envfile

Makefile

@@ -0,0 +1,6 @@
+up:
+	docker stack deploy -c docker-compose.yml mail
+down:
+	docker stack rm mail
+env:
+	export $(grep -v '^#' .env | xargs -0)

create_cold_standby.sh

@@ -4,4 +4,4 @@ export REMOTE_SSH_KEY=/root/.ssh/id_rsa
 export REMOTE_SSH_PORT=22
 export REMOTE_SSH_HOST=my.remote.host
 
-/opt/mailcow-dockerized/helper-scripts/_cold-standby.sh
+./helper-scripts/_cold-standby.sh

data/assets/ssl-example/cert.pem

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDBDCCAe6gAwIBAgIQeJMoL/3dxhxhT9EwuRTL/DALBgkqhkiG9w0BAQswEjEQ
-MA4GA1UEChMHbWFpbGNvdzAeFw0xNjEyMTMxMDExMDBaFw0xOTExMjgxMDExMDBa
-MC0xEDAOBgNVBAoTB21haWxjb3cxGTAXBgNVBAMTEG1haWwuZXhhbXBsZS5vcmcw
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRg0xT3At9DSb3H5OMp3K1
-MpXAgYyotSK6TS61fC0QEHy2fMXiws7Agcye6Ln7CG63Fe1eN2jkdlefy9xJivS8
-y5w0M8i168v5znzC8fnylL2iOiSYfK/B/oEqfU7YH4RcegO53oDDIUZmi4Frgnu7
-39VVOU1ZyHEVqGJ2H2aAIkoZRjGzumD9Ym4LWGidtKJzBgFt/qmhUeWXipM8w281
-XkQnJU79+x2ywnJSvEZ3r/ZVJC7kbjiVw+/k15k9Cxk6Ik8wmJ0X/+xWxoZomHQI
-1LM0VKAS/iaU95dn2bplvL6jTiiyWAbrMjSKs4XbPt/fIbOicNkj6+CFy0MVfyyH
-AgMBAAGjPzA9MA4GA1UdDwEB/wQEAwIAqDAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
-KwYBBQUHAwEwDAYDVR0TAQH/BAIwADALBgkqhkiG9w0BAQsDggEBAI/jBJa1P8nB
-eHUN5muQmjBVDVOYyWAAEapOe2HYsBcpjaB2H8Iw3DQzJtz6peYeYSCmHRVqFLCm
-VPrq36l9mPUotyPDPlQQAxCj9R2+WbGaJO+N/E1F8FQ94dr3jqwUyfjVPoqEjmIH
-NFkvbA0RJOeBm9oYGdhM0wjOBV9c9MTHFG82nQ/zQeTuPb7GXuKIOXYCxoLNOZMw
-UJ02Cqjv5ImrgOhcstAKX3Ip0urSvZUGvtPla4CGh+M6yDFJ08GzX6OiMIH207RW
-jAbUXXERSUv/7hysdDjGo5HZjCeMzVu9KAxoZXqnmvkk8g2swKWtWBRcoeU1VGx0
-Bx4Q4KMjuYQ=
------END CERTIFICATE-----

data/assets/ssl-example/key.pem

@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA0YNMU9wLfQ0m9x+TjKdytTKVwIGMqLUiuk0utXwtEBB8tnzF
-4sLOwIHMnui5+whutxXtXjdo5HZXn8vcSYr0vMucNDPItevL+c58wvH58pS9ojok
-mHyvwf6BKn1O2B+EXHoDud6AwyFGZouBa4J7u9/VVTlNWchxFahidh9mgCJKGUYx
-s7pg/WJuC1honbSicwYBbf6poVHll4qTPMNvNV5EJyVO/fsdssJyUrxGd6/2VSQu
-5G44lcPv5NeZPQsZOiJPMJidF//sVsaGaJh0CNSzNFSgEv4mlPeXZ9m6Zby+o04o
-slgG6zI0irOF2z7f3yGzonDZI+vghctDFX8shwIDAQABAoIBAQC9kiLnIgxXGyZt
-pmmYdA6re1jatZ2zLSp+DcY8ul3/0hs195IKCyCOOSQPiR520Pt0t+duP46uYZIJ
-aakp9gxaI5Vz+oMacH/AyaBDuDTj1Mf9WMSyIOfbDVCMRJOppGLcVh62+Gfjp2EO
-+h2hTJBuvypFkbK2kVIZOaHVpbXWKw1oYuEcTftk9XfxxvfSMw1HQ12/P2CAcbaa
-jPmVbisunv6kpXtewSBTcaLSYWJf1MYD5Hi8fzkD2FJSXYbfQd8RKvT2rj6FA7ux
-CDMzbYhdnd7lc63OARCIjfCRNtDT1cZ3gR1CQHD98lWxmPQIZukv+w7s/bSrFgnQ
-ROZ0ghBJAoGBAOmE/3d5FDmp0aJNxXynKcRGdpEEM4O40RIdqa2eR6Pa7aTRosao
-z0qVgdFuJrqjlB3jgedxXEX1M0abCUzzM9Q5F7JLl+KsjwRwpkIOkPiyUncLp7LK
-QbY3tvYBIdpjlF1USOMGRL4j11hqr4vQC/yPBF7jj81kCZDTbmZhp82jAoGBAOWu
-ql5QFUOlmqkuWIAFkiLEZhOu+ptqkE+zG50CCGMJIX0dJ2PHXFyNGInomAeT0nbI
-pbnK3x7KeEKiGrAqZFNCTHhApTwkrIj0L/RQbMDZ7u7j1AEUVNFEhIm62kg84FtG
-xtfxVxredE+NQc/tyV3hXegdNZxegALirlcMKIvNAoGAWFwIxk48Ru1o8z72QQqH
-lUsMRicOzwK5qV8r+xPvC6MlVL42F3F8rj4QFwzU/r4yp3SUjNyqC5aSRl8Xj9Re
-gijwPHi6Cf09SHLPliMo29GtvnnchJxfbPF7+23GP3p6gy4HPk/65u9s5nnH3uFk
-B7ad8sGsgg0eSXyXQ4okEn0CgYEAnogPuedGthlxBgMiPMMbmfm7hyyId4t3Ljuu
-/JExnsHnpobf8EPjoVIWNOIhRWGnrCtUEEhR9tvDZCKljyDDfKBPTdU496lMmX8K
-NnToi7gg7iy84T3aSVMktDgPgDrclMPmbZh8CeSvnVUfrtgu3Ci4+4Rlw5eKffNe
-aGDQ/6UCgYAbUq9mRT2WOXIo+Dchi9VzDWgtfOw5VEyqkSpb7hPiIYx5jNaENnVK
-cAi3iqbBgPJBuMlTrKmmaxdmssGOEZNJLuuXLDbCU+f5cpu5PQ4crC6UtRI5rlhp
-8Yc+oiv3HWbSw3sVRpMFB6NP4DnvgFW3B2Wdfb/lNzPCKWqBsX7gWw==
------END RSA PRIVATE KEY-----

data/conf/postfix/main.cf

@@ -198,3 +198,6 @@ parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks
 
 # DO NOT EDIT ANYTHING BELOW #
 # User overrides #
+
+myhostname = marcpartensky.com
+

docker-compose.yml

@@ -1,14 +1,13 @@
-version: '2.1'
+version: '3.9'
 services:
 
     unbound-mailcow:
       image: mailcow/unbound:1.15
-      environment:
-        - TZ=${TZ}
+      env_file: mailcow.conf
       volumes:
         - ./data/hooks/unbound:/hooks:Z
         - ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro,Z
-      restart: always
+      restart: unless-stopped
       tty: true
       networks:
         mailcow-network:
@@ -25,14 +24,8 @@ services:
         - mysql-vol-1:/var/lib/mysql/:Z
         - mysql-socket-vol-1:/var/run/mysqld/:z
         - ./data/conf/mysql/:/etc/mysql/conf.d/:ro,Z
-      environment:
-        - TZ=${TZ}
-        - MYSQL_ROOT_PASSWORD=${DBROOT}
-        - MYSQL_DATABASE=${DBNAME}
-        - MYSQL_USER=${DBUSER}
-        - MYSQL_PASSWORD=${DBPASS}
-        - MYSQL_INITDB_SKIP_TZINFO=1
-      restart: always
+      env_file: mailcow.conf
+      restart: unless-stopped
       ports:
         - "${SQL_PORT:-127.0.0.1:13306}:3306"
       networks:
@@ -44,11 +37,10 @@ services:
       image: redis:6-alpine
       volumes:
         - redis-vol-1:/data/:Z
-      restart: always
+      restart: unless-stopped
       ports:
         - "${REDIS_PORT:-127.0.0.1:7654}:6379"
-      environment:
-        - TZ=${TZ}
+      env_file: mailcow.conf
       sysctls:
         - net.core.somaxconn=4096
       networks:
@@ -59,12 +51,10 @@ services:
 
     clamd-mailcow:
       image: mailcow/clamd:1.43
-      restart: always
+      restart: unless-stopped
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
-      environment:
-        - TZ=${TZ}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
+      env_file: mailcow.conf
       volumes:
         - ./data/conf/clamav/:/etc/clamav/:Z
       networks:
@@ -77,12 +67,7 @@ services:
       stop_grace_period: 30s
       depends_on:
         - dovecot-mailcow
-      environment:
-        - TZ=${TZ}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+      env_file: mailcow.conf
       volumes:
         - ./data/hooks/rspamd:/hooks:Z
         - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
@@ -93,7 +78,7 @@ services:
         - ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z
         - ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z
         - rspamd-vol-1:/var/lib/rspamd:z
-      restart: always
+      restart: unless-stopped
       hostname: rspamd
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
@@ -127,38 +112,8 @@ services:
         - ./data/conf/nginx/:/etc/nginx/conf.d/:z
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
-      environment:
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - IMAP_PORT=${IMAP_PORT:-143}
-        - IMAPS_PORT=${IMAPS_PORT:-993}
-        - POP_PORT=${POP_PORT:-110}
-        - POPS_PORT=${POPS_PORT:-995}
-        - SIEVE_PORT=${SIEVE_PORT:-4190}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - SUBMISSION_PORT=${SUBMISSION_PORT:-587}
-        - SMTPS_PORT=${SMTPS_PORT:-465}
-        - SMTP_PORT=${SMTP_PORT:-25}
-        - API_KEY=${API_KEY:-invalid}
-        - API_KEY_READ_ONLY=${API_KEY_READ_ONLY:-invalid}
-        - API_ALLOW_FROM=${API_ALLOW_FROM:-invalid}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - MASTER=${MASTER:-y}
-        - DEV_MODE=${DEV_MODE:-n}
-        - WEBAUTHN_ONLY_TRUSTED_VENDORS=${WEBAUTHN_ONLY_TRUSTED_VENDORS:-n}
-      restart: always
+      env_file: mailcow.conf
+      restart: unless-stopped
       networks:
         mailcow-network:
           aliases:
@@ -166,22 +121,7 @@ services:
 
     sogo-mailcow:
       image: mailcow/sogo:1.106
-      environment:
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - TZ=${TZ}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - ACL_ANYONE=${ACL_ANYONE:-disallow}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - MASTER=${MASTER:-y}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+      env_file: mailcow.conf
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       volumes:
@@ -204,7 +144,7 @@ services:
         ofelia.job-exec.sogo_eautoreply.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool update-autoreply -p /etc/sogo/sieve.creds || exit 0\""
         ofelia.job-exec.sogo_backup.schedule: "@every 24h"
         ofelia.job-exec.sogo_backup.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool backup /sogo_backup ALL || exit 0\""
-      restart: always
+      restart: unless-stopped
       networks:
         mailcow-network:
           ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
@@ -232,26 +172,7 @@ services:
         - ./data/assets/templates:/templates:z
         - rspamd-vol-1:/var/lib/rspamd:z
         - mysql-socket-vol-1:/var/run/mysqld/:z
-      environment:
-        - DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-}
-        - DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - TZ=${TZ}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - MAILDIR_GC_TIME=${MAILDIR_GC_TIME:-7200}
-        - ACL_ANYONE=${ACL_ANYONE:-disallow}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
-        - MAILDIR_SUB=${MAILDIR_SUB:-}
-        - MASTER=${MASTER:-y}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+      env_file: mailcow.conf
       ports:
         - "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
         - "${IMAP_PORT:-143}:143"
@@ -259,7 +180,7 @@ services:
         - "${POP_PORT:-110}:110"
         - "${POPS_PORT:-995}:995"
         - "${SIEVE_PORT:-4190}:4190"
-      restart: always
+      restart: unless-stopped
       tty: true
       labels:
         ofelia.enabled: "true"
@@ -303,22 +224,14 @@ services:
         - crypt-vol-1:/var/lib/zeyple:z
         - rspamd-vol-1:/var/lib/rspamd:z
         - mysql-socket-vol-1:/var/run/mysqld/:z
-      environment:
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+      env_file: mailcow.conf
       cap_add:
         - NET_BIND_SERVICE
       ports:
         - "${SMTP_PORT:-25}:25"
         - "${SMTPS_PORT:-465}:465"
         - "${SUBMISSION_PORT:-587}:587"
-      restart: always
+      restart: unless-stopped
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       networks:
@@ -329,9 +242,8 @@ services:
 
     memcached-mailcow:
       image: memcached:alpine
-      restart: always
-      environment:
-        - TZ=${TZ}
+      restart: unless-stopped
+      env_file: mailcow.conf
       networks:
         mailcow-network:
           aliases:
@@ -357,15 +269,7 @@ services:
         until ping redis -c1 > /dev/null; do sleep 1; done &&
         until ping rspamd -c1 > /dev/null; do sleep 1; done &&
         exec nginx -g 'daemon off;'"
-      environment:
-        - HTTPS_PORT=${HTTPS_PORT:-443}
-        - HTTP_PORT=${HTTP_PORT:-80}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - TZ=${TZ}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - ADDITIONAL_SERVER_NAMES=${ADDITIONAL_SERVER_NAMES:-}
+      env_file: mailcow.conf
       volumes:
         - ./data/web:/web:ro,z
         - ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
@@ -373,11 +277,15 @@ services:
         - ./data/conf/nginx/:/etc/nginx/conf.d/:z
         - ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
         - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/:z
-      ports:
-        - "${HTTPS_BIND:-:}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
-        - "${HTTP_BIND:-:}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
-      restart: always
+      # ports:
+      #   - "${HTTPS_BIND:-:}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
+      #   - "${HTTP_BIND:-:}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
+      restart: unless-stopped
+      labels:
+        caddy: mail.marcpartensky.com
+        caddy.reverse_proxy: "{{upstreams 80}}"
       networks:
+        caddy:
         mailcow-network:
           aliases:
             - nginx
@@ -388,33 +296,13 @@ services:
       image: mailcow/acme:1.81
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
-      environment:
-        - LOG_LINES=${LOG_LINES:-9999}
-        - ACME_CONTACT=${ACME_CONTACT:-}
-        - ADDITIONAL_SAN=${ADDITIONAL_SAN}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - DIRECTORY_URL=${DIRECTORY_URL:-}
-        - ENABLE_SSL_SNI=${ENABLE_SSL_SNI:-n}
-        - SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
-        - SKIP_HTTP_VERIFICATION=${SKIP_HTTP_VERIFICATION:-n}
-        - ONLY_MAILCOW_HOSTNAME=${ONLY_MAILCOW_HOSTNAME:-n}
-        - LE_STAGING=${LE_STAGING:-n}
-        - TZ=${TZ}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
-        - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
+      env_file: mailcow.conf
       volumes:
         - ./data/web/.well-known/acme-challenge:/var/www/acme:z
         - ./data/assets/ssl:/var/lib/acme/:z
         - ./data/assets/ssl-example:/var/lib/ssl-example/:ro,Z
         - mysql-socket-vol-1:/var/run/mysqld/:z
-      restart: always
+      restart: unless-stopped
       networks:
         mailcow-network:
           aliases:
@@ -429,16 +317,9 @@ services:
         - sogo-mailcow
         - php-fpm-mailcow
         - redis-mailcow
-      restart: always
+      restart: unless-stopped
       privileged: true
-      environment:
-        - TZ=${TZ}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
-        - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+      env_file: mailcow.conf
       network_mode: "host"
       volumes:
         - /lib/modules:/lib/modules:ro
@@ -454,52 +335,8 @@ services:
         - mysql-socket-vol-1:/var/run/mysqld/:z
         - postfix-vol-1:/var/spool/postfix:z
         - ./data/assets/ssl:/etc/ssl/mail/:ro,z
-      restart: always
-      environment:
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - DBROOT=${DBROOT}
-        - USE_WATCHDOG=${USE_WATCHDOG:-n}
-        - WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL}
-        - WATCHDOG_NOTIFY_BAN=${WATCHDOG_NOTIFY_BAN:-y}
-        - WATCHDOG_SUBJECT=${WATCHDOG_SUBJECT:-Watchdog ALERT}
-        - WATCHDOG_EXTERNAL_CHECKS=${WATCHDOG_EXTERNAL_CHECKS:-n}
-        - WATCHDOG_MYSQL_REPLICATION_CHECKS=${WATCHDOG_MYSQL_REPLICATION_CHECKS:-n}
-        - WATCHDOG_VERBOSE=${WATCHDOG_VERBOSE:-n}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IP_BY_DOCKER_API=${IP_BY_DOCKER_API:-0}
-        - CHECK_UNBOUND=${CHECK_UNBOUND:-1}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
-        - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - HTTPS_PORT=${HTTPS_PORT:-443}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - EXTERNAL_CHECKS_THRESHOLD=${EXTERNAL_CHECKS_THRESHOLD:-1}
-        - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}
-        - UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}
-        - REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}
-        - MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}
-        - MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}
-        - SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}
-        - POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}
-        - CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}
-        - DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}
-        - DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}
-        - PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}
-        - RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}
-        - FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}
-        - ACME_THRESHOLD=${ACME_THRESHOLD:-1}
-        - RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}
-        - OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}
-        - MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}
-        - MAILQ_CRIT=${MAILQ_CRIT:-30}
+      restart: unless-stopped
+      env_file: mailcow.conf
       networks:
         mailcow-network:
           aliases:
@@ -509,13 +346,11 @@ services:
       image: mailcow/dockerapi:1.41
       security_opt:
         - label=disable
-      restart: always
-      oom_kill_disable: true
+      restart: unless-stopped
+        # oom_kill_disable: true
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
-      environment:
-        - DBROOT=${DBROOT}
-        - TZ=${TZ}
+      env_file: mailcow.conf
       volumes:
         - /var/run/docker.sock:/var/run/docker.sock:ro
       networks:
@@ -525,15 +360,12 @@ services:
 
     solr-mailcow:
       image: mailcow/solr:1.8.1
-      restart: always
+      restart: unless-stopped
       volumes:
         - solr-vol-1:/opt/solr/server/solr/dovecot-fts/data:Z
       ports:
         - "${SOLR_PORT:-127.0.0.1:18983}:8983"
-      environment:
-        - TZ=${TZ}
-        - SOLR_HEAP=${SOLR_HEAP:-1024}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
+      env_file: mailcow.conf
       networks:
         mailcow-network:
           aliases:
@@ -541,17 +373,8 @@ services:
 
     olefy-mailcow:
       image: mailcow/olefy:1.8.1
-      restart: always
-      environment:
-        - TZ=${TZ}
-        - OLEFY_BINDADDRESS=0.0.0.0
-        - OLEFY_BINDPORT=10055
-        - OLEFY_TMPDIR=/tmp
-        - OLEFY_PYTHON_PATH=/usr/bin/python3
-        - OLEFY_OLEVBA_PATH=/usr/bin/olevba3
-        - OLEFY_LOGLVL=20
-        - OLEFY_MINLENGTH=500
-        - OLEFY_DEL_TMP=1
+      restart: unless-stopped
+      env_file: mailcow.conf
       networks:
         mailcow-network:
           aliases:
@@ -559,10 +382,9 @@ services:
 
     ofelia-mailcow:
       image: mcuadros/ofelia:latest
-      restart: always
+      restart: unless-stopped
       command: daemon --docker
-      environment:
-        - TZ=${TZ}
+      env_file: mailcow.conf
       depends_on:
         - sogo-mailcow
         - dovecot-mailcow
@@ -595,12 +417,11 @@ services:
         - watchdog-mailcow
         - dockerapi-mailcow
         - solr-mailcow
-      environment:
-        - TZ=${TZ}
+      env_file: mailcow.conf
       image: robbertkl/ipv6nat
       security_opt:
         - label=disable
-      restart: always
+      restart: unless-stopped
       privileged: true
       network_mode: "host"
       volumes:
@@ -609,6 +430,7 @@ services:
 
 networks:
   mailcow-network:
+    # driver: overlay
     driver: bridge
     driver_opts:
       com.docker.network.bridge.name: br-mailcow
@@ -618,6 +440,10 @@ networks:
       config:
         - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
         - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+  caddy:
+    external: true
+    # driver: overlay
+    # attachable: true
 
 volumes:
   vmail-vol-1: