Liosha84andClaude Opus 5.5
7b7de905f9
continuous-integration/drone/pr Build is passing
Без этого после #26 сервер не стартует: AccessDeniedException /run/mail-secrets/SERVICE_TOKEN (на prod поправлено руками chmod 644 в томе 2026-11-07). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
85 lines
3.5 KiB
YAML
85 lines
3.5 KiB
YAML
# Same stand as docker-compose.jambotron.yml, but from the ready image — nothing is built on the VM:
|
|
# gitea.jambotron.com/jambotron_gang/reactive-mail-server (Drone builds it from master, see .drone.yml).
|
|
# Pin a build: MAIL_IMAGE_TAG=<first 8 chars of the master commit>; default latest (pulled again on every deploy).
|
|
# Test deploy on Jambotron (v0.2.3 75.3): pick this file in the deploy wizard.
|
|
# Outside, only the web client + API (service "mail", port 8080) through Jambotron's Caddy — give it a domain.
|
|
# SMTP (3025) stays inside the VM's docker network; nothing is sent outside (OUTBOUND_MODE=off).
|
|
# Secrets are generated on the first start into the "secrets" volume — nothing to type in, nothing in git.
|
|
# Mailboxes admin@<MAIL_DOMAINS> and trap@mail.test (catch-all): passwords in the "mail" log on the first start
|
|
# (Jambotron: project → Services → mail → Logs) and in /app/data/initial-passwords.txt
|
|
# of the "mail" container (docker exec <mail container> cat /app/data/initial-passwords.txt).
|
|
name: reactive-mail
|
|
|
|
services:
|
|
secrets-init:
|
|
image: alpine:3.20
|
|
restart: "no"
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
umask 077
|
|
for name in DB_PASSWORD JWT_SECRET SERVICE_TOKEN; do
|
|
[ -s /secrets/$$name ] || head -c 48 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' > /secrets/$$name
|
|
done
|
|
# postgres reads it as uid 70, the app as uid 10001 — readable inside these containers only
|
|
chmod 644 /secrets/DB_PASSWORD /secrets/JWT_SECRET /secrets/SERVICE_TOKEN
|
|
volumes:
|
|
- secrets:/secrets
|
|
|
|
db:
|
|
# Debian, not -alpine: on Jambotron staging VMs (Alpine 3.24, kernel 6.18) the Alpine build of postgres
|
|
# dies with "Bus error" even on --version; the Debian build works (2026-11-05)
|
|
image: postgres:17
|
|
restart: unless-stopped
|
|
depends_on:
|
|
secrets-init:
|
|
condition: service_completed_successfully
|
|
environment:
|
|
POSTGRES_DB: mailserver
|
|
POSTGRES_USER: mail
|
|
POSTGRES_PASSWORD_FILE: /run/mail-secrets/DB_PASSWORD
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
- secrets:/run/mail-secrets:ro
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U mail -d mailserver"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 10
|
|
mem_limit: 256m
|
|
|
|
mail:
|
|
image: gitea.jambotron.com/jambotron_gang/reactive-mail-server:${MAIL_IMAGE_TAG:-latest}
|
|
pull_policy: always
|
|
restart: unless-stopped
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
expose:
|
|
- "8080" # web client + API → domain in Jambotron
|
|
- "3025" # SMTP, inside the network only
|
|
- "3143" # IMAP (STARTTLS), inside the network only — open it in Jambotron as an internal TCP port
|
|
environment:
|
|
DB_HOST: db
|
|
MAILSERVER_SECRETS_DIR: /run/mail-secrets
|
|
MAIL_DOMAINS: ${MAIL_DOMAINS:-mail.test}
|
|
MAIL_HOSTNAME: ${MAIL_HOSTNAME:-mail.test}
|
|
DKIM_DOMAIN: ${MAIL_DOMAINS:-mail.test}
|
|
# mail trap: mail to any address without its own mailbox here (also gmail.com etc.) goes into this mailbox
|
|
MAIL_CATCH_ALL: ${MAIL_CATCH_ALL:-trap@mail.test}
|
|
MAIL_REGISTRATION: ${MAIL_REGISTRATION:-true} # test stand: anyone can create a mailbox in MAIL_DOMAINS (nothing goes outside)
|
|
OUTBOUND_MODE: "off"
|
|
SMTP_AUTH_WITHOUT_TLS: "true" # SMTP is not reachable from outside the VM
|
|
SPF_ENABLED: "false"
|
|
DMARC_ENABLED: "false"
|
|
volumes:
|
|
- data:/app/data
|
|
- secrets:/run/mail-secrets:ro
|
|
mem_limit: 512m
|
|
|
|
volumes:
|
|
secrets:
|
|
pgdata:
|
|
data:
|