Commits vergleichen
27 Commits
feat/arm64
...
master
| Autor | SHA1 | Datum | |
|---|---|---|---|
|
1a20582fad | ||
|
|
1a10dd53c8 | ||
|
|
2e6d5a87e1 | ||
|
|
cacd4bff00 | ||
|
|
93d70275c4 | ||
|
|
ba75c4b138 | ||
|
|
b5e4a9657f | ||
|
|
4ac8423b5d | ||
|
|
f013738bc8 | ||
|
|
08d1a4b18b | ||
|
|
2f185bc37c | ||
|
|
539a9189e1 | ||
|
|
dfa41acac8 | ||
|
|
08d8bdb06d | ||
|
|
e4bad57db7 | ||
|
|
48bf9c00b8 | ||
|
|
8c8acce780 | ||
|
|
8672a06f9b | ||
|
|
cda026001a | ||
|
|
66db6d90ad | ||
|
|
00e0405891 | ||
|
|
afee37a459 | ||
|
|
c6676620cd | ||
|
|
450e069fca | ||
|
|
73a51aaa40 | ||
|
|
1d663f06c4 | ||
|
|
2970d45e22 |
36 geänderte Dateien mit 2163 neuen und 1328 gelöschten Zeilen
4
.github/workflows/gh-pages.yml
gevendort
4
.github/workflows/gh-pages.yml
gevendort
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout 📥
|
||||
uses: actions/checkout@v3.5.2
|
||||
uses: actions/checkout@v3.5.3
|
||||
with:
|
||||
token: '${{ secrets.GHPAGES_ACTION_CHECKOUT_TOKEN_PAT }}'
|
||||
fetch-depth: '0' # https://github.com/timvink/mkdocs-git-revision-date-localized-plugin#note-when-using-build-environments
|
||||
|
|
@ -30,7 +30,7 @@ jobs:
|
|||
bash .github/workflows/fix_redirects.sh
|
||||
|
||||
- name: Deploy 🚀
|
||||
uses: JamesIves/github-pages-deploy-action@v4.4.1
|
||||
uses: JamesIves/github-pages-deploy-action@v4.4.2
|
||||
with:
|
||||
token: '${{ secrets.GHPAGES_ACTION_DEPLOY_TOKEN_PAT }}'
|
||||
git-config-name: '${{ secrets.GHPAGES_ACTION_DEPLOY_GITNAME_PAT }}'
|
||||
|
|
|
|||
2
.github/workflows/renovate_check-build.yml
gevendort
2
.github/workflows/renovate_check-build.yml
gevendort
|
|
@ -8,7 +8,7 @@ jobs:
|
|||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout 📥
|
||||
uses: actions/checkout@v3.5.2
|
||||
uses: actions/checkout@v3.5.3
|
||||
with:
|
||||
token: '${{ secrets.GHPAGES_ACTION_CHECKOUT_TOKEN_PAT }}'
|
||||
fetch-depth: '0' # https://github.com/timvink/mkdocs-git-revision-date-localized-plugin#note-when-using-build-environments
|
||||
|
|
|
|||
173
docs/index.de.md
173
docs/index.de.md
|
|
@ -1,12 +1,90 @@
|
|||
# 🐮 + 🐋 = 💕
|
||||
<figure markdown>
|
||||
{ width="150" }
|
||||
</figure>
|
||||
|
||||
# mailcow: dockerized - :cow: + :whale: = :two_hearts:
|
||||
**Die Mailserver-Suite mit dem 'moo'**
|
||||
|
||||
## Was ist mailcow: dockerized?
|
||||
|
||||
!!! question "Frage"
|
||||
Mailcow, MailCow oder doch mailcow? Wie heißt das Projekt nun genau?
|
||||
|
||||
Richtig: **mailcow**, denn mailcow ist eine eingetragene Wortmarke mit kleinem m :grin:
|
||||
|
||||
mailcow: dockerized ist eine Open-Source Groupware/E-Mail Suite auf Docker Basis.
|
||||
|
||||
Dabei setzt mailcow auf viele bekannte und lang bewertete Komponenten, welche im Zusammenspiel einen Rund um Sorglosen E-Mail Server ergeben.
|
||||
|
||||
Jeder Container repräsentiert eine einzelne Anwendung, die in einem überbrückten (Bridged) Netzwerk verbunden sind.
|
||||
|
||||
- [ACME](https://letsencrypt.org/) (Automatische Generation von Let's Encrypt Zertifikaten)
|
||||
- [ClamAV](https://www.clamav.net/) (Antiviren Scanner) (optional)
|
||||
- [Dovecot](https://www.dovecot.org/) (IMAP/POP Server zum Abrufen der E-Mails)
|
||||
- [MariaDB](https://mariadb.org/) (Datenbank zum Speichern der Nutzer Informationen u.w.)
|
||||
- [Memcached](https://www.memcached.org/) (Cache für den Webmailer SOGo)
|
||||
- [Netfilter](https://www.netfilter.org/) (Fail2ban-ähnliche Integration von [@mkuron](https://github.com/mkuron))
|
||||
- [Nginx](https://nginx.org/) (Webserver für die mailcow UI)
|
||||
- [Oletools](https://github.com/decalage2/oletools) über [Olefy](https://github.com/HeinleinSupport/olefy) (Analyse von Office Dokumenten nach Viren, Makros etc.)
|
||||
- [PHP](https://php.net/) (Programmiersprache der meisten Webbasierten mailcow Aktionen)
|
||||
- [Postfix](http://www.postfix.org/) (Empfänger/Sender für den E-Mail-Verkehr im Internet)
|
||||
- [Redis](https://redis.io/) (Speicher für Spaminformationen, DKIM Schlüssel u.w.)
|
||||
- [Rspamd](https://www.rspamd.com/) (Spamfilter mit automatischem Lernen von Spammails)
|
||||
- [SOGo](https://sogo.nu/) (Integrierter Webmailer und Cal-/Carddav Schnittstelle)
|
||||
- [Solr](https://solr.apache.org/) (Voll-Text-Suche für IMAP Verbindungen zum schnellen durchsuchen von E-Mails) (optional)
|
||||
- [Unbound](https://unbound.net/) (Integrierter DNS-Server zum Verifizieren von DNSSEC u.w)
|
||||
- Ein Watchdog für die grundlegende Überwachung des Containerstatus innerhalb von mailcow
|
||||
|
||||
Doch das Herzstück bzw. das, was mailcow besonders macht, ist die grafische Weboberfläche, die **mailcow UI**.
|
||||
|
||||
Diese bietet für so gut wie alle Einstellungen einen Platz und erlaubt das bequeme Anlegen von neuen Domains und E-Mail-Adressen mit wenigen Klicks.
|
||||
|
||||
Aber auch andere bzw. kniffligere Themen können in ihr problemlos erledigt werden:
|
||||
|
||||
- [DKIM](http://dkim.org) und [ARC](http://arc-spec.org/) Unterstützung bzw. Generation.
|
||||
- Black- und Whitelists pro Domain und pro Benutzer
|
||||
- Spam-Score-Verwaltung pro Benutzer (Spam ablehnen, Spam markieren, Greylist)
|
||||
- Erlauben Sie Mailbox-Benutzern, temporäre Spam-Aliase zu erstellen
|
||||
- Voranstellen von E-Mail-Tags an den Betreff oder Verschieben von E-Mails in Unterordner (pro Benutzer)
|
||||
- Mailbox-Benutzer können die TLS-Durchsetzung für eingehende und ausgehende Nachrichten umschalten
|
||||
- Benutzer können die Caches von SOGo ActiveSync-Geräten zurücksetzen
|
||||
- imapsync, um entfernte Postfächer regelmäßig zu migrieren oder abzurufen
|
||||
- TFA: Yubikey OTP und WebAuthn USB (nur Google Chrome und Derivate), TOTP
|
||||
- Hinzufügen von Whitelist-Hosts zur Weiterleitung von Mails an mailcow
|
||||
- Fail2ban-ähnliche Integration
|
||||
- Quarantäne-System
|
||||
- Antivirus-Scanning inkl. Makro-Scanning in Office-Dokumenten
|
||||
- Integrierte Basisüberwachung
|
||||
- Und weitere...
|
||||
|
||||
Die mailcow Daten (wie bspw. E-Mails, Userdaten etc.) werden in **Docker-Volumes** aufbewahrt - geben Sie gut auf diese Volumes acht:
|
||||
|
||||
- clamd-db-vol-1
|
||||
- crypt-vol-1
|
||||
- mysql-socket-vol-1
|
||||
- mysql-vol-1
|
||||
- postfix-vol-1
|
||||
- redis-vol-1
|
||||
- rspamd-vol-1
|
||||
- sogo-userdata-backup-vol-1
|
||||
- sogo-web-vol-1
|
||||
- solr-vol-1
|
||||
- vmail-index-vol-1
|
||||
- vmail-vol-1
|
||||
|
||||
!!! warning "Achtung"
|
||||
Die Mails werden komprimiert und verschlüsselt gespeichert. Das Schlüsselpaar ist in crypt-vol-1 zu finden. Bitte vergessen Sie nicht, dieses und andere Volumes zu sichern. #KeinBackupkeinMitleid
|
||||
---
|
||||
|
||||
## Unterstützen Sie das mailcow Projekt
|
||||
|
||||
Bitte erwägen Sie einen Supportvertrag gegen eine geringe monatliche Gebühr unter [Servercow](https://www.servercow.de/mailcow?#support), um die weitere Entwicklung zu unterstützen. _Wir_ unterstützen _Sie_, während _Sie_ _uns_ unterstützen. :)
|
||||
Bitte erwägen Sie einen Supportvertrag gegen eine geringe monatliche Gebühr unter [Servercow](https://www.servercow.de/mailcow?#support)[^1], um die weitere Entwicklung zu unterstützen. _Wir_ unterstützen _Sie_, während _Sie_ _uns_ unterstützen. :)
|
||||
|
||||
Wenn Sie super toll sind und uns ohne Vertrag unterstützen möchten, können Sie eine SAL-Lizenz erhalten, die Ihre Unterstützung bestätigt (kaufbar als flexible Einmalzahlung) bei [Servercow](https://www.servercow.de/mailcow#sal).
|
||||
Wenn Sie super toll sind und uns ohne Vertrag unterstützen möchten, können Sie eine SAL (Stay-Awesome License) erhalten, die Ihre Unterstützung bestätigt (kaufbar als flexible Einmalzahlung) bei [Servercow](https://www.servercow.de/mailcow#sal).
|
||||
|
||||
## Support erhalten
|
||||
---
|
||||
|
||||
## Hilfe gefällig?
|
||||
|
||||
Es gibt zwei Möglichkeiten, Support für Ihre mailcow-Installation zu erhalten.
|
||||
|
||||
|
|
@ -16,9 +94,9 @@ Für professionellen und priorisierten kommerziellen Support können Sie ein Bas
|
|||
|
||||
Darüber hinaus bieten wir auch eine voll ausgestattete und verwaltete [managed mailcow](https://www.servercow.de/mailcow#managed) an. Auf diese Weise kümmern wir uns um alles technische und Sie können Ihr ganzes Mail-Erlebnis auf eine problemlose Weise genießen.
|
||||
|
||||
### Community-Unterstützung und Chat
|
||||
### Community Support und Chat
|
||||
|
||||
Die andere Alternative ist unser kostenloser Community-Support auf unseren verschiedenen Kanälen unten. Bitte beachten Sie, dass dieser Support von unserer großartigen Community rund um mailcow betrieben wird. Diese Art von Support ist best-effort, freiwillig und es gibt keine Garantie für irgendetwas.
|
||||
Die Alternative ist unser kostenloser Community-Support auf unseren verschiedenen Kanälen unten. Bitte beachten Sie, dass dieser Support von unserer großartigen Community rund um mailcow betrieben wird. Diese Art von Support ist best-effort, freiwillig und es gibt keine Garantie für irgendetwas.
|
||||
|
||||
- Unsere mailcow Community @ [community.mailcow.email](https://community.mailcow.email)
|
||||
|
||||
|
|
@ -34,77 +112,26 @@ Nur für **Bug Tracking, Feature Requests und Codebeiträge**:
|
|||
|
||||
- GitHub @ [mailcow/mailcow-dockerized](https://github.com/mailcow/mailcow-dockerized)
|
||||
|
||||
## Demos
|
||||
---
|
||||
|
||||
Seit September 2022 stellen wir zwei Verschiedene Demos bereit:
|
||||
## Neugierig? Gleich ausprobieren!
|
||||
|
||||
+ **[demo.mailcow.email](https://demo.mailcow.email)** ist die altbekannte Demo, welche sich am **Stabilen Stand** der mailcow orrientiert.
|
||||
+ **[nightly-demo.mailcow.email](https://nightly-demo.mailcow.email)** ist die neue **Nightly Demo**, welche Testfunktionen beherbergt. (Also insbesondere für alle interessant, die keine Möglichkeit haben sich eine Testinstanz selbst zu erstellen.)
|
||||
Haben wir Ihr Interesse geweckt? Verschaffen Sie sich in unseren offiziellen **mailcow Demos** einen ersten Überblick über die Funktionalitäten von mailcow und Ihrer mailcow UI!
|
||||
|
||||
Die folgenden Anmeldedaten fürs Login funktionieren bei beiden Varianten:
|
||||
Seit September 2022 stellen wir zwei verschiedene Demos bereit:
|
||||
|
||||
- **Administrator**: admin / moohoo
|
||||
- **Domänen-Administrator**: department / moohoo
|
||||
- **Mailbox**: demo@440044.xyz / moohoo
|
||||
+ **[demo.mailcow.email](https://demo.mailcow.email)** ist die altbekannte Demo, welche sich am **Stabilen Stand** der mailcow orrientiert (master Branch auf GitHub).
|
||||
+ **[nightly-demo.mailcow.email](https://nightly-demo.mailcow.email)** ist die neue **Nightly Demo**, welche Testfunktionen beherbergt. (Also insbesondere für alle interessant, die keine Möglichkeit haben sich eine Testinstanz selbst zu erstellen.) (nightly Branch auf GitHub)
|
||||
|
||||
!!! success "Besonderheit"
|
||||
!!! abstract "Nutzen Sie diese Anmeldedaten für die Demos"
|
||||
|
||||
- **Administrator**: admin / moohoo
|
||||
- **Domänen-Administrator**: department / moohoo
|
||||
- **Mailbox**: demo@440044.xyz / moohoo
|
||||
|
||||
*Die Anmeldedaten für die Logins funktionieren bei beiden Varianten*
|
||||
|
||||
!!! success "Immer auf dem neusten Stand"
|
||||
Die Demo Instanzen erhalten die neusten Updates direkt nach Release von GitHub. Vollautomatisch, ohne Downtime!
|
||||
|
||||
## Überblick
|
||||
|
||||
Die integrierte **mailcow UI** ermöglicht administrative Arbeiten auf Ihrer Mailserver-Instanz sowie einen getrennten Domain-Administrator- und Mailbox-Benutzer-Zugriff:
|
||||
|
||||
- [DKIM](http://dkim.org) und [ARC](http://arc-spec.org/) Unterstützung
|
||||
- Black- und Whitelists pro Domain und pro Benutzer
|
||||
- Spam-Score-Verwaltung pro Benutzer (Spam ablehnen, Spam markieren, Greylist)
|
||||
- Erlauben Sie Mailbox-Benutzern, temporäre Spam-Aliase zu erstellen
|
||||
- Voranstellen von E-Mail-Tags an den Betreff oder Verschieben von E-Mails in Unterordner (pro Benutzer)
|
||||
- Mailbox-Benutzer können die TLS-Durchsetzung für eingehende und ausgehende Nachrichten umschalten
|
||||
- Benutzer können die Caches von SOGo ActiveSync-Geräten zurücksetzen
|
||||
- imapsync, um entfernte Postfächer regelmäßig zu migrieren oder abzurufen
|
||||
- TFA: Yubikey OTP und U2F USB (nur Google Chrome und Derivate), TOTP
|
||||
- Hinzufügen von Domänen, Postfächern, Aliasen, Domänenaliasen und SOGo-Ressourcen
|
||||
- Hinzufügen von Whitelist-Hosts zur Weiterleitung von Mails an mailcow
|
||||
- Fail2ban-ähnliche Integration
|
||||
- Quarantäne-System
|
||||
- Antivirus-Scanning inkl. Makro-Scanning in Office-Dokumenten
|
||||
- Integrierte Basisüberwachung
|
||||
- Eine Menge mehr...
|
||||
|
||||
mailcow: dockerized kommt mit mehreren Containern, die in einem überbrückten Netzwerk verbunden sind.
|
||||
Jeder Container repräsentiert eine einzelne Anwendung.
|
||||
|
||||
- [ACME](https://letsencrypt.org/)
|
||||
- [ClamAV](https://www.clamav.net/) (optional)
|
||||
- [Dovecot](https://www.dovecot.org/)
|
||||
- [MariaDB](https://mariadb.org/)
|
||||
- [Memcached](https://www.memcached.org/)
|
||||
- [Netfilter](https://www.netfilter.org/) (Fail2ban-ähnliche Integration von [@mkuron](https://github.com/mkuron))
|
||||
- [Nginx](https://nginx.org/)
|
||||
- [Oletools](https://github.com/decalage2/oletools) über [Olefy](https://github.com/HeinleinSupport/olefy)
|
||||
- [PHP](https://php.net/)
|
||||
- [Postfix](http://www.postfix.org/)
|
||||
- [Redis](https://redis.io/)
|
||||
- [Rspamd](https://www.rspamd.com/)
|
||||
- [SOGo](https://sogo.nu/)
|
||||
- [Solr](https://solr.apache.org/) (optional)
|
||||
- [Unbound](https://unbound.net/)
|
||||
- Ein Watchdog für die grundlegende Überwachung
|
||||
|
||||
!!! warning "Achtung"
|
||||
Die Mails werden komprimiert und verschlüsselt gespeichert. Das Schlüsselpaar ist in crypt-vol-1 zu finden. Bitte vergessen Sie nicht, dieses zu sichern.
|
||||
|
||||
**Docker-Volumes** zur Aufbewahrung dynamischer Daten - kümmern Sie sich um sie!
|
||||
|
||||
- clamd-db-vol-1
|
||||
- crypt-vol-1
|
||||
- mysql-socket-vol-1
|
||||
- mysql-vol-1
|
||||
- postfix-vol-1
|
||||
- redis-vol-1
|
||||
- rspamd-vol-1
|
||||
- sogo-userdata-backup-vol-1
|
||||
- sogo-web-vol-1
|
||||
- solr-vol-1
|
||||
- vmail-index-vol-1
|
||||
- vmail-vol-1
|
||||
[^1]: Servercow ist eine Hosting/Support Sparte der The Infrastructure Company GmbH (mailcow Maintainer)
|
||||
168
docs/index.en.md
168
docs/index.en.md
|
|
@ -1,20 +1,99 @@
|
|||
# 🐮 + 🐋 = 💕
|
||||
<figure markdown>
|
||||
{ width="150" }
|
||||
</figure>
|
||||
|
||||
## Help mailcow
|
||||
# mailcow: dockerized - :cow: + :whale: = :two_hearts:
|
||||
**The mailserver suite with the 'moo'**
|
||||
|
||||
Please consider a support contract for a small monthly fee at [Servercow EN](https://www.servercow.de/mailcow?lang=en#support) to support further development. _We_ support _you_ while _you_ support _us_. :)
|
||||
## What is mailcow: dockerized?
|
||||
|
||||
If you are super awesome and would like to support without a contract, you can get a SAL license that confirms your awesomeness (a flexible one-time payment) at [Servercow EN](https://www.servercow.de/mailcow?lang=en#sal).
|
||||
!!! question
|
||||
Mailcow, MailCow or mailcow? What is the exact name of the project?
|
||||
|
||||
## Get support
|
||||
Correct: **mailcow**, because mailcow is a registered word mark with a small m :grin:
|
||||
|
||||
mailcow: dockerized is an open source groupware/email suite based on docker.
|
||||
|
||||
mailcow relies on many well known and long used components, which in combination result in an all around carefree email server.
|
||||
|
||||
Each container represents a single application, connected in a bridged network.
|
||||
|
||||
- [ACME](https://letsencrypt.org/) (Automatic generation of Let's Encrypt certificates)
|
||||
- [ClamAV](https://www.clamav.net/) (anti-virus scanner) (optional)
|
||||
- [Dovecot](https://www.dovecot.org/) (IMAP/POP server for retrieving mail)
|
||||
- [MariaDB](https://mariadb.org/) (database to store user information, etc.)
|
||||
- [Memcached](https://www.memcached.org/) (cache for the SOGo webmailer)
|
||||
- [Netfilter](https://www.netfilter.org/) (Fail2ban-like integration of [@mkuron](https://github.com/mkuron))
|
||||
- [Nginx](https://nginx.org/) (Web server for the mailcow UI)
|
||||
- [Oletools](https://github.com/decalage2/oletools) via [Olefy](https://github.com/HeinleinSupport/olefy) (analyzing office documents for viruses, macros, etc.)
|
||||
- [PHP](https://php.net/) (programming language for most web-based mailcow actions)
|
||||
- [Postfix](http://www.postfix.org/) (Receiver/sender for mail traffic on the Internet)
|
||||
- [Redis](https://redis.io/) (storage for spam information, DKIM keys, etc.)
|
||||
- [Rspamd](https://www.rspamd.com/) (spam filter with automatic learning of spam mails)
|
||||
- [SOGo](https://sogo.nu/) (integrated webmailer and cal/carddav interface)
|
||||
- [Solr](https://solr.apache.org/) (full-text search for IMAP connections for quick email search) (optional)
|
||||
- [Unbound](https://unbound.net/) (integrated DNS server to check DNSSEC etc.)
|
||||
- A watchdog for basic monitoring of container health inside mailcow
|
||||
|
||||
But the heart of mailcow is the graphical web interface, the **mailcow UI**.
|
||||
|
||||
It offers a place for almost all settings and allows the comfortable creation of new domains and email addresses with just a few clicks.
|
||||
|
||||
But also other or more tricky tasks can be done in it with ease:
|
||||
|
||||
- [DKIM](http://dkim.org) and [ARC](http://arc-spec.org/) support/generation.
|
||||
- Black and white lists per domain and per user.
|
||||
- Spam score management per user (reject spam, flag spam, greylist).
|
||||
- Allow mailbox users to create temporary spam aliases
|
||||
- Prepend email tags to subject or move emails to subfolders (per user)
|
||||
- Allow mailbox users to toggle TLS enforcement for inbound and outbound messages
|
||||
- Users can reset caches on SOGo ActiveSync devices
|
||||
- imapsync to periodically migrate or retrieve remote mailboxes
|
||||
- TFA: Yubikey OTP and WebAuthn USB (Google Chrome and derivatives only), TOTP
|
||||
- Add whitelist hosts to forward mail to mailcow
|
||||
- Fail2ban-like integration
|
||||
- Quarantine system
|
||||
- Anti-virus scanning including macro scanning in Office documents
|
||||
- Integrated basic monitoring
|
||||
- And much more...
|
||||
|
||||
The mailcow data (such as emails, user data, etc.) is stored in **Docker volumes** - take good care of these volumes:
|
||||
|
||||
- clamd-db-vol-1
|
||||
- crypt-vol-1
|
||||
- mysql-socket-vol-1
|
||||
- mysql-vol-1
|
||||
- postfix-vol-1
|
||||
- redis-vol-1
|
||||
- rspamd-vol-1
|
||||
- sogo-userdata-backup-vol-1
|
||||
- sogo-web-vol-1
|
||||
- solr-vol-1
|
||||
- vmail-index-vol-1
|
||||
- vmail-vol-1
|
||||
|
||||
!!! warning
|
||||
The mails are compressed and encrypted. The key pair can be found in crypt-vol-1. Please don't forget to backup this and other volumes. #nobackupnopity
|
||||
|
||||
---
|
||||
|
||||
## Support the mailcow project
|
||||
|
||||
Please consider a support contract for a small monthly fee at [Servercow](https://www.servercow.de/mailcow?lang=en#support)[^1] to support further development. _We_ support _you_ while _you_ support _us_. :)
|
||||
|
||||
If you are super awesome and would like to support without a contract, you can get a SAL (Stay-Awesome License) that confirms your awesomeness (a flexible one-time payment) at [Servercow](https://www.servercow.de/mailcow?lang=en#sal).
|
||||
|
||||
---
|
||||
|
||||
## Need help?
|
||||
|
||||
There are two ways to achieve support for your mailcow installation.
|
||||
|
||||
### Commercial support
|
||||
|
||||
For professional and prioritized commercial support you can sign a basic support subscription at [Servercow EN](https://www.servercow.de/mailcow?lang=en#support). For custom inquiries or questions please contact us at [info@servercow.de](mailto:info@servercow.de) instead.
|
||||
For professional and prioritized commercial support you can sign a basic support subscription at [Servercow](https://www.servercow.de/mailcow?lang=en#support). For custom inquiries or questions please contact us at [info@servercow.de](mailto:info@servercow.de) instead.
|
||||
|
||||
Furthermore we do also provide a fully featured and managed mailcow [here](https://www.servercow.de/mailcow#managed). This way we take care about the technical magic underneath and you can enjoy your whole mail experience in a hassle-free way.
|
||||
Furthermore we do also provide a fully featured and managed mailcow [here](https://www.servercow.de/mailcow?lang=en#managed). This way we take care about the technical magic underneath and you can enjoy your whole mail experience in a hassle-free way.
|
||||
|
||||
### Community support and chat
|
||||
|
||||
|
|
@ -34,77 +113,24 @@ For **bug tracking, feature requests and code contributions** only:
|
|||
|
||||
- GitHub @ [mailcow/mailcow-dockerized](https://github.com/mailcow/mailcow-dockerized)
|
||||
|
||||
## Demos
|
||||
---
|
||||
## Interested? Try it out right away!
|
||||
|
||||
Have we got your interest? Get a first overview of the functionalities of mailcow and your mailcow UI in our official **mailcow demos**!
|
||||
|
||||
Since September 2022 we´re providing two seperate Demo instances:
|
||||
|
||||
+ **[demo.mailcow.email](https://demo.mailcow.email)** is the classic Demo based on the **stable releases**.
|
||||
+ **[nightly-demo.mailcow.email](https://nightly-demo.mailcow.email)** is the new **nightly demo** based on unreleased testing features. (So especially interesting for those who have no possibility to create a test instance themselves.)
|
||||
|
||||
Use the following credentials to login on both demos:
|
||||
!!! abstract "Use these credentials for the demos"
|
||||
- **Administrator**: admin / moohoo
|
||||
- **Domain-Administrator**: department / moohoo
|
||||
- **Mailbox**: demo@440044.xyz / moohoo
|
||||
|
||||
- **Administrator**: admin / moohoo
|
||||
- **Domain-Administrator**: department / moohoo
|
||||
- **Mailbox**: demo@440044.xyz / moohoo
|
||||
*The login credentials work for both variants*.
|
||||
|
||||
!!! success
|
||||
!!! success "Always up to date"
|
||||
The demo instances get the latest updates directly after releases from GitHub. Fully automatic, without any downtime!
|
||||
|
||||
## Overview
|
||||
|
||||
The integrated **mailcow UI** allows administrative work on your mail server instance as well as separated domain administrator and mailbox user access:
|
||||
|
||||
- [DKIM](http://dkim.org) and [ARC](http://arc-spec.org/) support
|
||||
- Black- and whitelists per domain and per user
|
||||
- Spam score management per-user (reject spam, mark spam, greylist)
|
||||
- Allow mailbox users to create temporary spam aliases
|
||||
- Prepend mail tags to subject or move mail to sub folder (per-user)
|
||||
- Allow mailbox users to toggle incoming and outgoing TLS enforcement
|
||||
- Allow users to reset SOGo ActiveSync device caches
|
||||
- imapsync to migrate or pull remote mailboxes regularly
|
||||
- TFA: Yubikey OTP and U2F USB (Google Chrome and derivatives only), TOTP
|
||||
- Add domains, mailboxes, aliases, domain aliases and SOGo resources
|
||||
- Add whitelisted hosts to forward mail to mailcow
|
||||
- Fail2ban-like integration
|
||||
- Quarantine system
|
||||
- Antivirus scanning incl. macro scanning in office documents
|
||||
- Integrated basic monitoring
|
||||
- A lot more...
|
||||
|
||||
mailcow: dockerized comes with multiple containers linked in one bridged network.
|
||||
Each container represents a single application.
|
||||
|
||||
- [ACME](https://letsencrypt.org/)
|
||||
- [ClamAV](https://www.clamav.net/) (optional)
|
||||
- [Dovecot](https://www.dovecot.org/)
|
||||
- [MariaDB](https://mariadb.org/)
|
||||
- [Memcached](https://www.memcached.org/)
|
||||
- [Netfilter](https://www.netfilter.org/) (Fail2ban-like integration by [@mkuron](https://github.com/mkuron))
|
||||
- [Nginx](https://nginx.org/)
|
||||
- [Oletools](https://github.com/decalage2/oletools) via [Olefy](https://github.com/HeinleinSupport/olefy)
|
||||
- [PHP](https://php.net/)
|
||||
- [Postfix](http://www.postfix.org/)
|
||||
- [Redis](https://redis.io/)
|
||||
- [Rspamd](https://www.rspamd.com/)
|
||||
- [SOGo](https://sogo.nu/)
|
||||
- [Solr](https://solr.apache.org/) (optional)
|
||||
- [Unbound](https://unbound.net/)
|
||||
- A Watchdog to provide basic monitoring
|
||||
|
||||
!!! warning
|
||||
Mails are stored compressed and encrypted. The key pair can be found in crypt-vol-1. Be sure to backup this volume!
|
||||
|
||||
**Docker volumes** to keep dynamic data - take care of them!
|
||||
|
||||
- clamd-db-vol-1
|
||||
- crypt-vol-1
|
||||
- mysql-socket-vol-1
|
||||
- mysql-vol-1
|
||||
- postfix-vol-1
|
||||
- redis-vol-1
|
||||
- rspamd-vol-1
|
||||
- sogo-userdata-backup-vol-1
|
||||
- sogo-web-vol-1
|
||||
- solr-vol-1
|
||||
- vmail-index-vol-1
|
||||
- vmail-vol-1
|
||||
[^1]: Servercow is a hosting/support division of The Infrastructure Company GmbH (mailcow maintainer).
|
||||
|
|
@ -1,14 +1,21 @@
|
|||
Öffnen Sie `data/conf/postfix/extra.cf` und setzen Sie das `message_size_limit` entsprechend in Bytes. Siehe `main.cf` für den Standardwert.
|
||||
|
||||
Starten Sie Postfix neu:
|
||||
Sie müssen auch die Nachrichtengröße in den Konfigurationen von Rspamd und Clamav anpassen:
|
||||
|
||||
+ in `data/conf/rspamd/local.d/options.inc` fügen Sie den `max_message` Parameter entsprechend den im Postfix gesetzten Wert hinzu. Ziehen Sie die [Rspamd Docs](https://rspamd.com/doc/configuration/options.html#:~:text=DoS%20(default%3A%201024)-,max_message,-maximum%20size%20of) für den Standardwert zu rate.
|
||||
+ in `data/conf/rspamd/local.d/external_services.conf` ändern Sie den Wert `max_size` Parameter für `oletools`
|
||||
+ in `data/conf/rspamd/local.d/antivirus.conf` ändern Sie den Wert `max_size` Parameter für `clamav`
|
||||
+ in `data/conf/clamav/clamd.conf` ändern Sie den Wert `MaxScanSize` und `MaxFileSize` auf dieselbe Größe wie in der Postfix `extra.cf`
|
||||
|
||||
Starten Sie Postfix, Rspamd and Clamav neu:
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose restart postfix-mailcow
|
||||
docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose restart postfix-mailcow
|
||||
docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1,14 +1,22 @@
|
|||
Open `data/conf/postfix/extra.cf` and set the `message_size_limit` accordingly in bytes. See `main.cf` for the default value.
|
||||
|
||||
Restart Postfix:
|
||||
You will also need to adjust message size in Rspamd and Clamav configurations:
|
||||
|
||||
+ in `data/conf/rspamd/local.d/options.inc` add `max_message` parameter, check [Rspamd Docs](https://rspamd.com/doc/configuration/options.html#:~:text=DoS%20(default%3A%201024)-,max_message,-maximum%20size%20of) for defaults
|
||||
+ in `data/conf/rspamd/local.d/external_services.conf` adjust `max_size` parameter for `oletools`
|
||||
+ in `data/conf/rspamd/local.d/antivirus.conf` adjust `max_size` parameter for `clamav`
|
||||
+ in `data/conf/clamav/clamd.conf` adjust `MaxScanSize` and `MaxFileSize`
|
||||
|
||||
|
||||
Restart Postfix, Rspamd and Clamav:
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose restart postfix-mailcow
|
||||
docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose restart postfix-mailcow
|
||||
docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow
|
||||
```
|
||||
|
|
|
|||
|
|
@ -109,6 +109,7 @@ Wenn redis-cli sich beschwert über...
|
|||
...das Schlüsselmuster nicht gefunden wurde und somit keine Daten zum Löschen vorhanden sind - ist es in Ordnung.
|
||||
|
||||
## CLI-Werkzeuge
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
|
|
@ -233,6 +234,7 @@ GLOBAL_RCPT_BL {
|
|||
```
|
||||
|
||||
3. Speichern Sie die Datei und starten Sie Rspamd neu:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
|
|
@ -370,7 +372,6 @@ my_plugin { }
|
|||
|
||||
Falls Sie keinen Konfigurationsblock hinzufügen, dann wird das Modul automatisch deaktiviert und im Logfile des rspamd-mailcow Containers sehen Sie folgende Nachricht:
|
||||
|
||||
|
||||
```
|
||||
mailcowdockerized-rspamd-mailcow-1 | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: lua module my_plugin is enabled but has not been configured
|
||||
mailcowdockerized-rspamd-mailcow-1 | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: my_plugin disabling unconfigured lua module
|
||||
|
|
@ -380,3 +381,4 @@ Falls Sie das Modul erfolgreich konfiguiert haben, dann sollte das Logfile des r
|
|||
|
||||
```
|
||||
mailcowdockerized-rspamd-mailcow-1 | 2023-05-20 14:04:50 #1(main) <8ayxpf>; cfg; rspamd_init_lua_filters: init lua module my_plugin from /etc/rspamd/plugins.d//my_plugin.lua; digest: 5cb88961e5
|
||||
```
|
||||
|
|
|
|||
|
|
@ -108,8 +108,8 @@ If redis-cli complains about...
|
|||
|
||||
...the key pattern was not found and thus no data is available to delete - it is fine.
|
||||
|
||||
|
||||
## CLI tools
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
|
|
@ -194,12 +194,6 @@ To reset custom defined thresholds, run:
|
|||
# or:
|
||||
docker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e "delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';"
|
||||
```
|
||||
```
|
||||
source mailcow.conf
|
||||
docker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e "delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';"
|
||||
# or:
|
||||
# docker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e "delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';"
|
||||
```
|
||||
|
||||
## Custom reject messages
|
||||
|
||||
|
|
@ -240,6 +234,7 @@ GLOBAL_RCPT_BL {
|
|||
```
|
||||
|
||||
3. Save the file and restart Rspamd:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
Seit dem 28. Februar 2017 wird mailcow mit aktivierten Ports 80 und 443 geliefert.
|
||||
|
||||
**Verwenden Sie die untenstehende Konfiguration nicht für Reverse-Proxy-Setups**, bitte lesen Sie dazu unsere [Reverse-Proxy-Anleitung](../post_installation/firststeps-rp.md), die einen Redirect von HTTP zu HTTPS beinhaltet.
|
||||
**Verwenden Sie die untenstehende Konfiguration nicht für Reverse-Proxy-Setups**, bitte lesen Sie dazu unsere [Reverse-Proxy-Anleitung](../post_installation/reverse-proxy/r_p.md), die einen Redirect von HTTP zu HTTPS beinhaltet.
|
||||
|
||||
Öffne `mailcow.conf` und setze `HTTP_BIND=` - falls nicht bereits gesetzt.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
Since February the 28th 2017 mailcow does come with port 80 and 443 enabled.
|
||||
|
||||
**Do not use the config below for reverse proxy setups**, please see our [reverse proxy guide](../post_installation/firststeps-rp.md) for this, which includes a redirect from HTTP to HTTPS.
|
||||
**Do not use the config below for reverse proxy setups**, please see our [reverse proxy guide](../post_installation/reverse-proxy/r_p.md) for this, which includes a redirect from HTTP to HTTPS.
|
||||
|
||||
Open `mailcow.conf` and set `HTTP_BIND=` - if not already set.
|
||||
|
||||
|
|
|
|||
|
|
@ -1,390 +0,0 @@
|
|||
Sie müssen die Nginx-Seite, die mit mailcow: dockerized geliefert wird, nicht ändern.
|
||||
mailcow: dockerized vertraut auf das Standard-Gateway IP 172.22.1.1 als Proxy.
|
||||
|
||||
1\. Stellen Sie sicher, dass Sie HTTP_BIND und HTTPS_BIND in `mailcow.conf` auf eine lokale Adresse ändern und die Ports entsprechend einstellen, zum Beispiel:
|
||||
``` bash
|
||||
HTTP_BIND=127.0.0.1
|
||||
HTTP_PORT=8080
|
||||
HTTPS_BIND=127.0.0.1
|
||||
HTTPS_PORT=8443
|
||||
```
|
||||
|
||||
Dadurch werden auch die Bindungen innerhalb des Nginx-Containers geändert! Dies ist wichtig, wenn Sie sich entscheiden, einen Proxy innerhalb von Docker zu verwenden.
|
||||
|
||||
**WICHTIG:** Verwenden Sie nicht Port 8081, 9081 oder 65510!
|
||||
|
||||
Erzeugen Sie die betroffenen Container neu, indem Sie den folgenden Befehl ausführen:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
**Wichtige Informationen, bitte lesen Sie diese sorgfältig durch!**
|
||||
|
||||
!!! info
|
||||
Wenn Sie planen, einen Reverse-Proxy zu verwenden und einen anderen Servernamen als **MAILCOW_HOSTNAME** verwenden wollen, müssen Sie **Zusätzliche Servernamen für mailcow UI** am Ende dieser Seite hinzufügen.
|
||||
|
||||
!!! warning "Warnung"
|
||||
Stellen Sie sicher, dass Sie `generate_config.sh` ausführen, bevor Sie die untenstehenden Konfigurationsbeispiele aktivieren.
|
||||
Das Skript `generate_config.sh` kopiert die Snake-oil Zertifikate an den richtigen Ort, so dass die Dienste nicht aufgrund fehlender Dateien nicht starten können.
|
||||
|
||||
!!! warning "Warnung"
|
||||
Wenn Sie TLS SNI aktivieren (`ENABLE_TLS_SNI` in mailcow.conf), **müssen** die Zertifikatspfade in Ihrem Reverse-Proxy mit den korrekten Pfaden in data/assets/ssl/{hostname} übereinstimmen. Die Zertifikate werden in `data/assets/ssl/{hostname1,hostname2,etc}` aufgeteilt und werden daher nicht funktionieren, wenn Sie die Beispiele von unten kopieren, die auf `data/assets/ssl/cert.pem` etc. zeigen.
|
||||
|
||||
!!! info
|
||||
Die Verwendung der untenstehenden Site-Konfigurationen wird **acme-Anfragen an mailcow** weiterleiten und es die Zertifikate selbst verwalten lassen.
|
||||
Der Nachteil der Verwendung von mailcow als ACME-Client hinter einem Reverse-Proxy ist, dass Sie Ihren Webserver neu laden müssen, nachdem acme-mailcow das Zertifikat geändert/erneuert/erstellt hat. Sie können entweder Ihren Webserver täglich neu laden oder ein Skript schreiben, um die Datei auf Änderungen zu überwachen.
|
||||
Auf vielen Servern wird logrotate den Webserver sowieso täglich neu laden.
|
||||
|
||||
Wenn Sie eine lokale Certbot-Installation verwenden möchten, müssen Sie die SSL-Zertifikatsparameter entsprechend ändern.
|
||||
**Stellen Sie sicher, dass Sie ein Post-Hook-Skript** ausführen, wenn Sie sich entscheiden, externe ACME-Clients zu verwenden. Ein Beispiel finden Sie am Ende dieser Seite.
|
||||
|
||||
|
||||
2\. Konfigurieren Sie Ihren lokalen Webserver als Reverse Proxy:
|
||||
|
||||
### Apache 2.4
|
||||
Erforderliche Module:
|
||||
```
|
||||
a2enmod rewrite proxy proxy_http headers ssl
|
||||
```
|
||||
|
||||
Let's Encrypt wird unserem Rewrite folgen, Zertifikatsanfragen in mailcow werden problemlos funktionieren.
|
||||
|
||||
**Die hervorgehobenen Zeilen müssen beachtet werden**.
|
||||
|
||||
``` apache hl_lines="2 10 11 17 22 23 24 25 30 31"
|
||||
<VirtualHost *:80>
|
||||
ServerName ZU MAILCOW HOSTNAMEN ÄNDERN
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTPS} off
|
||||
RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]
|
||||
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "http"
|
||||
</VirtualHost>
|
||||
<VirtualHost *:443>
|
||||
ServerName ZU MAILCOW HOSTNAMEN ÄNDERN
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
|
||||
# You should proxy to a plain HTTP session to offload SSL processing
|
||||
ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000
|
||||
ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
SSLCertificateFile MAILCOW_ORDNER/data/assets/ssl/cert.pem
|
||||
SSLCertificateKeyFile MAILCOW_ORDNER/data/assets/ssl/key.pem
|
||||
|
||||
# Wenn Sie einen HTTPS-Host als Proxy verwenden möchten:
|
||||
#SSLProxyEngine On
|
||||
|
||||
# Wenn Sie einen Proxy für einen nicht vertrauenswürdigen HTTPS-Host einrichten wollen:
|
||||
#SSLProxyVerify none
|
||||
#SSLProxyCheckPeerCN off
|
||||
#SSLProxyCheckPeerName off
|
||||
#SSLProxyCheckPeerExpire off
|
||||
</VirtualHost>
|
||||
```
|
||||
### Nginx
|
||||
|
||||
Let's Encrypt folgt unserem Rewrite, Zertifikatsanfragen funktionieren problemlos.
|
||||
|
||||
**Achten Sie auf die hervorgehobenen Zeilen**.
|
||||
|
||||
``` hl_lines="4 10 12 13 25 39"
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name ZU MAILCOW HOSTNAMEN ÄNDERN autodiscover.* autoconfig.*;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name ZU MAILCOW HOSTNAMEN ÄNDERN autodiscover.* autoconfig.*;
|
||||
|
||||
ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;
|
||||
ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# Siehe https://ssl-config.mozilla.org/#server=nginx für die neuesten Empfehlungen zu ssl-Einstellungen
|
||||
# Ein Beispiel für eine Konfiguration ist unten angegeben
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
location /Microsoft-Server-ActiveSync {
|
||||
proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 75;
|
||||
proxy_send_timeout 3650;
|
||||
proxy_read_timeout 3650;
|
||||
proxy_buffers 64 512k; # Seit dem 2022-04 Update nötig für SOGo
|
||||
client_body_buffer_size 512k;
|
||||
client_max_body_size 0;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
# Die folgenden Proxy-Buffer müssen gesetzt werden, wenn Sie SOGo nach dem Update 2022-04 (April 2022) verwenden wollen
|
||||
# Andernfalls wird ein Login wie folgt fehlschlagen: https://github.com/mailcow/mailcow-dockerized/issues/4537
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 64 512k;
|
||||
proxy_busy_buffers_size 512k;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### HAProxy (von der Community unterstützt)
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Community Beitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
**Wichtig/Fix erwünscht**: Dieses Beispiel leitet nur HTTPS-Verkehr weiter und benutzt nicht den in mailcow eingebauten ACME-Client.
|
||||
|
||||
```
|
||||
frontend https-in
|
||||
bind :::443 v4v6 ssl crt mailcow.pem
|
||||
default_backend mailcow
|
||||
|
||||
backend mailcow
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
||||
http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
|
||||
server mailcow 127.0.0.1:8080 check
|
||||
```
|
||||
|
||||
### Traefik v2 (von der Community unterstützt)
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Community Beitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
**Wichtig**: Diese Konfiguration deckt nur das "Reverseproxing" des Webpanels (nginx-mailcow) unter Verwendung von Traefik v2 ab. Wenn Sie auch die Mail-Dienste wie dovecot, postfix... reproxen wollen, müssen Sie die folgende Konfiguration an jeden Container anpassen und einen [EntryPoint](https://docs.traefik.io/routing/entrypoints/) in Ihrer `traefik.toml` oder `traefik.yml` (je nachdem, welche Konfiguration Sie verwenden) für jeden Port erstellen.
|
||||
|
||||
In diesem Abschnitt gehen wir davon aus, dass Sie Ihren Traefik 2 `[certificatesresolvers]` in Ihrer Traefik-Konfigurationsdatei richtig konfiguriert haben und auch acme verwenden. Das folgende Beispiel verwendet Lets Encrypt, aber Sie können es gerne auf Ihren eigenen Zertifikatsresolver ändern. Eine grundlegende Traefik 2 toml-Konfigurationsdatei mit allen oben genannten Elementen, die für dieses Beispiel verwendet werden kann, finden Sie hier [traefik.toml](https://github.com/Frenzoid/TraefikBasicConfig/blob/master/traefik.toml), falls Sie eine solche Datei benötigen oder einen Hinweis, wie Sie Ihre Konfiguration anpassen können.
|
||||
|
||||
Zuallererst werden wir den acme-mailcow-Container deaktivieren, da wir die von traefik bereitgestellten Zertifikate verwenden werden.
|
||||
Dazu müssen wir `SKIP_LETS_ENCRYPT=y` in unserer `mailcow.conf` setzen und den folgenden Befehl ausführen, um die Änderungen zu übernehmen:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Dann erstellen wir eine `docker-compose.override.yml` Datei, um die Hauptdatei `docker-compose.yml` zu überschreiben, die sich im mailcow-Stammverzeichnis befindet.
|
||||
|
||||
```yaml
|
||||
version: '2.1'
|
||||
|
||||
services:
|
||||
nginx-mailcow:
|
||||
networks:
|
||||
# Traefiks Netzwerk hinzufügen
|
||||
web:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
# Erstellt einen Router namens "moo" für den Container und richtet eine Regel ein, um den Container mit einer bestimmten Regel zu verknüpfen,
|
||||
# in diesem Fall eine Host-Regel mit unserer MAILCOW_HOSTNAME-Variable.
|
||||
- traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)
|
||||
# Aktiviert tls über den zuvor erstellten Router.
|
||||
- traefik.http.routers.moo.tls=true
|
||||
# Gibt an, welche Art von Cert-Resolver wir verwenden werden, in diesem Fall le (Lets Encrypt).
|
||||
- traefik.http.routers.moo.tls.certresolver=le
|
||||
# Erzeugt einen Dienst namens "moo" für den Container und gibt an, welchen internen Port des Containers
|
||||
# Traefik die eingehenden Daten weiterleiten soll.
|
||||
- traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}
|
||||
# Gibt an, welchen Eingangspunkt (externer Port) traefik für diesen Container abhören soll.
|
||||
# Websecure ist Port 443, siehe die Datei traefik.toml wie oben.
|
||||
- traefik.http.routers.moo.entrypoints=websecure
|
||||
# Stellen Sie sicher, dass traefik das Web-Netzwerk verwendet, nicht das mailcowdockerized_mailcow-network
|
||||
- traefik.docker.network=traefik_web
|
||||
|
||||
certdumper:
|
||||
image: humenius/traefik-certs-dumper
|
||||
command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1
|
||||
network_mode: none
|
||||
volumes:
|
||||
# Binden Sie das Volume, das Traefiks `acme.json' Datei enthält, ein
|
||||
- acme:/traefik:ro
|
||||
# SSL-Ordner von mailcow einhängen
|
||||
- ./data/assets/ssl/:/output:rw
|
||||
# Binden Sie den Docker Socket ein, damit traefik-certs-dumper die Container neu starten kann
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
restart: always
|
||||
environment:
|
||||
# Ändern Sie dies nur, wenn Sie eine andere Domain für mailcows Web-Frontend verwenden als in der Standard-Konfiguration
|
||||
- DOMAIN=${MAILCOW_HOSTNAME}
|
||||
|
||||
networks:
|
||||
web:
|
||||
external: true
|
||||
# Name des externen Netzwerks
|
||||
name: traefik_web
|
||||
|
||||
volumes:
|
||||
acme:
|
||||
external: true
|
||||
# Name des externen Docker Volumes, welches Traefiks `acme.json' Datei enthält
|
||||
name: traefik_acme
|
||||
```
|
||||
|
||||
Starten Sie die neuen Container mit:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Da Traefik 2 ein acme v2 Format verwendet, um ALLE Zertifikaten von allen Domains zu speichern, müssen wir einen Weg finden, die Zertifikate auszulagern. Zum Glück haben wir [diesen kleinen Container] (https://hub.docker.com/r/humenius/traefik-certs-dumper), der die Datei `acme.json` über ein Volume und eine Variable `DOMAIN=example. org`, und damit wird der Container die `cert.pem` und `key.pem` Dateien ausgeben, dafür lassen wir einfach den `traefik-certs-dumper` Container laufen, binden das `/traefik` Volume an den Ordner, in dem unsere `acme.json` gespeichert ist, binden das `/output` Volume an unseren mailcow `data/assets/ssl/` Ordner, und setzen die `DOMAIN=example.org` Variable auf die Domain, von der wir die Zertifikate ausgeben wollen.
|
||||
|
||||
Dieser Container überwacht die Datei `acme.json` auf Änderungen und generiert die Dateien `cert.pem` und `key.pem` direkt in `data/assets/ssl/`, wobei der Pfad mit dem `/output`-Pfad des Containers verbunden ist.
|
||||
|
||||
Sie können es über die Kommandozeile ausführen oder das [hier](https://hub.docker.com/r/humenius/traefik-certs-dumper) gezeigte docker-compose.yml verwenden.
|
||||
|
||||
Nachdem wir die Zertifikate übertragen haben, müssen wir die Konfigurationen aus unseren Postfix- und Dovecot-Containern neu laden und die Zertifikate überprüfen. Wie das geht, sehen Sie [hier](https://mailcow.github.io/mailcow-dockerized-docs/de/post_installation/firststeps-ssl/#ein-eigenes-zertifikat-verwenden).
|
||||
|
||||
Und das sollte es gewesen sein 😊, Sie können überprüfen, ob der Traefik-Router einwandfrei funktioniert, indem Sie das Dashboard von Traefik / traefik logs / über https auf die eingestellte Domain zugreifen, oder / und HTTPS, SMTP und IMAP mit den Befehlen auf der zuvor verlinkten Seite überprüfen.
|
||||
|
||||
### Caddy v2 (von der Community unterstützt)
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Communitybeitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
Die Konfiguration von Caddy mit mailcow ist sehr simpel.
|
||||
|
||||
In der Caddyfile muss einfach nur ein Bereich für den E-Mailserver angelegt werden.
|
||||
|
||||
Bspw:
|
||||
|
||||
``` hl_lines="1 3 13"
|
||||
|
||||
MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {
|
||||
log {
|
||||
output file /var/log/caddy/MAILCOW_HOSTNAME.log {
|
||||
roll_disabled
|
||||
roll_size 512M
|
||||
roll_uncompressed
|
||||
roll_local_time
|
||||
roll_keep 3
|
||||
roll_keep_for 48h
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:HTTP_BIND
|
||||
}
|
||||
```
|
||||
|
||||
Dies erlaubt es Caddy automatisch die Zertifikate zu erstellen und den Traffic für diese erwähnten Domains anzunehmen und an mailcow weiterzuleiten.
|
||||
|
||||
**Wichtig**: Der ACME Client der mailcow muss deaktiviert sein, da es sonst zu Fehlern seitens mailcow kommt.
|
||||
|
||||
Da Caddy sich direkt selbst um die Zertifikate kümmert, können wir mit dem folgenden Skript die Caddy generierten Zertifikate in die mailcow inkludieren:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
MD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))
|
||||
MD5SUM_NEW_CERT=($(md5sum /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt))
|
||||
|
||||
if [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.key /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
|
||||
else
|
||||
echo "Certs not copied from Caddy (Not needed)"
|
||||
fi
|
||||
```
|
||||
|
||||
!!! warning "Achtung"
|
||||
Der Zertifikatspfad von Caddy variiert je nach Installationsart.<br>
|
||||
Bei diesem Installationsbeispiel wurde Caddy mithilfe des Caddy Repos ([weitere Informationen hier](https://caddyserver.com/docs/install#debian-ubuntu-raspbian)) installiert.<br>
|
||||
<br>
|
||||
Um den Caddy Zertifikatspfad auf Ihrem System herauszufinden, genügt ein `find / -name "certificates"`.
|
||||
|
||||
|
||||
Dieses Skript könnte dann als Cronjob jede Stunde aufgerufen werden:
|
||||
|
||||
```bash
|
||||
0 * * * * /bin/bash /path/to/script/deploy-certs.sh >/dev/null 2>&1
|
||||
```
|
||||
|
||||
### Optional: Post-Hook-Skript für nicht-mailcow ACME-Clients
|
||||
|
||||
Die Verwendung eines lokalen Certbots (oder eines anderen ACME-Clients) erfordert den Neustart einiger Container, was Sie mit einem Post-Hook-Skript erledigen können.
|
||||
Stellen Sie sicher, dass Sie die Pfade entsprechend ändern:
|
||||
```
|
||||
#!/bin/bash
|
||||
cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
```
|
||||
|
||||
### Hinzufügen weiterer Servernamen für mailcow UI
|
||||
|
||||
Wenn Sie vorhaben, einen Servernamen zu verwenden, der nicht `MAILCOW_HOSTNAME` in Ihrem Reverse-Proxy ist, stellen Sie sicher, dass Sie diesen Namen zuerst in mailcow.conf über `ADDITIONAL_SERVER_NAMES` einpflegen. Die Namen müssen durch Kommas getrennt werden und **dürfen** keine Leerzeichen enthalten. Wenn Sie diesen Schritt überspringen, kann es sein, dass mailcow auf Ihren Reverse-Proxy mit einer falschen Seite antwortet.
|
||||
|
||||
```
|
||||
ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld
|
||||
```
|
||||
|
||||
Führen Sie zum Anwenden folgendes aus:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
|
@ -1,393 +0,0 @@
|
|||
You don't need to change the Nginx site that comes with mailcow: dockerized.
|
||||
mailcow: dockerized trusts the default gateway IP 172.22.1.1 as proxy.
|
||||
|
||||
1\. Make sure you change HTTP_BIND and HTTPS_BIND in `mailcow.conf` to a local address and set the ports accordingly, for example:
|
||||
``` bash
|
||||
HTTP_BIND=127.0.0.1
|
||||
HTTP_PORT=8080
|
||||
HTTPS_BIND=127.0.0.1
|
||||
HTTPS_PORT=8443
|
||||
```
|
||||
|
||||
This will also change the bindings inside the Nginx container! This is important, if you decide to use a proxy within Docker.
|
||||
|
||||
**IMPORTANT:** Do not use port 8081, 9081 or 65510!
|
||||
|
||||
Recreate affected containers by running the command:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
**Important information, please read them carefully!**
|
||||
|
||||
!!! info
|
||||
If you plan to use a reverse proxy and want to use another server name that is **not** MAILCOW_HOSTNAME, you need to read **Adding additional server names for mailcow UI** at the bottom of this page.
|
||||
|
||||
!!! warning
|
||||
Make sure you run `generate_config.sh` before you enable any site configuration examples below.
|
||||
The script `generate_config.sh` copies snake-oil certificates to the correct location, so the services will not fail to start due to missing files.
|
||||
|
||||
!!! warning
|
||||
If you enable TLS SNI (`ENABLE_TLS_SNI` in mailcow.conf), the certificate paths in your reverse proxy **must** match the correct paths in data/assets/ssl/{hostname}. The certificates will be split into `data/assets/ssl/{hostname1,hostname2,etc}` and therefore will not work when you copy the examples from below pointing to `data/assets/ssl/cert.pem` etc.
|
||||
|
||||
!!! info
|
||||
Using the site configs below will **forward ACME requests to mailcow** and let it handle certificates itself.
|
||||
The downside of using mailcow as ACME client behind a reverse proxy is, that you will need to reload your webserver after acme-mailcow changed/renewed/created the certificate. You can either reload your webserver daily or write a script to watch the file for changes.
|
||||
On many servers logrotate will reload the webserver daily anyway.
|
||||
|
||||
If you want to use a local certbot installation, you will need to change the SSL certificate parameters accordingly.
|
||||
**Make sure you run a post-hook script** when you decide to use external ACME clients. You will find an example at the bottom of this page.
|
||||
|
||||
|
||||
2\. Configure your local webserver as reverse proxy:
|
||||
|
||||
### Apache 2.4
|
||||
Required modules:
|
||||
```
|
||||
a2enmod rewrite proxy proxy_http headers ssl
|
||||
```
|
||||
|
||||
Let's Encrypt will follow our rewrite, certificate requests in mailcow will work fine.
|
||||
|
||||
**Take care of highlighted lines.**
|
||||
|
||||
``` apache hl_lines="2 10 11 17 22 23 24 25 30 31"
|
||||
<VirtualHost *:80>
|
||||
ServerName CHANGE_TO_MAILCOW_HOSTNAME
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTPS} off
|
||||
RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]
|
||||
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "http"
|
||||
</VirtualHost>
|
||||
<VirtualHost *:443>
|
||||
ServerName CHANGE_TO_MAILCOW_HOSTNAME
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
|
||||
# You should proxy to a plain HTTP session to offload SSL processing
|
||||
ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000
|
||||
ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
SSLCertificateFile MAILCOW_PATH/data/assets/ssl/cert.pem
|
||||
SSLCertificateKeyFile MAILCOW_PATH/data/assets/ssl/key.pem
|
||||
|
||||
# If you plan to proxy to a HTTPS host:
|
||||
#SSLProxyEngine On
|
||||
|
||||
# If you plan to proxy to an untrusted HTTPS host:
|
||||
#SSLProxyVerify none
|
||||
#SSLProxyCheckPeerCN off
|
||||
#SSLProxyCheckPeerName off
|
||||
#SSLProxyCheckPeerExpire off
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
### Nginx
|
||||
|
||||
Let's Encrypt will follow our rewrite, certificate requests will work fine.
|
||||
|
||||
**Take care of highlighted lines.**
|
||||
|
||||
``` hl_lines="4 10 12 13 25 39"
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;
|
||||
|
||||
ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;
|
||||
ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations
|
||||
# An example config is given below
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
location /Microsoft-Server-ActiveSync {
|
||||
proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 75;
|
||||
proxy_send_timeout 3650;
|
||||
proxy_read_timeout 3650;
|
||||
proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo
|
||||
client_body_buffer_size 512k;
|
||||
client_max_body_size 0;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
# The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update
|
||||
# Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 64 512k;
|
||||
proxy_busy_buffers_size 512k;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### HAProxy (community supported)
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
**Important/Fixme**: This example only forwards HTTPS traffic and does not use mailcows built-in ACME client.
|
||||
|
||||
```
|
||||
frontend https-in
|
||||
bind :::443 v4v6 ssl crt mailcow.pem
|
||||
default_backend mailcow
|
||||
|
||||
backend mailcow
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
||||
http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
|
||||
server mailcow 127.0.0.1:8080 check
|
||||
```
|
||||
|
||||
### Traefik v2 (community supported)
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
**Important**: This config only covers the "reverseproxing" of the webpannel (nginx-mailcow) using Traefik v2, if you also want to reverseproxy the mail services such as dovecot, postfix... you'll just need to adapt the following config to each container and create an [EntryPoint](https://docs.traefik.io/routing/entrypoints/) on your `traefik.toml` or `traefik.yml` (depending which config you use) for each port.
|
||||
|
||||
For this section we'll assume you have your Traefik 2 `[certificatesresolvers]` properly configured on your traefik configuration file, and also using acme, also, the following example uses Lets Encrypt, but feel free to change it to your own cert resolver. You can find a basic Traefik 2 toml config file with all the above implemented which can be used for this example here [traefik.toml](https://github.com/Frenzoid/TraefikBasicConfig/blob/master/traefik.toml) if you need one, or a hint on how to adapt your config.
|
||||
|
||||
|
||||
So, first of all, we are going to disable the acme-mailcow container since we'll use the certs that traefik will provide us.
|
||||
For this we'll have to set `SKIP_LETS_ENCRYPT=y` on our `mailcow.conf`, and run the following command to apply the changes:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Then we'll create a `docker-compose.override.yml` file in order to override the main `docker-compose.yml` found in your mailcow root folder.
|
||||
|
||||
```yaml
|
||||
version: '2.1'
|
||||
|
||||
services:
|
||||
nginx-mailcow:
|
||||
networks:
|
||||
# Add Traefik's network
|
||||
web:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
# Creates a router called "moo" for the container, and sets up a rule to link the container to certain rule,
|
||||
# in this case, a Host rule with our MAILCOW_HOSTNAME var.
|
||||
- traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)
|
||||
# Enables tls over the router we created before.
|
||||
- traefik.http.routers.moo.tls=true
|
||||
# Specifies which kind of cert resolver we'll use, in this case le (Lets Encrypt).
|
||||
- traefik.http.routers.moo.tls.certresolver=le
|
||||
# Creates a service called "moo" for the container, and specifies which internal port of the container
|
||||
# should traefik route the incoming data to.
|
||||
- traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}
|
||||
# Specifies which entrypoint (external port) should traefik listen to, for this container.
|
||||
# websecure being port 443, check the traefik.toml file liked above.
|
||||
- traefik.http.routers.moo.entrypoints=websecure
|
||||
# Make sure traefik uses the web network, not the mailcowdockerized_mailcow-network
|
||||
- traefik.docker.network=traefik_web
|
||||
|
||||
certdumper:
|
||||
image: humenius/traefik-certs-dumper
|
||||
command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1
|
||||
network_mode: none
|
||||
volumes:
|
||||
# Mount the volume which contains Traefik's `acme.json' file
|
||||
# Configure the external name in the volume definition
|
||||
- acme:/traefik:ro
|
||||
# Mount mailcow's SSL folder
|
||||
- ./data/assets/ssl/:/output:rw
|
||||
# Mount docker socket to restart containers
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
restart: always
|
||||
environment:
|
||||
# only change this, if you're using another domain for mailcow's web frontend compared to the standard config
|
||||
- DOMAIN=${MAILCOW_HOSTNAME}
|
||||
|
||||
networks:
|
||||
web:
|
||||
external: true
|
||||
# Name of the external network
|
||||
name: traefik_web
|
||||
|
||||
volumes:
|
||||
acme:
|
||||
external: true
|
||||
# Name of the external docker volume which contains Traefik's `acme.json' file
|
||||
name: traefik_acme
|
||||
```
|
||||
|
||||
Start the new containers with:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
|
||||
Now, there's only one thing left to do, which is setup the certs so that the mail services can use them as well, since Traefik 2 uses an acme v2 format to save ALL the license from all the domains we have, we'll need to find a way to dump the certs, lucky we have [this tiny container](https://hub.docker.com/r/humenius/traefik-certs-dumper) which grabs the `acme.json` file through a volume, and a variable `DOMAIN=example.org`, and with these, the container will output the `cert.pem` and `key.pem` files, for this we'll simply run the `traefik-certs-dumper` container binding the `/traefik` volume to the folder where our `acme.json` is saved, bind the `/output` volume to our mailcow `data/assets/ssl/` folder, and set up the `DOMAIN=example.org` variable to the domain we want the certs dumped from.
|
||||
|
||||
This container will watch over the `acme.json` file for any changes, and regenerate the `cert.pem` and `key.pem` files directly into `data/assets/ssl/` being the path binded to the container's `/output` path.
|
||||
|
||||
You can use the command line to run it, or use the docker-compose.yml shown [here](https://hub.docker.com/r/humenius/traefik-certs-dumper).
|
||||
|
||||
After we have the certs dumped, we'll have to reload the configs from our postfix and dovecot containers, and check the certs, you can see how [here](https://mailcow.github.io/mailcow-dockerized-docs/firststeps-ssl/#how-to-use-your-own-certificate).
|
||||
|
||||
Aaand that should be it 😊, you can check if the Traefik router works fine through Traefik's dashboard / traefik logs / accessing the setted domain through https, or / and check HTTPS, SMTP and IMAP through the commands shown on the page linked before.
|
||||
|
||||
|
||||
### Caddy v2 (supported by the community)
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
The configuration of Caddy with mailcow is very simple.
|
||||
|
||||
In the caddyfile you just have to create a section for the mailserver.
|
||||
|
||||
For example
|
||||
``` hl_lines="1 3 13"
|
||||
|
||||
MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {
|
||||
log {
|
||||
output file /var/log/caddy/MAILCOW_HOSTNAME.log {
|
||||
roll_disabled
|
||||
roll_size 512M
|
||||
roll_uncompressed
|
||||
roll_local_time
|
||||
roll_keep 3
|
||||
roll_keep_for 48h
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:HTTP_BIND
|
||||
}
|
||||
```
|
||||
|
||||
This allows Caddy to automatically create the certificates and accept traffic for these mentioned domains and forward them to mailcow.
|
||||
|
||||
**Important**: The ACME client of mailcow must be disabled, otherwise mailcow will fail.
|
||||
|
||||
Since Caddy takes care of the certificates itself, we can use the following script to include the Caddy generated certificates into mailcow:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
MD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))
|
||||
MD5SUM_NEW_CERT=($(md5sum /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt))
|
||||
|
||||
if [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.key /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
|
||||
else
|
||||
echo "Certs not copied from Caddy (Not needed)"
|
||||
fi
|
||||
```
|
||||
|
||||
!!! warning "Attention"
|
||||
Caddy's certificate path varies depending on the installation type.<br>
|
||||
In this installation example, Caddy was installed using the Caddy repo ([more informations here](https://caddyserver.com/docs/install#debian-ubuntu-raspbian)).<br>
|
||||
<br>
|
||||
To find out the Caddy certificate path on your system, just run a `find / -name "certificates"`.
|
||||
|
||||
This script could be called as a cronjob every hour:
|
||||
|
||||
```bash
|
||||
0 * * * * /bin/bash /path/to/script/deploy-certs.sh >/dev/null 2>&1
|
||||
```
|
||||
|
||||
### Optional: Post-hook script for non-mailcow ACME clients
|
||||
|
||||
Using a local certbot (or any other ACME client) requires to restart some containers, you can do this with a post-hook script.
|
||||
Make sure you change the paths accordingly:
|
||||
```
|
||||
#!/bin/bash
|
||||
cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
```
|
||||
|
||||
### Adding additional server names for mailcow UI
|
||||
|
||||
If you plan to use a server name that is not `MAILCOW_HOSTNAME` in your reverse proxy, make sure to populate that name in mailcow.conf via `ADDITIONAL_SERVER_NAMES` first. Names must be separated by commas and **must not** contain spaces. If you skip this step, mailcow may respond to your reverse proxy with an incorrect site.
|
||||
|
||||
```
|
||||
ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld
|
||||
```
|
||||
|
||||
Run the following command to apply:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
|
@ -235,7 +235,7 @@ docker restart $(docker ps -qaf name=nginx-mailcow)
|
|||
docker restart $(docker ps -qaf name=dovecot-mailcow)
|
||||
```
|
||||
|
||||
Siehe [Post-Hook-Skript für Nicht-mailcow-ACME-Clients](../firststeps-rp#optional-post-hook-skript-fur-nicht-mailcow-acme-clients) für ein vollständiges Beispielskript.
|
||||
Siehe [Post-Hook-Skript für Nicht-mailcow-ACME-Clients](../reverse-proxy/r_p#optional-post-hook-skript-fur-nicht-mailcow-acme-clients) für ein vollständiges Beispielskript.
|
||||
|
||||
### Test gegen das ACME-Verzeichnis
|
||||
|
||||
|
|
|
|||
|
|
@ -235,7 +235,7 @@ docker restart $(docker ps -qaf name=nginx-mailcow)
|
|||
docker restart $(docker ps -qaf name=dovecot-mailcow)
|
||||
```
|
||||
|
||||
See [Post-hook script for non-mailcow ACME clients](../firststeps-rp/#optional-post-hook-script-for-non-mailcow-acme-clients) for a full example script.
|
||||
See [Post-hook script for non-mailcow ACME clients](../reverse-proxy/r_p/#optional-post-hook-script-for-non-mailcow-acme-clients) for a full example script.
|
||||
|
||||
### Test against staging ACME directory
|
||||
|
||||
|
|
|
|||
55
docs/post_installation/reverse-proxy/r_p-apache24.de.md
Normale Datei
55
docs/post_installation/reverse-proxy/r_p-apache24.de.md
Normale Datei
|
|
@ -0,0 +1,55 @@
|
|||
!!! warning "Wichtig"
|
||||
Lesen Sie zuerst [die Übersicht](r_p.md).
|
||||
|
||||
Erforderliche Module:
|
||||
```
|
||||
a2enmod rewrite proxy proxy_http headers ssl
|
||||
```
|
||||
|
||||
Let's Encrypt wird unserem Rewrite folgen, Zertifikatsanfragen in mailcow werden problemlos funktionieren.
|
||||
|
||||
**Die hervorgehobenen Zeilen müssen beachtet werden**.
|
||||
|
||||
``` apache hl_lines="2 10 11 17 22 23 24 25 30 31"
|
||||
<VirtualHost *:80>
|
||||
ServerName ZU MAILCOW HOSTNAMEN ÄNDERN
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTPS} off
|
||||
RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]
|
||||
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "http"
|
||||
</VirtualHost>
|
||||
<VirtualHost *:443>
|
||||
ServerName ZU MAILCOW HOSTNAMEN ÄNDERN
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
|
||||
# You should proxy to a plain HTTP session to offload SSL processing
|
||||
ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000
|
||||
ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
SSLCertificateFile MAILCOW_ORDNER/data/assets/ssl/cert.pem
|
||||
SSLCertificateKeyFile MAILCOW_ORDNER/data/assets/ssl/key.pem
|
||||
|
||||
# Wenn Sie einen HTTPS-Host als Proxy verwenden möchten:
|
||||
#SSLProxyEngine On
|
||||
|
||||
# Wenn Sie einen Proxy für einen nicht vertrauenswürdigen HTTPS-Host einrichten wollen:
|
||||
#SSLProxyVerify none
|
||||
#SSLProxyCheckPeerCN off
|
||||
#SSLProxyCheckPeerName off
|
||||
#SSLProxyCheckPeerExpire off
|
||||
</VirtualHost>
|
||||
```
|
||||
55
docs/post_installation/reverse-proxy/r_p-apache24.en.md
Normale Datei
55
docs/post_installation/reverse-proxy/r_p-apache24.en.md
Normale Datei
|
|
@ -0,0 +1,55 @@
|
|||
!!! warning "Important"
|
||||
First read [the overview](r_p.md).
|
||||
|
||||
Required modules:
|
||||
```
|
||||
a2enmod rewrite proxy proxy_http headers ssl
|
||||
```
|
||||
|
||||
Let's Encrypt will follow our rewrite, certificate requests in mailcow will work fine.
|
||||
|
||||
**Take care of highlighted lines.**
|
||||
|
||||
``` apache hl_lines="2 10 11 17 22 23 24 25 30 31"
|
||||
<VirtualHost *:80>
|
||||
ServerName CHANGE_TO_MAILCOW_HOSTNAME
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTPS} off
|
||||
RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]
|
||||
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "http"
|
||||
</VirtualHost>
|
||||
<VirtualHost *:443>
|
||||
ServerName CHANGE_TO_MAILCOW_HOSTNAME
|
||||
ServerAlias autodiscover.*
|
||||
ServerAlias autoconfig.*
|
||||
|
||||
# You should proxy to a plain HTTP session to offload SSL processing
|
||||
ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000
|
||||
ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync
|
||||
ProxyPass / http://127.0.0.1:8080/
|
||||
ProxyPassReverse / http://127.0.0.1:8080/
|
||||
ProxyPreserveHost On
|
||||
ProxyAddHeaders On
|
||||
RequestHeader set X-Forwarded-Proto "https"
|
||||
|
||||
SSLCertificateFile MAILCOW_PATH/data/assets/ssl/cert.pem
|
||||
SSLCertificateKeyFile MAILCOW_PATH/data/assets/ssl/key.pem
|
||||
|
||||
# If you plan to proxy to a HTTPS host:
|
||||
#SSLProxyEngine On
|
||||
|
||||
# If you plan to proxy to an untrusted HTTPS host:
|
||||
#SSLProxyVerify none
|
||||
#SSLProxyCheckPeerCN off
|
||||
#SSLProxyCheckPeerName off
|
||||
#SSLProxyCheckPeerExpire off
|
||||
</VirtualHost>
|
||||
```
|
||||
66
docs/post_installation/reverse-proxy/r_p-caddy2.de.md
Normale Datei
66
docs/post_installation/reverse-proxy/r_p-caddy2.de.md
Normale Datei
|
|
@ -0,0 +1,66 @@
|
|||
!!! warning "Wichtig"
|
||||
Lesen Sie zuerst [die Übersicht](r_p.md).
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Communitybeitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
Die Konfiguration von Caddy mit mailcow ist sehr simpel.
|
||||
|
||||
In der Caddyfile muss einfach nur ein Bereich für den E-Mailserver angelegt werden.
|
||||
|
||||
Bspw:
|
||||
|
||||
``` hl_lines="1 3 13"
|
||||
|
||||
MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {
|
||||
log {
|
||||
output file /var/log/caddy/MAILCOW_HOSTNAME.log {
|
||||
roll_disabled
|
||||
roll_size 512M
|
||||
roll_uncompressed
|
||||
roll_local_time
|
||||
roll_keep 3
|
||||
roll_keep_for 48h
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:HTTP_BIND
|
||||
}
|
||||
```
|
||||
|
||||
Dies erlaubt es Caddy automatisch die Zertifikate zu erstellen und den Traffic für diese erwähnten Domains anzunehmen und an mailcow weiterzuleiten.
|
||||
|
||||
**Wichtig**: Der ACME Client der mailcow muss deaktiviert sein, da es sonst zu Fehlern seitens mailcow kommt.
|
||||
|
||||
Da Caddy sich direkt selbst um die Zertifikate kümmert, können wir mit dem folgenden Skript die Caddy generierten Zertifikate in die mailcow inkludieren:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
MD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))
|
||||
MD5SUM_NEW_CERT=($(md5sum /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt))
|
||||
|
||||
if [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.key /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
|
||||
else
|
||||
echo "Certs not copied from Caddy (Not needed)"
|
||||
fi
|
||||
```
|
||||
|
||||
!!! warning "Achtung"
|
||||
Der Zertifikatspfad von Caddy variiert je nach Installationsart.<br>
|
||||
Bei diesem Installationsbeispiel wurde Caddy mithilfe des Caddy Repos ([weitere Informationen hier](https://caddyserver.com/docs/install#debian-ubuntu-raspbian)) installiert.<br>
|
||||
<br>
|
||||
Um den Caddy Zertifikatspfad auf Ihrem System herauszufinden, genügt ein `find / -name "certificates"`.
|
||||
|
||||
|
||||
Dieses Skript könnte dann als Cronjob jede Stunde aufgerufen werden:
|
||||
|
||||
```bash
|
||||
0 * * * * /bin/bash /path/to/script/deploy-certs.sh >/dev/null 2>&1
|
||||
```
|
||||
64
docs/post_installation/reverse-proxy/r_p-caddy2.en.md
Normale Datei
64
docs/post_installation/reverse-proxy/r_p-caddy2.en.md
Normale Datei
|
|
@ -0,0 +1,64 @@
|
|||
!!! warning "Important"
|
||||
First read [the overview](r_p.md).
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
The configuration of Caddy with mailcow is very simple.
|
||||
|
||||
In the caddyfile you just have to create a section for the mailserver.
|
||||
|
||||
For example
|
||||
``` hl_lines="1 3 13"
|
||||
|
||||
MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {
|
||||
log {
|
||||
output file /var/log/caddy/MAILCOW_HOSTNAME.log {
|
||||
roll_disabled
|
||||
roll_size 512M
|
||||
roll_uncompressed
|
||||
roll_local_time
|
||||
roll_keep 3
|
||||
roll_keep_for 48h
|
||||
}
|
||||
}
|
||||
|
||||
reverse_proxy 127.0.0.1:HTTP_BIND
|
||||
}
|
||||
```
|
||||
|
||||
This allows Caddy to automatically create the certificates and accept traffic for these mentioned domains and forward them to mailcow.
|
||||
|
||||
**Important**: The ACME client of mailcow must be disabled, otherwise mailcow will fail.
|
||||
|
||||
Since Caddy takes care of the certificates itself, we can use the following script to include the Caddy generated certificates into mailcow:
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
MD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))
|
||||
MD5SUM_NEW_CERT=($(md5sum /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt))
|
||||
|
||||
if [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/your.domain.tld/your.domain.tld.key /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
|
||||
else
|
||||
echo "Certs not copied from Caddy (Not needed)"
|
||||
fi
|
||||
```
|
||||
|
||||
!!! warning "Attention"
|
||||
Caddy's certificate path varies depending on the installation type.<br>
|
||||
In this installation example, Caddy was installed using the Caddy repo ([more informations here](https://caddyserver.com/docs/install#debian-ubuntu-raspbian)).<br>
|
||||
<br>
|
||||
To find out the Caddy certificate path on your system, just run a `find / -name "certificates"`.
|
||||
|
||||
This script could be called as a cronjob every hour:
|
||||
|
||||
```bash
|
||||
0 * * * * /bin/bash /path/to/script/deploy-certs.sh >/dev/null 2>&1
|
||||
```
|
||||
19
docs/post_installation/reverse-proxy/r_p-haproxy.de.md
Normale Datei
19
docs/post_installation/reverse-proxy/r_p-haproxy.de.md
Normale Datei
|
|
@ -0,0 +1,19 @@
|
|||
!!! warning "Wichtig"
|
||||
Lesen Sie zuerst [die Übersicht](r_p.md).
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Community Beitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
**Wichtig/Fix erwünscht**: Dieses Beispiel leitet nur HTTPS-Verkehr weiter und benutzt nicht den in mailcow eingebauten ACME-Client.
|
||||
|
||||
```
|
||||
frontend https-in
|
||||
bind :::443 v4v6 ssl crt mailcow.pem
|
||||
default_backend mailcow
|
||||
|
||||
backend mailcow
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
||||
http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
|
||||
server mailcow 127.0.0.1:8080 check
|
||||
```
|
||||
19
docs/post_installation/reverse-proxy/r_p-haproxy.en.md
Normale Datei
19
docs/post_installation/reverse-proxy/r_p-haproxy.en.md
Normale Datei
|
|
@ -0,0 +1,19 @@
|
|||
!!! warning "Important"
|
||||
First read [the overview](r_p.md).
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
**Important/Fixme**: This example only forwards HTTPS traffic and does not use mailcows built-in ACME client.
|
||||
|
||||
```
|
||||
frontend https-in
|
||||
bind :::443 v4v6 ssl crt mailcow.pem
|
||||
default_backend mailcow
|
||||
|
||||
backend mailcow
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Proto https if { ssl_fc }
|
||||
http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
|
||||
server mailcow 127.0.0.1:8080 check
|
||||
```
|
||||
60
docs/post_installation/reverse-proxy/r_p-nginx.de.md
Normale Datei
60
docs/post_installation/reverse-proxy/r_p-nginx.de.md
Normale Datei
|
|
@ -0,0 +1,60 @@
|
|||
!!! warning "Wichtig"
|
||||
Lesen Sie zuerst [die Übersicht](r_p.md).
|
||||
|
||||
Let's Encrypt folgt unserem Rewrite, Zertifikatsanfragen funktionieren problemlos.
|
||||
|
||||
**Achten Sie auf die hervorgehobenen Zeilen**.
|
||||
|
||||
``` hl_lines="4 10 12 13 25 39"
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name ZU MAILCOW HOSTNAMEN ÄNDERN autodiscover.* autoconfig.*;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name ZU MAILCOW HOSTNAMEN ÄNDERN autodiscover.* autoconfig.*;
|
||||
|
||||
ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;
|
||||
ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# Siehe https://ssl-config.mozilla.org/#server=nginx für die neuesten Empfehlungen zu ssl-Einstellungen
|
||||
# Ein Beispiel für eine Konfiguration ist unten angegeben
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
location /Microsoft-Server-ActiveSync {
|
||||
proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 75;
|
||||
proxy_send_timeout 3650;
|
||||
proxy_read_timeout 3650;
|
||||
proxy_buffers 64 512k; # Seit dem 2022-04 Update nötig für SOGo
|
||||
client_body_buffer_size 512k;
|
||||
client_max_body_size 0;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
# Die folgenden Proxy-Buffer müssen gesetzt werden, wenn Sie SOGo nach dem Update 2022-04 (April 2022) verwenden wollen
|
||||
# Andernfalls wird ein Login wie folgt fehlschlagen: https://github.com/mailcow/mailcow-dockerized/issues/4537
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 64 512k;
|
||||
proxy_busy_buffers_size 512k;
|
||||
}
|
||||
}
|
||||
```
|
||||
60
docs/post_installation/reverse-proxy/r_p-nginx.en.md
Normale Datei
60
docs/post_installation/reverse-proxy/r_p-nginx.en.md
Normale Datei
|
|
@ -0,0 +1,60 @@
|
|||
!!! warning "Important"
|
||||
First read [the overview](r_p.md).
|
||||
|
||||
Let's Encrypt will follow our rewrite, certificate requests will work fine.
|
||||
|
||||
**Take care of highlighted lines.**
|
||||
|
||||
``` hl_lines="4 10 12 13 25 39"
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
server {
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;
|
||||
|
||||
ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;
|
||||
ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_session_cache shared:SSL:50m;
|
||||
ssl_session_tickets off;
|
||||
|
||||
# See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations
|
||||
# An example config is given below
|
||||
ssl_protocols TLSv1.2;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;
|
||||
ssl_prefer_server_ciphers off;
|
||||
|
||||
location /Microsoft-Server-ActiveSync {
|
||||
proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_connect_timeout 75;
|
||||
proxy_send_timeout 3650;
|
||||
proxy_read_timeout 3650;
|
||||
proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo
|
||||
client_body_buffer_size 512k;
|
||||
client_max_body_size 0;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:8080/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
# The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update
|
||||
# Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537
|
||||
proxy_buffer_size 128k;
|
||||
proxy_buffers 64 512k;
|
||||
proxy_busy_buffers_size 512k;
|
||||
}
|
||||
}
|
||||
```
|
||||
105
docs/post_installation/reverse-proxy/r_p-traefik2.de.md
Normale Datei
105
docs/post_installation/reverse-proxy/r_p-traefik2.de.md
Normale Datei
|
|
@ -0,0 +1,105 @@
|
|||
!!! warning "Wichtig"
|
||||
Lesen Sie zuerst [die Übersicht](r_p.md).
|
||||
|
||||
!!! warning "Warnung"
|
||||
Dies ist ein nicht unterstützter Community Beitrag. Korrekturen sind immer erwünscht!
|
||||
|
||||
**Wichtig**: Diese Konfiguration deckt nur das "Reverseproxing" des Webpanels (nginx-mailcow) unter Verwendung von Traefik v2 ab. Wenn Sie auch die Mail-Dienste wie dovecot, postfix... reproxen wollen, müssen Sie die folgende Konfiguration an jeden Container anpassen und einen [EntryPoint](https://docs.traefik.io/routing/entrypoints/) in Ihrer `traefik.toml` oder `traefik.yml` (je nachdem, welche Konfiguration Sie verwenden) für jeden Port erstellen.
|
||||
|
||||
In diesem Abschnitt gehen wir davon aus, dass Sie Ihren Traefik 2 `[certificatesresolvers]` in Ihrer Traefik-Konfigurationsdatei richtig konfiguriert haben und auch acme verwenden. Das folgende Beispiel verwendet Lets Encrypt, aber Sie können es gerne auf Ihren eigenen Zertifikatsresolver ändern. Eine grundlegende Traefik 2 toml-Konfigurationsdatei mit allen oben genannten Elementen, die für dieses Beispiel verwendet werden kann, finden Sie hier [traefik.toml](https://github.com/Frenzoid/TraefikBasicConfig/blob/master/traefik.toml), falls Sie eine solche Datei benötigen oder einen Hinweis, wie Sie Ihre Konfiguration anpassen können.
|
||||
|
||||
Zuallererst werden wir den acme-mailcow-Container deaktivieren, da wir die von traefik bereitgestellten Zertifikate verwenden werden.
|
||||
Dazu müssen wir `SKIP_LETS_ENCRYPT=y` in unserer `mailcow.conf` setzen und den folgenden Befehl ausführen, um die Änderungen zu übernehmen:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Dann erstellen wir eine `docker-compose.override.yml` Datei, um die Hauptdatei `docker-compose.yml` zu überschreiben, die sich im mailcow-Stammverzeichnis befindet.
|
||||
|
||||
```yaml
|
||||
version: '2.1'
|
||||
|
||||
services:
|
||||
nginx-mailcow:
|
||||
networks:
|
||||
# Traefiks Netzwerk hinzufügen
|
||||
web:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
# Erstellt einen Router namens "moo" für den Container und richtet eine Regel ein, um den Container mit einer bestimmten Regel zu verknüpfen,
|
||||
# in diesem Fall eine Host-Regel mit unserer MAILCOW_HOSTNAME-Variable.
|
||||
- traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)
|
||||
# Aktiviert tls über den zuvor erstellten Router.
|
||||
- traefik.http.routers.moo.tls=true
|
||||
# Gibt an, welche Art von Cert-Resolver wir verwenden werden, in diesem Fall le (Lets Encrypt).
|
||||
- traefik.http.routers.moo.tls.certresolver=le
|
||||
# Erzeugt einen Dienst namens "moo" für den Container und gibt an, welchen internen Port des Containers
|
||||
# Traefik die eingehenden Daten weiterleiten soll.
|
||||
- traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}
|
||||
# Gibt an, welchen Eingangspunkt (externer Port) traefik für diesen Container abhören soll.
|
||||
# Websecure ist Port 443, siehe die Datei traefik.toml wie oben.
|
||||
- traefik.http.routers.moo.entrypoints=websecure
|
||||
# Stellen Sie sicher, dass traefik das Web-Netzwerk verwendet, nicht das mailcowdockerized_mailcow-network
|
||||
- traefik.docker.network=traefik_web
|
||||
|
||||
certdumper:
|
||||
image: humenius/traefik-certs-dumper
|
||||
command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1
|
||||
network_mode: none
|
||||
volumes:
|
||||
# Binden Sie das Volume, das Traefiks `acme.json' Datei enthält, ein
|
||||
- acme:/traefik:ro
|
||||
# SSL-Ordner von mailcow einhängen
|
||||
- ./data/assets/ssl/:/output:rw
|
||||
# Binden Sie den Docker Socket ein, damit traefik-certs-dumper die Container neu starten kann
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
restart: always
|
||||
environment:
|
||||
# Ändern Sie dies nur, wenn Sie eine andere Domain für mailcows Web-Frontend verwenden als in der Standard-Konfiguration
|
||||
- DOMAIN=${MAILCOW_HOSTNAME}
|
||||
|
||||
networks:
|
||||
web:
|
||||
external: true
|
||||
# Name des externen Netzwerks
|
||||
name: traefik_web
|
||||
|
||||
volumes:
|
||||
acme:
|
||||
external: true
|
||||
# Name des externen Docker Volumes, welches Traefiks `acme.json' Datei enthält
|
||||
name: traefik_acme
|
||||
```
|
||||
|
||||
Starten Sie die neuen Container mit:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Da Traefik 2 ein acme v2 Format verwendet, um ALLE Zertifikaten von allen Domains zu speichern, müssen wir einen Weg finden, die Zertifikate auszulagern. Zum Glück haben wir [diesen kleinen Container] (https://hub.docker.com/r/humenius/traefik-certs-dumper), der die Datei `acme.json` über ein Volume und eine Variable `DOMAIN=example. org`, und damit wird der Container die `cert.pem` und `key.pem` Dateien ausgeben, dafür lassen wir einfach den `traefik-certs-dumper` Container laufen, binden das `/traefik` Volume an den Ordner, in dem unsere `acme.json` gespeichert ist, binden das `/output` Volume an unseren mailcow `data/assets/ssl/` Ordner, und setzen die `DOMAIN=example.org` Variable auf die Domain, von der wir die Zertifikate ausgeben wollen.
|
||||
|
||||
Dieser Container überwacht die Datei `acme.json` auf Änderungen und generiert die Dateien `cert.pem` und `key.pem` direkt in `data/assets/ssl/`, wobei der Pfad mit dem `/output`-Pfad des Containers verbunden ist.
|
||||
|
||||
Sie können es über die Kommandozeile ausführen oder das [hier](https://hub.docker.com/r/humenius/traefik-certs-dumper) gezeigte docker-compose.yml verwenden.
|
||||
|
||||
Nachdem wir die Zertifikate übertragen haben, müssen wir die Konfigurationen aus unseren Postfix- und Dovecot-Containern neu laden und die Zertifikate überprüfen. Wie das geht, sehen Sie [hier](https://mailcow.github.io/mailcow-dockerized-docs/de/post_installation/firststeps-ssl/#ein-eigenes-zertifikat-verwenden).
|
||||
|
||||
Und das sollte es gewesen sein 😊, Sie können überprüfen, ob der Traefik-Router einwandfrei funktioniert, indem Sie das Dashboard von Traefik / traefik logs / über https auf die eingestellte Domain zugreifen, oder / und HTTPS, SMTP und IMAP mit den Befehlen auf der zuvor verlinkten Seite überprüfen.
|
||||
108
docs/post_installation/reverse-proxy/r_p-traefik2.en.md
Normale Datei
108
docs/post_installation/reverse-proxy/r_p-traefik2.en.md
Normale Datei
|
|
@ -0,0 +1,108 @@
|
|||
!!! warning "Important"
|
||||
First read [the overview](r_p.md).
|
||||
|
||||
!!! warning
|
||||
This is an unsupported community contribution. Feel free to provide fixes.
|
||||
|
||||
**Important**: This config only covers the "reverseproxing" of the webpannel (nginx-mailcow) using Traefik v2, if you also want to reverseproxy the mail services such as dovecot, postfix... you'll just need to adapt the following config to each container and create an [EntryPoint](https://docs.traefik.io/routing/entrypoints/) on your `traefik.toml` or `traefik.yml` (depending which config you use) for each port.
|
||||
|
||||
For this section we'll assume you have your Traefik 2 `[certificatesresolvers]` properly configured on your traefik configuration file, and also using acme, also, the following example uses Lets Encrypt, but feel free to change it to your own cert resolver. You can find a basic Traefik 2 toml config file with all the above implemented which can be used for this example here [traefik.toml](https://github.com/Frenzoid/TraefikBasicConfig/blob/master/traefik.toml) if you need one, or a hint on how to adapt your config.
|
||||
|
||||
|
||||
So, first of all, we are going to disable the acme-mailcow container since we'll use the certs that traefik will provide us.
|
||||
For this we'll have to set `SKIP_LETS_ENCRYPT=y` on our `mailcow.conf`, and run the following command to apply the changes:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
Then we'll create a `docker-compose.override.yml` file in order to override the main `docker-compose.yml` found in your mailcow root folder.
|
||||
|
||||
```yaml
|
||||
version: '2.1'
|
||||
|
||||
services:
|
||||
nginx-mailcow:
|
||||
networks:
|
||||
# Add Traefik's network
|
||||
web:
|
||||
labels:
|
||||
- traefik.enable=true
|
||||
# Creates a router called "moo" for the container, and sets up a rule to link the container to certain rule,
|
||||
# in this case, a Host rule with our MAILCOW_HOSTNAME var.
|
||||
- traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)
|
||||
# Enables tls over the router we created before.
|
||||
- traefik.http.routers.moo.tls=true
|
||||
# Specifies which kind of cert resolver we'll use, in this case le (Lets Encrypt).
|
||||
- traefik.http.routers.moo.tls.certresolver=le
|
||||
# Creates a service called "moo" for the container, and specifies which internal port of the container
|
||||
# should traefik route the incoming data to.
|
||||
- traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}
|
||||
# Specifies which entrypoint (external port) should traefik listen to, for this container.
|
||||
# websecure being port 443, check the traefik.toml file liked above.
|
||||
- traefik.http.routers.moo.entrypoints=websecure
|
||||
# Make sure traefik uses the web network, not the mailcowdockerized_mailcow-network
|
||||
- traefik.docker.network=traefik_web
|
||||
|
||||
certdumper:
|
||||
image: humenius/traefik-certs-dumper
|
||||
command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1
|
||||
network_mode: none
|
||||
volumes:
|
||||
# Mount the volume which contains Traefik's `acme.json' file
|
||||
# Configure the external name in the volume definition
|
||||
- acme:/traefik:ro
|
||||
# Mount mailcow's SSL folder
|
||||
- ./data/assets/ssl/:/output:rw
|
||||
# Mount docker socket to restart containers
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
restart: always
|
||||
environment:
|
||||
# only change this, if you're using another domain for mailcow's web frontend compared to the standard config
|
||||
- DOMAIN=${MAILCOW_HOSTNAME}
|
||||
|
||||
networks:
|
||||
web:
|
||||
external: true
|
||||
# Name of the external network
|
||||
name: traefik_web
|
||||
|
||||
volumes:
|
||||
acme:
|
||||
external: true
|
||||
# Name of the external docker volume which contains Traefik's `acme.json' file
|
||||
name: traefik_acme
|
||||
```
|
||||
|
||||
Start the new containers with:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
|
||||
Now, there's only one thing left to do, which is setup the certs so that the mail services can use them as well, since Traefik 2 uses an acme v2 format to save ALL the license from all the domains we have, we'll need to find a way to dump the certs, lucky we have [this tiny container](https://hub.docker.com/r/humenius/traefik-certs-dumper) which grabs the `acme.json` file through a volume, and a variable `DOMAIN=example.org`, and with these, the container will output the `cert.pem` and `key.pem` files, for this we'll simply run the `traefik-certs-dumper` container binding the `/traefik` volume to the folder where our `acme.json` is saved, bind the `/output` volume to our mailcow `data/assets/ssl/` folder, and set up the `DOMAIN=example.org` variable to the domain we want the certs dumped from.
|
||||
|
||||
This container will watch over the `acme.json` file for any changes, and regenerate the `cert.pem` and `key.pem` files directly into `data/assets/ssl/` being the path binded to the container's `/output` path.
|
||||
|
||||
You can use the command line to run it, or use the docker-compose.yml shown [here](https://hub.docker.com/r/humenius/traefik-certs-dumper).
|
||||
|
||||
After we have the certs dumped, we'll have to reload the configs from our postfix and dovecot containers, and check the certs, you can see how [here](https://mailcow.github.io/mailcow-dockerized-docs/firststeps-ssl/#how-to-use-your-own-certificate).
|
||||
|
||||
Aaand that should be it 😊, you can check if the Traefik router works fine through Traefik's dashboard / traefik logs / accessing the setted domain through https, or / and check HTTPS, SMTP and IMAP through the commands shown on the page linked before.
|
||||
93
docs/post_installation/reverse-proxy/r_p.de.md
Normale Datei
93
docs/post_installation/reverse-proxy/r_p.de.md
Normale Datei
|
|
@ -0,0 +1,93 @@
|
|||
Sie müssen die Nginx-Seite, die mit mailcow: dockerized geliefert wird, nicht ändern.
|
||||
mailcow: dockerized vertraut auf das Standard-Gateway IP 172.22.1.1 als Proxy.
|
||||
|
||||
Stellen Sie sicher, dass Sie HTTP_BIND und HTTPS_BIND in `mailcow.conf` auf eine lokale Adresse ändern und die Ports entsprechend einstellen, zum Beispiel:
|
||||
``` bash
|
||||
HTTP_BIND=127.0.0.1
|
||||
HTTP_PORT=8080
|
||||
HTTPS_BIND=127.0.0.1
|
||||
HTTPS_PORT=8443
|
||||
```
|
||||
|
||||
Dadurch werden auch die Bindungen innerhalb des Nginx-Containers geändert! Dies ist wichtig, wenn Sie sich entscheiden, einen Proxy innerhalb von Docker zu verwenden.
|
||||
|
||||
**WICHTIG:** Verwenden Sie nicht Port 8081, 9081 oder 65510!
|
||||
|
||||
Erzeugen Sie die betroffenen Container neu, indem Sie den folgenden Befehl ausführen:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
## Wichtige Informationen, bitte lesen Sie diese sorgfältig durch!
|
||||
|
||||
!!! info
|
||||
Wenn Sie planen, einen Reverse-Proxy zu verwenden und einen anderen Servernamen als **MAILCOW_HOSTNAME** verwenden wollen, müssen Sie [Zusätzliche Servernamen für mailcow UI](#hinzufügen-weiterer-servernamen-für-mailcow-ui) hierunter.
|
||||
|
||||
!!! warning "Warnung"
|
||||
Stellen Sie sicher, dass Sie `generate_config.sh` ausführen, bevor Sie die Konfigurationsbeispiele aktivieren.
|
||||
Das Skript `generate_config.sh` kopiert die Snake-oil Zertifikate an den richtigen Ort, so dass die Dienste nicht aufgrund fehlender Dateien nicht starten können.
|
||||
|
||||
!!! warning "Warnung"
|
||||
Wenn Sie TLS SNI aktivieren (`ENABLE_TLS_SNI` in mailcow.conf), **müssen** die Zertifikatspfade in Ihrem Reverse-Proxy mit den korrekten Pfaden in `data/assets/ssl/{hostname}` übereinstimmen. Die Zertifikate werden in `data/assets/ssl/{hostname1,hostname2,etc}` aufgeteilt und werden daher nicht funktionieren, wenn Sie die Beispiele von unten kopieren, die auf `data/assets/ssl/cert.pem` etc. zeigen.
|
||||
|
||||
!!! info
|
||||
Die Verwendung der Konfigurationsbeispiele wird **acme-Anfragen an mailcow** weiterleiten und es die Zertifikate selbst verwalten lassen.
|
||||
Der Nachteil der Verwendung von mailcow als ACME-Client hinter einem Reverse-Proxy ist, dass Sie Ihren Webserver neu laden müssen, nachdem acme-mailcow das Zertifikat geändert/erneuert/erstellt hat. Sie können entweder Ihren Webserver täglich neu laden oder ein Skript schreiben, um die Datei auf Änderungen zu überwachen.
|
||||
Auf vielen Servern wird logrotate den Webserver sowieso täglich neu laden.
|
||||
|
||||
Wenn Sie eine lokale Certbot-Installation verwenden möchten, müssen Sie die SSL-Zertifikatsparameter entsprechend ändern.
|
||||
**Stellen Sie sicher, dass Sie ein Post-Hook-Skript** ausführen, wenn Sie sich entscheiden, externe ACME-Clients zu verwenden. [Ein Beispiel](#optional-post-hook-skript-für-nicht-mailcow-acme-clients) finden Sie hierunter.
|
||||
|
||||
|
||||
Konfigurieren Sie Ihren lokalen Webserver als Reverse Proxy anhand folgender Konfigurationsbeispiele:
|
||||
|
||||
- [Apache 2.4](r_p-apache24.md)
|
||||
- [Nginx](r_p-nginx.md)
|
||||
- [HAProxy](r_p-haproxy.md)
|
||||
- [Traefik v2](r_p-traefik2.md)
|
||||
- [Caddy v2](r_p-caddy2.md)
|
||||
|
||||
## Optional: Post-Hook-Skript für nicht-mailcow ACME-Clients
|
||||
|
||||
Die Verwendung eines lokalen Certbots (oder eines anderen ACME-Clients) erfordert den Neustart einiger Container, was Sie mit einem Post-Hook-Skript erledigen können.
|
||||
Stellen Sie sicher, dass Sie die Pfade entsprechend ändern:
|
||||
```
|
||||
#!/bin/bash
|
||||
cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
```
|
||||
|
||||
## Hinzufügen weiterer Servernamen für mailcow UI
|
||||
|
||||
Wenn Sie vorhaben, einen Servernamen zu verwenden, der nicht `MAILCOW_HOSTNAME` in Ihrem Reverse-Proxy ist, stellen Sie sicher, dass Sie diesen Namen zuerst in mailcow.conf über `ADDITIONAL_SERVER_NAMES` einpflegen. Die Namen müssen durch Kommas getrennt werden und **dürfen** keine Leerzeichen enthalten. Wenn Sie diesen Schritt überspringen, kann es sein, dass mailcow auf Ihren Reverse-Proxy mit einer falschen Seite antwortet.
|
||||
|
||||
```
|
||||
ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld
|
||||
```
|
||||
|
||||
Führen Sie zum Anwenden folgendes aus:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
93
docs/post_installation/reverse-proxy/r_p.en.md
Normale Datei
93
docs/post_installation/reverse-proxy/r_p.en.md
Normale Datei
|
|
@ -0,0 +1,93 @@
|
|||
You don't need to change the Nginx site that comes with mailcow: dockerized.
|
||||
mailcow: dockerized trusts the default gateway IP 172.22.1.1 as proxy.
|
||||
|
||||
Make sure you change HTTP_BIND and HTTPS_BIND in `mailcow.conf` to a local address and set the ports accordingly, for example:
|
||||
``` bash
|
||||
HTTP_BIND=127.0.0.1
|
||||
HTTP_PORT=8080
|
||||
HTTPS_BIND=127.0.0.1
|
||||
HTTPS_PORT=8443
|
||||
```
|
||||
|
||||
This will also change the bindings inside the Nginx container! This is important, if you decide to use a proxy within Docker.
|
||||
|
||||
**IMPORTANT:** Do not use port 8081, 9081 or 65510!
|
||||
|
||||
Recreate affected containers by running the command:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
## Important information, please read them carefully!
|
||||
|
||||
!!! info
|
||||
If you plan to use a reverse proxy and want to use another server name that is **not** MAILCOW_HOSTNAME, you need to read [Adding additional server names for mailcow UI](#adding-additional-server-names-for-mailcow-ui) below.
|
||||
|
||||
!!! warning
|
||||
Make sure you run `generate_config.sh` before you enable any site configuration examples.
|
||||
The script `generate_config.sh` copies snake-oil certificates to the correct location, so the services will not fail to start due to missing files.
|
||||
|
||||
!!! warning
|
||||
If you enable TLS SNI (`ENABLE_TLS_SNI` in mailcow.conf), the certificate paths in your reverse proxy **must** match the correct paths in `data/assets/ssl/{hostname}`. The certificates will be split into `data/assets/ssl/{hostname1,hostname2,etc}` and therefore will not work when you copy the examples from below pointing to `data/assets/ssl/cert.pem` etc.
|
||||
|
||||
!!! info
|
||||
Using the site configuration examples will **forward ACME requests to mailcow** and let it handle certificates itself.
|
||||
The downside of using mailcow as ACME client behind a reverse proxy is, that you will need to reload your webserver after acme-mailcow changed/renewed/created the certificate. You can either reload your webserver daily or write a script to watch the file for changes.
|
||||
On many servers logrotate will reload the webserver daily anyway.
|
||||
|
||||
If you want to use a local certbot installation, you will need to change the SSL certificate parameters accordingly.
|
||||
**Make sure you run a post-hook script** when you decide to use external ACME clients. You will find [an example](#optional-post-hook-script-for-non-mailcow-acme-clients) below.
|
||||
|
||||
|
||||
Configure your local webserver as reverse proxy using following configuration examples:
|
||||
|
||||
- [Apache 2.4](r_p-apache24.md)
|
||||
- [Nginx](r_p-nginx.md)
|
||||
- [HAProxy](r_p-haproxy.md)
|
||||
- [Traefik v2](r_p-traefik2.md)
|
||||
- [Caddy v2](r_p-caddy2.md)
|
||||
|
||||
## Optional: Post-hook script for non-mailcow ACME clients
|
||||
|
||||
Using a local certbot (or any other ACME client) requires to restart some containers, you can do this with a post-hook script.
|
||||
Make sure you change the paths accordingly:
|
||||
```
|
||||
#!/bin/bash
|
||||
cp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
|
||||
cp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
|
||||
postfix_c=$(docker ps -qaf name=postfix-mailcow)
|
||||
dovecot_c=$(docker ps -qaf name=dovecot-mailcow)
|
||||
nginx_c=$(docker ps -qaf name=nginx-mailcow)
|
||||
docker restart ${postfix_c} ${dovecot_c} ${nginx_c}
|
||||
```
|
||||
|
||||
## Adding additional server names for mailcow UI
|
||||
|
||||
If you plan to use a server name that is not `MAILCOW_HOSTNAME` in your reverse proxy, make sure to populate that name in mailcow.conf via `ADDITIONAL_SERVER_NAMES` first. Names must be separated by commas and **must not** contain spaces. If you skip this step, mailcow may respond to your reverse proxy with an incorrect site.
|
||||
|
||||
```
|
||||
ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld
|
||||
```
|
||||
|
||||
Run the following command to apply:
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
||||
``` bash
|
||||
docker compose up -d
|
||||
```
|
||||
|
||||
=== "docker-compose (Standalone)"
|
||||
|
||||
``` bash
|
||||
docker-compose up -d
|
||||
```
|
||||
|
|
@ -44,13 +44,13 @@ Im Rahmen unseres Supports können wir Ihnen bei der korrekten Planung Ihres Set
|
|||
Grundsätzlich kann mailcow auf jeder Distribution verwendet werden, die von Docker CE unterstützt wird (siehe https://docs.docker.com/install/).
|
||||
Es kann jedoch in vereinzelten Fällen zu einer Inkompatibilität der Betriebssysteme und den mailcow Komponenten kommen.
|
||||
|
||||
Die folgende Tabelle enthält alle von uns offiziell unterstützten und getesteten Betriebssysteme (*Stand April 2023*):
|
||||
Die folgende Tabelle enthält alle von uns offiziell unterstützten und getesteten Betriebssysteme (*Stand Juni 2023*):
|
||||
|
||||
| Betriebssystem | Kompatibilität |
|
||||
| ----------------------- | ------------------------------------------------ |
|
||||
| Alpine 3.16 und älter | [⚠️](https://www.alpinelinux.org/ "Eingeschränkt Kompatibel") |
|
||||
| Centos 7 | [✅](https://www.centos.org/ "Vollständig Kompatibel") |
|
||||
| Debian 10, 11 | [✅](https://www.debian.org/index.de.html "Vollständig Kompatibel") |
|
||||
| Debian 10, 11, 12 | [✅](https://www.debian.org/index.de.html "Vollständig Kompatibel") |
|
||||
| Ubuntu 18.04, 20.04, 22.04 | [✅](https://ubuntu.com/ "Vollständig Kompatibel")|
|
||||
| Alma Linux 8 | [✅](https://almalinux.org/ "Vollständig Kompatibel") |
|
||||
| Rocky Linux 9 | [✅](https://rockylinux.org/ "Vollständig Kompatibel") |
|
||||
|
|
|
|||
|
|
@ -42,13 +42,13 @@ We can help to correctly plan your setup as part of our support.
|
|||
Basically, mailcow can be used on any distribution that is supported by Docker CE (see https://docs.docker.com/install/).
|
||||
However, in some cases there may be incompatibilities between the operating systems and the mailcow components.
|
||||
|
||||
The following table contains all operating systems officially supported and tested by us (*as of April 2022*):
|
||||
The following table contains all operating systems officially supported and tested by us (*as of June 2023*):
|
||||
|
||||
| OS | Compatibility |
|
||||
| ----------------------- | ------------------------------------------------ |
|
||||
| Alpine 3.17+ and older | [⚠️](https://www.alpinelinux.org/ "Limited Compatibility") |
|
||||
| Centos 7 | [✅](https://www.centos.org/ "Fully Compatible") |
|
||||
| Debian 10, 11 | [✅](https://www.debian.org/index.html "Fully Compatible") |
|
||||
| Debian 10, 11, 12 | [✅](https://www.debian.org/index.html "Fully Compatible") |
|
||||
| Ubuntu 18.04, 20.04, 22.04 | [✅](https://ubuntu.com/ "Fully Compatible")|
|
||||
| Alma Linux 8 | [✅](https://almalinux.org/ "Fully Compatible") |
|
||||
| Rocky Linux 9 | [✅](https://rockylinux.org/ "Fully Compatible") |
|
||||
|
|
|
|||
|
|
@ -212,7 +212,7 @@ version: '2'
|
|||
services:
|
||||
mailman-core:
|
||||
environment:
|
||||
- DATABASE_URL=postgres://mailman:DBPASS@database/mailmandb
|
||||
- DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb
|
||||
- HYPERKITTY_API_KEY=HYPERKITTY_KEY
|
||||
- TZ=Europe/Berlin
|
||||
- MTA=postfix
|
||||
|
|
@ -222,7 +222,7 @@ services:
|
|||
|
||||
mailman-web:
|
||||
environment:
|
||||
- DATABASE_URL=postgres://mailman:DBPASS@database/mailmandb
|
||||
- DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb
|
||||
- HYPERKITTY_API_KEY=HYPERKITTY_KEY
|
||||
- TZ=Europe/Berlin
|
||||
- SECRET_KEY=DJANGO_KEY
|
||||
|
|
|
|||
|
|
@ -212,7 +212,7 @@ version: '2'
|
|||
services:
|
||||
mailman-core:
|
||||
environment:
|
||||
- DATABASE_URL=postgres://mailman:DBPASS@database/mailmandb
|
||||
- DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb
|
||||
- HYPERKITTY_API_KEY=HYPERKITTY_KEY
|
||||
- TZ=Europe/Berlin
|
||||
- MTA=postfix
|
||||
|
|
@ -222,7 +222,7 @@ services:
|
|||
|
||||
mailman-web:
|
||||
environment:
|
||||
- DATABASE_URL=postgres://mailman:DBPASS@database/mailmandb
|
||||
- DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb
|
||||
- HYPERKITTY_API_KEY=HYPERKITTY_KEY
|
||||
- TZ=Europe/Berlin
|
||||
- SECRET_KEY=DJANGO_KEY
|
||||
|
|
|
|||
736
docs/third_party/roundcube/third_party-roundcube.de.md
gevendort
736
docs/third_party/roundcube/third_party-roundcube.de.md
gevendort
|
|
@ -1,206 +1,375 @@
|
|||
## Installation von Roundcube
|
||||
|
||||
Laden Sie Roundcube 1.6.x in das Web htdocs Verzeichnis herunter und entpacken Sie es (hier `rc/`):
|
||||
```bash
|
||||
# Prüfen Sie, ob eine neuere Version vorliegt!
|
||||
cd data/web
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
Sofern nicht abweichend angegeben wird für alle aufgeführten Kommandos angenommen, dass diese im mailcow
|
||||
Installationsverzeichnis ausgeführt werden, d. h. dem Verzeichnis, welches `mailcow.conf` usw. enthält. Bitte führen Sie
|
||||
die Kommandos nicht blind aus, sondern verstehen Sie was diese bewirken. Keines der Kommandos sollte einen Fehler
|
||||
ausgeben; sollten Sie dennoch auf einen Fehler stoßen, beheben Sie diesen sofern notwendig bevor Sie mit den
|
||||
nachfolgenden Kommandos fortfahren.
|
||||
|
||||
# Ändern Sie den Ordnernamen
|
||||
mv roundcubemail-1.6.1 rc
|
||||
### Hinweise zur Verwendung von composer
|
||||
|
||||
# Berechtigungen ändern
|
||||
chown -R root: rc/
|
||||
Diese Anweisungen verwenden das Programm composer zur Aktualisierung der Abhängigkeiten von Roundcube und um
|
||||
Roundcube-Plugins zu installieren bzw. zu aktualisieren.
|
||||
|
||||
Das roundcube-plugin-installer composer Plugin hat eine [Design-Schwäche](https://github.com/roundcube/plugin-installer/issues/38),
|
||||
die dazu führen kann, dass composer bei Operationen fehlschlägt, im Rahmen derer Pakete aktualisiert oder deinstalliert
|
||||
werden.
|
||||
|
||||
Die Fehlermeldung in diesem Falle besagt, dass eine `require`-Anweisung in `autoload_real.php` fehlgeschlagen ist, weil
|
||||
eine Datei nicht gefunden werden konnte. Beispiel:
|
||||
|
||||
```
|
||||
In autoload_real.php line 43:
|
||||
require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory
|
||||
```
|
||||
|
||||
Wenn Sie eine Rechtschreibprüfung benötigen, erstellen Sie eine Datei `data/hooks/phpfpm/aspell.sh` mit folgendem Inhalt und geben Sie dann `chmod +x data/hooks/phpfpm/aspell.sh` ein. Dadurch wird eine lokale Rechtschreibprüfung installiert. Beachten Sie, dass die meisten modernen Webbrowser eine eingebaute Rechtschreibprüfung haben, so dass Sie diese vielleicht nicht benötigen.
|
||||
Leider treten diese Fehler relativ häufig auf, sie lassen sich jedoch leicht beheben indem der Autoloader aktualisiert
|
||||
wird und das fehlgeschlagene Kommando im Anschluss erneut ausgeführt wird:
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o
|
||||
# Nun das fehlgeschlagene Kommando erneut ausführen
|
||||
```
|
||||
|
||||
### Vorbereitung
|
||||
|
||||
Zunächst laden wir `mailcow.conf` um Zugriff auf die mailcow-Einstellungen innerhalb der nachfolgenden Kommandos zu
|
||||
erhalten.
|
||||
|
||||
```bash
|
||||
source mailcow.conf
|
||||
```
|
||||
|
||||
Laden Sie Roundcube 1.6.x (prüfen Sie das aktuellste Release und passen Sie die URL entsprechend an) in das web
|
||||
Verzeichnis herunter und entpacken Sie es (hier `rc/`):
|
||||
|
||||
```bash
|
||||
mkdir -m 755 data/web/rc
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config
|
||||
```
|
||||
|
||||
### Optional: Rechtschreibprüfung
|
||||
Wenn Sie eine Rechtschreibprüfung benötigen, erstellen Sie eine Datei `data/hooks/phpfpm/aspell.sh` mit folgendem Inhalt
|
||||
und geben Sie dann `chmod +x data/hooks/phpfpm/aspell.sh` ein. Dadurch wird eine lokale Rechtschreibprüfung installiert.
|
||||
Beachten Sie, dass die meisten modernen Webbrowser eine eingebaute Rechtschreibprüfung haben, so dass Sie diese
|
||||
vielleicht nicht benötigen.
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
apk update
|
||||
apk add aspell-de # oder jede andere Sprache
|
||||
```
|
||||
|
||||
### Installation des MIME-Typ-Verzeichnisses
|
||||
Laden Sie die `mime.types` Datei herunter, da diese nicht im `php-fpm`-Container enthalten ist.
|
||||
|
||||
```bash
|
||||
wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
|
||||
```
|
||||
|
||||
### Anlegen der Roundcube-Datenbank
|
||||
Erstellen Sie eine Datenbank für Roundcube im mailcow mysql Container. Dies erstellt einen neuen `roundcube`
|
||||
Datenbank-Benutzer mit einem Zufallspasswort, welches in die Shell ausgegeben wird und in einer Shell-Variable für die
|
||||
Verwendung durch die nachfolgenden Kommandos gespeichert wird. Beachten Sie, dass Sie die `DBROUNDCUBE`-Shell-Variable
|
||||
manuell auf das ausgegebene Passwort setzen müssen, falls sie den Installationsprozess unterbrechen und später in einer
|
||||
neuen Shell fortsetzen sollten.
|
||||
|
||||
```bash
|
||||
DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
|
||||
echo Das Datenbank-Password für den Benutzer roundcube lautet $DBROUNDCUBE
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';"
|
||||
```
|
||||
|
||||
### Roundcube-Konfigurationsdatei
|
||||
|
||||
Erstellen Sie eine Datei `data/web/rc/config/config.inc.php` mit dem folgenden Inhalt.
|
||||
- **Ändern Sie den Parameter `des_key` auf einen Zufallswert.** Er wird verwendet, um Ihr IMAP-Passwort vorübergehend zu speichern.
|
||||
- Der `db_prefix` ist optional, wird aber empfohlen.
|
||||
- Wenn Sie die Rechtschreibprüfung im obigen Schritt nicht installiert haben, entfernen Sie den Parameter `spellcheck_engine` und ersetzen ihn durch `$config['enable_spellcheck'] = false;`.
|
||||
```php
|
||||
- Die `des_key`-Einstellung wird auf einen Zufallswert gesetzt. Sie wird u. a. zur Verschlüsselung vorübergehend
|
||||
gespeicherter IMAP-Passwörter verwendet.
|
||||
- Die Liste der Plugins kann nach Belieben angepasst werden. Die folgende Liste enthält eine Liste von
|
||||
Standard-Plugins, welche ich als allgemein nützlich empfinde und die gut mit mailcow zusammenspielen:
|
||||
- Das archive-Plugin fügt einen Archiv-Button hinzu, der ausgewählte E-Mails in ein konfigurierbares
|
||||
Archiv-Verzeichnis verschiebt.
|
||||
- Das managesieve-Plugin bietet eine benutzerfreundliche Oberfläche zur Verwaltung serverseitiger E-Mail-Filter und
|
||||
Abwesenheits-Benachrichtigungen.
|
||||
- Das acl-Plugin ermöglicht die Verwaltung von Zugriffskontroll-Listen auf IMAP-Verzeichnissen, mit der Möglichkeit
|
||||
IMAP-Verzeichnisse mit anderen Benutzern zu teilen.
|
||||
- Das markasjunk-Plugin fügt Buttons hinzu, um ausgewählte E-Mails als Spam (oder E-Mails im Junk-Verzeichnis nicht
|
||||
als Spam) zu markieren und diese in das Junk-Verzeichnis (oder zurück in den Posteingang) zu verschieben. Die in
|
||||
mailcow enthaltenen Sieve-Filter lösen automatisch die zugehörige Lern-Operation in rspamd aus, so dass keine
|
||||
weitere Konfiguration des Plugins erforderlich ist.
|
||||
- Das zipdownload-Plugin erlaubt es, mehrere E-Mail-Anhänge oder E-Mails als ZIP-Archiv herunterzuladen.
|
||||
- Wenn Sie die Rechtschreibprüfung im obigen Schritt nicht installiert haben, entfernen Sie den Parameter
|
||||
`spellcheck_engine`.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/config/config.inc.php
|
||||
<?php
|
||||
error_reporting(0);
|
||||
if (!file_exists('/tmp/mime.types')) {
|
||||
file_put_contents("/tmp/mime.types", fopen("http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types", 'r'));
|
||||
\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';
|
||||
\$config['imap_host'] = 'dovecot:143';
|
||||
\$config['smtp_host'] = 'postfix:588';
|
||||
\$config['smtp_user'] = '%u';
|
||||
\$config['smtp_pass'] = '%p';
|
||||
\$config['support_url'] = '';
|
||||
\$config['product_name'] = 'Roundcube Webmail';
|
||||
\$config['cipher_method'] = 'chacha20-poly1305';
|
||||
\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc "A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\]^_{|}~" 2> /dev/null | head -c 32)';
|
||||
\$config['plugins'] = [
|
||||
'archive',
|
||||
'managesieve',
|
||||
'acl',
|
||||
'markasjunk',
|
||||
'zipdownload',
|
||||
];
|
||||
\$config['spellcheck_engine'] = 'aspell';
|
||||
\$config['mime_types'] = '/web/rc/config/mime.types';
|
||||
\$config['enable_installer'] = true;
|
||||
|
||||
\$config['managesieve_host'] = 'dovecot:4190';
|
||||
// Enables separate management interface for vacation responses (out-of-office)
|
||||
// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section
|
||||
\$config['managesieve_vacation'] = 1;
|
||||
EOCONFIG
|
||||
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Initialisierung der Datenbank
|
||||
Richten Sie Ihren Browser auf `https://myserver/rc/installer`. Prüfen Sie, dass die Webseite in keinem der Schritte "NOT
|
||||
OK"-Testergebnisse zeigt. Einige "NOT AVAILABLE"-Testergebnisse sind bzgl. der verschiedenen Datenbank-Erweiterungen
|
||||
erwartet, von denen nur MySQL benötigt wird.
|
||||
|
||||
Initialisieren Sie die Datenbank und verlassen Sie das Installationsprogramm. Es ist nicht notwendig, die
|
||||
Konfigurationsdatei mit der heruntergeladenen Datei zu aktualisieren, sofern Sie keine Änderungen an den Einstellungen
|
||||
innerhalb des Installationsprogramms durchgeführt habe, die Sie übernehmen möchten.
|
||||
|
||||
### Webserver-Konfiguration
|
||||
|
||||
Das Roundcube-Verzeichnis enthält einige Inhalte, die nicht an Web-Nutzer ausgeliefert werden sollen. Wir erstellen
|
||||
daher eine Konfigurations-Ergänzung für nginx, um nur die öffentlichen Teile von Roundcube im Web zu exponieren:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location /rc/ {
|
||||
alias /web/rc/public_html/;
|
||||
}
|
||||
$config = array();
|
||||
$config['db_dsnw'] = 'mysql://' . getenv('DBUSER') . ':' . getenv('DBPASS') . '@mysql/' . getenv('DBNAME');
|
||||
$config['imap_host'] = 'tls://dovecot:143';
|
||||
$config['smtp_host'] = 'tls://postfix:587';
|
||||
$config['smtp_user'] = '%u';
|
||||
$config['smtp_pass'] = '%p';
|
||||
$config['support_url'] = '';
|
||||
$config['product_name'] = 'Roundcube Webmail';
|
||||
$config['des_key'] = 'yourrandomstring_changeme';
|
||||
$config['log_dir'] = '/dev/null';
|
||||
$config['temp_dir'] = '/tmp';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Deaktivieren und entfernen des Installationsprogramms
|
||||
|
||||
Löschen Sie das Verzeichnis `data/web/rc/installer` nach einer erfolgreichen Installation, und setzen Sie die
|
||||
`enable_installer`-Option in `data/web/rc/config/config.inc.php` auf `false`:
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc/installer
|
||||
sed -i -e "s/\(\$config\['enable_installer'\].* = \)true/\1false/" data/web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Aktualisierung der Roundcube-Abhängigkeiten
|
||||
|
||||
Dieser Schritt ist nicht unbedingt notwendig, aber zumindest zum Zeitpunkt der Erstellung dieser Anweisungen enthielten
|
||||
die mit Roundcube ausgelieferten Abhängigkeiten Versionen mit Sicherheitslücken, daher könnte es eine gute Idee sein,
|
||||
die Abhängigkeiten auf die neusten Versionen zu aktualisieren. Aus demselben Grund sollte composer update hin und wieder
|
||||
ausgeführt werden.
|
||||
|
||||
```bash
|
||||
cp -n data/web/rc/composer.json-dist data/web/rc/composer.json
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o
|
||||
```
|
||||
|
||||
Sie können außerdem `composer audit` verwenden, um bekannte Sicherheitslücken in den installierten composer-Paketen
|
||||
anzuzeigen.
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit
|
||||
```
|
||||
|
||||
### Ermöglichen der Klartext-Authentifizierung für den php-fpm-Container ohne die Verwendung von TLS
|
||||
|
||||
Wir müssen die Verwendung von Klartext-Authentifizierung über nicht verschlüsselte Verbindungen (innerhalb der
|
||||
Container-Netzwerks) in Dovecot zulassen, was in der Standard-Installation von mailcow nur für den SOGo-Container
|
||||
zum gleichen Zweck möglich ist. Danach starten Sie den Dovecot-Container neu, damit die Änderung wirksam wird.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/conf/dovecot/extra.conf
|
||||
remote ${IPV4_NETWORK}.0/24 {
|
||||
disable_plaintext_auth = no
|
||||
}
|
||||
remote ${IPV6_NETWORK} {
|
||||
disable_plaintext_auth = no
|
||||
}
|
||||
EOCONFIG
|
||||
|
||||
docker compose restart dovecot-mailcow
|
||||
```
|
||||
|
||||
### Ofelia-Job für Roundcube-Aufräumtätigkeiten
|
||||
|
||||
Roundcube muss regelmässig die Datenbank von nicht mehr benötigter Information befreien. Wir legen einen Ofelia-Job an,
|
||||
der das Roundcube `cleandb.sh`-Skript regelmässig ausführt.
|
||||
|
||||
Um dies zu tun, fügen Sie folgendes zu `docker-compose.override.yml` hinzu (falls Sie bereits einige Anpassungen für den
|
||||
php-fpm-Container durchgeführt haben, fügen Sie die Label dem bestehenden Abschnitt hinzu):
|
||||
|
||||
```yml
|
||||
version: '2.1'
|
||||
services:
|
||||
php-fpm-mailcow:
|
||||
labels:
|
||||
ofelia.enabled: "true"
|
||||
ofelia.job-exec.roundcube_cleandb.schedule: "@every 168h"
|
||||
ofelia.job-exec.roundcube_cleandb.user: "www-data"
|
||||
ofelia.job-exec.roundcube_cleandb.command: "/bin/bash -c \"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\""
|
||||
```
|
||||
|
||||
## Optionale Zusatz-Funktionalitäten
|
||||
|
||||
## Aktivieren der Funktion "Passwort ändern" in Roundcube
|
||||
|
||||
Das Ändern des mailcow Passworts aus der Roundcube-Benutzeroberfläche wird durch das password-Plugin ermöglicht. Wir
|
||||
konfigurieren dieses zur Verwendung der mailcow-API zur Passwort-Aktualisierung, was es zunächst erfordert, die API zu
|
||||
aktivieren und den API-Schlüssel zu ermitteln (Lese-/Schreib-Zugriff notwendig). Die API kann in der
|
||||
mailcow-Administrationsoberfläche aktiviert werden, wo Sie auch den API-Schlüssel finden.
|
||||
|
||||
Öffnen Sie `data/web/rc/config/config.inc.php` und aktivieren Sie das Passwort-Plugin, indem Sie es dem
|
||||
`$config['plugins']`-Array hinzufügen, zum Beispiel:
|
||||
|
||||
```php
|
||||
$config['plugins'] = array(
|
||||
'archive',
|
||||
'managesieve'
|
||||
'managesieve',
|
||||
'acl',
|
||||
'markasjunk',
|
||||
'zipdownload',
|
||||
'password',
|
||||
);
|
||||
$config['spellcheck_engine'] = 'aspell';
|
||||
$config['mime_types'] = '/tmp/mime.types';
|
||||
$config['imap_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
$config['enable_installer'] = true;
|
||||
$config['smtp_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
$config['db_prefix'] = 'mailcow_rc1';
|
||||
```
|
||||
|
||||
Richten Sie Ihren Browser auf `https://myserver/rc/installer` und folgen Sie den Anweisungen.
|
||||
Initialisiere die Datenbank und verlasse das Installationsprogramm.
|
||||
Konfigurieren Sie das password-Plugin (stellen Sie sicher, __\*\*API_KEY\*\*__ auf Ihren mailcow Lese-/Schreib-API-Schlüssel
|
||||
anzupassen):
|
||||
|
||||
**Löschen Sie das Verzeichnis `data/web/rc/installer` nach einer erfolgreichen Installation!**
|
||||
|
||||
## Konfigurieren Sie die ManageSieve-Filterung
|
||||
|
||||
Öffnen Sie `data/web/rc/config/config.inc.php` und ändern Sie die folgenden Parameter (oder fügen Sie sie am Ende der Datei hinzu):
|
||||
```php
|
||||
$config['managesieve_host'] = 'tls://dovecot:4190';
|
||||
$config['managesieve_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
// Aktiviert separate Verwaltungsschnittstelle für Urlaubsantworten (außer Haus)
|
||||
// 0 - kein separater Abschnitt (Standard),
|
||||
// 1 - Abschnitt "Urlaub" hinzufügen,
|
||||
// 2 - Abschnitt "Urlaub" hinzufügen, aber Abschnitt "Filter" ausblenden
|
||||
$config['managesieve_vacation'] = 1;
|
||||
```
|
||||
|
||||
## Aktivieren Sie die Funktion "Passwort ändern" in Roundcube
|
||||
|
||||
Öffnen Sie `data/web/rc/config/config.inc.php` und aktivieren Sie das Passwort-Plugin:
|
||||
|
||||
```php
|
||||
[...]
|
||||
$config['plugins'] = array(
|
||||
'archive',
|
||||
'password',
|
||||
);
|
||||
[...]
|
||||
```
|
||||
|
||||
Öffnen Sie `data/web/rc/plugins/password/password.php`, suchen Sie nach `case 'ssha':` und fügen Sie oben hinzu:
|
||||
|
||||
```php
|
||||
case 'ssha256':
|
||||
$salt = rcube_utils::random_bytes(8);
|
||||
$crypted = base64_encode( hash('sha256', $password . $salt, TRUE ) . $salt );
|
||||
$prefix = '{SSHA256}';
|
||||
break;
|
||||
```
|
||||
|
||||
Öffnen Sie `data/web/rc/plugins/password/config.inc.php` und ändern Sie die folgenden Parameter (oder fügen Sie sie am Ende der Datei hinzu):
|
||||
|
||||
```php
|
||||
$config['password_driver'] = 'sql';
|
||||
$config['password_algorithm'] = 'ssha256';
|
||||
$config['password_algorithm_prefix'] = '{SSHA256}';
|
||||
$config['password_query'] = "UPDATE mailbox SET password = %P WHERE username = %u";
|
||||
```
|
||||
|
||||
## CardDAV Adressbücher in Roundcube einbinden
|
||||
|
||||
Laden Sie die neueste Version von [RCMCardDAV](https://github.com/mstilkerich/rcmcarddav) in das Roundcube Plugin Verzeichnis und entpacken Sie es (hier `rc/plugins`):
|
||||
```bash
|
||||
cd data/web/rc/plugins
|
||||
wget -O - https://github.com/mstilkerich/rcmcarddav/releases/download/v4.4.1/carddav-v4.4.1-roundcube16.tar.gz | tar xfvz -
|
||||
chown -R root: carddav/
|
||||
cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php
|
||||
<?php
|
||||
\$config['password_driver'] = 'mailcow';
|
||||
\$config['password_confirm_current'] = true;
|
||||
\$config['password_mailcow_api_host'] = 'http://nginx';
|
||||
\$config['password_mailcow_api_token'] = '**API_KEY**';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
Kopieren Sie die Datei `config.inc.php.dist` nach `config.inc.php` (hier in `rc/plugins/carddav`) und fügen Sie die folgende Voreinstellung an das Ende der Datei an - vergessen Sie nicht, `mx.example.org` durch Ihren eigenen Hostnamen zu ersetzen:
|
||||
```php
|
||||
$prefs['SOGo'] = array(
|
||||
'name' => 'SOGo',
|
||||
'username' => '%u',
|
||||
'password' => '%p',
|
||||
'url' => 'https://mx.example.org/SOGo/dav/%u/',
|
||||
'carddav_name_only' => true,
|
||||
Hinweis: Sollten Sie die mailcow nginx-Konfiguration so angepasst haben, dass http-Anfragen auf https umgeleitet werden
|
||||
(wie z. B. [hier](https://docs.mailcow.email/manual-guides/u_e-80_to_443/) beschrieben), dann wird die direkte
|
||||
Verbindung zum nginx-Container via HTTP nicht funktionieren, da nginx kein im Zertifikat enthaltener Hostname ist. In
|
||||
solchen Fällen setzen Sie `password_mailcow_api_host` stattdessen auf die öffentliche URI:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php
|
||||
<?php
|
||||
\$config['password_driver'] = 'mailcow';
|
||||
\$config['password_confirm_current'] = true;
|
||||
\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';
|
||||
\$config['password_mailcow_api_token'] = '**API_KEY**';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
## CardDAV-Adressbücher in Roundcube einbinden
|
||||
|
||||
Installieren Sie die neuste v5-Version (die untenstehende Konfiguration ist kompatibel zu v5-Releases) mit composer.
|
||||
Antworten Sie `Y`, wenn Sie gefragt werden, ob Sie das Plugin aktivieren möchten.
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o "roundcube/carddav:~5"
|
||||
```
|
||||
|
||||
Editieren Sie die Datei `data/web/rc/plugins/carddav/config.inc.php` und fügen Sie folgenden Inhalt hinzu:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php
|
||||
<?php
|
||||
\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';
|
||||
|
||||
\$prefs['SOGo'] = [
|
||||
'accountname' => 'SOGo',
|
||||
'username' => '%u',
|
||||
'password' => '%p',
|
||||
'discovery_url' => 'http://sogo:20000/SOGo/dav/',
|
||||
'name' => '%N',
|
||||
'use_categories' => true,
|
||||
'active' => true,
|
||||
'readonly' => false,
|
||||
'refresh_time' => '02:00:00',
|
||||
'fixed' => array( 'active', 'name', 'username', 'password', 'refresh_time' ),
|
||||
'hide' => false,
|
||||
);
|
||||
```
|
||||
Bitte beachten Sie, dass dieses Preset nur das Standard-Adressbuch integriert (dasjenige, das den Namen "Persönliches Adressbuch" trägt und nicht gelöscht werden kann). Weitere Adressbücher werden derzeit nicht automatisch erkannt, können aber manuell in den Roundcube-Einstellungen hinzugefügt werden.
|
||||
|
||||
Aktivieren Sie das Plugin, indem Sie `carddav` zu `$config['plugins']` in `rc/config/config.inc.php` hinzufügen.
|
||||
|
||||
Wenn Sie die Standard-Adressbücher (die in der Roundcube-Datenbank gespeichert sind) entfernen möchten, so dass nur die CardDAV-Adressbücher zugänglich sind, fügen Sie `$config['address_book_type'] = '';` in die Konfigurationsdatei `data/web/rc/config/config.inc.php` ein.
|
||||
|
||||
---
|
||||
|
||||
Optional können Sie Roundcube's Link zu der mailcow Apps Liste hinzufügen.
|
||||
Um dies zu tun, öffnen oder erstellen Sie `data/web/inc/vars.local.inc.php` und fügen Sie den folgenden Code-Block hinzu:
|
||||
|
||||
*HINWEIS: Vergessen Sie nicht, das `<?php` Trennzeichen in der ersten Zeile einzufügen*
|
||||
|
||||
```php
|
||||
...
|
||||
$MAILCOW_APPS = array(
|
||||
array(
|
||||
'name' => 'SOGo',
|
||||
'link' => '/SOGo/'
|
||||
),
|
||||
array(
|
||||
'name' => 'Roundcube',
|
||||
'link' => '/rc/'
|
||||
)
|
||||
);
|
||||
...
|
||||
'fixed' => ['username', 'password'],
|
||||
];
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
## Aktualisierung von Roundcube
|
||||
RCMCardDAV legt alle Adressbücher des Benutzers beim Login in Roundcube an, einschließlich __abonnierten__ Adressbüchern
|
||||
die mit dem Benutzers von anderen Benutzern geteilt werden.
|
||||
|
||||
Ein Upgrade von Roundcube ist recht einfach: Gehen Sie auf die [Github releases](https://github.com/roundcube/roundcubemail/releases) Seite für Roundcube und holen Sie sich den Link für die "complete.tar.gz" Datei für die gewünschte Version. Dann folgen Sie den untenstehenden Befehlen und ändern Sie die URL und den Namen des Roundcube-Ordners, falls nötig.
|
||||
Wenn Sie das Standard-Adressbuch (gespeichert in der Roundcube-Datenbank) entfernen möchten, so dass nur
|
||||
CardDAV-Adressbücher verwendet werden können, fügen Sie der Konfigurationsdatei `data/web/rc/config/config.inc.php` die
|
||||
Option `$config['address_book_type'] = '';` hinzu.
|
||||
|
||||
Hinweis: RCMCardDAV verwendet zusätzliche Datenbank-Tabellen. Nach der Installation (oder Aktualisierung) von RCMCardDAV
|
||||
ist es notwendig, sich in Roundcube neu anzumelden (melden Sie sich vorher ab, wenn Sie bereits eingeloggt sind), da die
|
||||
Erzeugung der Datenbank-Tabellen bzw. Änderungen nur bei der Anmeldung in Roundcube durchgeführt werden.
|
||||
|
||||
### Übermittlung der Client-Netzwerkadresse an Dovecot
|
||||
|
||||
Normalerweise sieht der IMAP-Server Dovecot die Netzwerkadresse des php-fpm-Containers wenn Roundcube zu diesem
|
||||
Verbindungen aufbaut. Durch Verwendung einer IMAP-Erweiterung und dem `roundcube-dovecot_client_ip` Roundcube-Plugin ist
|
||||
es möglich, dass Roundcube Dovecot die Client-Netzwerkadresse übermittelt, so dass in den Log-Dateien die
|
||||
Client-Netzwerkadresse erscheint. Dies führt dazu, dass Login-Versuche an Roundcube in den Dovecot-Logs genauso wie
|
||||
direkte Client-Verbindungen zu Dovecot aufgezeichnet werden, und fehlgeschlagene Login-Versuche an Roundcube
|
||||
analog zu fehlgeschlagenen direkten IMAP-Logins durch den netfilter-Container oder andere ggf. verfügbare Mechanismen
|
||||
zur Behandlung von Bruteforce-Attacken auf den IMAP-Server aufgegriffen werden und z. B. zu einer Blockierung des
|
||||
Clients führen.
|
||||
|
||||
Hierzu muss das Roundcube-Plugin installiert werden:
|
||||
|
||||
```bash
|
||||
# Starten Sie eine Bash-Sitzung des mailcow PHP-Containers
|
||||
docker exec -it mailcowdockerized-php-fpm-mailcow-1 bash
|
||||
|
||||
# Installieren Sie die erforderliche Upgrade-Abhängigkeit, dann aktualisieren Sie Roundcube auf die gewünschte Version
|
||||
apk add rsync
|
||||
cd /tmp
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
cd roundcubemail-1.6.1
|
||||
bin/installto.sh /web/rc
|
||||
|
||||
# Geben Sie 'Y' ein und drücken Sie die Eingabetaste, um Ihre Installation von Roundcube zu aktualisieren.
|
||||
# Geben Sie 'N' ein, wenn folgender Dialog erscheint: "Do you want me to fix your local configuration".
|
||||
|
||||
# Sollte im Output eine Notice kommen "NOTICE: Update dependencies by running php composer.phar update --no-dev" sollte an kurzerhand composer.phar downloaden und die updates durchführen:
|
||||
cd /web/rc
|
||||
wget https://getcomposer.org/download/2.4.2/composer.phar
|
||||
php composer.phar update --no-dev
|
||||
# Auf die Frage "Do you trust "roundcube/plugin-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] " bitte mit y antworten.
|
||||
|
||||
# Entfernen Sie übrig gebliebene Dateien
|
||||
cd /tmp
|
||||
rm -rf roundcube*
|
||||
|
||||
# Falls Sie von Version 1.5 auf 1.6 updaten, dann führen Sie folgende Befehle aus, um die Konfigurationsdatei anzupassen:`
|
||||
sed -i "s/\$config\['default_host'\].*$/\$config\['imap_host'\]\ =\ 'tls:\/\/dovecot:143'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['default_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['smtp_server'\].*$/\$config\['smtp_host'\]\ =\ 'tls:\/\/postfix:587'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['smtp_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['managesieve_host'\].*$/\$config\['managesieve_host'\]\ =\ 'tls:\/\/dovecot:4190'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['managesieve_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o "takerukoushirou/roundcube-dovecot_client_ip:~1"
|
||||
```
|
||||
|
||||
## Administratoren ohne Passwort in Roundcube einloggen lassen
|
||||
Weiterhin müssen wir Dovecot konfigurieren, so dass der php-fpm-Container als Teil eines vertrauenswürdigen Netzwerks
|
||||
betrachtet wird und somit die Client-Netzwerkadresse innerhalb einer IMAP-Sitzung überschreiben darf. Beachten Sie, dass
|
||||
dies auch die Klartext-Authentifizierung für die aufgeführten Netzwerkbereiche erlaubt, so dass das explizite
|
||||
Überschreiben von `disable_plaintext_auth` weiter oben in diesem Fall nicht notwendig ist.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/conf/dovecot/extra.conf
|
||||
login_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}
|
||||
EOCONFIG
|
||||
|
||||
docker compose restart dovecot-mailcow
|
||||
```
|
||||
|
||||
### Roundcube zur mailcow Apps-Liste hinzufügen
|
||||
|
||||
Optional können Sie Roundcubes Link zu der mailcow Apps Liste hinzufügen.
|
||||
Um dies zu tun, öffnen oder erstellen Sie `data/web/inc/vars.local.inc.php` und stellen Sie sicher, dass es den
|
||||
folgenden Konfigurationsblock beinhaltet:
|
||||
|
||||
```php
|
||||
<?php
|
||||
|
||||
$MAILCOW_APPS = [
|
||||
[
|
||||
'name' => 'SOGo',
|
||||
'link' => '/SOGo/'
|
||||
],
|
||||
[
|
||||
'name' => 'Roundcube',
|
||||
'link' => '/rc/'
|
||||
]
|
||||
];
|
||||
```
|
||||
|
||||
### Administratoren ohne Passwort in Roundcube einloggen lassen
|
||||
|
||||
Installieren Sie zunächst das Plugin [dovecot_impersonate](https://github.com/corbosman/dovecot_impersonate/) und fügen Sie Roundcube als App hinzu (siehe oben).
|
||||
|
||||
|
|
@ -223,7 +392,6 @@ services:
|
|||
- ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}
|
||||
```
|
||||
|
||||
|
||||
Bearbeiten Sie `data/web/js/site/mailbox.js` und den folgenden Code nach [`if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }`](https://github.com/mailcow/mailcow-dockerized/blob/2f9da5ae93d93bf62a8c2b7a5a6ae50a41170c48/data/web/js/site/mailbox.js#L485-L487)
|
||||
|
||||
```js
|
||||
|
|
@ -238,7 +406,7 @@ Bearbeiten Sie `data/web/mailbox.php` und fügen Sie diese Zeile zum Array [`$te
|
|||
'allow_admin_email_login_roundcube' => (preg_match("/^(yes|y)+$/i", $_ENV["ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE"])) ? 'true' : 'false',
|
||||
```
|
||||
|
||||
Bearbeiten Sie `data/web/templates/mailbox.twig` und fügen Sie diesen Code am Ende des [javascript-Abschnitts](https://github.com/mailcow/mailcow-dockerized/blob/2f9da5ae93d93bf62a8c2b7a5a6ae50a41170c48/data/web/templates/mailbox.twig#L49-L57) ein:
|
||||
Bearbeiten Sie `data/web/templates/mailbox.twig` und fügen Sie diesen Code am Ende des [Javascript-Abschnitts](https://github.com/mailcow/mailcow-dockerized/blob/2f9da5ae93d93bf62a8c2b7a5a6ae50a41170c48/data/web/templates/mailbox.twig#L49-L57) ein:
|
||||
|
||||
```js
|
||||
var ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE = {{ allow_admin_email_login_roundcube }};
|
||||
|
|
@ -249,6 +417,7 @@ Kopieren Sie den Inhalt der folgenden Dateien aus diesem [Snippet](https://gitla
|
|||
* `data/web/inc/lib/RoundcubeAutoLogin.php`
|
||||
* `data/web/rc-auth.php`
|
||||
|
||||
## Abschluss der Installation
|
||||
Starten Sie schließlich mailcow neu
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
|
@ -266,5 +435,228 @@ Starten Sie schließlich mailcow neu
|
|||
```
|
||||
|
||||
|
||||
## Aktualisierung von Roundcube
|
||||
|
||||
Ein Upgrade von Roundcube ist recht einfach: Gehen Sie auf die
|
||||
[GitHub releases](https://github.com/roundcube/roundcubemail/releases) Seite für Roundcube und holen Sie sich den Link
|
||||
für die "complete.tar.gz" Datei für die gewünschte Version. Dann folgen Sie den untenstehenden Befehlen und ändern Sie
|
||||
die URL und den Namen des Roundcube-Ordners, falls nötig.
|
||||
|
||||
```bash
|
||||
# Starten Sie eine Bash-Sitzung des mailcow PHP-Containers
|
||||
docker exec -it mailcowdockerized-php-fpm-mailcow-1 bash
|
||||
|
||||
# Installieren Sie die erforderliche Upgrade-Abhängigkeit, dann aktualisieren Sie Roundcube auf die gewünschte Version
|
||||
apk add rsync
|
||||
cd /tmp
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
cd roundcubemail-1.6.1
|
||||
bin/installto.sh /web/rc
|
||||
|
||||
# Geben Sie 'Y' ein und drücken Sie die Eingabetaste, um Ihre Installation von Roundcube zu aktualisieren.
|
||||
# Geben Sie 'N' ein, wenn folgender Dialog erscheint: "Do you want me to fix your local configuration".
|
||||
|
||||
# Sollte im Output eine Notice kommen "NOTICE: Update dependencies by running php composer.phar update --no-dev" führen
|
||||
Sie composer aus:
|
||||
cd /web/rc
|
||||
composer update --no-dev -o
|
||||
# Auf die Frage "Do you trust "roundcube/plugin-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] " bitte mit y antworten.
|
||||
|
||||
# Entfernen Sie übrig gebliebene Dateien
|
||||
rm -rf /tmp/roundcube*
|
||||
|
||||
# Falls Sie von Version 1.5 auf 1.6 updaten, dann führen Sie folgende Befehle aus, um die Konfigurationsdatei anzupassen:`
|
||||
sed -i "s/\$config\['default_host'\].*$/\$config\['imap_host'\]\ =\ 'dovecot:143'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['default_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['smtp_server'\].*$/\$config\['smtp_host'\]\ =\ 'postfix:588'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['smtp_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['managesieve_host'\].*$/\$config\['managesieve_host'\]\ =\ 'dovecot:4190'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['managesieve_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Aktualisierung von composer-Plugins
|
||||
|
||||
Um Roundcube-Plugins und -Abhängigkeiten zu aktualisieren, die mit composer installiert wurden (z. B.
|
||||
RCMCardDAV-Plugin), führen Sie einfach composer im Container aus:
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o
|
||||
```
|
||||
|
||||
### Aktualisierung des MIME-Typ-Verzeichnisses
|
||||
|
||||
Um das MIME-Typ-Verzeichnis zu aktualisieren, laden Sie dieses erneut mit dem Kommando aus den
|
||||
[Installations-Anweisungen](#Installation-des-MIME-Typ-Verzeichnisses) herunter.
|
||||
|
||||
## Deinstallation von Roundcube
|
||||
|
||||
Für die Deinstallation wird ebenfalls angenommen, dass die Kommandos im mailcow-Installationsverzeichnis ausgeführt
|
||||
werden und dass `mailcow.conf` in die Shell geladen wurde, siehe Abschnitt [Vorbereitung](#Vorbereitung) oben.
|
||||
|
||||
### Entfernen des Web-Verzeichnisses
|
||||
|
||||
Dies entfernt die Roundcube-Installation mit allen Plugins und Abhängigkeiten die Sie ggf. installiert haben,
|
||||
einschließlich solcher, die mit composer installiert wurden.
|
||||
|
||||
Hinweis: Dies entfernt auch alle angepassten Konfigurationen die Sie ggf. in Roundcube durchgeführt haben. Sollten Sie
|
||||
diese erhalten wollen, verschieben Sie das Verzeichnis an einen anderen Ort statt es zu entfernen.
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc
|
||||
```
|
||||
|
||||
### Entfernen der Datenbank
|
||||
|
||||
Hinweis: Dies löscht alle Daten, die Roundcube abgespeichert hat. Wenn Sie diese erhalten möchten, können Sie
|
||||
`mysqldump` ausführen, bevor Sie die Datenbank löschen, oder die Datenbank einfach nicht löschen.
|
||||
|
||||
```bash
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "DROP USER 'roundcube'@'%';"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "DROP DATABASE roundcubemail;"
|
||||
```
|
||||
|
||||
### Entfernen der Konfigurationsanpassungen für mailcow
|
||||
|
||||
Um die Dateien zu ermitteln, lesen Sie bitte die Installationsanweisungen und machen Sie die Schritte, die Sie dort
|
||||
zuvor durchgeführt haben, rückgängig.
|
||||
|
||||
## Migration von einer älteren mailcow-Roundcube-Installation
|
||||
|
||||
Ältere Versionen dieser Anleitung verwendeten die mailcow-Datenbank auch für Roundcube, mit einem konfigurierten Präfix
|
||||
`mailcow_rc1` für alle Roundcube-Tabellen.
|
||||
|
||||
Zur Migration wird ebenfalls angenommen, dass alle Kommandos im mailcow-Installationsverzeichnis ausgeführt werden und
|
||||
`mailcow.conf` in die Shell geladen wurde, siehe [Vorbereitung](#Vorbereitung) oben. Dies Kommandos der verschiedenen
|
||||
Schritte bauen aufeinander auf und müssen innerhalb derselben Shell ausgeführt werden. Insbesondere setzen einige
|
||||
Schritte Shell-Variablen (besonders die `DBROUNDCUBE`-Variable mit dem Datenbank-Passwort für den
|
||||
roundcube-Datenbankbenutzer), die in späteren Schritten verwendet werden.
|
||||
|
||||
### Anlegen eines neuen roundcube-Datenbankbenutzers und der Datenbank
|
||||
|
||||
Folgen Sie den [Anweisungen oben](#Anlegen-der-Roundcube-Datenbank) um den roundcube-Datenbankbenutzer und die getrennte
|
||||
Datenbank anzulegen.
|
||||
|
||||
### Migration der Roundcube-Daten aus der mailcow-Datenbank
|
||||
|
||||
Bevor wir mit der Migration starten, deaktivieren wir Roundcube, um weitere Änderungen an dessen Datenbank-Tabellen zu
|
||||
vermeiden.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location ^~ /rc/ {
|
||||
return 503;
|
||||
}
|
||||
EOCONFIG
|
||||
docker compose exec nginx-mailcow nginx -s reload
|
||||
```
|
||||
|
||||
Nun kopieren wir die Roundcube-Daten in die neue Datenbank. Wir entfernen das Datenbank-Tabellen-Präfix in diesem
|
||||
Schritt, welches Sie ggf. anpassen müssen, wenn Sie ein anderes Präfix als `mailcow_rc1` verwendet haben. Es ist auch
|
||||
möglich, das Präfix beizubehalten (in diesem Fall behalten Sie auch die zugehörige Roundcube-Einstellung `db_prefix`
|
||||
bei).
|
||||
|
||||
```bash
|
||||
RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e "show tables like 'mailcow_rc1%';" | tr '\n\r' ' ')
|
||||
docker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c "mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail"
|
||||
```
|
||||
|
||||
### Aktualisierung der Roundcube-Konfiguration
|
||||
|
||||
Führen Sie folgende Kommandos aus, um die nicht mehr notwendige `db_prefix` Option zu entfernen. Wir aktivieren außerdem
|
||||
das Logging in Roundcube, indem wir die Einstellungen `log_dir` und `temp_dir` entfernen, welche Teil der alten
|
||||
Anweisungen waren.
|
||||
|
||||
```bash
|
||||
sed -i "/\$config\['db_prefix'\].*$/d" data/web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['log_dir'\].*$/d" data/web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['temp_dir'\].*$/d" data/web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
Wir müssen die nginx-Konfiguration anpassen, so dass nicht-öffentliche Verzeichnisse von Roundcube nicht exponiert
|
||||
werden, insbesondere die Verzeichnisse, welche Log-Dateien und temporäre Dateien enthalten:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location /rc/ {
|
||||
alias /web/rc/public_html/;
|
||||
}
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
Wir können auch die `cipher_method`-Einstellung auf eine sicherere Einstellung ändern, aber beachten Sie, dass mit der
|
||||
alten Methode verschlüsselte Daten danach nicht mehr entschlüsselt werden können. Dies betrifft insbesondere
|
||||
CardDAV-Passwörter, sofern Sie RCMCardDAV verwenden und Ihre Nutzer benutzerdefinierte Adressbücher hinzugefügt haben
|
||||
(die Admin-Voreinstellungen für die SOGo-Adressbücher werden automatisch beim nächsten Login für den jeweiligen Nutzer
|
||||
korrigiert). Wenn Sie die `cipher_method` ändern wollen, führen Sie folgendes Kommando aus:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/web/rc/config/config.inc.php
|
||||
\$config['cipher_method'] = 'chacha20-poly1305';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Umstellung des RCMCardDAV-Plugins auf die Installation mittels composer
|
||||
|
||||
Dieser Schritt ist optional, aber er gleicht Ihre Installation an die aktuelle Fassung der Anweisungen an und ermöglicht
|
||||
die Aktualisierung von RCMCardDAV mittels composer. Dies wird einfach dadurch erreicht, dass das carddav-Plugin aus dem
|
||||
Installationsverzeichnis gelöscht und entsprechend der [Anweisungen oben](#CardDAV-Adressbücher-in-Roundcube-einbinden)
|
||||
installiert wird, einschließlich der Erstellung einer neuen RCMCardDAV v5-Konfiguration. Falls Sie das RCMCardDAV
|
||||
angepasst haben, sollten Sie dieses sichern, bevor Sie das Plugin löschen, und Ihre Anpassungen später in die neue
|
||||
Konfigurationsdatei übernehmen.
|
||||
|
||||
Um das carddav-Plugin zu löschen, führen Sie folgendes Kommando aus, danach befolgen Sie zur Neuinstallation die
|
||||
[Anweisungen oben](#CardDAV-Adressbücher-in-Roundcube-einbinden):
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc/plugins/carddav
|
||||
```
|
||||
|
||||
### Umschalten von Roundcube auf die neue Datenbank
|
||||
|
||||
Zunächst passen wir die Roundcube-Konfiguration an, so dass die neue Datenbank verwendet wird.
|
||||
```bash
|
||||
sed -i "/\$config\['db_dsnw'\].*$/d" data/web/rc/config/config.inc.php
|
||||
cat <<EOCONFIG >>data/web/rc/config/config.inc.php
|
||||
\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Roundcube Web-Zugriff reaktivieren
|
||||
|
||||
Führen Sie chown und chmod auf den sensitiven Roundcube-Verzeichnissen, welche in [Vorbereitung](#Vorbereitung)
|
||||
aufgeführt sind aus, um sicherzustellen, dass der nginx-Webserver nicht auf Dateien zugreifen darf, die er nicht
|
||||
ausliefern soll.
|
||||
|
||||
Dann reaktivieren Sie den Web-Zugriff für Roundcube, indem Sie die temporäre Roundcube-Konfigurations-Erweiterung für
|
||||
nginx durch die [oben](#Webserver-Konfiguration) beschriebene ersetzen, und laden anschließend die nginx-Konfiguration
|
||||
neu:
|
||||
|
||||
```bash
|
||||
docker compose exec nginx-mailcow nginx -s reload
|
||||
```
|
||||
|
||||
### Andere Anpassungen
|
||||
|
||||
Sie müssen auch die Konfiguration des Roundcube password-Plugins entsprechend dieser Anweisungen anpassen, sofern Sie
|
||||
diese Funktionalität aktiviert haben, da die alten Anweisungen das Passwort direkt in der mailcow-Datenbank änderten,
|
||||
wohingegen diese Fassung der Anweisungen die mailcow-API zur Passwort-Änderung verwendet.
|
||||
|
||||
Bezüglich weiterer Anpassungen und Neuerungen (z. B. roundcube-dovecot\_client\_ip Plugin) können Sie die aktuellen
|
||||
Anweisungen durchgehen und Ihre Konfiguration entsprechend anpassen bzw. die genannten Installationsschritte für neue
|
||||
Funktionalitäten ausführen.
|
||||
|
||||
Insbesondere beachten Sie folgende Abschnitte:
|
||||
|
||||
- [Ofelia-Job für Roundcube-Aufräumtätigkeiten](#Ofelia-Job-für-Roundcube-Aufräumtätigkeiten)
|
||||
- [Ermöglichen der Klartext-Authentifizierung für den php-fpm-Container ohne die Verwendung von TLS](#Ermöglichen-der-Klartext-Authentifizierung-für-den-php-fpm-Container-ohne-die-Verwendung-von-TLS)
|
||||
- [Übermittlung der Client-Netzwerkadresse an Dovecot](#Übermittlung-der-Client-Netzwerkadresse-an-Dovecot)
|
||||
|
||||
### Entfernen der Roundcube-Tabellen aus der mailcow-Datenbank
|
||||
|
||||
Nachdem Sie sichergestellt haben, dass die Migration erfolgreich durchgeführt wurde und Roundcube mit der getrennten
|
||||
Datenbank funktioniert, können Sie die Roundcube-Tabellen aus der mailcow-Datenbank mit dem folgenden Kommando
|
||||
entfernen:
|
||||
|
||||
```bash
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e "SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \+/,/g');"
|
||||
```
|
||||
|
|
|
|||
701
docs/third_party/roundcube/third_party-roundcube.en.md
gevendort
701
docs/third_party/roundcube/third_party-roundcube.en.md
gevendort
|
|
@ -1,207 +1,352 @@
|
|||
## Installing Roundcube
|
||||
|
||||
Download Roundcube 1.6.x to the web htdocs directory and extract it (here `rc/`):
|
||||
```bash
|
||||
# Check for a newer release!
|
||||
cd data/web
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
Unless otherwise stated, all of the given commands are expected to be executed in the mailcow installation directory,
|
||||
i.e., the directory containing `mailcow.conf` etc. Please do not blindly execute the commands but understand what they
|
||||
do. None of the commands is supposed to produce an error, so if you encounter an error, fix it if necessary before
|
||||
continuing with the subsequent commands.
|
||||
|
||||
# Change folder name
|
||||
mv roundcubemail-1.6.1 rc
|
||||
### Note on composer usage
|
||||
|
||||
# Change permissions
|
||||
chown -R root: rc/
|
||||
This guide uses composer to update roundcube dependencies or install / update roundcube plugins.
|
||||
|
||||
The roundcube-plugin-installer composer plugin has a [design issue](https://github.com/roundcube/plugin-installer/issues/38)
|
||||
that can lead to composer errors when packages are upgraded or uninstalled in the composer execution.
|
||||
|
||||
The error message will typically tell you that a `require` in `autoload_real.php` failed because a file could not be
|
||||
opened. Example:
|
||||
|
||||
```
|
||||
In autoload_real.php line 43:
|
||||
require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory
|
||||
```
|
||||
|
||||
If you need spell check features, create a file `data/hooks/phpfpm/aspell.sh` with the following content, then `chmod +x data/hooks/phpfpm/aspell.sh`. This installs a local spell check engine. Note, most modern web browsers have built in spell check, so you may not want/need this.
|
||||
Unfortunately these occur quite frequently, but they can be worked around by updating the autoloader and re-running the
|
||||
failed command:
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o
|
||||
# Now execute the command that failed again
|
||||
```
|
||||
|
||||
### Preparation
|
||||
First we load `mailcow.conf` so we have access to the mailcow configuration settings for the following commands.
|
||||
|
||||
```bash
|
||||
source mailcow.conf
|
||||
```
|
||||
|
||||
Download Roundcube 1.6.x (check for latest release and adapt URL) to the web directory and extract it (here `rc/`):
|
||||
|
||||
```bash
|
||||
mkdir -m 755 data/web/rc
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config
|
||||
```
|
||||
|
||||
### Optional: Spellchecking
|
||||
If you need spell check features, create a file `data/hooks/phpfpm/aspell.sh` with the following content, then
|
||||
`chmod +x data/hooks/phpfpm/aspell.sh`. This installs a local spell check engine. Note, most modern web browsers have
|
||||
built in spell check, so you may not want/need this.
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
apk update
|
||||
apk add aspell-en # or any other language
|
||||
```
|
||||
|
||||
### Install mime type mappings
|
||||
Download the `mime.types` file as it is not included in the php-fpm container.
|
||||
|
||||
```bash
|
||||
wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types
|
||||
```
|
||||
|
||||
### Create roundcube database
|
||||
Create a database for roundcube in the mailcow MySQL container. This creates a new `roundcube` database user
|
||||
with a random password, which will be echoed to the shell and stored in a shell variable for use by later
|
||||
commands. Note that when you interrupt the process and continue in a new shell, you must set the `DBROUNDCUBE`
|
||||
shell variable manually to the password output by the following commands.
|
||||
|
||||
```bash
|
||||
DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
|
||||
echo Database password for user roundcube is $DBROUNDCUBE
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';"
|
||||
```
|
||||
|
||||
### Roundcube configuration
|
||||
Create a file `data/web/rc/config/config.inc.php` with the following content.
|
||||
- **Change the `des_key` parameter to a random value.** It is used to temporarily store your IMAP password.
|
||||
- The `db_prefix` is optional but recommended.
|
||||
- If you didn't install spell check in the above step, remove `spellcheck_engine` parameter and replace it with `$config['enable_spellcheck'] = false;`.
|
||||
```php
|
||||
- The `des_key` option is set to a random value. It is used to temporarily store your IMAP password.
|
||||
- The plugins list can be adapted to your preference. I added a set of standard plugins that I consider of common
|
||||
usefulness and which work well together with mailcow:
|
||||
- The archive plugin adds an archive button that moves selected messages to a user-configurable archive folder.
|
||||
- The managesieve plugin provides a user-friendly interface to manage server-side mail filtering and vacation / out
|
||||
of office notification.
|
||||
- The acl plugin allows to manage access control lists on IMAP folders, including the ability to share IMAP folders
|
||||
to other users.
|
||||
- The markasjunk plugin adds buttons to mark selected messages as junk (or messages in the junk folder not as junk)
|
||||
and moves them to the junk folder or back to the inbox. The sieve filters included with mailcow will take care
|
||||
that action triggers a learn as spam/ham action in rspamd, so no further configuration of the plugin is needed.
|
||||
- The zipdownload plugin allows to download multiple message attachments or messages as a zip file.
|
||||
- If you didn't install spell check in the above step, remove `spellcheck_engine` parameter.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/config/config.inc.php
|
||||
<?php
|
||||
error_reporting(0);
|
||||
if (!file_exists('/tmp/mime.types')) {
|
||||
file_put_contents("/tmp/mime.types", fopen("http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types", 'r'));
|
||||
\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';
|
||||
\$config['imap_host'] = 'dovecot:143';
|
||||
\$config['smtp_host'] = 'postfix:588';
|
||||
\$config['smtp_user'] = '%u';
|
||||
\$config['smtp_pass'] = '%p';
|
||||
\$config['support_url'] = '';
|
||||
\$config['product_name'] = 'Roundcube Webmail';
|
||||
\$config['cipher_method'] = 'chacha20-poly1305';
|
||||
\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc "A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\]^_{|}~" 2> /dev/null | head -c 32)';
|
||||
\$config['plugins'] = [
|
||||
'archive',
|
||||
'managesieve',
|
||||
'acl',
|
||||
'markasjunk',
|
||||
'zipdownload',
|
||||
];
|
||||
\$config['spellcheck_engine'] = 'aspell';
|
||||
\$config['mime_types'] = '/web/rc/config/mime.types';
|
||||
\$config['enable_installer'] = true;
|
||||
|
||||
\$config['managesieve_host'] = 'dovecot:4190';
|
||||
// Enables separate management interface for vacation responses (out-of-office)
|
||||
// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section
|
||||
\$config['managesieve_vacation'] = 1;
|
||||
EOCONFIG
|
||||
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php
|
||||
docker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Initialize database
|
||||
Point your browser to `https://myserver/rc/installer`. Check that the website shows no "NOT OK" check results on
|
||||
any of the steps, some "NOT AVAILABLE" are expected regarding different database extensions of which we only need MySQL.
|
||||
Initialize the database and leave the installer. It is not necessary to update the configuration with
|
||||
the downloaded one, unless you made some settings in the installer you would like to take over.
|
||||
|
||||
### Webserver configuration
|
||||
|
||||
The roundcube directory includes some locations that we do not want to serve to web users. We add a configuration
|
||||
extension to nginx to only expose the public directory of roundcube.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location /rc/ {
|
||||
alias /web/rc/public_html/;
|
||||
}
|
||||
$config = array();
|
||||
$config['db_dsnw'] = 'mysql://' . getenv('DBUSER') . ':' . getenv('DBPASS') . '@mysql/' . getenv('DBNAME');
|
||||
$config['imap_host'] = 'tls://dovecot:143';
|
||||
$config['smtp_host'] = 'tls://postfix:587';
|
||||
$config['smtp_user'] = '%u';
|
||||
$config['smtp_pass'] = '%p';
|
||||
$config['support_url'] = '';
|
||||
$config['product_name'] = 'Roundcube Webmail';
|
||||
$config['des_key'] = 'yourrandomstring_changeme';
|
||||
$config['log_dir'] = '/dev/null';
|
||||
$config['temp_dir'] = '/tmp';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Disable and remove installer
|
||||
|
||||
Delete the directory `data/web/rc/installer` after a successful installation, and set the `enable_installer` option
|
||||
to false in `data/web/rc/config/config.inc.php`:
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc/installer
|
||||
sed -i -e "s/\(\$config\['enable_installer'\].* = \)true/\1false/" data/web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Update roundcube dependencies
|
||||
|
||||
This step is not strictly necessary, but at least at the time of this writing the dependencies shipped with roundcube
|
||||
included versions with security vulnerabilities, so it may be a good idea to update the dependencies to the latest
|
||||
versions. For the same reason, it may be a good idea to run the composer update once in a while.
|
||||
|
||||
```bash
|
||||
cp -n data/web/rc/composer.json-dist data/web/rc/composer.json
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o
|
||||
```
|
||||
|
||||
You can also use `composer audit` to check for any reported security issues with the installed set of composer packages:
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit
|
||||
```
|
||||
|
||||
### Allow plaintext authentication for the php-fpm container without using TLS
|
||||
|
||||
We need to allow plaintext authentication in dovecot over unencrypted connection (inside the container network), which
|
||||
is per default mailcow installation only possible for the SOGo container for the very same purpose. Afterwards restart
|
||||
the dovecot container so the change becomes effective.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/conf/dovecot/extra.conf
|
||||
remote ${IPV4_NETWORK}.0/24 {
|
||||
disable_plaintext_auth = no
|
||||
}
|
||||
remote ${IPV6_NETWORK} {
|
||||
disable_plaintext_auth = no
|
||||
}
|
||||
EOCONFIG
|
||||
|
||||
docker compose restart dovecot-mailcow
|
||||
```
|
||||
|
||||
### Ofelia job for roundcube housekeeping
|
||||
|
||||
Roundcube needs to clean some stale information from the database every once in a while,
|
||||
for which we will create an ofelia job that runs the roundcube `cleandb.sh` script.
|
||||
|
||||
To do this, add the following to `docker-compose.override.yml` (if you already have some
|
||||
adaptations for the php-fpm container, add the labels to the existing section):
|
||||
|
||||
```yml
|
||||
version: '2.1'
|
||||
services:
|
||||
php-fpm-mailcow:
|
||||
labels:
|
||||
ofelia.enabled: "true"
|
||||
ofelia.job-exec.roundcube_cleandb.schedule: "@every 168h"
|
||||
ofelia.job-exec.roundcube_cleandb.user: "www-data"
|
||||
ofelia.job-exec.roundcube_cleandb.command: "/bin/bash -c \"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\""
|
||||
```
|
||||
|
||||
## Optional extra functionality
|
||||
|
||||
### Enable change password function in Roundcube
|
||||
|
||||
Changing the mailcow password from the roundcube UI is supported via the password plugin. We will configure it to use
|
||||
the mailcow API to update the password, which requires to enable the API first and to get the API key (read/write API
|
||||
access required). The API can be enabled in the mailcow admin interface, where you can also find the API key.
|
||||
|
||||
Open `data/web/rc/config/config.inc.php` and enable the password plugin by adding it to the `$config['plugins']` array,
|
||||
for example:
|
||||
|
||||
```php
|
||||
$config['plugins'] = array(
|
||||
'archive',
|
||||
'managesieve'
|
||||
'managesieve',
|
||||
'acl',
|
||||
'markasjunk',
|
||||
'zipdownload',
|
||||
'password',
|
||||
);
|
||||
$config['spellcheck_engine'] = 'aspell';
|
||||
$config['mime_types'] = '/tmp/mime.types';
|
||||
$config['imap_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
$config['enable_installer'] = true;
|
||||
$config['smtp_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
$config['db_prefix'] = 'mailcow_rc1';
|
||||
```
|
||||
|
||||
Point your browser to `https://myserver/rc/installer` and follow the instructions.
|
||||
Initialize the database and leave the installer.
|
||||
Configure the password plugin (be sure to adapt __\*\*API_KEY\*\*__ to you mailcow read/write API key):
|
||||
|
||||
**Delete the directory `data/web/rc/installer` after a successful installation!**
|
||||
|
||||
## Configure ManageSieve filtering
|
||||
|
||||
Open `data/web/rc/config/config.inc.php` and change the following parameters (or add them at the bottom of that file):
|
||||
```php
|
||||
$config['managesieve_host'] = 'tls://dovecot:4190';
|
||||
$config['managesieve_conn_options'] = array(
|
||||
'ssl' => array('verify_peer' => false, 'verify_peer_name' => false, 'allow_self_signed' => true)
|
||||
);
|
||||
// Enables separate management interface for vacation responses (out-of-office)
|
||||
// 0 - no separate section (default),
|
||||
// 1 - add Vacation section,
|
||||
// 2 - add Vacation section, but hide Filters section
|
||||
$config['managesieve_vacation'] = 1;
|
||||
```
|
||||
|
||||
## Enable change password function in Roundcube
|
||||
|
||||
Open `data/web/rc/config/config.inc.php` and enable the password plugin:
|
||||
|
||||
```php
|
||||
...
|
||||
$config['plugins'] = array(
|
||||
'archive',
|
||||
'password',
|
||||
);
|
||||
...
|
||||
```
|
||||
|
||||
Open `data/web/rc/plugins/password/password.php`, search for `case 'ssha':` and add above:
|
||||
|
||||
```php
|
||||
case 'ssha256':
|
||||
$salt = rcube_utils::random_bytes(8);
|
||||
$crypted = base64_encode( hash('sha256', $password . $salt, TRUE ) . $salt );
|
||||
$prefix = '{SSHA256}';
|
||||
break;
|
||||
```
|
||||
|
||||
Open `data/web/rc/plugins/password/config.inc.php` and change the following parameters (or add them at the bottom of that file):
|
||||
|
||||
```php
|
||||
$config['password_driver'] = 'sql';
|
||||
$config['password_algorithm'] = 'ssha256';
|
||||
$config['password_algorithm_prefix'] = '{SSHA256}';
|
||||
$config['password_query'] = "UPDATE mailbox SET password = %P WHERE username = %u";
|
||||
```
|
||||
|
||||
## Integrate CardDAV addressbooks in Roundcube
|
||||
|
||||
Download the latest release of [RCMCardDAV](https://github.com/mstilkerich/rcmcarddav) to the Roundcube plugin directory and extract it (here `rc/plugins`):
|
||||
```bash
|
||||
cd data/web/rc/plugins
|
||||
wget -O - https://github.com/mstilkerich/rcmcarddav/releases/download/v4.4.1/carddav-v4.4.1-roundcube16.tar.gz | tar xfvz -
|
||||
chown -R root: carddav/
|
||||
cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php
|
||||
<?php
|
||||
\$config['password_driver'] = 'mailcow';
|
||||
\$config['password_confirm_current'] = true;
|
||||
\$config['password_mailcow_api_host'] = 'http://nginx';
|
||||
\$config['password_mailcow_api_token'] = '**API_KEY**';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
Copy the file `config.inc.php.dist` to `config.inc.php` (here in `rc/plugins/carddav`) and append the following preset to the end of the file - don't forget to replace `mx.example.org` with your own hostname:
|
||||
```php
|
||||
$prefs['SOGo'] = array(
|
||||
'name' => 'SOGo',
|
||||
'username' => '%u',
|
||||
'password' => '%p',
|
||||
'url' => 'https://mx.example.org/SOGo/dav/%u/',
|
||||
'carddav_name_only' => true,
|
||||
Note: If you have changed the mailcow nginx configuration to redirect http requests to https
|
||||
(e.g., as described [here](https://docs.mailcow.email/manual-guides/u_e-80_to_443/)), then
|
||||
directly talking to the nginx container via http will not work because nginx is not a hostname contained
|
||||
in the certificate. In such cases, set `password_mailcow_api_host` in the above configuration to the
|
||||
public URI instead:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php
|
||||
<?php
|
||||
\$config['password_driver'] = 'mailcow';
|
||||
\$config['password_confirm_current'] = true;
|
||||
\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';
|
||||
\$config['password_mailcow_api_token'] = '**API_KEY**';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Integrate CardDAV addressbooks in Roundcube
|
||||
|
||||
Install the latest v5 version (the config below is compatible with v5 releases) using composer.
|
||||
Answer `Y` when asked if you want to activate the plugin.
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o "roundcube/carddav:~5"
|
||||
```
|
||||
|
||||
Edit the file `data/web/rc/plugins/carddav/config.inc.php` and insert the following content:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php
|
||||
<?php
|
||||
\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';
|
||||
|
||||
\$prefs['SOGo'] = [
|
||||
'accountname' => 'SOGo',
|
||||
'username' => '%u',
|
||||
'password' => '%p',
|
||||
'discovery_url' => 'http://sogo:20000/SOGo/dav/',
|
||||
'name' => '%N',
|
||||
'use_categories' => true,
|
||||
'active' => true,
|
||||
'readonly' => false,
|
||||
'refresh_time' => '02:00:00',
|
||||
'fixed' => array( 'active', 'name', 'username', 'password', 'refresh_time' ),
|
||||
'hide' => false,
|
||||
);
|
||||
```
|
||||
Please note, that this preset only integrates the default addressbook (the one that's named "Personal Address Book" and can't be deleted). Additional addressbooks are currently not automatically detected but can be manually added within the roundecube settings.
|
||||
|
||||
Enable the plugin by adding `carddav` to `$config['plugins']` in `rc/config/config.inc.php`.
|
||||
|
||||
If you want to remove the default addressbooks (stored in the Roundcube database), so that only the CardDAV addressbooks are accessible, append `$config['address_book_type'] = '';` to the config file `data/web/rc/config/config.inc.php`.
|
||||
|
||||
---
|
||||
|
||||
Optionally, you can add Roundcube's link to the mailcow Apps list.
|
||||
To do this, open or create `data/web/inc/vars.local.inc.php` and add the following code-block:
|
||||
|
||||
*NOTE: Don't forget to add the `<?php` delimiter on the first line*
|
||||
|
||||
```php
|
||||
...
|
||||
$MAILCOW_APPS = array(
|
||||
array(
|
||||
'name' => 'SOGo',
|
||||
'link' => '/SOGo/'
|
||||
),
|
||||
array(
|
||||
'name' => 'Roundcube',
|
||||
'link' => '/rc/'
|
||||
)
|
||||
);
|
||||
...
|
||||
'fixed' => ['username', 'password'],
|
||||
];
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
## Upgrading Roundcube
|
||||
RCMCardDAV will add all addressbooks of the user on login, including __subscribed__ addressbooks shared to the user by
|
||||
other users.
|
||||
|
||||
Upgrading Roundcube is rather simple, go to the [Github releases](https://github.com/roundcube/roundcubemail/releases) page for Roundcube and get the link for the "complete.tar.gz" file for the wanted release. Then follow the below commands and change the URL and Roundcube folder name if needed.
|
||||
If you want to remove the default addressbooks (stored in the Roundcube database), so that only the CardDAV addressbooks
|
||||
are accessible, append `$config['address_book_type'] = '';` to the config file `data/web/rc/config/config.inc.php`.
|
||||
|
||||
Note: RCMCardDAV uses additional database tables. After installing (or upgrading) RCMCardDAV, it is required to log
|
||||
in roundcube (log out first if already logged in) because the database table creation / changes are performed only
|
||||
during the login to roundcube.
|
||||
|
||||
### Forward the client network address to dovecot
|
||||
|
||||
Normally, the IMAP server dovecot will see the network address of the php-fpm container when roundcube interacts with the IMAP
|
||||
server. Using an IMAP extension and the `roundcube-dovecot_client_ip` roundcube plugin, it is possible for roundcube to tell
|
||||
dovecot the client IP, so it will also show up in the logs as the remote IP. When doing this, login attempts will show in the
|
||||
dovecot logs like any direct client connections to dovecot, and such failed logins into roundcube will be treated in the same
|
||||
manner as failed direct IMAP logins, causing blocking of the client with the netfilter container or other mechanisms that may
|
||||
already be in place to handle bruteforce attacks on the IMAP server.
|
||||
|
||||
For this, the roundcube plugin must be installed.
|
||||
|
||||
```bash
|
||||
# Enter a bash session of the mailcow PHP container
|
||||
docker exec -it mailcowdockerized-php-fpm-mailcow-1 bash
|
||||
|
||||
# Install required upgrade dependency, then upgrade Roundcube to wanted release
|
||||
apk add rsync
|
||||
cd /tmp
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
cd roundcubemail-1.6.1
|
||||
bin/installto.sh /web/rc
|
||||
|
||||
# Type 'Y' and press enter to upgrade your install of Roundcube
|
||||
# Type 'N' to "Do you want me to fix your local configuration" if prompted
|
||||
|
||||
# If you see "NOTICE: Update dependencies by running php composer.phar update --no-dev" just download composer.phar and run it:
|
||||
cd /web/rc
|
||||
wget https://getcomposer.org/download/2.4.2/composer.phar
|
||||
php composer.phar update --no-dev
|
||||
# When asked "Do you trust "roundcube/plugin-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] " hit y and continue.
|
||||
|
||||
|
||||
# Remove leftover files
|
||||
cd /tmp
|
||||
rm -rf roundcube*
|
||||
|
||||
# If you're going from 1.5 to 1.6 please run the config file changes below
|
||||
sed -i "s/\$config\['default_host'\].*$/\$config\['imap_host'\]\ =\ 'tls:\/\/dovecot:143'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['default_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['smtp_server'\].*$/\$config\['smtp_host'\]\ =\ 'tls:\/\/postfix:587'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['smtp_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['managesieve_host'\].*$/\$config\['managesieve_host'\]\ =\ 'tls:\/\/dovecot:4190'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['managesieve_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o "takerukoushirou/roundcube-dovecot_client_ip:~1"
|
||||
```
|
||||
|
||||
## Let admins log into Roundcube without password
|
||||
Furthermore, we must configure dovecot to treat the php-fpm container as part of a trusted network so it is allowed to override
|
||||
the client IP in the IMAP session. Note that this also enables plaintext authentication for the listed network ranges, so the
|
||||
explicit overridings of `disable_plaintext_auth` done above are not necessary when using this.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/conf/dovecot/extra.conf
|
||||
login_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}
|
||||
EOCONFIG
|
||||
|
||||
docker compose restart dovecot-mailcow
|
||||
```
|
||||
|
||||
### Add roundcube link to mailcow Apps list
|
||||
|
||||
You can add Roundcube's link to the mailcow Apps list.
|
||||
To do this, open or create `data/web/inc/vars.local.inc.php` and make sure it includes the following configuration
|
||||
block:
|
||||
|
||||
```php
|
||||
<?php
|
||||
|
||||
$MAILCOW_APPS = [
|
||||
[
|
||||
'name' => 'SOGo',
|
||||
'link' => '/SOGo/'
|
||||
],
|
||||
[
|
||||
'name' => 'Roundcube',
|
||||
'link' => '/rc/'
|
||||
]
|
||||
];
|
||||
```
|
||||
|
||||
### Let admins log into Roundcube without password
|
||||
|
||||
First, install plugin [dovecot_impersonate](https://github.com/corbosman/dovecot_impersonate/) and add Roundcube as an app (see above).
|
||||
|
||||
|
|
@ -224,7 +369,6 @@ services:
|
|||
- ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}
|
||||
```
|
||||
|
||||
|
||||
Edit `data/web/js/site/mailbox.js` and the following code after [`if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }`](https://github.com/mailcow/mailcow-dockerized/blob/2f9da5ae93d93bf62a8c2b7a5a6ae50a41170c48/data/web/js/site/mailbox.js#L485-L487)
|
||||
|
||||
```js
|
||||
|
|
@ -250,6 +394,7 @@ Copy the contents of the following files from this [Snippet](https://gitlab.com/
|
|||
* `data/web/inc/lib/RoundcubeAutoLogin.php`
|
||||
* `data/web/rc-auth.php`
|
||||
|
||||
## Finish installation
|
||||
Finally, restart mailcow
|
||||
|
||||
=== "docker compose (Plugin)"
|
||||
|
|
@ -265,3 +410,215 @@ Finally, restart mailcow
|
|||
docker-compose down
|
||||
docker-compose up -d
|
||||
```
|
||||
|
||||
## Upgrading Roundcube
|
||||
|
||||
Upgrading Roundcube is rather simple, go to the [GitHub releases](https://github.com/roundcube/roundcubemail/releases)
|
||||
page for Roundcube and get the link for the "complete.tar.gz" file for the wanted release. Then follow the below
|
||||
commands and change the URL and Roundcube folder name if needed.
|
||||
|
||||
```bash
|
||||
# Enter a bash session of the mailcow PHP container
|
||||
docker exec -it mailcowdockerized-php-fpm-mailcow-1 bash
|
||||
|
||||
# Install required upgrade dependency, then upgrade Roundcube to wanted release
|
||||
apk add rsync
|
||||
cd /tmp
|
||||
wget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.1/roundcubemail-1.6.1-complete.tar.gz | tar xfvz -
|
||||
cd roundcubemail-1.6.1
|
||||
bin/installto.sh /web/rc
|
||||
|
||||
# Type 'Y' and press enter to upgrade your install of Roundcube
|
||||
# Type 'N' to "Do you want me to fix your local configuration" if prompted
|
||||
|
||||
# If you see "NOTICE: Update dependencies by running php composer.phar update --no-dev" run composer:
|
||||
cd /web/rc
|
||||
composer update --no-dev -o
|
||||
# If asked "Do you trust "roundcube/plugin-installer" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?] " hit y and continue.
|
||||
|
||||
# Remove leftover files
|
||||
rm -rf /tmp/roundcube*
|
||||
|
||||
# If you're going from 1.5 to 1.6 please run the config file changes below
|
||||
sed -i "s/\$config\['default_host'\].*$/\$config\['imap_host'\]\ =\ 'dovecot:143'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['default_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['smtp_server'\].*$/\$config\['smtp_host'\]\ =\ 'postfix:588'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['smtp_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
sed -i "s/\$config\['managesieve_host'\].*$/\$config\['managesieve_host'\]\ =\ 'dovecot:4190'\;/" /web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['managesieve_port'\].*$/d" /web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
### Upgrade composer plugins
|
||||
|
||||
To upgrade roundcube plugins installed using composer and dependencies (e.g. RCMCardDAV plugin), you can simply run
|
||||
composer in the container:
|
||||
|
||||
```bash
|
||||
docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o
|
||||
```
|
||||
|
||||
### Upgrade mime type mappings
|
||||
|
||||
To upgrade the mime type mappings, re-download them using the command in the
|
||||
[installation instructions](#Install-mime-type-mappings).
|
||||
|
||||
## Uninstalling roundcube
|
||||
|
||||
For the uninstallation, it is also assumed that the commands are executed in the mailcow installation directory and
|
||||
that `mailcow.conf` has been sourced in the shell, see [Preparation](#Preparation) above.
|
||||
|
||||
### Remove the web directory
|
||||
|
||||
This deletes the roundcube installation and all plugins and dependencies that you may have installed,
|
||||
including those installed with composer.
|
||||
|
||||
Note: This deletes also any custom configuration that you may have done in roundcube. If you want to preserve it, move it some
|
||||
place else instead of deleting it.
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc
|
||||
```
|
||||
|
||||
### Remove the database
|
||||
|
||||
Note: This clears all data stored for roundcube. If you want to preserve it, you could use `mysqldump` before deleting the data,
|
||||
or simply keep the database.
|
||||
|
||||
```bash
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "DROP USER 'roundcube'@'%';"
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e "DROP DATABASE roundcubemail;"
|
||||
```
|
||||
|
||||
### Remove any custom configuration files we added to mailcow
|
||||
|
||||
To determine these, please read through the installation steps and revert what you changed there.
|
||||
|
||||
## Migration from older mailcow roundcube setup
|
||||
|
||||
Older versions of this instruction used the mailcow database also for roundcube, with a configured name prefix
|
||||
`mailcow_rc1` on all roundcube tables.
|
||||
|
||||
For the migration, it is also assumed that the commands are executed in the mailcow installation directory and
|
||||
that `mailcow.conf` has been sourced in the shell, see [Preparation](#Preparation) above. The commands of the different
|
||||
steps build on each other and must be executed in the same shell. Particularly, some steps set shell variables (most
|
||||
importantly the `DBROUNDCUBE` variable with the database password of the roundcube database user) used in later steps.
|
||||
|
||||
### Create new roundcube database user and database
|
||||
|
||||
Follow the [steps above](#Create-roundcube-database) to create the roundcube database user and the separate database.
|
||||
|
||||
### Migrate roundcube data from mailcow database
|
||||
|
||||
Before starting the database migration, we disable roundcube to avoid further changes to the roundcube database tables
|
||||
during the migration.
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location ^~ /rc/ {
|
||||
return 503;
|
||||
}
|
||||
EOCONFIG
|
||||
docker compose exec nginx-mailcow nginx -s reload
|
||||
```
|
||||
|
||||
Now we copy the roundcube data to the new database. We strip the database table prefix in the process, you may need to
|
||||
adjust `mailcow\_rc1` in case you used a different prefix. It is also possible to keep the prefix (then also keep the
|
||||
respective `db_prefix` roundcube setting).
|
||||
|
||||
```bash
|
||||
RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e "show tables like 'mailcow_rc1%';" | tr '\n\r' ' ')
|
||||
docker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c "mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail"
|
||||
```
|
||||
|
||||
### Update roundcube configuration
|
||||
|
||||
Run the following to remove the no longer required `db_prefix` option. We also enable logging of roundcube by removing
|
||||
the settings `log_dir` and `temp_dir` that were part of the old setup instructions.
|
||||
|
||||
```bash
|
||||
sed -i "/\$config\['db_prefix'\].*$/d" data/web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['log_dir'\].*$/d" data/web/rc/config/config.inc.php
|
||||
sed -i "/\$config\['temp_dir'\].*$/d" data/web/rc/config/config.inc.php
|
||||
```
|
||||
|
||||
We need to adapt the nginx configuration for roundcube to not expose the non-public folders of roundcube, specifically
|
||||
those containing temporary files and log files:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom
|
||||
location /rc/ {
|
||||
alias /web/rc/public_html/;
|
||||
}
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
We can also update the `cipher_method` to a more secure one but mind that data previously encrypted by roundcube cannot
|
||||
be decrypted anymore afterwards. This specifically affects stored CardDAV passwords if you use RCMCardDAV and your
|
||||
users added custom addressbooks (the preset will be fixed automatically upon next login of the user). If you want to
|
||||
change the `cipher_method`, run:
|
||||
|
||||
```bash
|
||||
cat <<EOCONFIG >>data/web/rc/config/config.inc.php
|
||||
\$config['cipher_method'] = 'chacha20-poly1305';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Switch RCMCardDAV plugin to composer installation method
|
||||
|
||||
This is optional but will align your installation with these instructions and enable you to upgrade RCMCardDAV
|
||||
using composer. This is simply done by deleting the carddav plugin from the installation and installing it using
|
||||
composer according to the [instructions above](#Integrate-CardDAV-addressbooks-in-Roundcube), which include the creation
|
||||
of a new RCMCardDAV v5 config. In case you modified your RCMCardDAV configuration file, you may want to backup it before
|
||||
deleting the plugin and carry over your changes to the new configuration afterwards as well.
|
||||
|
||||
To delete the carddav plugin run the following command, then re-install according to the
|
||||
[instructions above](#Integrate-CardDAV-addressbooks-in-Roundcube):
|
||||
|
||||
```bash
|
||||
rm -r data/web/rc/plugins/carddav
|
||||
```
|
||||
|
||||
### Switch roundcube to new database
|
||||
|
||||
First adapt the roundcube configuration to use the new database.
|
||||
```bash
|
||||
sed -i "/\$config\['db_dsnw'\].*$/d" data/web/rc/config/config.inc.php
|
||||
cat <<EOCONFIG >>data/web/rc/config/config.inc.php
|
||||
\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';
|
||||
EOCONFIG
|
||||
```
|
||||
|
||||
### Re-enable roundcube web access
|
||||
Execute the chown and chmod commands on sensitive roundcube directories listed in [Preparation](#Preparation), to
|
||||
make sure the nginx webserver cannot access files it is not supposed to serve.
|
||||
|
||||
Then re-enable web access to roundcube by replacing our temporary roundcube custom config for the one described
|
||||
[above](#Webserver-configuration), and reload the nginx configuration:
|
||||
|
||||
```bash
|
||||
docker compose exec nginx-mailcow nginx -s reload
|
||||
```
|
||||
|
||||
### Other changes
|
||||
You must also adapt the configuration of the roundcube password plugin according to this instruction, specifically if
|
||||
you use the password changing functionality, since the old instruction directly changed the password in the database,
|
||||
whereas this version of the instruction uses the mailcow API for the password change.
|
||||
|
||||
Regarding other changes and additions (e.g., roundcube-dovecot\_client\_ip plugin), you can go through the current
|
||||
installation instructions and adapt your configuration accordingly or perform the listed installation steps for new
|
||||
additions.
|
||||
|
||||
Specifically, consider the following sections:
|
||||
- [Ofelia job for roundcube housekeeping](#Ofelia-job-for-roundcube-housekeeping)
|
||||
- [Allow plaintext authentication in dovecot](#Allow-plaintext-authentication-for-the-php-fpm-container-without-using-TLS),
|
||||
if you adapt the roundcube configuration to contact dovecot via non-encrypted IMAP connection.
|
||||
- [Forward the client network address to dovecot](#Forward-the-client-network-address-to-dovecot)
|
||||
|
||||
### Removing roundcube tables from mailcow database
|
||||
|
||||
After you have verified that the migration was successful and roundcube works using the separate database, you can remove
|
||||
the roundcube tables from the mailcow database using the following command:
|
||||
|
||||
```bash
|
||||
docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e "SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \+/,/g');"
|
||||
```
|
||||
|
|
|
|||
|
|
@ -132,10 +132,6 @@ Anschließend Rspamd neustarten mit:
|
|||
|
||||
Nun kompiliert Rspamd die besagten Regex Maps wieder neu mit Hyperscan.
|
||||
|
||||
!!! warning "Achtung"
|
||||
Das originale Hyperscan funktioniert (Stand Mai 2023) **NUR** auf x86. ARM64 wird voraussichtlich **nicht** offiziell von Intel supported[^3]
|
||||
|
||||
|
||||
[^1]: [netcat](https://linux.die.net/man/1/nc), [nmap](https://linux.die.net/man/1/nmap), [openssl](https://wiki.openssl.org/index.php/Manual:S_client(1)), [telnet](https://linux.die.net/man/1/telnet), etc.
|
||||
[^2]: [Hyperscan](https://github.com/intel/hyperscan)
|
||||
[^3]: [Status für Hyperscan auf ARM64](https://github.com/intel/hyperscan/pull/287#issuecomment-746558138)
|
||||
|
|
|
|||
|
|
@ -132,10 +132,6 @@ Restart Rspamd afterwards:
|
|||
|
||||
Now Rspamd recompiles the said regex maps again with Hyperscan.
|
||||
|
||||
!!! warning
|
||||
The original Hyperscan works (as of May 2023) **ONLY** on x86. ARM64 is **not** expected to be officially supported by Intel[^3]
|
||||
|
||||
|
||||
[^1]: [netcat](https://linux.die.net/man/1/nc), [nmap](https://linux.die.net/man/1/nmap), [openssl](https://wiki.openssl.org/index.php/Manual:S_client(1)), [telnet](https://linux.die.net/man/1/telnet), etc.
|
||||
[^2]: [Hyperscan](https://github.com/intel/hyperscan)
|
||||
[^3]: [Status for Hyperscan on ARM64](https://github.com/intel/hyperscan/pull/287#issuecomment-746558138)
|
||||
23
mkdocs.yml
23
mkdocs.yml
|
|
@ -47,6 +47,9 @@ markdown_extensions:
|
|||
- pymdownx.superfences
|
||||
- pymdownx.tabbed:
|
||||
alternate_style: true
|
||||
- pymdownx.emoji:
|
||||
emoji_index: !!python/name:materialx.emoji.twemoji
|
||||
emoji_generator: !!python/name:materialx.emoji.to_svg
|
||||
|
||||
nav:
|
||||
- 'Information & Support': 'index.md'
|
||||
|
|
@ -65,7 +68,13 @@ nav:
|
|||
- 'IP bindings': 'post_installation/firststeps-ip_bindings.md'
|
||||
- 'Local MTA on Docker host': 'post_installation/firststeps-local_mta.md'
|
||||
- 'Logging': 'post_installation/firststeps-logging.md'
|
||||
- 'Reverse Proxy': 'post_installation/firststeps-rp.md'
|
||||
- 'Reverse Proxy':
|
||||
- 'Overview': 'post_installation/reverse-proxy/r_p.md'
|
||||
- 'Apache 2.4': 'post_installation/reverse-proxy/r_p-apache24.md'
|
||||
- 'Nginx': 'post_installation/reverse-proxy/r_p-nginx.md'
|
||||
- 'HAProxy (community supported)': 'post_installation/reverse-proxy/r_p-haproxy.md'
|
||||
- 'Traefik v2 (community supported)': 'post_installation/reverse-proxy/r_p-traefik2.md'
|
||||
- 'Caddy v2 (community supported)': 'post_installation/reverse-proxy/r_p-caddy2.md'
|
||||
- 'Rspamd UI': 'post_installation/firststeps-rspamd_ui.md'
|
||||
- 'SNAT': 'post_installation/firststeps-snat.md'
|
||||
- 'Sync job migration': 'post_installation/firststeps-sync_jobs_migration.md'
|
||||
|
|
@ -177,7 +186,9 @@ plugins:
|
|||
default_language: en
|
||||
languages:
|
||||
en: English
|
||||
de: Deutsch
|
||||
de:
|
||||
name: Deutsch
|
||||
site_name: "mailcow: dockerized Dokumentation"
|
||||
nav_translations:
|
||||
#### Begin of german translation
|
||||
de:
|
||||
|
|
@ -194,6 +205,11 @@ plugins:
|
|||
'Disable IPv6': 'IPv6 deaktivieren'
|
||||
'IP bindings': 'IP-Bindings'
|
||||
'Local MTA on Docker host': 'Lokaler MTA auf Docker-Host'
|
||||
### Reverse Proxy Subsection
|
||||
'Overview': 'Übersicht'
|
||||
'HAProxy (community supported)': 'HAProxy (von der Community unterstützt)'
|
||||
'Traefik v2 (community supported)': 'Traefik v2 (von der Community unterstützt)'
|
||||
'Caddy v2 (community supported)': 'Caddy v2 (von der Community unterstützt)'
|
||||
'Sync job migration': 'Migration mit Sync Jobs'
|
||||
### Models Section
|
||||
'Models': 'Modelle'
|
||||
|
|
@ -265,7 +281,6 @@ plugins:
|
|||
'Run scripts before and after updates': 'Skripte vor und nach Aktualisierungen ausführen'
|
||||
### Client Configuration Section
|
||||
'Client Configuration': 'Client-Konfiguration'
|
||||
'Overview': 'Übersicht'
|
||||
'Manual configuration': 'Manuelle Konfiguration'
|
||||
### Third party apps Section
|
||||
'Third party apps': 'Anwendungen von Drittanbietern'
|
||||
|
|
@ -295,7 +310,7 @@ plugins:
|
|||
'firststeps-ip_bindings.md': 'post_installation/firststeps-ip_bindings.en.md'
|
||||
'firststeps-local_mta.md': 'post_installation/firststeps-local_mta.en.md'
|
||||
'firststeps-logging.md': 'post_installation/firststeps-logging.en.md'
|
||||
'firststeps-rp.md': 'post_installation/firststeps-rp.en.md'
|
||||
'firststeps-rp.md': 'post_installation/reverse-proxy/r_p.en.md'
|
||||
'firststeps-rspamd_ui.md': 'post_installation/firststeps-rspamd_ui.en.md'
|
||||
'firststeps-snat.md': 'post_installation/firststeps-snat.en.md'
|
||||
'firststeps-sync_jobs_migration.md': 'post_installation/firststeps-sync_jobs_migration.en.md'
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
mkdocs-material==9.1.14
|
||||
mkdocs-material==9.1.18
|
||||
mkdocs-redirects==1.2.0
|
||||
pygments==2.15.1
|
||||
mkdocs-static-i18n==0.56
|
||||
mkdocs-git-revision-date-localized-plugin==1.2.0
|
||||
pillow==9.5.0
|
||||
pillow==10.0.0
|
||||
cairosvg==2.7.0
|
||||
|
|
|
|||
Laden …
In neuem Issue referenzieren