From e18d101cae1dfcef29abd102d2908d429f4688d5 Mon Sep 17 00:00:00 2001 From: Yuqian Yang Date: Mon, 30 Jun 2025 14:25:02 +0800 Subject: mail: revert removing. --- services/config.template | 4 ++ services/docker/mail-server/Dockerfile | 4 +- services/docker/mail-server/app/main.bash | 4 +- services/docker/nginx/Dockerfile | 1 - .../docker/nginx/configs/common/acme-challenge | 3 -- services/docker/nginx/configs/common/http-listen | 2 - services/docker/nginx/configs/common/https-listen | 3 -- .../docker/nginx/configs/common/https-redirect | 3 -- services/docker/nginx/configs/common/proxy-common | 7 --- services/docker/nginx/configs/conf.d/default.conf | 9 ---- .../docker/nginx/configs/conf.d/websocket.conf | 4 -- .../nginx/configs/templates/mail.conf.template | 6 --- .../nginx/configs/templates/root.conf.template | 40 --------------- .../nginx/configs/templates/ssl.conf.template | 17 ------- .../nginx/configs/templates/timeline.conf.template | 6 --- services/docker/nginx/nginx-wrapper.bash | 4 -- .../disabled/nginx/timeline.conf.template | 8 +-- services/templates/docker-compose.yaml.template | 58 ++++++++++++++++++++-- .../templates/envs/mail-server-common.env.template | 1 + services/templates/envs/mail-server.env.template | 6 +++ services/templates/envs/roundcubemail.env.template | 6 +++ services/templates/my-roundcube.inc.php | 3 ++ services/templates/nginx/common/acme-challenge | 3 ++ services/templates/nginx/common/http-listen | 2 + services/templates/nginx/common/https-listen | 3 ++ services/templates/nginx/common/https-redirect | 3 ++ services/templates/nginx/common/reverse-proxy | 7 +++ services/templates/nginx/default.conf | 9 ++++ services/templates/nginx/mail.conf.template | 29 +++++++++++ services/templates/nginx/root.conf.template | 40 +++++++++++++++ services/templates/nginx/ssl.conf.template | 17 +++++++ services/templates/nginx/timeline.conf.template | 6 +++ services/templates/nginx/websocket.conf | 4 ++ 33 files changed, 207 insertions(+), 115 deletions(-) delete mode 100644 services/docker/nginx/configs/common/acme-challenge delete mode 100644 services/docker/nginx/configs/common/http-listen delete mode 100644 services/docker/nginx/configs/common/https-listen delete mode 100644 services/docker/nginx/configs/common/https-redirect delete mode 100644 services/docker/nginx/configs/common/proxy-common delete mode 100644 services/docker/nginx/configs/conf.d/default.conf delete mode 100644 services/docker/nginx/configs/conf.d/websocket.conf delete mode 100644 services/docker/nginx/configs/templates/mail.conf.template delete mode 100644 services/docker/nginx/configs/templates/root.conf.template delete mode 100644 services/docker/nginx/configs/templates/ssl.conf.template delete mode 100644 services/docker/nginx/configs/templates/timeline.conf.template create mode 100644 services/templates/envs/mail-server-common.env.template create mode 100644 services/templates/envs/mail-server.env.template create mode 100644 services/templates/envs/roundcubemail.env.template create mode 100644 services/templates/my-roundcube.inc.php create mode 100644 services/templates/nginx/common/acme-challenge create mode 100644 services/templates/nginx/common/http-listen create mode 100644 services/templates/nginx/common/https-listen create mode 100644 services/templates/nginx/common/https-redirect create mode 100644 services/templates/nginx/common/reverse-proxy create mode 100644 services/templates/nginx/default.conf create mode 100644 services/templates/nginx/mail.conf.template create mode 100644 services/templates/nginx/root.conf.template create mode 100644 services/templates/nginx/ssl.conf.template create mode 100644 services/templates/nginx/timeline.conf.template create mode 100644 services/templates/nginx/websocket.conf (limited to 'services') diff --git a/services/config.template b/services/config.template index 19f35e9..77be817 100644 --- a/services/config.template +++ b/services/config.template @@ -1,9 +1,13 @@ CRUPEST_SERVICES_DIR=services CRUPEST_DATA_DIR=data CRUPEST_ROOT_URL=https://@@CRUPEST_DOMAIN@@ +CRUPEST_MAIL_SERVER_DOMAIN=mail.@@CRUPEST_DOMAIN@@ CRUPEST_DOCKER_DIR=@@CRUPEST_SERVICES_DIR@@/docker +CRUPEST_DATA_SECRET_DIR=@@CRUPEST_DATA_DIR@@/secret CRUPEST_DATA_CERTBOT_DIR=@@CRUPEST_DATA_DIR@@/certbot CRUPEST_DATA_GIT_DIR=@@CRUPEST_DATA_DIR@@/git +CRUPEST_DATA_MAIL_SERVER_DIR=@@CRUPEST_DATA_DIR@@/mail-server +CRUPEST_DATA_ROUNDCUBE_DIR=@@CRUPEST_DATA_DIR@@/roundcube CRUPEST_GENERATED_DIR=@@CRUPEST_SERVICES_DIR@@/generated CRUPEST_SSL_FULLCHAIN_FILE=@@CRUPEST_DATA_CERTBOT_DIR@@/certs/live/@@CRUPEST_DOMAIN@@/fullchain.pem CRUPEST_SSL_PRIVATE_KEY_FILE=@@CRUPEST_DATA_CERTBOT_DIR@@/certs/live/@@CRUPEST_DOMAIN@@/privkey.pem diff --git a/services/docker/mail-server/Dockerfile b/services/docker/mail-server/Dockerfile index 7a3be9a..8ac8792 100644 --- a/services/docker/mail-server/Dockerfile +++ b/services/docker/mail-server/Dockerfile @@ -2,10 +2,10 @@ FROM denoland/deno AS deno-build COPY --from=deno . /workdir/ WORKDIR /workdir RUN deno install -RUN deno task compile:mail-relay +RUN deno task compile:mail FROM dovecot/dovecot:latest-root -COPY --from=deno-build /workdir/mail-relay/out/crupest-relay /app/ +COPY --from=deno-build /workdir/mail/out/crupest-mail /app/ ADD dovecot.conf /etc/dovecot/dovecot.conf ADD app/* /app/ CMD ["/app/main.bash"] diff --git a/services/docker/mail-server/app/main.bash b/services/docker/mail-server/app/main.bash index 70c9b75..fda36a4 100755 --- a/services/docker/mail-server/app/main.bash +++ b/services/docker/mail-server/app/main.bash @@ -7,5 +7,7 @@ die() { exit 1 } -/app/crupest-relay serve --real & +# TODO: restore this. +# /app/crupest-mail serve --real & + /dovecot/sbin/dovecot -F diff --git a/services/docker/nginx/Dockerfile b/services/docker/nginx/Dockerfile index 77398cd..3169e00 100644 --- a/services/docker/nginx/Dockerfile +++ b/services/docker/nginx/Dockerfile @@ -6,6 +6,5 @@ FROM nginx:mainline RUN apt update && apt-get install -y tini certbot && rm -rf /var/lib/apt/lists/* ADD mail-robots.txt /srv/mail/robots.txt ADD certbot.bash nginx-wrapper.bash /app/ -COPY configs/. /etc/nginx/ COPY --from=build-www /project/public /srv/www CMD ["/usr/bin/tini", "--", "/app/nginx-wrapper.bash"] diff --git a/services/docker/nginx/configs/common/acme-challenge b/services/docker/nginx/configs/common/acme-challenge deleted file mode 100644 index 26054b8..0000000 --- a/services/docker/nginx/configs/common/acme-challenge +++ /dev/null @@ -1,3 +0,0 @@ -location /.well-known/acme-challenge { - root /srv/acme; -} diff --git a/services/docker/nginx/configs/common/http-listen b/services/docker/nginx/configs/common/http-listen deleted file mode 100644 index 76cb18d..0000000 --- a/services/docker/nginx/configs/common/http-listen +++ /dev/null @@ -1,2 +0,0 @@ -listen 80; -listen [::]:80; diff --git a/services/docker/nginx/configs/common/https-listen b/services/docker/nginx/configs/common/https-listen deleted file mode 100644 index db2f68e..0000000 --- a/services/docker/nginx/configs/common/https-listen +++ /dev/null @@ -1,3 +0,0 @@ -listen 443 ssl; -listen [::]:443 ssl; -http2 on; diff --git a/services/docker/nginx/configs/common/https-redirect b/services/docker/nginx/configs/common/https-redirect deleted file mode 100644 index 56d095d..0000000 --- a/services/docker/nginx/configs/common/https-redirect +++ /dev/null @@ -1,3 +0,0 @@ -location / { - return 301 https://$host$request_uri; -} diff --git a/services/docker/nginx/configs/common/proxy-common b/services/docker/nginx/configs/common/proxy-common deleted file mode 100644 index 4193548..0000000 --- a/services/docker/nginx/configs/common/proxy-common +++ /dev/null @@ -1,7 +0,0 @@ -proxy_http_version 1.1; -proxy_set_header Upgrade $http_upgrade; -proxy_set_header Connection $connection_upgrade; -proxy_set_header Host $host; -proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; -proxy_set_header X-Forwarded-Proto $scheme; -proxy_set_header X-Real-IP $remote_addr; diff --git a/services/docker/nginx/configs/conf.d/default.conf b/services/docker/nginx/configs/conf.d/default.conf deleted file mode 100644 index 515942b..0000000 --- a/services/docker/nginx/configs/conf.d/default.conf +++ /dev/null @@ -1,9 +0,0 @@ -server { - listen 80 default_server; - listen [::]:80 default_server; - listen 443 ssl default_server; - listen [::]:443 ssl default_server; - http2 on; - - return 444; -} diff --git a/services/docker/nginx/configs/conf.d/websocket.conf b/services/docker/nginx/configs/conf.d/websocket.conf deleted file mode 100644 index 32af4c3..0000000 --- a/services/docker/nginx/configs/conf.d/websocket.conf +++ /dev/null @@ -1,4 +0,0 @@ -map $http_upgrade $connection_upgrade { - default upgrade; - '' close; -} diff --git a/services/docker/nginx/configs/templates/mail.conf.template b/services/docker/nginx/configs/templates/mail.conf.template deleted file mode 100644 index 5f80654..0000000 --- a/services/docker/nginx/configs/templates/mail.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name mail.${CRUPEST_DOMAIN}; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/docker/nginx/configs/templates/root.conf.template b/services/docker/nginx/configs/templates/root.conf.template deleted file mode 100644 index 4cc9a51..0000000 --- a/services/docker/nginx/configs/templates/root.conf.template +++ /dev/null @@ -1,40 +0,0 @@ -server { - server_name ${CRUPEST_DOMAIN}; - include common/https-listen; - - location / { - root /srv/www; - } - - location /git/ { - include common/proxy-common; - client_max_body_size 5G; - proxy_pass http://git-server:3636; - } - - location = /github { - return 301 ${CRUPEST_GITHUB}; - } - - location = /github/ { - return 301 ${CRUPEST_GITHUB}; - } - - location /_${CRUPEST_V2RAY_PATH} { - if ($http_upgrade != "websocket") { - return 404; - } - - proxy_redirect off; - include common/proxy-common; - proxy_pass http://v2ray:10000; - } -} - -server { - server_name ${CRUPEST_DOMAIN}; - include common/http-listen; - - include common/https-redirect; - include common/acme-challenge; -} diff --git a/services/docker/nginx/configs/templates/ssl.conf.template b/services/docker/nginx/configs/templates/ssl.conf.template deleted file mode 100644 index 54205f1..0000000 --- a/services/docker/nginx/configs/templates/ssl.conf.template +++ /dev/null @@ -1,17 +0,0 @@ -# This file contains important security parameters. If you modify this file -# manually, Certbot will be unable to automatically provide future security -# updates. Instead, Certbot will print and log an error message with a path to -# the up-to-date file that you will need to refer to when manually updating -# this file. Contents are based on https://ssl-config.mozilla.org - -ssl_certificate /etc/letsencrypt/live/${CRUPEST_DOMAIN}/fullchain.pem; -ssl_certificate_key /etc/letsencrypt/live/${CRUPEST_DOMAIN}/privkey.pem; - -ssl_session_cache shared:le_nginx_SSL:10m; -ssl_session_timeout 1440m; -ssl_session_tickets off; - -ssl_protocols TLSv1.2 TLSv1.3; -ssl_prefer_server_ciphers off; - -ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"; diff --git a/services/docker/nginx/configs/templates/timeline.conf.template b/services/docker/nginx/configs/templates/timeline.conf.template deleted file mode 100644 index a467594..0000000 --- a/services/docker/nginx/configs/templates/timeline.conf.template +++ /dev/null @@ -1,6 +0,0 @@ -server { - server_name timeline.${CRUPEST_DOMAIN}; - include common/http-listen; - - include common/acme-challenge; -} diff --git a/services/docker/nginx/nginx-wrapper.bash b/services/docker/nginx/nginx-wrapper.bash index c848287..a4a19ec 100755 --- a/services/docker/nginx/nginx-wrapper.bash +++ b/services/docker/nginx/nginx-wrapper.bash @@ -7,10 +7,6 @@ die() { exit 1 } -[[ -n "$CRUPEST_DOMAIN" ]] || die "CRUPEST_DOMAIN is not set. It is used as root domain." -[[ -n "$CRUPEST_GITHUB" ]] || die "CRUPEST_GITHUB is not set. It is used as GitHub redirection." -[[ -n "$CRUPEST_V2RAY_PATH" ]] || die "CRUPEST_V2RAY_PATH is not set. It is used as v2ray tunnel endpoint." - /app/certbot.bash & /docker-entrypoint.sh nginx "-g" "daemon off;" diff --git a/services/templates/disabled/nginx/timeline.conf.template b/services/templates/disabled/nginx/timeline.conf.template index ce7341b..086c1f7 100644 --- a/services/templates/disabled/nginx/timeline.conf.template +++ b/services/templates/disabled/nginx/timeline.conf.template @@ -2,9 +2,9 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name timeline.@@CRUPEST_DOMAIN@@; - + location / { - include common/reverse-proxy; + include conf.d/common/reverse-proxy; proxy_pass http://timeline:5000/; } @@ -16,6 +16,6 @@ server { listen [::]:80; server_name timeline.@@CRUPEST_DOMAIN@@; - include common/https-redirect; - include common/acme-challenge; + include conf.d/common/https-redirect; + include conf.d/common/acme-challenge; } diff --git a/services/templates/docker-compose.yaml.template b/services/templates/docker-compose.yaml.template index a48d529..f9ea0dc 100644 --- a/services/templates/docker-compose.yaml.template +++ b/services/templates/docker-compose.yaml.template @@ -15,16 +15,48 @@ services: env_file: - "./@@CRUPEST_GENERATED_DIR@@/envs/nginx.env" - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env" volumes: + - "./@@CRUPEST_GENERATED_DIR@@/nginx:/etc/nginx/conf.d" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/certs:/etc/letsencrypt" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/data:/var/lib/letsencrypt" - - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/srv/acme:ro" - "./@@CRUPEST_DATA_CERTBOT_DIR@@/webroot:/var/www/certbot" networks: default: ipv4_address: "172.21.5.2" restart: "on-failure:3" + mail-server: + pull_policy: build + build: + context: "./@@CRUPEST_DOCKER_DIR@@/mail-server" + additional_contexts: + - "deno=./deno" + dockerfile: Dockerfile + pull: true + container_name: mail-server + hostname: mail + domainname: "@@CRUPEST_DOMAIN@@" + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server-common.env" + - "./@@CRUPEST_GENERATED_DIR@@/envs/mail-server.env" + ports: + - "143:143" # IMAP4 (explicit TLS => STARTTLS) + - "993:993" # IMAP4 (implicit TLS) + - "587:587" # ESMTP (explicit TLS => STARTTLS) + - "465:465" # ESMTP (implicit TLS) + - "4190:4190" # manage sieve protocol + volumes: + - "./@@CRUPEST_DATA_MAIL_SERVER_DIR@@:/data" + - "./@@CRUPEST_SSL_FULLCHAIN_FILE@@:/etc/dovecot/ssl/tls.crt" + - "./@@CRUPEST_SSL_PRIVATE_KEY_FILE@@:/etc/dovecot/ssl/tls.key" + - "/etc/localtime:/etc/localtime:ro" + networks: + default: + ipv4_address: "172.21.5.3" + restart: "on-failure:3" + stop_grace_period: 1m + git-server: pull_policy: build build: @@ -38,7 +70,24 @@ services: - "./@@CRUPEST_DATA_GIT_DIR@@:/git" networks: default: - ipv4_address: "172.21.5.3" + ipv4_address: "172.21.5.4" + restart: on-failure:3 + + roundcubemail: + image: "roundcube/roundcubemail" + pull_policy: always + hostname: roundcubemail + env_file: + - "./@@CRUPEST_GENERATED_DIR@@/envs/roundcubemail.env" + volumes: + - "./@@CRUPEST_GENERATED_DIR@@/my-roundcube.inc.php:/var/roundcube/config/my-roundcube.inc.php" + - "./@@CRUPEST_DATA_SECRET_DIR@@/gnupg:/var/roundcube/enigma" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/www/html:/var/www/html" + - "./@@CRUPEST_DATA_ROUNDCUBE_DIR@@/db:/var/roundcube/db" + - "roundcubemail-temp:/tmp/roundcube-temp" + networks: + default: + ipv4_address: "172.21.5.5" restart: on-failure:3 v2ray: @@ -53,7 +102,7 @@ services: - "./@@CRUPEST_GENERATED_DIR@@/envs/v2ray.env" networks: default: - ipv4_address: "172.21.5.5" + ipv4_address: "172.21.5.6" restart: "on-failure:3" auto-backup: @@ -69,6 +118,9 @@ services: - "./data/auto-backup:/data/auto-backup" restart: "on-failure:3" +volumes: + roundcubemail-temp: + networks: default: enable_ipv6: false diff --git a/services/templates/envs/mail-server-common.env.template b/services/templates/envs/mail-server-common.env.template new file mode 100644 index 0000000..d2b2c58 --- /dev/null +++ b/services/templates/envs/mail-server-common.env.template @@ -0,0 +1 @@ +CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_PATH@@ diff --git a/services/templates/envs/mail-server.env.template b/services/templates/envs/mail-server.env.template new file mode 100644 index 0000000..0aa7ab6 --- /dev/null +++ b/services/templates/envs/mail-server.env.template @@ -0,0 +1,6 @@ +CRUPEST_MAIL_SERVER_MAIL_DOMAIN=@@CRUPEST_DOMAIN@@ +CRUPEST_MAIL_SERVER_DATA_PATH=/data/crupest-relay/ +CRUPEST_MAIL_SERVER_INBOUND_FALLBACK=crupest@crupest.life +CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY=@@CRUPEST_MAIL_SERVER_MAILEROO_INBOUND_KEY@@ +CRUPEST_MAIL_SERVER_MAILEROO_USER=@@CRUPEST_MAIL_SERVER_MAILEROO_USER@@ +CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD=@@CRUPEST_MAIL_SERVER_MAILEROO_PASSWORD@@ diff --git a/services/templates/envs/roundcubemail.env.template b/services/templates/envs/roundcubemail.env.template new file mode 100644 index 0000000..4297b82 --- /dev/null +++ b/services/templates/envs/roundcubemail.env.template @@ -0,0 +1,6 @@ +ROUNDCUBEMAIL_DEFAULT_HOST=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@ +ROUNDCUBEMAIL_DEFAULT_PORT=993 +ROUNDCUBEMAIL_SMTP_SERVER=ssl://@@CRUPEST_MAIL_SERVER_DOMAIN@@ +ROUNDCUBEMAIL_SMTP_PORT=465 +ROUNDCUBEMAIL_DB_TYPE=sqlite +ROUNDCUBEMAIL_PLUGINS=archive,enigma,jqueryui,newmail_notifier,show_additional_headers,userinfo,zipdownload,managesieve diff --git a/services/templates/my-roundcube.inc.php b/services/templates/my-roundcube.inc.php new file mode 100644 index 0000000..c07aff9 --- /dev/null +++ b/services/templates/my-roundcube.inc.php @@ -0,0 +1,3 @@ +