2016-12-09 20:40:57 +01:00
|
|
|
# mailcow-dockerized
|
2016-12-09 20:39:02 +01:00
|
|
|
|
2016-12-11 18:58:29 +01:00
|
|
|
mailcow dockerized comes with 11 containers linked in a mailcow network:
|
|
|
|
Dovecot, Memcached, Redis, MariaDB, PowerDNS Recursor, PHP-FPM, Postfix, Nginx, Rmilter, Rspamd and SOGo.
|
|
|
|
|
2016-12-11 20:09:08 +01:00
|
|
|
All configurations were written with security in mind.
|
|
|
|
|
2016-12-12 09:26:17 +01:00
|
|
|
### Exposed ports:
|
2016-12-11 20:11:46 +01:00
|
|
|
|
2016-12-12 21:53:58 +01:00
|
|
|
| Service | Hostname, Alias | External bindings | Internal bindings |
|
|
|
|
|:-------------|:-------------------------------|:---------------------------------------------|:-------------------------------|
|
|
|
|
| Postfix | ${MAILCOW_HOSTNAME}, postfix | 25/tcp, 465/tcp, 587/tcp | 588/tcp |
|
|
|
|
| Dovecot | ${MAILCOW_HOSTNAME}, dovecot | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp |
|
|
|
|
| Nginx | nginx | 443/tcp | 80/tcp, 8081/tcp |
|
|
|
|
| PowerDNS | pdns | - | 53/udp |
|
|
|
|
| Rspamd | rspamd | - | 11333/tcp, 11334/tcp |
|
|
|
|
| MariaDB | mysql | - | 3306/tcp |
|
|
|
|
| Rmilter | rmilter | - | 9000/tcp |
|
|
|
|
| PHP FPM | phpfpm | - | 9000/tcp |
|
|
|
|
| SOGo | sogo | - | 9000/tcp |
|
|
|
|
| Redis | redis | - | 6379/tcp |
|
|
|
|
| Memcached | memcached | - | 11211/tcp |
|
|
|
|
|
|
|
|
All containers share a network ${MAILCOW_NETWORK} (name can be changed, but remove all containers and rebuild them after changing).
|
|
|
|
IPs are dynamic and taken from subnet ${DOCKER_SUBNET}.
|
2016-12-11 20:09:01 +01:00
|
|
|
|
2016-12-10 21:49:41 +01:00
|
|
|
## Installation
|
2016-12-09 20:39:02 +01:00
|
|
|
|
2016-12-11 22:03:24 +01:00
|
|
|
1. You need Docker. Most systems can install Docker by running `wget -qO- https://get.docker.com/ | sh`
|
2016-12-11 20:09:01 +01:00
|
|
|
|
2016-12-11 22:03:24 +01:00
|
|
|
2. Clone this repository and configure `mailcow.conf`, do not use special chars in passwords in this file (will be fixed soon).
|
|
|
|
It is almost always enough to just change the hostname.
|
2016-12-09 20:39:02 +01:00
|
|
|
|
2016-12-11 22:03:24 +01:00
|
|
|
3. Run `./build-all.sh` - select `Y` when asked to reset the admin password.
|
2016-12-10 21:49:41 +01:00
|
|
|
|
2016-12-09 20:39:02 +01:00
|
|
|
Done.
|
|
|
|
|
2016-12-11 18:58:29 +01:00
|
|
|
You can now access https://${MAILCOW_HOSTNAME} with the default credentials `admin` + password `moohoo`.
|
|
|
|
|
|
|
|
## Configuration after installation
|
|
|
|
|
|
|
|
### Rspamd UI access
|
|
|
|
If you want to use Rspamds web UI, you need to set a Rspamd controller password:
|
|
|
|
|
|
|
|
```
|
|
|
|
# Generate hash
|
|
|
|
docker exec -it rspamd-mailcow rspamadm pw
|
|
|
|
```
|
|
|
|
|
|
|
|
Replace given hash in data/conf/rspamd/override.d/worker-controller.inc:
|
|
|
|
```
|
|
|
|
enable_password = "myhash";
|
|
|
|
```
|
|
|
|
|
|
|
|
Restart rspamd:
|
|
|
|
```
|
|
|
|
docker restart rspamd-mailcow
|
|
|
|
```
|
|
|
|
|
|
|
|
Open https://${MAILCOW_HOSTNAME}/rspamd in a browser.
|
|
|
|
|
2016-12-12 21:53:58 +01:00
|
|
|
### SSL (and: How to use Let's Encrypt)
|
|
|
|
mailcow dockerized generates a CA named "mailcow" with a self-signed server certificate in `data/assets/ssl` via `000-build-certs.sh`.
|
2016-12-11 18:58:29 +01:00
|
|
|
|
|
|
|
Get the certbot client:
|
|
|
|
```
|
2016-12-11 20:09:08 +01:00
|
|
|
wget https://dl.eff.org/certbot-auto -O /usr/local/sbin/certbot && chmod +x /usr/local/sbin/certbot
|
2016-12-11 18:58:29 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Please disable applications blocking port 80 and run certbot:
|
|
|
|
```
|
2016-12-11 20:09:08 +01:00
|
|
|
certbot-auto certonly \
|
2016-12-11 18:58:29 +01:00
|
|
|
--standalone \
|
|
|
|
--standalone-supported-challenges http-01 \
|
|
|
|
-d ${MAILCOW_HOSTNAME} \
|
|
|
|
--email you@example.org \
|
|
|
|
--agree-tos
|
|
|
|
```
|
|
|
|
|
2016-12-11 20:09:08 +01:00
|
|
|
Create hard links to the full path of the new certificates. Assuming you are still in the mailcow root folder:
|
2016-12-11 18:58:29 +01:00
|
|
|
```
|
2016-12-12 21:53:58 +01:00
|
|
|
mv data/assets/ssl/cert.{pem,pem.backup}
|
|
|
|
mv data/assets/ssl/key.{pem,pem.backup}
|
2016-12-11 20:09:08 +01:00
|
|
|
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/fullchain.pem) data/assets/ssl/mail.crt
|
|
|
|
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/privkey.pem) data/assets/ssl/mail.key
|
2016-12-11 18:58:29 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Restart containers which use the certificate:
|
|
|
|
```
|
|
|
|
docker restart postfix-mailcow
|
|
|
|
docker restart dovecot-mailcow
|
|
|
|
docker restart nginx-mailcow
|
|
|
|
```
|
2016-12-09 20:39:02 +01:00
|
|
|
|
2016-12-11 20:09:08 +01:00
|
|
|
When renewing certificates, run the last two steps (link + restart) as post-hook in certbot.
|
2016-12-11 18:58:29 +01:00
|
|
|
|
|
|
|
## Special usage
|
2016-12-09 20:39:02 +01:00
|
|
|
### build-*.files
|
|
|
|
|
|
|
|
(Re)build a container:
|
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-$name.sh
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
2016-12-09 20:40:57 +01:00
|
|
|
**:exclamation:** Any previous container with the same name will be stopped and removed.
|
2016-12-09 20:39:02 +01:00
|
|
|
No persistent data is deleted at any time.
|
|
|
|
If an image exists, you will be asked wether or not to repull/rebuild it.
|
|
|
|
|
2016-12-12 21:53:58 +01:00
|
|
|
Build files are numbered "nnn" for dependencies.
|
2016-12-10 21:49:41 +01:00
|
|
|
|
2016-12-12 21:53:58 +01:00
|
|
|
### Logs
|
2016-12-10 21:49:41 +01:00
|
|
|
|
2016-12-12 21:53:58 +01:00
|
|
|
You can use docker logs $name for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter responses.
|
2016-12-10 21:49:41 +01:00
|
|
|
|
2016-12-11 14:13:17 +01:00
|
|
|
### MariaDB
|
2016-12-09 20:39:02 +01:00
|
|
|
|
2016-12-11 14:13:17 +01:00
|
|
|
Connect to MariaDB database:
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh --client
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
2016-12-12 10:01:27 +01:00
|
|
|
Init schema (will also be installed when running `./n-build-sql.sh` without parameters):
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh --init-schema
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Reset mailcow admin to `admin:moohoo`:
|
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh --reset-admin
|
2016-12-11 14:13:17 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Dump database to file backup_${DBNAME}_${DATE}.sql:
|
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh --dump
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
2016-12-11 18:58:29 +01:00
|
|
|
Restore database from a file:
|
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh --restore filename
|
2016-12-12 09:39:21 +01:00
|
|
|
```
|
2016-12-11 18:58:29 +01:00
|
|
|
|
2016-12-09 20:39:02 +01:00
|
|
|
### Redis
|
|
|
|
|
|
|
|
Connect to redis database:
|
|
|
|
```
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-redis.sh --client
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
2016-12-11 18:58:29 +01:00
|
|
|
### Rspamd examples
|
2016-12-09 20:39:02 +01:00
|
|
|
|
|
|
|
Use rspamadm:
|
|
|
|
```
|
2016-12-10 21:49:41 +01:00
|
|
|
docker exec -it rspamd-mailcow rspamadm --help
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Use rspamc:
|
|
|
|
```
|
2016-12-10 21:49:41 +01:00
|
|
|
docker exec -it rspamd-mailcow rspamc --help
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
### Remove persistent data
|
|
|
|
|
2016-12-11 14:13:17 +01:00
|
|
|
MariaDB:
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
2016-12-11 14:13:17 +01:00
|
|
|
docker stop mariadb-mailcow
|
|
|
|
docker rm mariadb-mailcow
|
2016-12-09 20:39:02 +01:00
|
|
|
rm -rf data/db/mysql/*
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-sql.sh
|
2016-12-09 20:39:02 +01:00
|
|
|
```
|
|
|
|
|
|
|
|
Redis:
|
|
|
|
```
|
|
|
|
# If you feel hardcore:
|
|
|
|
docker stop redis-mailcow
|
|
|
|
docker rm redus-mailcow
|
|
|
|
rm -rf data/db/redis/*
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-redis.sh
|
2016-12-09 20:39:02 +01:00
|
|
|
|
|
|
|
## It is almost always enough to just flush all keys:
|
2016-12-12 10:01:27 +01:00
|
|
|
./n-build-redis client
|
2016-12-09 20:39:02 +01:00
|
|
|
# FLUSHALL [ENTER]
|
|
|
|
```
|