliases:
|
||||
- destination.test
|
||||
environment:
|
||||
# WORKAROUND: Same workaround as needed for dms-relay
|
||||
- PERMIT_DOCKER=connected-networks
|
||||
configs:
|
||||
- source: dms-accounts-destination
|
||||
|
|
@ -75,6 +77,13 @@ services:
|
|||
# NOTE: This feature requires Docker Compose v2.23.1 (Nov 2023) or newer:
|
||||
# https://github.com/compose-spec/compose-spec/pull/446
|
||||
configs:
|
||||
# `postfix-main.cf`, a single line change to make all outbound SMTP connections over implicit TLS instead of the default explicit TLS (StartTLS).
|
||||
# NOTE: If you need to only selectively relay mail, you would need to instead adjust this on the relay service in `/etc/postfix/master.cf`,
|
||||
# However DMS presently modifies this when using the DMS Relay Host feature support, which may override `postfix-master.cf` or `user-patches.sh` due to `check-for-changes.sh`.
|
||||
dms-main:
|
||||
content: |
|
||||
smtp_tls_wrappermode=yes
|
||||
|
||||
# DMS expects an account to be configured to run, this example provides accounts already created.
|
||||
# Login credentials:
|
||||
# user: "john.doe@example.test" password: "secret"
|
||||
|
|
@ -94,13 +103,6 @@ configs:
|
|||
content: |
|
||||
jane.doe@destination.test|{SHA512-CRYPT}$$6$$o65y1ZXC4ooOPLwZ$$7TF1nYowEtNJpH6BwJBgdj2pPAxaCvhIKQA6ww5zdHm/AA7aemY9eoHC91DOgYNaKj1HLxSeWNDdvrp6mbtUY.
|
||||
|
||||
# This is `postfix-main.cf`, single line change to make all outbound SMTP connections over port 465 instead of 25 (default)
|
||||
# If you selectively relay mail, you would need to adjust this on the relay service in `/etc/postfix/master.cf`,
|
||||
# However DMS presently modifies this when using the DMS Relay Host feature support, which may override `postfix-master.cf` or `user-patches.sh` due to `check-for-changes.sh`.
|
||||
dms-main:
|
||||
content: |
|
||||
smtp_tls_wrappermode=yes
|
||||
|
||||
# TLS files:
|
||||
# - Use an ECDSA cert that's been signed by a self-signed CA for TLS cert verification.
|
||||
# - This cert is only valid for mail.example.test, mail.destination.test, smtp.relay-service.test
|
||||
|
|
|
|||
|
|
@ -108,3 +108,11 @@ It is possible to utilize the `getmail-gmail-xoauth-tokens` helper to provide au
|
|||
[getmail-docs]: https://getmail6.org/configuration.html
|
||||
[getmail-docs-xoauth-12]: https://github.com/getmail6/getmail6/blob/1f95606156231f1e074ba62a9baa64f892a92ef8/docs/getmailrc-examples#L286
|
||||
[getmail-docs-xoauth-13]: https://github.com/getmail6/getmail6/blob/1f95606156231f1e074ba62a9baa64f892a92ef8/docs/getmailrc-examples#L351
|
||||
|
||||
## Debugging
|
||||
|
||||
To debug your `getmail` configurations, run this `setup debug` command:
|
||||
|
||||
```sh
|
||||
docker exec -it dms-container-name setup debug getmail
|
||||
```
|
||||
|
|
|
|||
|
|
@ -21,10 +21,6 @@ This can be configured by [overriding the default Postfix configurations][docs::
|
|||
In `postfix-main.cf` you'll have to set the [`smtp_bind_address`][postfix-docs::smtp-bind-address-ipv4] and [`smtp_bind_address6`][postfix-docs::smtp-bind-address-ipv6]
|
||||
to the respective IP-address on the server you want to use.
|
||||
|
||||
[docs::overrides-postfix]: ../../config/advanced/override-defaults/postfix.md
|
||||
[postfix-docs::smtp-bind-address-ipv4]: https://www.postfix.org/postconf.5.html#smtp_bind_address
|
||||
[postfix-docs::smtp-bind-address-ipv6]: https://www.postfix.org/postconf.5.html#smtp_bind_address6
|
||||
|
||||
!!! example
|
||||
|
||||
=== "Contributed solution"
|
||||
|
|
@ -56,9 +52,44 @@ to the respective IP-address on the server you want to use.
|
|||
|
||||
If that avoids the concern with `smtp-amavis`, you may still need to additionally override for the [`relay` transport][gh-src::postfix-master-cf::relay-transport] as well if you have configured DMS to relay mail.
|
||||
|
||||
=== "Bridged Networks"
|
||||
|
||||
When your DMS container is using a bridge network, you'll instead need to restrict which IP address inbound and outbound traffic is routed through via the bridged interface.
|
||||
|
||||
For **inbound** traffic, you may configure this at whatever scope is most appropriate for you:
|
||||
|
||||
- **Daemon:** Change the [default bind address][inbound-ip::docker-docs::daemon] configured in `/etc/docker/daemon.json` (default `0.0.0.0`)
|
||||
- **Network:** Assign the [`host_binding_ipv4` bridge driver option][inbound-ip::docker-docs::network] as shown in the below `compose.yaml` snippet.
|
||||
- **Container:** Provide an explicit host IP address when [publishing a port][inbound-ip::docker-docs::container].
|
||||
|
||||
For **outbound** traffic, the bridge network will use the default route. You can change this by either:
|
||||
|
||||
- [Manually routing networks][outbound-ip::route-manually] on the host.
|
||||
- Use the [`host_ipv4` driver option][outbind-ip::host-ipv4] for Docker networks to force the SNAT (source IP) that the bridged network will route outbound traffic through.
|
||||
- This IP address must belong to a network interface to be routed through it.
|
||||
- IPv6 support via `host_ipv6` [requires at least Docker v25][outbind-ip::host-ipv6].
|
||||
|
||||
---
|
||||
|
||||
Here is a `compose.yaml` snippet that applies the inbound + outbound settings to the default bridge network Docker Compose creates (_if it already exists, you will need to ensure it's re-created to apply the updated settings_):
|
||||
|
||||
```yaml title="compose.yaml"
|
||||
networks:
|
||||
default:
|
||||
driver_opts:
|
||||
# Inbound IP (sets the host IP that published ports receive traffic from):
|
||||
com.docker.network.bridge.host_binding_ipv4: 198.51.100.42
|
||||
# Outbound IP (sets the host IP that external hosts will receive connections from):
|
||||
com.docker.network.host_ipv4: 198.51.100.42
|
||||
```
|
||||
|
||||
!!! note "IP addresses for documentation"
|
||||
|
||||
IP addresses shown in above examples are placeholders, they are IP addresses reserved for documentation by IANA (_[RFC-5737 (IPv4)][rfc-5737] and [RFC-3849 (IPv6)][rfc-3849]_). Replace them with the IP addresses you want DMS to send mail through.
|
||||
IP addresses shown in above examples (`198.51.100.42` + `2001:DB8::42`) are placeholders, they are IP addresses reserved for documentation by IANA (_[RFC-5737 (IPv4)][rfc-5737] and [RFC-3849 (IPv6)][rfc-3849]_). Replace them with the IP addresses you want DMS to send mail through.
|
||||
|
||||
[docs::overrides-postfix]: ../../config/advanced/override-defaults/postfix.md
|
||||
[postfix-docs::smtp-bind-address-ipv4]: https://www.postfix.org/postconf.5.html#smtp_bind_address
|
||||
[postfix-docs::smtp-bind-address-ipv6]: https://www.postfix.org/postconf.5.html#smtp_bind_address6
|
||||
|
||||
[rfc-5737]: https://datatracker.ietf.org/doc/html/rfc5737
|
||||
[rfc-3849]: https://datatracker.ietf.org/doc/html/rfc3849
|
||||
|
|
@ -66,3 +97,10 @@ to the respective IP-address on the server you want to use.
|
|||
[gh-pr::3465::comment-restrictions]: https://github.com/docker-mailserver/docker-mailserver/pull/3465#discussion_r1458114528
|
||||
[gh-pr::3465::alternative-solution]: https://github.com/docker-mailserver/docker-mailserver/pull/3465#issuecomment-1678107233
|
||||
[gh-src::postfix-master-cf::relay-transport]: https://github.com/docker-mailserver/docker-mailserver/blob/9cdbef2b369fb4fb0f1b4e534da8703daf92abc9/target/postfix/master.cf#L65
|
||||
|
||||
[inbound-ip::docker-docs::daemon]: https://docs.docker.com/reference/cli/dockerd/#default-network-options
|
||||
[inbound-ip::docker-docs::network]: https://docs.docker.com/engine/network/drivers/bridge/#default-host-binding-address
|
||||
[inbound-ip::docker-docs::container]: https://docs.docker.com/reference/compose-file/services/#ports
|
||||
[outbound-ip::route-manually]: https://github.com/moby/moby/issues/30053#issuecomment-1077041045
|
||||
[outbind-ip::host-ipv4]: https://github.com/moby/libnetwork/pull/2454
|
||||
[outbind-ip::host-ipv6]: https://github.com/moby/moby/issues/46469
|
||||
|
|
|
|||
|
|
@ -64,6 +64,7 @@ ${RED}[${ORANGE}SUB${RED}]${ORANGE}COMMANDS${RESET}
|
|||
|
||||
${LBLUE}COMMAND${RESET} debug ${RED}:=${RESET}
|
||||
setup debug ${CYAN}fetchmail${RESET}
|
||||
setup debug ${CYAN}getmail${RESET}
|
||||
setup debug ${CYAN}login${RESET} <COMMANDS>
|
||||
setup debug ${CYAN}show-mail-logs${RESET}
|
||||
|
||||
|
|
@ -150,6 +151,7 @@ function _main() {
|
|||
( debug )
|
||||
case ${2:-} in
|
||||
( fetchmail ) debug-fetchmail ;;
|
||||
( getmail ) debug-getmail ;;
|
||||
( show-mail-logs ) cat /var/log/mail/mail.log ;;
|
||||
( login )
|
||||
shift 2
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue