eSlider
7d874c5117
- scripts/dynadot-dns.sh: DNS-01 hook (snapshot -> append TXT -> restore); set_dns2 wants lowercase record types, ResponseCode checks on deploy/clean - compose: SSL_TYPE=letsencrypt, mount tls/letsencrypt/<domain> -> /etc/letsencrypt/live/<domain>; drop-in jail.d/ignoreip.local so the postfix jail can't ban the docker bridge gateway (host self-DoS) - cert issued for mail.produktor.io (Let's Encrypt, ECDSA); renewal via acme.sh cron + reloadcmd (postfix/dovecot reload)
34 lines
1007 B
YAML
34 lines
1007 B
YAML
services:
|
|
mailserver:
|
|
image: docker.io/mailserver/docker-mailserver:latest
|
|
container_name: mailserver
|
|
hostname: mail.produktor.io
|
|
ports:
|
|
- "25:25"
|
|
- "465:465"
|
|
- "587:587"
|
|
- "143:143"
|
|
- "993:993"
|
|
volumes:
|
|
- ./data/mail-data/:/var/mail/
|
|
- ./data/mail-state/:/var/mail-state/
|
|
- ./data/mail-logs/:/var/log/mail/
|
|
- ./config/:/tmp/docker-mailserver/
|
|
# fail2ban: never ban the docker bridge gateway / host LAN (self-DoS guard)
|
|
- ./config/fail2ban/ignoreip.conf:/etc/fail2ban/jail.d/ignoreip.local:ro
|
|
- ./tls/letsencrypt/mail.produktor.io:/etc/letsencrypt/live/mail.produktor.io:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
environment:
|
|
- ENABLE_SPAMASSASSIN=1
|
|
- ENABLE_CLAMAV=0
|
|
- ENABLE_FAIL2BAN=1
|
|
- ENABLE_POP3=0
|
|
- SSL_TYPE=letsencrypt
|
|
- PERMIT_DOCKER=none
|
|
- ONE_DIR=1
|
|
- SPOOF_PROTECTION=1
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_PTRACE
|
|
restart: unless-stopped
|