diff options
Diffstat (limited to 'services')
24 files changed, 132 insertions, 40 deletions
diff --git a/services/config.template b/services/config.template index 19f35e9..77be817 100644 --- a/services/config.template +++ b/services/config.template @@ -1,9 +1,13 @@ CRUPEST_SERVICES_DIR=services CRUPEST_DATA_DIR=data CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@ +CRUPEST_MAIL_SERVER_DOMAIN=mail.@@CRUPEST_DOMAIN@@ CRUPEST_DOCKER_DIR=@@CRUPEST_SERVICES_DIR@@/docker +CRUPEST_DATA_SECRET_DIR=@@CRUPEST_DATA_DIR@@/secret CRUPEST_DATA_CERTBOT_DIR=@@CRUPEST_DATA_DIR@@/certbot CRUPEST_DATA_GIT_DIR=@@CRUPEST_DATA_DIR@@/git +CRUPEST_DATA_MAIL_SERVER_DIR=@@CRUPEST_DATA_DIR@@/mail-server +CRUPEST_DATA_ROUNDCUBE_DIR=@@CRUPEST_DATA_DIR@@/roundcube CRUPEST_GENERATED_DIR=@@CRUPEST_SERVICES_DIR@@/generated CRUPEST_SSL_FULLCHAIN_FILE=@@CRUPEST_DATA_CERTBOT_DIR@@/certs/live/@@CRUPEST_DOMAIN@@/fullchain.pem CRUPEST_SSL_PRIVATE_KEY_FILE=@@CRUPEST_DATA_CERTBOT_DIR@@/certs/live/@@CRUPEST_DOMAIN@@/privkey.pem diff --git a/services/docker/mail-server/Dockerfile b/services/docker/mail-server/Dockerfile index 7a3be9a..8ac8792 100644 --- a/services/docker/mail-server/Dockerfile +++ b/services/docker/mail-server/Dockerfile @@ -2,10 +2,10 @@ FROM denoland/deno AS deno-build COPY --from=deno . /workdir/ WORKDIR /workdir RUN deno install -RUN deno task compile:mail-relay +RUN deno task compile:mail FROM dovecot/dovecot:latest-root -COPY --from=deno-build /workdir/mail-relay/out/crupest-relay /app/ +COPY --from=deno-build /workdir/mail/out/crupest-mail /app/ ADD dovecot.conf /etc/dovecot/dovecot.conf ADD app/* /app/ CMD ["/app/main.bash"] diff --git a/services/docker/mail-server/app/main.bash b/services/docker/mail-server/app/main.bash index 70c9b75..fda36a4 100755 --- a/services/docker/mail-server/app/main.bash +++ b/services/docker/mail-server/app/main.bash @@ -7,5 +7,7 @@ die() { exit 1 } -/app/crupest-relay serve --real & +# TODO: restore this. +# /app/crupest-mail serve --real & + /dovecot/sbin/dovecot -F diff --git a/services/docker/nginx/Dockerfile b/services/docker/nginx/Dockerfile index 77398cd..3169e00 100644 --- a/services/docker/nginx/Dockerfile +++ b/services/docker/nginx/Dockerfile @@ -6,6 +6,5 @@ FROM nginx:mainline RUN apt update && apt-get install -y tini certbot && rm -rf /var/lib/apt/lists/* ADD mail-robots.txt /srv/mail/robots.txt ADD certbot.bash nginx-wrapper.bash /app/ -COPY configs/. /etc/nginx/ COPY --from=build-www /project/public /srv/www CMD ["/usr/bin/tini", "--", "/app/nginx-wrapper.bash"] diff --git a/services/docker/nginx/configs/templates/mail.conf.template b/services/docker/nginx/configs/templates/mail.conf.template deleted file mode 100644 index 5f80654..0000000 --- a/services/docker/nginx/configs/templates/mail.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name mail.${CRUPEST_DOMAIN}; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/docker/nginx/configs/templates/timeline.conf.template b/services/docker/nginx/configs/templates/timeline.conf.template deleted file mode 100644 index a467594..0000000 --- a/services/docker/nginx/configs/templates/timeline.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name timeline.${CRUPEST_DOMAIN}; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/docker/nginx/nginx-wrapper.bash b/services/docker/nginx/nginx-wrapper.bash index c848287..a4a19ec 100755 --- a/services/docker/nginx/nginx-wrapper.bash +++ b/services/docker/nginx/nginx-wrapper.bash @@ -7,10 +7,6 @@ die() { exit 1 } -[[ -n "$CRUPEST_DOMAIN" ]] || die "CRUPEST_DOMAIN is not set. It is used as root domain." -[[ -n "$CRUPEST_GITHUB" ]] || die "CRUPEST_GITHUB is not set. It is used as GitHub redirection." -[[ -n "$CRUPEST_V2RAY_PATH" ]] || die "CRUPEST_V2RAY_PATH is not set. It is used as v2ray tunnel endpoint." - /app/certbot.bash & /docker-entrypoint.sh nginx "-g" "daemon off;" diff --git a/services/templates/disabled/nginx/timeline.conf.template b/services/templates/disabled/nginx/timeline.conf.template index ce7341b..086c1f7 100644 --- a/services/templates/disabled/nginx/timeline.conf.template +++ b/services/templates/disabled/nginx/timeline.conf.template @@ -2,9 +2,9 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name timeline.@@CRUPEST_DOMAIN@@; - + location / { - include common/reverse-proxy; + include conf.d/common/reverse-proxy; proxy_pass http://timeline:5000/; } @@ -16,6 +16,6 @@ server { listen [::]:80; server_name timeline.@@CRUPEST_DOMAIN@@; - include common/https-redirect; - include common/acme-challenge; + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; } diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template index a48d529..f9ea0dc 100644 --- a/services/templates/docker-compose.yaml.template +++ b/services/templates/docker-compose.yaml.template @@ -15,16 +15,48 @@ services: env_file: - "./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env" - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env" volumes: + - "./@@CRUPEST_GENERATED_DIR@@/nginx:/etc/nginx/conf.d" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt" - - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot" networks: default: ipv4_address: "172.21.5.2" restart: "on-failure:3" + mail-server: + pull_policy: build + build: + context: "./@@CRUPEST_DOCKER_DIR@@/mail-server" + additional_contexts: + - "deno=./deno" + dockerfile: Dockerfile + pull: true + container_name: mail-server + hostname: mail + domainname: "@@CRUPEST_DOMAIN@@" + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server.env" + ports: + - "143:143" # IMAP4 (explicit TLS => STARTTLS) + - "993:993" # IMAP4 (implicit TLS) + - "587:587" # ESMTP (explicit TLS => STARTTLS) + - "465:465" # ESMTP (implicit TLS) + - "4190:4190" # manage sieve protocol + volumes: + - "./@@CRUPEST_DATA_MAIL_SERVER_DIR@@:/data" + - "./@@CRUPEST_SSL_FULLCHAIN_FILE@@:/etc/dovecot/ssl/tls.crt" + - "./@@CRUPEST_SSL_PRIVATE_KEY_FILE@@:/etc/dovecot/ssl/tls.key" + - "/etc/localtime:/etc/localtime:ro" + networks: + default: + ipv4_address: "172.21.5.3" + restart: "on-failure:3" + stop_grace_period: 1m + git-server: pull_policy: build build: @@ -38,7 +70,24 @@ services: - "./@@CRUPEST_DATA_GIT_DIR@@:/git" networks: default: - ipv4_address: "172.21.5.3" + ipv4_address: "172.21.5.4" + restart: on-failure:3 + + roundcubemail: + image: "roundcube/roundcubemail" + pull_policy: always + hostname: roundcubemail + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/roundcubemail.env" + volumes: + - "./@@CRUPEST_GENERATED_DIR@@/my-roundcube.inc.php:/var/roundcube/config/my-roundcube.inc.php" + - "./@@CRUPEST_DATA_SECRET_DIR@@/gnupg:/var/roundcube/enigma" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/www/html:/var/www/html" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/db:/var/roundcube/db" + - "roundcubemail-temp:/tmp/roundcube-temp" + networks: + default: + ipv4_address: "172.21.5.5" restart: on-failure:3 v2ray: @@ -53,7 +102,7 @@ services: - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env" networks: default: - ipv4_address: "172.21.5.5" + ipv4_address: "172.21.5.6" restart: "on-failure:3" auto-backup: @@ -69,6 +118,9 @@ services: - "./data/auto-backup:/data/auto-backup" restart: "on-failure:3" +volumes: + roundcubemail-temp: + networks: default: enable_ipv6: false diff --git a/services/templates/envs/mail-server-common.env.template b/services/templates/envs/mail-server-common.env.template new file mode 100644 index 0000000..d2b2c58 --- /dev/null +++ b/services/templates/envs/mail-server-common.env.template @@ -0,0 +1 @@ +CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@ diff --git a/services/templates/envs/mail-server.env.template b/services/templates/envs/mail-server.env.template new file mode 100644 index 0000000..0aa7ab6 --- /dev/null +++ b/services/templates/envs/mail-server.env.template @@ -0,0 +1,6 @@ +CRUPEST_MAIL_SERVER_MAIL_DOMAIN=@@CRUPEST_DOMAIN@@ +CRUPEST_MAIL_SERVER_DATA_PATH=/data/crupest-relay/ +CRUPEST_MAIL_SERVER_INBOUND_FALLBACK=crupest@crupest.life +CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY@@ +CRUPEST_MAIL_SERVER_MAILEROO_USER=@@CRUPEST_MAIL_SERVER_MAILEROO_USER@@ +CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD=@@CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD@@ diff --git a/services/templates/envs/roundcubemail.env.template b/services/templates/envs/roundcubemail.env.template new file mode 100644 index 0000000..4297b82 --- /dev/null +++ b/services/templates/envs/roundcubemail.env.template @@ -0,0 +1,6 @@ +ROUNDCUBEMAIL_DEFAULT_HOST=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@ +ROUNDCUBEMAIL_DEFAULT_PORT=993 +ROUNDCUBEMAIL_SMTP_SERVER=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@ +ROUNDCUBEMAIL_SMTP_PORT=465 +ROUNDCUBEMAIL_DB_TYPE=sqlite +ROUNDCUBEMAIL_PLUGINS=archive,enigma,jqueryui,newmail_notifier,show_additional_headers,userinfo,zipdownload,managesieve diff --git a/services/templates/my-roundcube.inc.php b/services/templates/my-roundcube.inc.php new file mode 100644 index 0000000..c07aff9 --- /dev/null +++ b/services/templates/my-roundcube.inc.php @@ -0,0 +1,3 @@ +<?php + +$config['managesieve_host'] = 'tls://%h'; diff --git a/services/docker/nginx/configs/common/acme-challenge b/services/templates/nginx/common/acme-challenge index 26054b8..8280cd8 100644 --- a/services/docker/nginx/configs/common/acme-challenge +++ b/services/templates/nginx/common/acme-challenge @@ -1,3 +1,3 @@ location /.well-known/acme-challenge { - root /srv/acme; + root /var/www/certbot; } diff --git a/services/docker/nginx/configs/common/http-listen b/services/templates/nginx/common/http-listen index 76cb18d..76cb18d 100644 --- a/services/docker/nginx/configs/common/http-listen +++ b/services/templates/nginx/common/http-listen diff --git a/services/docker/nginx/configs/common/https-listen b/services/templates/nginx/common/https-listen index db2f68e..db2f68e 100644 --- a/services/docker/nginx/configs/common/https-listen +++ b/services/templates/nginx/common/https-listen diff --git a/services/docker/nginx/configs/common/https-redirect b/services/templates/nginx/common/https-redirect index 56d095d..56d095d 100644 --- a/services/docker/nginx/configs/common/https-redirect +++ b/services/templates/nginx/common/https-redirect diff --git a/services/docker/nginx/configs/common/proxy-common b/services/templates/nginx/common/reverse-proxy index 4193548..4193548 100644 --- a/services/docker/nginx/configs/common/proxy-common +++ b/services/templates/nginx/common/reverse-proxy diff --git a/services/docker/nginx/configs/conf.d/default.conf b/services/templates/nginx/default.conf index 515942b..515942b 100644 --- a/services/docker/nginx/configs/conf.d/default.conf +++ b/services/templates/nginx/default.conf diff --git a/services/templates/nginx/mail.conf.template b/services/templates/nginx/mail.conf.template new file mode 100644 index 0000000..ebb9f46 --- /dev/null +++ b/services/templates/nginx/mail.conf.template @@ -0,0 +1,29 @@ +server { + server_name mail.@@CRUPEST_DOMAIN@@; + include conf.d/common/https-listen; + + location = /robots.txt { + root /srv/mail; + } + + location = /@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@ { + include conf.d/common/reverse-proxy; + proxy_pass http://mail-server:2345/@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@; + } + + location / { + include conf.d/common/reverse-proxy; + proxy_pass http://roundcubemail:80/; + } + + client_max_body_size 5G; +} + + +server { + server_name mail.@@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; + + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; +} diff --git a/services/docker/nginx/configs/templates/root.conf.template b/services/templates/nginx/root.conf.template index 4cc9a51..7a56982 100644 --- a/services/docker/nginx/configs/templates/root.conf.template +++ b/services/templates/nginx/root.conf.template @@ -1,23 +1,23 @@ server { - server_name ${CRUPEST_DOMAIN}; - include common/https-listen; + server_name @@CRUPEST_DOMAIN@@; + include conf.d/common/https-listen; location / { root /srv/www; } location /git/ { - include common/proxy-common; + include conf.d/common/reverse-proxy; client_max_body_size 5G; proxy_pass http://git-server:3636; } location = /github { - return 301 ${CRUPEST_GITHUB}; + return 301 @@CRUPEST_GITHUB@@; } location = /github/ { - return 301 ${CRUPEST_GITHUB}; + return 301 @@CRUPEST_GITHUB@@; } location /_${CRUPEST_V2RAY_PATH} { @@ -26,15 +26,15 @@ server { } proxy_redirect off; - include common/proxy-common; + include conf.d/common/reverse-proxy; proxy_pass http://v2ray:10000; } } server { - server_name ${CRUPEST_DOMAIN}; - include common/http-listen; + server_name @@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; - include common/https-redirect; - include common/acme-challenge; + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; } diff --git a/services/docker/nginx/configs/templates/ssl.conf.template b/services/templates/nginx/ssl.conf.template index 54205f1..181a1af 100644 --- a/services/docker/nginx/configs/templates/ssl.conf.template +++ b/services/templates/nginx/ssl.conf.template @@ -4,8 +4,8 @@ # the up-to-date file that you will need to refer to when manually updating # this file. Contents are based on https://ssl-config.mozilla.org -ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem; +ssl_certificate /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/@@CRUPEST_DOMAIN@@/privkey.pem; ssl_session_cache shared:le_nginx_SSL:10m; ssl_session_timeout 1440m; diff --git a/services/templates/nginx/timeline.conf.template b/services/templates/nginx/timeline.conf.template new file mode 100644 index 0000000..3414510 --- /dev/null +++ b/services/templates/nginx/timeline.conf.template @@ -0,0 +1,6 @@ +server { + server_name timeline.@@CRUPEST_DOMAIN@@; + include conf.d/common/http-listen; + + include conf.d/common/acme-challenge; +} diff --git a/services/docker/nginx/configs/conf.d/websocket.conf b/services/templates/nginx/websocket.conf index 32af4c3..32af4c3 100644 --- a/services/docker/nginx/configs/conf.d/websocket.conf +++ b/services/templates/nginx/websocket.conf |