Removed server_ for better overview

2025-08-29 15:06:26 +02:00 · 2023-08-22 22:53:44 +02:00
parent 571bed27a3
commit 4254642313
246 changed files with 45 additions and 45 deletions
--- a/roles/docker-mailu/README.md
+++ b/roles/docker-mailu/README.md
@@ -0,0 +1,145 @@
+# Mailu Server Docker Role
+
+This guide provides instructions for setting up, operating, and maintaining the Mailu server docker role. 
+
+## Table of Contents
+
+- [Setup](#setup)
+  - [Fetchmail Issues](#fetchmail-issues)
+  - [Data Deletion](#data-deletion)
+  - [Port Management](#port-management)
+  - [Admin Account Creation](#admin-account-creation)
+  - [CLI User Management](#cli-user-management)
+  - [Starting the Server](#starting-the-server)
+- [Debugging](#debugging)
+- [Testing](#testing)
+- [Updates](#updates)
+- [To-Do](#to-do)
+- [References](#references)
+
+## Setup
+
+### Fetchmail Issues
+
+Fetchmail might not work properly with large amounts of data. For more information, refer to this [issue](https://github.com/Mailu/Mailu/issues/1719). 
+
+#### Deactivating Fetchmail
+
+Before uninstalling Fetchmail, ensure to remove all fetched accounts from the administration panel.
+
+#### Fetchmail Security Concerns
+
+There are known security concerns with Fetchmail as stated in the [German Wikipedia](https://de.wikipedia.org/wiki/Fetchmail). If you require Fetchmail functions in the future, consider creating a Docker container for [Getmail](https://en.wikipedia.org/wiki/Getmail) as it is considered more secure.
+
+#### Fetchmail Workaround
+
+If you need to receive emails from another account, follow these steps:
+
+1. Redirect your emails to your new email account.
+2. Export all data from your original account.
+3. Import all data to your new account.
+
+### Data Deletion
+
+To delete all volumes and data, execute the following command with caution:
+
+```bash
+rm -vr /etc/mailu/; docker volume rm $(docker volume ls -q | grep mailu_)
+```
+
+### Port Management
+
+Check for any port conflicts and manually change the conflicting ports if necessary. Use the following command to verify:
+
+```bash
+netstat -tulpn
+```
+
+### Admin Account Creation
+
+To use Mailu, create the primary administrator user account, `admin@{{hostname}}`, using the command below. Replace `PASSWORD` with your preferred password:
+
+```bash
+docker-compose -p mailu exec admin flask mailu admin {{admin}} {{hostname}} PASSWORD
+```
+
+### CLI User Management
+
+For managing users, follow the instructions in the official [Mailu CLI documentation](https://mailu.io/master/cli.html).
+
+### Starting the Server
+
+To start the server, use the following command:
+
+```bash
+docker-compose -p mailu up -d
+```
+
+## Debugging
+
+### Database Access
+
+To access the database, use the following command:
+
+```bash
+docker-compose exec -it database mysql -u root -D mailu -p
+```
+
+### Container Access
+
+To access the front container, use this command:
+
+```bash
+docker-compose exec -it front /bin/bash
+```
+
+### Restarting Services
+
+To restart all services, use the following command:
+
+```bash
+docker-compose restart 
+```
+
+### Resending Queued Mails
+
+To resend queued mails, use this command:
+
+```bash
+docker-compose exec -it smtp postqueue -f
+```
+
+## Testing
+
+Use the following tools for testing:
+
+
+
+- SSL-Tools Mailserver Test (URL: https://de.ssl-tools.net/mailservers/)
+- TestEmail.de (URL: http://testemail.de/)
+
+## Updates
+
+For instructions on updating your Mailu setup, follow the official [Mailu maintenance guide](https://mailu.io/master/maintain.html).
+
+## To-Do
+
+- Implement two-factor authentication in Roundcube Webmail. More information can be found [here](https://blog.kuepper.nrw/2019/03/30/roundcube-webmail-mit-zwei-faktor-authentifizierung/).
+- Integrate Nextcloud 15 and newer with Mailu. Learn more about this [here](https://mailu.io/master/faq.html#i-want-to-integrate-nextcloud-15-and-newer-with-mailu).
+- User authentication with Nextcloud. Find more information [here](https://docs.nextcloud.com/server/9.0/admin_manual/configuration_user/user_auth_ftp_smb_imap.html).
+
+## References
+
+- [Mailu compose setup guide](https://mailu.io/1.7/compose/setup.html)
+- [SysPass issue #1299](https://github.com/nuxsmin/sysPass/issues/1299)
+- [Mailu issue #1719](https://github.com/Mailu/Mailu/issues/1719)
+- [Mailu issue #1171](https://github.com/Mailu/Mailu/issues/1171)
+- [Mailu issue #2135](https://github.com/Mailu/Mailu/issues/2135)
+- [Mailu issue #2827](https://github.com/Mailu/Mailu/issues/2827)
+- [Mailu GitHub repository](https://github.com/Mailu/Mailu)
+- [Plesk support article on RoundCube connection issue](https://support.plesk.com/hc/en-us/articles/115001264814-Unable-to-log-into-RoundCube-Connection-to-storage-server-failed)
+- [Gist by marienfressinaud](https://gist.github.com/marienfressinaud/f284a59b18aad395eb0de2d22836ae6b)
+
+For more information about this role, visit the [GitHub repository](https://github.com/kevinveenbirkenbach/computer-playbook/tree/master/roles/server_docker-mailu).
+
+This README.md was optimized with [Chat-GPT](https://chat.openai.com/share/d1ad5ce7-3aa1-4a14-a959-63393b39374a)
--- a/roles/docker-mailu/handlers/main.yml
+++ b/roles/docker-mailu/handlers/main.yml
@@ -0,0 +1,20 @@
+---
+- name: recreate mailu
+  command:
+    cmd: docker-compose -p mailu up -d --force-recreate
+    chdir: "{{path_docker_compose_files}}mailu/"
+  environment:
+    COMPOSE_HTTP_TIMEOUT: 900
+    DOCKER_CLIENT_TIMEOUT: 900
+- name: "restart deploy-letsencrypt-mailu.service"
+  systemd:
+    name: deploy-letsencrypt-mailu.service
+    state: restarted
+    enabled: yes
+    daemon_reload: yes
+- name: "restart deploy-letsencrypt-mailu.timer"
+  systemd:
+    name: deploy-letsencrypt-mailu.timer
+    state: restarted
+    enabled: yes
+    daemon_reload: yes
--- a/roles/docker-mailu/meta/main.yml
+++ b/roles/docker-mailu/meta/main.yml
@@ -0,0 +1,3 @@
+dependencies:
+- server_native-docker-reverse-proxy
+- systemd_notifier
--- a/roles/docker-mailu/tasks/main.yml
+++ b/roles/docker-mailu/tasks/main.yml
@@ -0,0 +1,63 @@
+---
+
+- name: recieve {{domain}} certificate
+  command: certbot certonly --agree-tos --email {{administrator_email}} --non-interactive --webroot -w /var/lib/letsencrypt/ -d {{domain}}
+
+- name: configure {{domain}}.conf
+  vars:
+    client_max_body_size: "31M"
+  template: src=roles/server_native-docker-reverse-proxy/templates/domain.conf.j2 dest=/etc/nginx/conf.d/{{domain}}.conf
+  notify: restart nginx
+
+- name: "create {{path_docker_compose_files}}mailu"
+  file:
+    path: "{{path_docker_compose_files}}mailu"
+    state: directory
+    mode: 0755
+
+- name: "create {{path_administrator_scripts}}mailu"
+  file:
+    path: "{{path_administrator_scripts}}mailu"
+    state: directory
+    mode: 0755
+
+- name: "create /etc/mailu/"
+  file:
+    path: "/etc/mailu"
+    state: directory
+    mode: 0755
+
+- name: "create /etc/mailu/certs"
+  file:
+    path: "/etc/mailu/certs"
+    state: directory
+    mode: 0755
+
+- name: add docker-compose.yml
+  template: 
+    src:  "docker-compose.yml.j2" 
+    dest: "{{path_docker_compose_files}}mailu/docker-compose.yml"
+  notify: recreate mailu
+
+- name: add mailu.env
+  template: 
+    src:  "mailu.env.j2" 
+    dest: "{{path_docker_compose_files}}mailu/mailu.env"
+  notify: recreate mailu
+
+- name: add deploy-letsencrypt-mailu.sh
+  template: 
+    src: "deploy-letsencrypt-mailu.sh.j2" 
+    dest: "{{path_administrator_scripts}}mailu/deploy-letsencrypt-mailu.sh"
+
+- name: configure deploy-letsencrypt-mailu.service
+  template: 
+    src:  "deploy-letsencrypt-mailu.service.j2"
+    dest: "/etc/systemd/system/deploy-letsencrypt-mailu.service"
+  notify: restart deploy-letsencrypt-mailu.service
+
+- name: configure deploy-letsencrypt-mailu.timer
+  template: 
+    src:  "deploy-letsencrypt-mailu.timer.j2" 
+    dest: "/etc/systemd/system/deploy-letsencrypt-mailu.timer"
+  notify: restart deploy-letsencrypt-mailu.timer
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.service.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.service.j2
@@ -0,0 +1,7 @@
+[Unit]
+Description=Let's Encrypt Mailu Deploy
+OnFailure=systemd-notifier@%n.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/bash {{path_administrator_scripts}}mailu/deploy-letsencrypt-mailu.sh
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.sh.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.sh.j2
@@ -0,0 +1,4 @@
+#!/bin/sh
+cp /etc/letsencrypt/live/{{domain}}/privkey.pem /etc/mailu/certs/key.pem || exit 1
+cp /etc/letsencrypt/live/{{domain}}/fullchain.pem /etc/mailu/certs/cert.pem || exit 1
+docker exec {{mailu_front_container_name}} nginx -s reload
--- a/roles/docker-mailu/templates/deploy-letsencrypt-mailu.timer.j2
+++ b/roles/docker-mailu/templates/deploy-letsencrypt-mailu.timer.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Deployment of Let's Encrypt's certificates
+
+[Timer]
+OnCalendar={{on_calendar_deploy_mailu_certificates}}
+RandomizedDelaySec={{randomized_delay_sec}}
+Persistent=true
+
+[Install]
+WantedBy=timers.target
--- a/roles/docker-mailu/templates/docker-compose.yml.j2
+++ b/roles/docker-mailu/templates/docker-compose.yml.j2
@@ -0,0 +1,255 @@
+version: '2.2'
+
+services:
+
+  # External dependencies
+  redis:
+    image: redis:alpine
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "redis_data:/data"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 1s
+      timeout: 3s
+      retries: 30
+    logging:
+      driver: journald
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.203.254
+  
+  database:
+    image: mariadb
+    restart: always
+    environment:
+      MYSQL_DATABASE: "mailu"
+      MYSQL_USER: "mailu"
+      MYSQL_PASSWORD: "{{mailu_database_password}}"
+      MYSQL_ROOT_PASSWORD: "{{mailu_database_password}}"
+      MARIADB_AUTO_UPGRADE: "1"
+    volumes:
+      - database:/var/lib/mysql
+    healthcheck:
+      test: "/usr/bin/mariadb --user=mailu --password={{mailu_database_password}} --execute \"SHOW DATABASES;\""
+      interval: 3s
+      timeout: 1s
+      retries: 5
+    logging:
+      driver: journald
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.203.254
+    networks:
+      - default
+      - webmail
+      - radicale
+
+  # Core services
+  resolver:
+    image: ghcr.io/mailu/unbound:{{mailu_version}}
+    env_file: mailu.env
+    restart: always
+    networks:
+      default:
+        ipv4_address: 192.168.203.254
+    logging:
+      driver: journald
+
+  front:
+    image: ghcr.io/mailu/nginx:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    logging:
+      driver: journald
+    ports:
+      - "127.0.0.1:{{ http_port }}:80"
+      - "{{ ip4_address }}:25:25"
+      - "{{ ip4_address }}:465:465"
+      - "{{ ip4_address }}:{{system_email_port}}:{{system_email_port}}"
+      - "{{ ip4_address }}:110:110"
+      - "{{ ip4_address }}:995:995"
+      - "{{ ip4_address }}:143:143"
+      - "{{ ip4_address }}:993:993"
+    volumes:
+      - "/etc/mailu/overrides/nginx:/overrides:ro"
+      - "/etc/mailu/certs:/certs"
+    depends_on:
+      resolver:
+        condition: service_started
+      database:
+        condition: service_healthy
+    networks:
+      - default
+      - webmail
+      - radicale
+    dns:
+      - 192.168.203.254
+      
+  admin:
+    image: ghcr.io/mailu/admin:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "admin_data:/data"
+      - "dkim:/dkim"
+    depends_on:
+      - resolver
+      - front
+      - redis
+      - database
+    logging:
+      driver: journald
+    dns:
+      - 192.168.203.254
+  imap:
+    image: ghcr.io/mailu/dovecot:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "dovecot_mail:/mail"
+      - "/etc/mailu/overrides:/overrides:ro"
+    depends_on:
+      - front
+      - resolver
+    dns:
+      - 192.168.203.254
+    logging:
+      driver: journald
+
+  smtp:
+    image: ghcr.io/mailu/postfix:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "/etc/mailu/overrides:/overrides:ro"
+      - "smtp_queue:/queue"
+    depends_on:
+      - front
+      - resolver
+    dns:
+      - 192.168.203.254
+    logging:
+      driver: journald
+
+  oletools:
+    image: ghcr.io/mailu/oletools:{{mailu_version}}
+    hostname: oletools
+    restart: always
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.203.254
+    networks:
+      - noinet
+
+  antispam:
+    image: ghcr.io/mailu/rspamd:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "filter:/var/lib/rspamd"
+      - "dkim:/dkim"
+      - "/etc/mailu/overrides/rspamd:/overrides:ro"
+    depends_on:
+      - front
+      - redis 
+      - antivirus
+      - resolver
+    dns:
+      - 192.168.203.254
+    networks:
+      - default
+      - noinet
+    logging:
+      driver: journald
+
+  # Optional services
+  antivirus:
+    image: ghcr.io/mailu/clamav:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "filter:/data"
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.203.254
+    logging:
+      driver: journald
+
+  webdav:
+    image: ghcr.io/mailu/radicale:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "webdav_data:/data"
+    logging:
+      driver: journald
+    networks:
+      - radicale
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.203.254
+
+  fetchmail:
+    image: ghcr.io/mailu/fetchmail:{{mailu_version}}
+    volumes:
+      - "admin_data:/data"
+    restart: always
+    env_file: mailu.env
+    logging:
+      driver: journald
+    depends_on:
+      - admin
+      - smtp
+      - imap
+      - resolver
+    dns:
+      - 192.168.203.254
+
+  webmail:
+    image: ghcr.io/mailu/webmail:{{mailu_version}}
+    restart: always
+    env_file: mailu.env
+    volumes:
+      - "webmail_data:/data"
+    depends_on:
+      - imap
+      - front
+      - resolver
+    logging:
+      driver: journald
+    networks:
+      - webmail
+    dns:
+      - 192.168.203.254
+
+volumes:
+  database:
+  smtp_queue:
+  admin_data:
+  webdav_data:
+  webmail_data:
+  filter:
+  dkim:
+  dovecot_mail:
+  redis_data:
+networks:
+  default:
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: {{mailu_subnet}}
+  radicale:
+    driver: bridge
+  webmail:
+    driver: bridge
+  noinet:
+    driver: bridge
+    internal: true
--- a/roles/docker-mailu/templates/mailu.env.j2
+++ b/roles/docker-mailu/templates/mailu.env.j2
@@ -0,0 +1,154 @@
+# Mailu main configuration file
+#
+# This file is autogenerated by the configuration management wizard for compose flavor.
+# For a detailed list of configuration variables, see the documentation at
+# https://mailu.io
+
+###################################
+# Common configuration variables
+###################################
+
+# Set to a randomly generated 16 bytes string
+SECRET_KEY={{mailu_secret_key}}
+
+# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
+SUBNET={{mailu_subnet}}
+
+# Main mail domain
+DOMAIN={{mailu_domain}}
+
+# Hostnames for this server, separated with comas
+HOSTNAMES={{domain}}
+
+# Postmaster local part (will append the main mail domain)
+POSTMASTER=admin
+
+# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
+TLS_FLAVOR=mail
+
+# Authentication rate limit (per source IP address)
+AUTH_RATELIMIT=10/minute;1000/hour
+
+# Opt-out of statistics, replace with "True" to opt out
+DISABLE_STATISTICS=True
+
+###################################
+# Optional features
+###################################
+
+# Expose the admin interface (value: true, false)
+ADMIN=true
+
+# Choose which webmail to run if any (values: roundcube, rainloop, none)
+WEBMAIL=roundcube
+
+# Dav server implementation (value: radicale, none)
+WEBDAV=radicale
+
+# Antivirus solution (value: clamav, none)
+ANTIVIRUS=clamav
+
+###################################
+# Mail settings
+###################################
+
+# Message size limit in bytes
+# Default: accept messages up to 50MB
+# Max attachment size will be 33% smaller
+MESSAGE_SIZE_LIMIT=50000000
+
+# Networks granted relay permissions
+# Use this with care, all hosts in this networks will be able to send mail without authentication!
+RELAYNETS=
+
+# Will relay all outgoing mails if configured
+RELAYHOST=
+
+# Fetchmail delay
+FETCHMAIL_DELAY=600
+
+# Recipient delimiter, character used to delimiter localpart from custom address part
+RECIPIENT_DELIMITER=+
+
+# DMARC rua and ruf email
+DMARC_RUA=admin
+DMARC_RUF=admin
+
+# Welcome email, enable and set a topic and body if you wish to send welcome
+# emails to all users.
+WELCOME=false
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
+
+# Maildir Compression
+# choose compression-method, default: none (value: bz2, gz)
+COMPRESSION=
+# change compression-level, default: 6 (value: 1-9)
+COMPRESSION_LEVEL=
+
+###################################
+# Web settings
+###################################
+
+# Path to redirect / to
+WEBROOT_REDIRECT=/webmail
+
+# Path to the admin interface if enabled
+WEB_ADMIN=/admin
+
+# Path to the webmail if enabled
+WEB_WEBMAIL=/webmail
+
+# Website name
+SITENAME=Mailservices
+
+# Linked Website URL
+WEBSITE=https://{{domain}}
+
+
+
+###################################
+# Advanced settings
+###################################
+
+# Log driver for front service. Possible values:
+# json-file (default)
+# journald (On systemd platforms, useful for Fail2Ban integration)
+# syslog (Non systemd platforms, Fail2Ban integration. Disables `docker-compose log` for front!)
+# LOG_DRIVER=json-file
+
+# docker-compose project name, this will prepended to containers names.
+COMPOSE_PROJECT_NAME=mailu
+
+# Default password scheme used for newly created accounts and changed passwords
+# (value: BLF-CRYPT, SHA512-CRYPT, SHA256-CRYPT, MD5-CRYPT, CRYPT)
+PASSWORD_SCHEME=BLF-CRYPT
+
+# Header to take the real ip from
+REAL_IP_HEADER=
+
+# IPs for nginx set_real_ip_from (CIDR list separated by commas)
+REAL_IP_FROM=
+
+# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
+REJECT_UNLISTED_RECIPIENT=
+
+# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
+LOG_LEVEL=WARNING
+
+###################################
+# Database settings
+###################################
+DB_FLAVOR=mysql
+DB_USER=mailu
+DB_PW={{mailu_database_password}}
+DB_HOST=database:3306
+DB_NAME=mailu
+ROUNDCUBE_DB_FLAVOR=mysql
+ROUNDCUBE_DB_USER=mailu
+ROUNDCUBE_DB_PW={{mailu_database_password}}
+ROUNDCUBE_DB_NAME=mailu
+ROUNDCUBE_DB_HOST=database:3306
+
+
+API_TOKEN={{mailu_api_token}}
--- a/roles/docker-mailu/vars/main.yml
+++ b/roles/docker-mailu/vars/main.yml
@@ -0,0 +1 @@
+mailu_front_container_name: "mailu-front-1"
				`@@ -0,0 +1 @@`
				`mailu_front_container_name: "mailu-front-1"`