From 1b32cb3c24efad361642b0798bf652037f5661d1 Mon Sep 17 00:00:00 2001
From: thopic <thopic@gnous.fr>
Date: Tue, 4 Oct 2022 09:14:20 +0200
Subject: [PATCH] Make use of docker-compose.override.yml to track changes +
 completely disable ipv6

https://cloud.gnous.fr/apps/deck/#/board/4/card/25
https://docs.mailcow.email/post_installation/firststeps-disable_ipv6/
---
 .gitignore                                    |  1 -
 data/conf/dovecot/dovecot.conf                |  2 +-
 data/conf/nginx/dynmaps.conf                  |  1 -
 .../nginx/templates/listen_plain.template     |  1 -
 data/conf/nginx/templates/listen_ssl.template |  1 -
 data/conf/phpfpm/php-fpm.d/pools.conf         |  4 +-
 docker-compose.override.yml                   | 58 +++++++++++++++++++
 docker-compose.yml                            | 39 ++-----------
 8 files changed, 65 insertions(+), 42 deletions(-)
 create mode 100644 docker-compose.override.yml

diff --git a/.gitignore b/.gitignore
index 5782cad9..b47ed51f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,7 +59,6 @@ data/web/inc/vars.local.inc.php
 data/web/inc/app_info.inc.php
 data/web/nextcloud*/
 data/web/rc*/
-docker-compose.override.yml
 mailcow.conf
 mailcow.conf_backup
 rebuild-images.sh
diff --git a/data/conf/dovecot/dovecot.conf b/data/conf/dovecot/dovecot.conf
index b7aca757..8d35d589 100644
--- a/data/conf/dovecot/dovecot.conf
+++ b/data/conf/dovecot/dovecot.conf
@@ -159,7 +159,7 @@ service lmtp {
   }
   user = vmail
 }
-listen = *,[::]
+listen = *
 ssl_cert = </etc/ssl/mail/cert.pem
 ssl_key = </etc/ssl/mail/key.pem
 userdb {
diff --git a/data/conf/nginx/dynmaps.conf b/data/conf/nginx/dynmaps.conf
index 99c0c6aa..91ecba07 100644
--- a/data/conf/nginx/dynmaps.conf
+++ b/data/conf/nginx/dynmaps.conf
@@ -1,6 +1,5 @@
 server {
   listen 8081;
-  listen [::]:8081;
   index index.php index.html;
   server_name _;
   error_log  /var/log/nginx/error.log;
diff --git a/data/conf/nginx/templates/listen_plain.template b/data/conf/nginx/templates/listen_plain.template
index a044b22f..68133480 100644
--- a/data/conf/nginx/templates/listen_plain.template
+++ b/data/conf/nginx/templates/listen_plain.template
@@ -1,2 +1 @@
 listen ${HTTP_PORT};
-listen [::]:${HTTP_PORT};
diff --git a/data/conf/nginx/templates/listen_ssl.template b/data/conf/nginx/templates/listen_ssl.template
index 93ec80c6..8be4901a 100644
--- a/data/conf/nginx/templates/listen_ssl.template
+++ b/data/conf/nginx/templates/listen_ssl.template
@@ -1,2 +1 @@
 listen ${HTTPS_PORT} ssl http2;
-listen [::]:${HTTPS_PORT} ssl http2;
diff --git a/data/conf/phpfpm/php-fpm.d/pools.conf b/data/conf/phpfpm/php-fpm.d/pools.conf
index 605e686c..d6df1243 100644
--- a/data/conf/phpfpm/php-fpm.d/pools.conf
+++ b/data/conf/phpfpm/php-fpm.d/pools.conf
@@ -6,7 +6,7 @@ pm.max_children = 15
 pm.start_servers = 2
 pm.min_spare_servers = 2
 pm.max_spare_servers = 4
-listen = [::]:9001
+listen = 9001
 access.log = /proc/self/fd/2
 clear_env = no
 catch_workers_output = yes
@@ -21,7 +21,7 @@ pm.max_children = 50
 pm.start_servers = 10
 pm.min_spare_servers = 10
 pm.max_spare_servers = 15
-listen = [::]:9002
+listen = 9002
 access.log = /proc/self/fd/2
 clear_env = no
 catch_workers_output = yes
diff --git a/docker-compose.override.yml b/docker-compose.override.yml
new file mode 100644
index 00000000..5f730caf
--- /dev/null
+++ b/docker-compose.override.yml
@@ -0,0 +1,58 @@
+version: '2.1'
+services:
+
+    nginx-mailcow:
+      expose:
+        - "${HTTP_PORT:-80}"
+      networks:
+        proxy:
+        mailcow-network:
+          aliases:
+            - nginx
+      labels:
+        - traefik.enable=true
+        - traefik.docker.network=proxy
+        - traefik.http.middlewares.mail-redirect-websecure.redirectscheme.scheme=https
+        - traefik.http.routers.mail-http.middlewares=mail-redirect-websecure
+        - traefik.http.routers.mail-http.rule=Host(`${MAILCOW_HOSTNAME}`)
+        - traefik.http.routers.mail-http.entrypoints=web
+        - traefik.http.routers.mail-https.rule=Host(`${MAILCOW_HOSTNAME}`)
+        - traefik.http.routers.mail-https.entrypoints=websecure
+        - traefik.http.routers.mail-https.tls=true
+        - traefik.http.routers.mail-https.tls.certresolver=myhttpchallenge
+        - traefik.http.services.mail.loadbalancer.server.port=80
+        - "co.elastic.logs/module=nginx"
+        - "co.elastic.logs/fileset=access"
+
+    certdumper:
+        image: humenius/traefik-certs-dumper
+        restart: always
+        # container_name: traefik_certdumper
+        network_mode: none
+        volumes:
+          # mount the folder which contains Traefik's `acme.json' file
+          #   in this case Traefik is started from its own docker-compose in ../traefik
+          - ${DATA_PATH}/traefik:/traefik:ro
+          # mount mailcow's SSL folder
+          - ./data/assets/ssl/:/output:rw
+        environment:
+          # only change this, if you're using another domain for mailcow's web frontend compared to the standard config
+          - DOMAIN=${MAILCOW_HOSTNAME}
+
+    ipv6nat-mailcow:
+      image: bash:latest
+      restart: "no"
+      entrypoint: ["echo", "ipv6nat disabled in compose.override.yml"]
+
+networks:
+  mailcow-network:
+    driver_opts:
+      com.docker.network.bridge.name: br-mailcow
+    enable_ipv6: false
+    ipam:
+      driver: default
+      config:
+        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
+        - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+  proxy:
+      external: true
diff --git a/docker-compose.yml b/docker-compose.yml
index 4d4ed37e..b35f6070 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -375,44 +375,15 @@ services:
         - ./data/assets/ssl/:/etc/ssl/mail/:ro,z
         - ./data/conf/nginx/:/etc/nginx/conf.d/:z
         - ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
-        - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/:z
-      expose:
-        - "${HTTP_PORT:-80}"
+        - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/
+      # ports:
+        # - "${HTTPS_BIND:-0.0.0.0}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
+        # - "${HTTP_BIND:-0.0.0.0}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
       restart: always
       networks:
-        proxy:
         mailcow-network:
           aliases:
             - nginx
-      labels:
-        - traefik.enable=true
-        - traefik.docker.network=proxy
-        - traefik.http.middlewares.mail-redirect-websecure.redirectscheme.scheme=https
-        - traefik.http.routers.mail-http.middlewares=mail-redirect-websecure
-        - traefik.http.routers.mail-http.rule=Host(`${MAILCOW_HOSTNAME}`)
-        - traefik.http.routers.mail-http.entrypoints=web
-        - traefik.http.routers.mail-https.rule=Host(`${MAILCOW_HOSTNAME}`)
-        - traefik.http.routers.mail-https.entrypoints=websecure
-        - traefik.http.routers.mail-https.tls=true
-        - traefik.http.routers.mail-https.tls.certresolver=myhttpchallenge
-        - traefik.http.services.mail.loadbalancer.server.port=80
-        - "co.elastic.logs/module=nginx"
-        - "co.elastic.logs/fileset=access"
-
-    certdumper:
-        image: humenius/traefik-certs-dumper
-        restart: always
-        # container_name: traefik_certdumper
-        network_mode: none
-        volumes:
-          # mount the folder which contains Traefik's `acme.json' file
-          #   in this case Traefik is started from its own docker-compose in ../traefik
-          - ${DATA_PATH}/traefik:/traefik:ro
-          # mount mailcow's SSL folder
-          - ./data/assets/ssl/:/output:rw
-        environment:
-          # only change this, if you're using another domain for mailcow's web frontend compared to the standard config
-          - DOMAIN=${MAILCOW_HOSTNAME}
 
     acme-mailcow:
       depends_on:
@@ -650,8 +621,6 @@ networks:
       config:
         - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
         - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-  proxy:
-      external: true
 
 volumes:
   vmail-vol-1: