This commit is contained in:
Niklas Meyer 2023-09-13 16:57:44 +02:00 committed by GitHub
commit 0058750701
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
12 changed files with 166 additions and 135 deletions

View File

@ -1,12 +1,14 @@
FROM clamav/clamav:1.0.1-1_base FROM alpine:3.18
LABEL maintainer "André Peters <andre.peters@servercow.de>" LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
RUN apk upgrade --no-cache \ RUN apk upgrade --no-cache \
&& apk add --update --no-cache \ && apk add --update --no-cache \
rsync \ rsync \
clamav \
bind-tools \ bind-tools \
bash bash \
tini
# init # init
COPY clamd.sh /clamd.sh COPY clamd.sh /clamd.sh
@ -14,7 +16,9 @@ RUN chmod +x /sbin/tini
# healthcheck # healthcheck
COPY healthcheck.sh /healthcheck.sh COPY healthcheck.sh /healthcheck.sh
COPY clamdcheck.sh /usr/local/bin
RUN chmod +x /healthcheck.sh RUN chmod +x /healthcheck.sh
RUN chmod +x /usr/local/bin/clamdcheck.sh
HEALTHCHECK --start-period=6m CMD "/healthcheck.sh" HEALTHCHECK --start-period=6m CMD "/healthcheck.sh"
ENTRYPOINT [] ENTRYPOINT []

View File

@ -0,0 +1,14 @@
#!/bin/sh
set -eu
if [ "${CLAMAV_NO_CLAMD:-}" != "false" ]; then
if [ "$(echo "PING" | nc localhost 3310)" != "PONG" ]; then
echo "ERROR: Unable to contact server"
exit 1
fi
echo "Clamd is up"
fi
exit 0

View File

@ -1,119 +1,127 @@
FROM debian:bullseye-slim FROM alpine:3.18
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>" LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
ARG DEBIAN_FRONTEND=noninteractive
# renovate: datasource=github-tags depName=dovecot/core versioning=semver-coerced
ARG DOVECOT=2.3.20
# renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced
ARG GOSU_VERSION=1.16 ARG GOSU_VERSION=1.16
ENV LC_ALL C
ENV LANG C.UTF-8
ENV LC_ALL C.UTF-8
# Add groups and users before installing Dovecot to not break compatibility # Add groups and users before installing Dovecot to not break compatibility
RUN groupadd -g 5000 vmail \ RUN addgroup -g 5000 vmail \
&& groupadd -g 401 dovecot \ && addgroup -g 401 dovecot \
&& groupadd -g 402 dovenull \ && addgroup -g 402 dovenull \
&& groupadd -g 999 sogo \ && sed -i "s/999/99/" /etc/group \
&& usermod -a -G sogo nobody \ && addgroup -g 999 sogo \
&& useradd -g vmail -u 5000 vmail -d /var/vmail \ && addgroup nobody sogo \
&& useradd -c "Dovecot unprivileged user" -d /dev/null -u 401 -g dovecot -s /bin/false dovecot \ && adduser -D -u 5000 -G vmail -h /var/vmail vmail \
&& useradd -c "Dovecot login user" -d /dev/null -u 402 -g dovenull -s /bin/false dovenull \ && adduser -D -G dovecot -u 401 -h /dev/null -s /sbin/nologin dovecot \
&& touch /etc/default/locale \ && adduser -D -G dovenull -u 402 -h /dev/null -s /sbin/nologin dovenull \
&& apt-get update \ && apk add --no-cache --update \
&& apt-get -y --no-install-recommends install \ build-base \
build-essential \ bash \
apt-transport-https \ bind-tools \
ca-certificates \ ca-certificates \
cpanminus \
curl \ curl \
dnsutils \ cyrus-sasl-dev \
dirmngr \ gcc \
gettext \ gettext-dev \
gnupg2 \ gnupg \
gnupg-dirmngr \
jq \ jq \
libauthen-ntlm-perl \ libintl \
libcgi-pm-perl \ libssl1.1 \
libcrypt-openssl-rsa-perl \ libstdc++ \
libcrypt-ssleay-perl \ libxml2-dev \
libdata-uniqid-perl \ lua \
libdbd-mysql-perl \ lua-cjson \
libdbi-perl \
libdigest-hmac-perl \
libdist-checkconflicts-perl \
libencode-imaputf7-perl \
libfile-copy-recursive-perl \
libfile-tail-perl \
libhtml-parser-perl \
libio-compress-perl \
libio-socket-inet6-perl \
libio-socket-ssl-perl \
libio-tee-perl \
libipc-run-perl \
libjson-webtoken-perl \
liblockfile-simple-perl \
libmail-imapclient-perl \
libmodule-implementation-perl \
libmodule-scandeps-perl \
libnet-ssleay-perl \
libpackage-stash-perl \
libpackage-stash-xs-perl \
libpar-packer-perl \
libparse-recdescent-perl \
libproc-processtable-perl \
libreadonly-perl \
libregexp-common-perl \
libssl-dev \
libsys-meminfo-perl \
libterm-readkey-perl \
libtest-deep-perl \
libtest-fatal-perl \
libtest-mock-guard-perl \
libtest-mockobject-perl \
libtest-nowarnings-perl \
libtest-pod-perl \
libtest-requires-perl \
libtest-simple-perl \
libtest-warn-perl \
libtry-tiny-perl \
libunicode-string-perl \
liburi-perl \
libwww-perl \
lua-sql-mysql \
lua-socket \ lua-socket \
lua-sql-mysql \
lua5.3-sql-mysql \
make \
mariadb-connector-c \
mariadb-dev \
glib-dev \
gcompat \
mariadb-client \ mariadb-client \
# libressl-dev \
openssl-dev \
pcre-dev \
perl \
perl-dev \
perl-ntlm \
perl-cgi \
perl-crypt-openssl-rsa \
perl-utils \
perl-crypt-ssleay \
perl-data-uniqid \
perl-dbd-mysql \
perl-dbi \
perl-digest-hmac \
perl-dist-checkconflicts \
perl-encode-imaputf7 \
perl-file-copy-recursive \
perl-file-tail \
perl-io-socket-inet6 \
perl-io-gzip \
perl-io-socket-ssl \
perl-io-tee \
perl-ipc-run \
perl-json-webtoken \
perl-mail-imapclient \
perl-module-implementation \
perl-module-scandeps \
perl-net-ssleay \
perl-package-stash \
perl-package-stash-xs \
perl-par-packer \
perl-parse-recdescent \
libproc \
perl-readonly \
perl-regexp-common \
perl-sys-meminfo \
perl-term-readkey \
perl-test-deep \
perl-test-fatal \
perl-test-mockobject \
perl-test-mock-guard \
perl-test-pod \
perl-test-requires \
perl-test-simple \
perl-test-warn \
perl-try-tiny \
perl-unicode-string \
perl-proc-processtable \
perl-app-cpanminus \
procps \ procps \
python3-pip \ python3 \
redis-server \ python3-dev \
supervisor \ py3-pip \
redis \
syslog-ng \ syslog-ng \
syslog-ng-core \ syslog-ng-redis \
syslog-ng-mod-redis \ syslog-ng-json \
supervisor \
tzdata \
wget \ wget \
&& dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \ dovecot \
&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" \ dovecot-dev \
&& chmod +x /usr/local/bin/gosu \
&& gosu nobody true \
&& apt-key adv --fetch-keys https://repo.dovecot.org/DOVECOT-REPO-GPG \
&& echo "deb https://repo.dovecot.org/ce-${DOVECOT}/debian/bullseye bullseye main" > /etc/apt/sources.list.d/dovecot.list \
&& apt-get update \
&& apt-get -y --no-install-recommends install \
dovecot-lua \
dovecot-managesieved \
dovecot-sieve \
dovecot-lmtpd \ dovecot-lmtpd \
dovecot-lua \
dovecot-ldap \ dovecot-ldap \
dovecot-mysql \ dovecot-mysql \
dovecot-core \ dovecot-sql \
dovecot-submissiond \
dovecot-pigeonhole-plugin \
dovecot-pop3d \ dovecot-pop3d \
dovecot-imapd \ dovecot-fts-solr \
dovecot-solr \ && arch=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/) \
&& pip3 install mysql-connector-python html2text jinja2 redis \ && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$arch" \
&& apt-get autoremove --purge -y \ && chmod +x /usr/local/bin/gosu \
&& apt-get autoclean \ && gosu nobody true
&& rm -rf /var/lib/apt/lists/* \
&& rm -rf /tmp/* /var/tmp/* /root/.cache/ RUN cpan LockFile::Simple
# imapsync dependencies
RUN cpan Crypt::OpenSSL::PKCS12 RUN pip3 install mysql-connector-python html2text jinja2 redis
COPY trim_logs.sh /usr/local/bin/trim_logs.sh COPY trim_logs.sh /usr/local/bin/trim_logs.sh
COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh COPY clean_q_aged.sh /usr/local/bin/clean_q_aged.sh

View File

@ -13,6 +13,10 @@ autostart=true
[program:dovecot] [program:dovecot]
command=/usr/sbin/dovecot -F command=/usr/sbin/dovecot -F
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autorestart=true autorestart=true
[eventlistener:processes] [eventlistener:processes]

View File

@ -1,4 +1,4 @@
@version: 3.28 @version: 4.1
@include "scl.conf" @include "scl.conf"
options { options {
chain_hostnames(off); chain_hostnames(off);
@ -6,11 +6,11 @@ options {
use_dns(no); use_dns(no);
use_fqdn(no); use_fqdn(no);
owner("root"); group("adm"); perm(0640); owner("root"); group("adm"); perm(0640);
stats_freq(0); stats(freq(0));
bad_hostname("^gconfd$"); bad_hostname("^gconfd$");
}; };
source s_src { source s_dgram {
unix-stream("/dev/log"); unix-dgram("/dev/log");
internal(); internal();
}; };
destination d_stdout { pipe("/dev/stdout"); }; destination d_stdout { pipe("/dev/stdout"); };
@ -36,7 +36,7 @@ filter f_replica {
not match("Error: sync: Unknown user in remote" value("MESSAGE")); not match("Error: sync: Unknown user in remote" value("MESSAGE"));
}; };
log { log {
source(s_src); source(s_dgram);
filter(f_replica); filter(f_replica);
destination(d_stdout); destination(d_stdout);
filter(f_mail); filter(f_mail);

View File

@ -1,4 +1,4 @@
@version: 3.28 @version: 4.1
@include "scl.conf" @include "scl.conf"
options { options {
chain_hostnames(off); chain_hostnames(off);
@ -6,11 +6,11 @@ options {
use_dns(no); use_dns(no);
use_fqdn(no); use_fqdn(no);
owner("root"); group("adm"); perm(0640); owner("root"); group("adm"); perm(0640);
stats_freq(0); stats(freq(0));
bad_hostname("^gconfd$"); bad_hostname("^gconfd$");
}; };
source s_src { source s_dgram {
unix-stream("/dev/log"); unix-dgram("/dev/log");
internal(); internal();
}; };
destination d_stdout { pipe("/dev/stdout"); }; destination d_stdout { pipe("/dev/stdout"); };
@ -36,7 +36,7 @@ filter f_replica {
not match("Error: sync: Unknown user in remote" value("MESSAGE")); not match("Error: sync: Unknown user in remote" value("MESSAGE"));
}; };
log { log {
source(s_src); source(s_dgram);
filter(f_replica); filter(f_replica);
destination(d_stdout); destination(d_stdout);
filter(f_mail); filter(f_mail);

View File

@ -1,19 +1,19 @@
FROM debian:bullseye-slim FROM debian:bookworm-slim
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>" LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
ARG DEBIAN_FRONTEND=noninteractive ARG DEBIAN_FRONTEND=noninteractive
ARG CODENAME=bullseye ARG CODENAME=bookworm
ENV LC_ALL C ENV LC_ALL C
RUN apt-get update && apt-get install -y \ RUN apt-get update && apt-get install -y --no-install-recommends \
tzdata \ tzdata \
ca-certificates \ ca-certificates \
gnupg2 \ gnupg2 \
apt-transport-https \ apt-transport-https \
dnsutils \ dnsutils \
netcat \ netcat-traditional \
&& apt-key adv --fetch-keys https://rspamd.com/apt-stable/gpg.key \ && apt-key adv --fetch-keys https://rspamd.com/apt-stable/gpg.key \
&& echo "deb [arch=amd64] https://rspamd.com/apt-stable/ $CODENAME main" > /etc/apt/sources.list.d/rspamd.list \ && echo "deb https://rspamd.com/apt-stable/ $CODENAME main" > /etc/apt/sources.list.d/rspamd.list \
&& apt-get update \ && apt-get update \
&& apt-get --no-install-recommends -y install rspamd redis-tools procps nano \ && apt-get --no-install-recommends -y install rspamd redis-tools procps nano \
&& rm -rf /var/lib/apt/lists/* \ && rm -rf /var/lib/apt/lists/* \

View File

@ -2,7 +2,7 @@ FROM debian:bullseye-slim
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>" LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
ARG DEBIAN_FRONTEND=noninteractive ARG DEBIAN_FRONTEND=noninteractive
ARG SOGO_DEBIAN_REPOSITORY=http://packages.sogo.nu/nightly/5/debian/ ARG SOGO_DEBIAN_REPOSITORY=http://www.axis.cz/linux/debian
# renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced
ARG GOSU_VERSION=1.16 ARG GOSU_VERSION=1.16
ENV LC_ALL C ENV LC_ALL C
@ -32,7 +32,7 @@ RUN echo "Building from repository $SOGO_DEBIAN_REPOSITORY" \
&& mkdir /usr/share/doc/sogo \ && mkdir /usr/share/doc/sogo \
&& touch /usr/share/doc/sogo/empty.sh \ && touch /usr/share/doc/sogo/empty.sh \
&& apt-key adv --keyserver keys.openpgp.org --recv-key 74FFC6D72B925A34B5D356BDF8A27B36A6E2EAE9 \ && apt-key adv --keyserver keys.openpgp.org --recv-key 74FFC6D72B925A34B5D356BDF8A27B36A6E2EAE9 \
&& echo "deb ${SOGO_DEBIAN_REPOSITORY} bullseye bullseye" > /etc/apt/sources.list.d/sogo.list \ && echo "deb [trusted=yes] ${SOGO_DEBIAN_REPOSITORY} bullseye sogo-v5" > /etc/apt/sources.list.d/sogo.list \
&& apt-get update && apt-get install -y --no-install-recommends \ && apt-get update && apt-get install -y --no-install-recommends \
sogo \ sogo \
sogo-activesync \ sogo-activesync \

View File

@ -1,4 +1,5 @@
FROM solr:7.7-slim FROM solr:7.7-slim
LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
USER root USER root

View File

@ -1,5 +1,5 @@
FROM alpine:3.17 FROM alpine:3.17
LABEL maintainer "André Peters <andre.peters@servercow.de>" LABEL maintainer "The Infrastructure Company GmbH <info@servercow.de>"
# Installation # Installation
RUN apk add --update \ RUN apk add --update \

View File

@ -241,8 +241,8 @@ plugin {
mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem mail_crypt_global_public_key = </mail_crypt/ecpubkey.pem
mail_crypt_save_version = 2 mail_crypt_save_version = 2
# Enable compression while saving, lz4 Dovecot v2.2.11+ # Enable compression while saving, zstd Dovecot v2.3.17+
zlib_save = lz4 zlib_save = zstd
mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename
mail_log_fields = uid box msgid size mail_log_fields = uid box msgid size

View File

@ -2,7 +2,7 @@ version: '2.1'
services: services:
unbound-mailcow: unbound-mailcow:
image: mailcow/unbound:1.17 image: mailcow/unbound:1.19
environment: environment:
- TZ=${TZ} - TZ=${TZ}
volumes: volumes:
@ -58,7 +58,7 @@ services:
- redis - redis
clamd-mailcow: clamd-mailcow:
image: mailcow/clamd:1.61 image: mailcow/clamd:1.63
restart: always restart: always
depends_on: depends_on:
- unbound-mailcow - unbound-mailcow
@ -76,7 +76,7 @@ services:
- clamd - clamd
rspamd-mailcow: rspamd-mailcow:
image: mailcow/rspamd:1.92 image: mailcow/rspamd:1.93
stop_grace_period: 30s stop_grace_period: 30s
depends_on: depends_on:
- dovecot-mailcow - dovecot-mailcow
@ -106,7 +106,7 @@ services:
- rspamd - rspamd
php-fpm-mailcow: php-fpm-mailcow:
image: mailcow/phpfpm:1.84 image: mailcow/phpfpm:1.85
command: "php-fpm -d date.timezone=${TZ} -d expose_php=0" command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
depends_on: depends_on:
- redis-mailcow - redis-mailcow
@ -170,7 +170,7 @@ services:
- phpfpm - phpfpm
sogo-mailcow: sogo-mailcow:
image: mailcow/sogo:1.118 image: mailcow/sogo:1.119
environment: environment:
- DBNAME=${DBNAME} - DBNAME=${DBNAME}
- DBUSER=${DBUSER} - DBUSER=${DBUSER}
@ -217,7 +217,7 @@ services:
- sogo - sogo
dovecot-mailcow: dovecot-mailcow:
image: mailcow/dovecot:1.24 image: mailcow/dovecot:1.25
depends_on: depends_on:
- mysql-mailcow - mysql-mailcow
dns: dns:
@ -297,7 +297,7 @@ services:
- dovecot - dovecot
postfix-mailcow: postfix-mailcow:
image: mailcow/postfix:1.71 image: mailcow/postfix:1.72
depends_on: depends_on:
- mysql-mailcow - mysql-mailcow
volumes: volumes:
@ -391,7 +391,7 @@ services:
acme-mailcow: acme-mailcow:
depends_on: depends_on:
- nginx-mailcow - nginx-mailcow
image: mailcow/acme:1.84 image: mailcow/acme:1.85
dns: dns:
- ${IPV4_NETWORK:-172.22.1}.254 - ${IPV4_NETWORK:-172.22.1}.254
environment: environment:
@ -427,7 +427,7 @@ services:
- acme - acme
netfilter-mailcow: netfilter-mailcow:
image: mailcow/netfilter:1.52 image: mailcow/netfilter:1.53
stop_grace_period: 30s stop_grace_period: 30s
depends_on: depends_on:
- dovecot-mailcow - dovecot-mailcow
@ -450,7 +450,7 @@ services:
- /lib/modules:/lib/modules:ro - /lib/modules:/lib/modules:ro
watchdog-mailcow: watchdog-mailcow:
image: mailcow/watchdog:1.97 image: mailcow/watchdog:1.98
dns: dns:
- ${IPV4_NETWORK:-172.22.1}.254 - ${IPV4_NETWORK:-172.22.1}.254
tmpfs: tmpfs:
@ -512,7 +512,7 @@ services:
- watchdog - watchdog
dockerapi-mailcow: dockerapi-mailcow:
image: mailcow/dockerapi:2.05 image: mailcow/dockerapi:2.06
security_opt: security_opt:
- label=disable - label=disable
restart: always restart: always
@ -531,7 +531,7 @@ services:
- dockerapi - dockerapi
solr-mailcow: solr-mailcow:
image: mailcow/solr:1.8.1 image: mailcow/solr:1.8.2
restart: always restart: always
volumes: volumes:
- solr-vol-1:/opt/solr/server/solr/dovecot-fts/data - solr-vol-1:/opt/solr/server/solr/dovecot-fts/data
@ -547,7 +547,7 @@ services:
- solr - solr
olefy-mailcow: olefy-mailcow:
image: mailcow/olefy:1.11 image: mailcow/olefy:1.12
restart: always restart: always
environment: environment:
- TZ=${TZ} - TZ=${TZ}