mailcow-dockerized/README.md

186 lines
6.9 KiB
Markdown
Raw Normal View History

2016-12-10 03:40:57 +08:00
# mailcow-dockerized
2016-12-10 03:39:02 +08:00
mailcow dockerized comes with 11 containers linked in a mailcow network:
Dovecot, Memcached, Redis, MariaDB, PowerDNS Recursor, PHP-FPM, Postfix, Nginx, Rmilter, Rspamd and SOGo.
2016-12-12 03:09:08 +08:00
All configurations were written with security in mind.
2016-12-12 16:26:17 +08:00
### Exposed ports:
2016-12-12 03:11:46 +08:00
2016-12-13 04:56:32 +08:00
| Name | Service | Hostname, Alias | External bindings | Internal bindings |
|:------------------|:-------------|:-------------------------------|:---------------------------------------------|:-------------------------------|
| postfix-mailcow | Postfix | ${MAILCOW_HOSTNAME}, postfix | 25/tcp, 465/tcp, 587/tcp | 588/tcp |
| dovecot-mailcow | Dovecot | ${MAILCOW_HOSTNAME}, dovecot | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp |
| nginx-mailcow | Nginx | nginx | 443/tcp | 80/tcp, 8081/tcp |
| pdns-mailcow | PowerDNS | pdns | - | 53/udp |
| rspamd-mailcow | Rspamd | rspamd | - | 11333/tcp, 11334/tcp |
| mariadb-mailcow | MariaDB | mysql | - | 3306/tcp |
| rmilter-mailcow | Rmilter | rmilter | - | 9000/tcp |
| phpfpm-mailcow | PHP FPM | phpfpm | - | 9000/tcp |
| sogo-mailcow | SOGo | sogo | - | 9000/tcp |
| redis-mailcow | Redis | redis | - | 6379/tcp |
| memcached-mailcow | Memcached | memcached | - | 11211/tcp |
2016-12-13 04:53:58 +08:00
2016-12-14 22:56:30 +08:00
All containers share a network "mailcow-network" with the subnet 172.22.1.0/24 - if you want to change it, set it in the composer file.
IPs are dynamic except for PowerDNS resolver which has a static ip address 172.22.1.2.
2016-12-12 03:09:01 +08:00
2016-12-14 22:56:30 +08:00
### **FAQ**
2016-12-13 21:02:12 +08:00
- rspamd learns mail as spam or ham when you move a message in or out of the junk folder to any mailbox besides trash.
- rspamd auto-learns mail when a high or low score is detected (see https://rspamd.com/doc/configuration/statistic.html#autolearning)
2016-12-14 23:49:36 +08:00
- You can upgrade SOGo by running `docker-compose up -d sogo-mailcow nginx-mailcow`.
2016-12-13 21:02:12 +08:00
- Only Postfix and Rspamd use the PowerDNS resolver for DNSSEC.
- Linking to existing redis and memcached containers will be possible soon
## Installation
2016-12-10 03:39:02 +08:00
2016-12-14 22:56:30 +08:00
1. You need Docker and Docker Compose. Most systems can install Docker by running `wget -qO- https://get.docker.com/ | sh` - see [this link](https://docs.docker.com/compose/install/) for installing Docker Compose.
2016-12-12 03:09:01 +08:00
2016-12-12 05:03:24 +08:00
2. Clone this repository and configure `mailcow.conf`, do not use special chars in passwords in this file (will be fixed soon).
2016-12-10 03:39:02 +08:00
2016-12-14 22:56:30 +08:00
3. `docker-compose up -d` - leave the `-d` out for a wall of logs in case of debugging.
2016-12-10 03:39:02 +08:00
Done.
2016-12-14 22:56:30 +08:00
You can now access https://${MAILCOW_HOSTNAME} with the default credentials `admin` + password `moohoo`. The database will be initialized when you first visit the UI.
## Configuration after installation
### Rspamd UI access
If you want to use Rspamds web UI, you need to set a Rspamd controller password:
```
# Generate hash
2016-12-14 23:40:10 +08:00
docker-compose exec rspamd-mailcow rspamadm pw
```
Replace given hash in data/conf/rspamd/override.d/worker-controller.inc:
```
enable_password = "myhash";
```
Restart rspamd:
```
2016-12-14 23:42:07 +08:00
docker-compose restart rspamd-mailcow
```
Open https://${MAILCOW_HOSTNAME}/rspamd in a browser.
2016-12-13 04:53:58 +08:00
### SSL (and: How to use Let's Encrypt)
2016-12-14 23:25:20 +08:00
mailcow dockerized comes with a snakeoil CA "mailcow" and a server certificate in `data/assets/ssl`. Please use your own trusted certificates.
2016-12-15 17:02:54 +08:00
**Use Let's Encrypt**
Get the certbot client:
```
2016-12-12 03:09:08 +08:00
wget https://dl.eff.org/certbot-auto -O /usr/local/sbin/certbot && chmod +x /usr/local/sbin/certbot
```
Please disable applications blocking port 80 and run certbot:
```
2016-12-12 03:09:08 +08:00
certbot-auto certonly \
--standalone \
--standalone-supported-challenges http-01 \
-d ${MAILCOW_HOSTNAME} \
--email you@example.org \
--agree-tos
```
2016-12-12 03:09:08 +08:00
Create hard links to the full path of the new certificates. Assuming you are still in the mailcow root folder:
```
2016-12-13 04:53:58 +08:00
mv data/assets/ssl/cert.{pem,pem.backup}
mv data/assets/ssl/key.{pem,pem.backup}
2016-12-15 17:02:54 +08:00
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/fullchain.pem) data/assets/ssl/cert.pem
ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/privkey.pem) data/assets/ssl/key.pem
```
Restart containers which use the certificate:
```
2016-12-14 23:42:07 +08:00
docker-compose restart postfix-mailcow
docker-compose restart dovecot-mailcow
docker-compose restart nginx-mailcow
```
2016-12-10 03:39:02 +08:00
2016-12-12 03:09:08 +08:00
When renewing certificates, run the last two steps (link + restart) as post-hook in certbot.
2016-12-14 22:56:30 +08:00
## More useful commands and examples (todo: move to wiki soon)
2016-12-13 04:53:58 +08:00
### Logs
2016-12-14 23:42:07 +08:00
You can use `docker-compose logs $service-name` for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter responses.
2016-12-11 21:13:17 +08:00
### MariaDB
2016-12-10 03:39:02 +08:00
2016-12-11 21:13:17 +08:00
Connect to MariaDB database:
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
source mailcow.conf
2016-12-14 23:40:10 +08:00
docker-compose exec mariadb-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
Init schema (will be auto-installed by mailcow UI, but just in case...):
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
source mailcow.conf
2016-12-14 23:40:10 +08:00
docker-compose exec mariadb-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < data/web/inc/init.sql
2016-12-10 03:39:02 +08:00
```
Reset mailcow admin to `admin:moohoo`:
```
2016-12-14 22:56:30 +08:00
source mailcow.conf
2016-12-14 23:40:10 +08:00
docker-compose exec mariadb-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e "DROP TABLE admin; DROP TABLE domain_admins"
2016-12-14 22:56:30 +08:00
# Open mailcow UI to auto-init the db
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
Backup and restore database:
```
2016-12-14 22:56:30 +08:00
source mailcow.conf
# Create
DATE=$(date +"%Y%m%d_%H%M%S")
2016-12-14 23:40:10 +08:00
docker-compose exec mariadb-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql
2016-12-14 22:56:30 +08:00
# Restore
docker exec -i mariadb-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < ${1}
2016-12-12 16:39:21 +08:00
```
2016-12-10 03:39:02 +08:00
### Redis
2016-12-14 22:56:30 +08:00
Connect to redis key store:
2016-12-10 03:39:02 +08:00
```
2016-12-14 23:40:10 +08:00
docker-compose exec redis-mailcow redis-cli
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
### Use rspamadm:
2016-12-10 03:39:02 +08:00
```
2016-12-14 23:40:10 +08:00
docker-compose exec rspamd-mailcow rspamadm --help
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
### Use rspamc:
2016-12-10 03:39:02 +08:00
```
2016-12-14 23:40:10 +08:00
docker-compose exec rspamd-mailcow rspamc --help
2016-12-10 03:39:02 +08:00
```
2016-12-14 22:56:30 +08:00
### Use doveadm:
```
2016-12-14 23:40:10 +08:00
docker-compose exec dovecot-mailcow doveadm
```
2016-12-10 03:39:02 +08:00
### Remove persistent data
2016-12-11 21:13:17 +08:00
MariaDB:
2016-12-10 03:39:02 +08:00
```
2016-12-11 21:13:17 +08:00
docker stop mariadb-mailcow
docker rm mariadb-mailcow
2016-12-10 03:39:02 +08:00
rm -rf data/db/mysql/*
2016-12-12 17:01:27 +08:00
./n-build-sql.sh
2016-12-10 03:39:02 +08:00
```
Redis:
```
# If you feel hardcore:
docker stop redis-mailcow
docker rm redus-mailcow
rm -rf data/db/redis/*
2016-12-12 17:01:27 +08:00
./n-build-redis.sh
2016-12-10 03:39:02 +08:00
## It is almost always enough to just flush all keys:
2016-12-12 17:01:27 +08:00
./n-build-redis client
2016-12-10 03:39:02 +08:00
# FLUSHALL [ENTER]
```