fix

Makefile

@@ -0,0 +1,6 @@
+up:
+	docker stack deploy -c docker-compose.yml mail
+down:
+	docker stack rm mail
+env:
+	export $(grep -v '^#' .env | xargs -0)

create_cold_standby.sh

@@ -4,4 +4,4 @@ export REMOTE_SSH_KEY=/root/.ssh/id_rsa
 export REMOTE_SSH_PORT=22
 export REMOTE_SSH_HOST=my.remote.host
 
-/opt/mailcow-dockerized/helper-scripts/_cold-standby.sh
+./helper-scripts/_cold-standby.sh

data/assets/ssl-example/cert.pem

@@ -1,19 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDBDCCAe6gAwIBAgIQeJMoL/3dxhxhT9EwuRTL/DALBgkqhkiG9w0BAQswEjEQ
-MA4GA1UEChMHbWFpbGNvdzAeFw0xNjEyMTMxMDExMDBaFw0xOTExMjgxMDExMDBa
-MC0xEDAOBgNVBAoTB21haWxjb3cxGTAXBgNVBAMTEG1haWwuZXhhbXBsZS5vcmcw
-ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRg0xT3At9DSb3H5OMp3K1
-MpXAgYyotSK6TS61fC0QEHy2fMXiws7Agcye6Ln7CG63Fe1eN2jkdlefy9xJivS8
-y5w0M8i168v5znzC8fnylL2iOiSYfK/B/oEqfU7YH4RcegO53oDDIUZmi4Frgnu7
-39VVOU1ZyHEVqGJ2H2aAIkoZRjGzumD9Ym4LWGidtKJzBgFt/qmhUeWXipM8w281
-XkQnJU79+x2ywnJSvEZ3r/ZVJC7kbjiVw+/k15k9Cxk6Ik8wmJ0X/+xWxoZomHQI
-1LM0VKAS/iaU95dn2bplvL6jTiiyWAbrMjSKs4XbPt/fIbOicNkj6+CFy0MVfyyH
-AgMBAAGjPzA9MA4GA1UdDwEB/wQEAwIAqDAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
-KwYBBQUHAwEwDAYDVR0TAQH/BAIwADALBgkqhkiG9w0BAQsDggEBAI/jBJa1P8nB
-eHUN5muQmjBVDVOYyWAAEapOe2HYsBcpjaB2H8Iw3DQzJtz6peYeYSCmHRVqFLCm
-VPrq36l9mPUotyPDPlQQAxCj9R2+WbGaJO+N/E1F8FQ94dr3jqwUyfjVPoqEjmIH
-NFkvbA0RJOeBm9oYGdhM0wjOBV9c9MTHFG82nQ/zQeTuPb7GXuKIOXYCxoLNOZMw
-UJ02Cqjv5ImrgOhcstAKX3Ip0urSvZUGvtPla4CGh+M6yDFJ08GzX6OiMIH207RW
-jAbUXXERSUv/7hysdDjGo5HZjCeMzVu9KAxoZXqnmvkk8g2swKWtWBRcoeU1VGx0
-Bx4Q4KMjuYQ=
------END CERTIFICATE-----

data/assets/ssl-example/key.pem

@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEpAIBAAKCAQEA0YNMU9wLfQ0m9x+TjKdytTKVwIGMqLUiuk0utXwtEBB8tnzF
-4sLOwIHMnui5+whutxXtXjdo5HZXn8vcSYr0vMucNDPItevL+c58wvH58pS9ojok
-mHyvwf6BKn1O2B+EXHoDud6AwyFGZouBa4J7u9/VVTlNWchxFahidh9mgCJKGUYx
-s7pg/WJuC1honbSicwYBbf6poVHll4qTPMNvNV5EJyVO/fsdssJyUrxGd6/2VSQu
-5G44lcPv5NeZPQsZOiJPMJidF//sVsaGaJh0CNSzNFSgEv4mlPeXZ9m6Zby+o04o
-slgG6zI0irOF2z7f3yGzonDZI+vghctDFX8shwIDAQABAoIBAQC9kiLnIgxXGyZt
-pmmYdA6re1jatZ2zLSp+DcY8ul3/0hs195IKCyCOOSQPiR520Pt0t+duP46uYZIJ
-aakp9gxaI5Vz+oMacH/AyaBDuDTj1Mf9WMSyIOfbDVCMRJOppGLcVh62+Gfjp2EO
-+h2hTJBuvypFkbK2kVIZOaHVpbXWKw1oYuEcTftk9XfxxvfSMw1HQ12/P2CAcbaa
-jPmVbisunv6kpXtewSBTcaLSYWJf1MYD5Hi8fzkD2FJSXYbfQd8RKvT2rj6FA7ux
-CDMzbYhdnd7lc63OARCIjfCRNtDT1cZ3gR1CQHD98lWxmPQIZukv+w7s/bSrFgnQ
-ROZ0ghBJAoGBAOmE/3d5FDmp0aJNxXynKcRGdpEEM4O40RIdqa2eR6Pa7aTRosao
-z0qVgdFuJrqjlB3jgedxXEX1M0abCUzzM9Q5F7JLl+KsjwRwpkIOkPiyUncLp7LK
-QbY3tvYBIdpjlF1USOMGRL4j11hqr4vQC/yPBF7jj81kCZDTbmZhp82jAoGBAOWu
-ql5QFUOlmqkuWIAFkiLEZhOu+ptqkE+zG50CCGMJIX0dJ2PHXFyNGInomAeT0nbI
-pbnK3x7KeEKiGrAqZFNCTHhApTwkrIj0L/RQbMDZ7u7j1AEUVNFEhIm62kg84FtG
-xtfxVxredE+NQc/tyV3hXegdNZxegALirlcMKIvNAoGAWFwIxk48Ru1o8z72QQqH
-lUsMRicOzwK5qV8r+xPvC6MlVL42F3F8rj4QFwzU/r4yp3SUjNyqC5aSRl8Xj9Re
-gijwPHi6Cf09SHLPliMo29GtvnnchJxfbPF7+23GP3p6gy4HPk/65u9s5nnH3uFk
-B7ad8sGsgg0eSXyXQ4okEn0CgYEAnogPuedGthlxBgMiPMMbmfm7hyyId4t3Ljuu
-/JExnsHnpobf8EPjoVIWNOIhRWGnrCtUEEhR9tvDZCKljyDDfKBPTdU496lMmX8K
-NnToi7gg7iy84T3aSVMktDgPgDrclMPmbZh8CeSvnVUfrtgu3Ci4+4Rlw5eKffNe
-aGDQ/6UCgYAbUq9mRT2WOXIo+Dchi9VzDWgtfOw5VEyqkSpb7hPiIYx5jNaENnVK
-cAi3iqbBgPJBuMlTrKmmaxdmssGOEZNJLuuXLDbCU+f5cpu5PQ4crC6UtRI5rlhp
-8Yc+oiv3HWbSw3sVRpMFB6NP4DnvgFW3B2Wdfb/lNzPCKWqBsX7gWw==
------END RSA PRIVATE KEY-----

data/conf/postfix/main.cf

@@ -198,3 +198,6 @@ parent_domain_matches_subdomains = debug_peer_list,fast_flush_domains,mynetworks
 
 # DO NOT EDIT ANYTHING BELOW #
 # User overrides #
+
+myhostname = mail.marcpartensky.com
+

docker-compose.yml

@@ -1,14 +1,14 @@
-version: '2.1'
+version: '3.9'
 services:
 
     unbound-mailcow:
       image: mailcow/unbound:1.15
+      restart: unless-stopped
       environment:
-        - TZ=${TZ}
+        TZ: ${TZ}
       volumes:
         - ./data/hooks/unbound:/hooks:Z
         - ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro,Z
-      restart: always
       tty: true
       networks:
         mailcow-network:
@@ -18,6 +18,7 @@ services:
 
     mysql-mailcow:
       image: mariadb:10.5
+      restart: unless-stopped
       depends_on:
         - unbound-mailcow
       stop_grace_period: 45s
@@ -26,13 +27,12 @@ services:
         - mysql-socket-vol-1:/var/run/mysqld/:z
         - ./data/conf/mysql/:/etc/mysql/conf.d/:ro,Z
       environment:
-        - TZ=${TZ}
-        - MYSQL_ROOT_PASSWORD=${DBROOT}
-        - MYSQL_DATABASE=${DBNAME}
-        - MYSQL_USER=${DBUSER}
-        - MYSQL_PASSWORD=${DBPASS}
-        - MYSQL_INITDB_SKIP_TZINFO=1
-      restart: always
+        TZ: ${TZ}
+        MYSQL_ROOT_PASSWORD: ${DBROOT}
+        MYSQL_DATABASE: ${DBNAME}
+        MYSQL_USER: ${DBUSER}
+        MYSQL_PASSWORD: ${DBPASS}
+        MYSQL_INITDB_SKIP_TZINFO: 1
       ports:
         - "${SQL_PORT:-127.0.0.1:13306}:3306"
       networks:
@@ -42,13 +42,13 @@ services:
 
     redis-mailcow:
       image: redis:6-alpine
+      restart: unless-stopped
       volumes:
         - redis-vol-1:/data/:Z
-      restart: always
       ports:
         - "${REDIS_PORT:-127.0.0.1:7654}:6379"
       environment:
-        - TZ=${TZ}
+        TZ: ${TZ}
       sysctls:
         - net.core.somaxconn=4096
       networks:
@@ -59,12 +59,12 @@ services:
 
     clamd-mailcow:
       image: mailcow/clamd:1.43
-      restart: always
+      restart: unless-stopped
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
-        - TZ=${TZ}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
+        TZ: ${TZ}
+        SKIP_CLAMD: ${SKIP_CLAMD:-n}
       volumes:
         - ./data/conf/clamav/:/etc/clamav/:Z
       networks:
@@ -74,15 +74,16 @@ services:
 
     rspamd-mailcow:
       image: mailcow/rspamd:1.79
+      restart: unless-stopped
       stop_grace_period: 30s
       depends_on:
         - dovecot-mailcow
       environment:
-        - TZ=${TZ}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+        TZ: ${TZ}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        IPV6_NETWORK: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
       volumes:
         - ./data/hooks/rspamd:/hooks:Z
         - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
@@ -93,7 +94,6 @@ services:
         - ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z
         - ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z
         - rspamd-vol-1:/var/lib/rspamd:z
-      restart: always
       hostname: rspamd
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
@@ -104,6 +104,7 @@ services:
 
     php-fpm-mailcow:
       image: mailcow/phpfpm:1.78
+      restart: unless-stopped
       command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
       depends_on:
         - redis-mailcow
@@ -128,37 +129,36 @@ services:
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - IMAP_PORT=${IMAP_PORT:-143}
-        - IMAPS_PORT=${IMAPS_PORT:-993}
-        - POP_PORT=${POP_PORT:-110}
-        - POPS_PORT=${POPS_PORT:-995}
-        - SIEVE_PORT=${SIEVE_PORT:-4190}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - SUBMISSION_PORT=${SUBMISSION_PORT:-587}
-        - SMTPS_PORT=${SMTPS_PORT:-465}
-        - SMTP_PORT=${SMTP_PORT:-25}
-        - API_KEY=${API_KEY:-invalid}
-        - API_KEY_READ_ONLY=${API_KEY_READ_ONLY:-invalid}
-        - API_ALLOW_FROM=${API_ALLOW_FROM:-invalid}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - MASTER=${MASTER:-y}
-        - DEV_MODE=${DEV_MODE:-n}
-        - WEBAUTHN_ONLY_TRUSTED_VENDORS=${WEBAUTHN_ONLY_TRUSTED_VENDORS:-n}
-      restart: always
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
+        LOG_LINES: ${LOG_LINES:-9999}
+        TZ: ${TZ}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        MAILCOW_PASS_SCHEME: ${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
+        IMAP_PORT: ${IMAP_PORT:-143}
+        IMAPS_PORT: ${IMAPS_PORT:-993}
+        POP_PORT: ${POP_PORT:-110}
+        POPS_PORT: ${POPS_PORT:-995}
+        SIEVE_PORT: ${SIEVE_PORT:-4190}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        IPV6_NETWORK: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+        SUBMISSION_PORT: ${SUBMISSION_PORT:-587}
+        SMTPS_PORT: ${SMTPS_PORT:-465}
+        SMTP_PORT: ${SMTP_PORT:-25}
+        API_KEY: ${API_KEY:-invalid}
+        API_KEY_READ_ONLY: ${API_KEY_READ_ONLY:-invalid}
+        API_ALLOW_FROM: ${API_ALLOW_FROM:-invalid}
+        COMPOSE_PROJECT_NAME: ${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+        SKIP_SOLR: ${SKIP_SOLR:-y}
+        SKIP_CLAMD: ${SKIP_CLAMD:-n}
+        SKIP_SOGO: ${SKIP_SOGO:-n}
+        ALLOW_ADMIN_EMAIL_LOGIN: ${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+        MASTER: ${MASTER:-y}
+        DEV_MODE: ${DEV_MODE:-n}
+        WEBAUTHN_ONLY_TRUSTED_VENDORS: ${WEBAUTHN_ONLY_TRUSTED_VENDORS:-n}
       networks:
         mailcow-network:
           aliases:
@@ -166,22 +166,23 @@ services:
 
     sogo-mailcow:
       image: mailcow/sogo:1.106
+      restart: unless-stopped
       environment:
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - TZ=${TZ}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - ACL_ANYONE=${ACL_ANYONE:-disallow}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - MASTER=${MASTER:-y}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        TZ: ${TZ}
+        LOG_LINES: ${LOG_LINES:-9999}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        MAILCOW_PASS_SCHEME: ${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
+        ACL_ANYONE: ${ACL_ANYONE:-disallow}
+        ALLOW_ADMIN_EMAIL_LOGIN: ${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        SOGO_EXPIRE_SESSION: ${SOGO_EXPIRE_SESSION:-480}
+        SKIP_SOGO: ${SKIP_SOGO:-n}
+        MASTER: ${MASTER:-y}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       volumes:
@@ -204,7 +205,6 @@ services:
         ofelia.job-exec.sogo_eautoreply.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool update-autoreply -p /etc/sogo/sieve.creds || exit 0\""
         ofelia.job-exec.sogo_backup.schedule: "@every 24h"
         ofelia.job-exec.sogo_backup.command: "/bin/bash -c \"[[ $${MASTER} == y ]] && /usr/local/bin/gosu sogo /usr/sbin/sogo-tool backup /sogo_backup ALL || exit 0\""
-      restart: always
       networks:
         mailcow-network:
           ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
@@ -213,6 +213,7 @@ services:
 
     dovecot-mailcow:
       image: mailcow/dovecot:1.159
+      restart: unless-stopped
       depends_on:
         - mysql-mailcow
       dns:
@@ -233,25 +234,25 @@ services:
         - rspamd-vol-1:/var/lib/rspamd:z
         - mysql-socket-vol-1:/var/run/mysqld/:z
       environment:
-        - DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-}
-        - DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - TZ=${TZ}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - MAILCOW_PASS_SCHEME=${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - MAILDIR_GC_TIME=${MAILDIR_GC_TIME:-7200}
-        - ACL_ANYONE=${ACL_ANYONE:-disallow}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
-        - MAILDIR_SUB=${MAILDIR_SUB:-}
-        - MASTER=${MASTER:-y}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+        DOVECOT_MASTER_USER: ${DOVECOT_MASTER_USER:-}
+        DOVECOT_MASTER_PASS: ${DOVECOT_MASTER_PASS:-}
+        LOG_LINES: ${LOG_LINES:-9999}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        TZ: ${TZ}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        MAILCOW_PASS_SCHEME: ${MAILCOW_PASS_SCHEME:-BLF-CRYPT}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        ALLOW_ADMIN_EMAIL_LOGIN: ${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+        MAILDIR_GC_TIME: ${MAILDIR_GC_TIME:-7200}
+        ACL_ANYONE: ${ACL_ANYONE:-disallow}
+        SKIP_SOLR: ${SKIP_SOLR:-y}
+        MAILDIR_SUB: ${MAILDIR_SUB:-}
+        MASTER: ${MASTER:-y}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
+        COMPOSE_PROJECT_NAME: ${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
       ports:
         - "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
         - "${IMAP_PORT:-143}:143"
@@ -259,7 +260,6 @@ services:
         - "${POP_PORT:-110}:110"
         - "${POPS_PORT:-995}:995"
         - "${SIEVE_PORT:-4190}:4190"
-      restart: always
       tty: true
       labels:
         ofelia.enabled: "true"
@@ -293,6 +293,7 @@ services:
 
     postfix-mailcow:
       image: mailcow/postfix:1.66
+      restart: unless-stopped
       depends_on:
         - mysql-mailcow
       volumes:
@@ -304,21 +305,20 @@ services:
         - rspamd-vol-1:/var/lib/rspamd:z
         - mysql-socket-vol-1:/var/run/mysqld/:z
       environment:
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+        LOG_LINES: ${LOG_LINES:-9999}
+        TZ: ${TZ}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
       cap_add:
         - NET_BIND_SERVICE
       ports:
         - "${SMTP_PORT:-25}:25"
         - "${SMTPS_PORT:-465}:465"
         - "${SUBMISSION_PORT:-587}:587"
-      restart: always
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       networks:
@@ -329,7 +329,7 @@ services:
 
     memcached-mailcow:
       image: memcached:alpine
-      restart: always
+      restart: unless-stopped
       environment:
         - TZ=${TZ}
       networks:
@@ -338,11 +338,12 @@ services:
             - memcached
 
     nginx-mailcow:
+      image: nginx:mainline-alpine
+      restart: unless-stopped
       depends_on:
         - sogo-mailcow
         - php-fpm-mailcow
         - redis-mailcow
-      image: nginx:mainline-alpine
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
@@ -358,14 +359,14 @@ services:
         until ping rspamd -c1 > /dev/null; do sleep 1; done &&
         exec nginx -g 'daemon off;'"
       environment:
-        - HTTPS_PORT=${HTTPS_PORT:-443}
-        - HTTP_PORT=${HTTP_PORT:-80}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - TZ=${TZ}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
-        - ADDITIONAL_SERVER_NAMES=${ADDITIONAL_SERVER_NAMES:-}
+        HTTPS_PORT: ${HTTPS_PORT:-443}
+        HTTP_PORT: ${HTTP_PORT:-80}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        TZ: ${TZ}
+        SKIP_SOGO: ${SKIP_SOGO:-n}
+        ALLOW_ADMIN_EMAIL_LOGIN: ${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+        ADDITIONAL_SERVER_NAMES: ${ADDITIONAL_SERVER_NAMES:-}
       volumes:
         - ./data/web:/web:ro,z
         - ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
@@ -373,48 +374,57 @@ services:
         - ./data/conf/nginx/:/etc/nginx/conf.d/:z
         - ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
         - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/:z
-      ports:
-        - "${HTTPS_BIND:-:}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
-        - "${HTTP_BIND:-:}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
-      restart: always
+      # ports:
+      #   - "${HTTPS_BIND:-:}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
+      #   - "${HTTP_BIND:-:}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
+      labels:
+        caddy: mail.marcpartensky.com, mail.marc.wf, mail.marc.tf, m.marc.wf, m.marc.tf
+        caddy.reverse_proxy: "{{upstreams 80}}"
+        traefik.enable: true
+        traefik.http.routers.nginx-mailcow.rule: Host(`mail.marcpartensky.com`)
+        traefik.http.routers.nginx-mailcow.entrypoints: websecure
+        traefik.http.routers.nginx-mailcow.tls.certresolver: tls
+        traefik.http.services.nginx-mailcow.loadbalancer.server.port: 80
+
       networks:
+        caddy:
         mailcow-network:
           aliases:
             - nginx
 
     acme-mailcow:
+      image: mailcow/acme:1.81
+      restart: unless-stopped
       depends_on:
         - nginx-mailcow
-      image: mailcow/acme:1.81
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
-        - LOG_LINES=${LOG_LINES:-9999}
-        - ACME_CONTACT=${ACME_CONTACT:-}
-        - ADDITIONAL_SAN=${ADDITIONAL_SAN}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - DIRECTORY_URL=${DIRECTORY_URL:-}
-        - ENABLE_SSL_SNI=${ENABLE_SSL_SNI:-n}
-        - SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
-        - SKIP_HTTP_VERIFICATION=${SKIP_HTTP_VERIFICATION:-n}
-        - ONLY_MAILCOW_HOSTNAME=${ONLY_MAILCOW_HOSTNAME:-n}
-        - LE_STAGING=${LE_STAGING:-n}
-        - TZ=${TZ}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
-        - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
+        LOG_LINES: ${LOG_LINES:-9999}
+        ACME_CONTACT: ${ACME_CONTACT:-}
+        ADDITIONAL_SAN: ${ADDITIONAL_SAN}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        SKIP_LETS_ENCRYPT: ${SKIP_LETS_ENCRYPT:-n}
+        COMPOSE_PROJECT_NAME: ${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+        DIRECTORY_URL: ${DIRECTORY_URL:-}
+        ENABLE_SSL_SNI: ${ENABLE_SSL_SNI:-n}
+        SKIP_IP_CHECK: ${SKIP_IP_CHECK:-n}
+        SKIP_HTTP_VERIFICATION: ${SKIP_HTTP_VERIFICATION:-n}
+        ONLY_MAILCOW_HOSTNAME: ${ONLY_MAILCOW_HOSTNAME:-n}
+        LE_STAGING: ${LE_STAGING:-n}
+        TZ: ${TZ}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
+        SNAT_TO_SOURCE: ${SNAT_TO_SOURCE:-n}
+        SNAT6_TO_SOURCE: ${SNAT6_TO_SOURCE:-n}
       volumes:
         - ./data/web/.well-known/acme-challenge:/var/www/acme:z
         - ./data/assets/ssl:/var/lib/acme/:z
         - ./data/assets/ssl-example:/var/lib/ssl-example/:ro,Z
         - mysql-socket-vol-1:/var/run/mysqld/:z
-      restart: always
       networks:
         mailcow-network:
           aliases:
@@ -422,6 +432,7 @@ services:
 
     netfilter-mailcow:
       image: mailcow/netfilter:1.46
+      restart: unless-stopped
       stop_grace_period: 30s
       depends_on:
         - dovecot-mailcow
@@ -429,22 +440,22 @@ services:
         - sogo-mailcow
         - php-fpm-mailcow
         - redis-mailcow
-      restart: always
       privileged: true
       environment:
-        - TZ=${TZ}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
-        - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+        TZ: ${TZ}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        IPV6_NETWORK: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+        SNAT_TO_SOURCE: ${SNAT_TO_SOURCE:-n}
+        SNAT6_TO_SOURCE: ${SNAT6_TO_SOURCE:-n}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
       network_mode: "host"
       volumes:
         - /lib/modules:/lib/modules:ro
 
     watchdog-mailcow:
       image: mailcow/watchdog:1.96
+      restart: unless-stopped
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       tmpfs:
@@ -454,52 +465,51 @@ services:
         - mysql-socket-vol-1:/var/run/mysqld/:z
         - postfix-vol-1:/var/spool/postfix:z
         - ./data/assets/ssl:/etc/ssl/mail/:ro,z
-      restart: always
       environment:
-        - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
-        - LOG_LINES=${LOG_LINES:-9999}
-        - TZ=${TZ}
-        - DBNAME=${DBNAME}
-        - DBUSER=${DBUSER}
-        - DBPASS=${DBPASS}
-        - DBROOT=${DBROOT}
-        - USE_WATCHDOG=${USE_WATCHDOG:-n}
-        - WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL}
-        - WATCHDOG_NOTIFY_BAN=${WATCHDOG_NOTIFY_BAN:-y}
-        - WATCHDOG_SUBJECT=${WATCHDOG_SUBJECT:-Watchdog ALERT}
-        - WATCHDOG_EXTERNAL_CHECKS=${WATCHDOG_EXTERNAL_CHECKS:-n}
-        - WATCHDOG_MYSQL_REPLICATION_CHECKS=${WATCHDOG_MYSQL_REPLICATION_CHECKS:-n}
-        - WATCHDOG_VERBOSE=${WATCHDOG_VERBOSE:-n}
-        - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
-        - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
-        - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
-        - IP_BY_DOCKER_API=${IP_BY_DOCKER_API:-0}
-        - CHECK_UNBOUND=${CHECK_UNBOUND:-1}
-        - SKIP_CLAMD=${SKIP_CLAMD:-n}
-        - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
-        - SKIP_SOGO=${SKIP_SOGO:-n}
-        - HTTPS_PORT=${HTTPS_PORT:-443}
-        - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
-        - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-        - EXTERNAL_CHECKS_THRESHOLD=${EXTERNAL_CHECKS_THRESHOLD:-1}
-        - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}
-        - UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}
-        - REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}
-        - MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}
-        - MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}
-        - SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}
-        - POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}
-        - CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}
-        - DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}
-        - DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}
-        - PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}
-        - RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}
-        - FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}
-        - ACME_THRESHOLD=${ACME_THRESHOLD:-1}
-        - RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}
-        - OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}
-        - MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}
-        - MAILQ_CRIT=${MAILQ_CRIT:-30}
+        IPV6_NETWORK: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+        LOG_LINES: ${LOG_LINES:-9999}
+        TZ: ${TZ}
+        DBNAME: ${DBNAME}
+        DBUSER: ${DBUSER}
+        DBPASS: ${DBPASS}
+        DBROOT: ${DBROOT}
+        USE_WATCHDOG: ${USE_WATCHDOG:-n}
+        WATCHDOG_NOTIFY_EMAIL: ${WATCHDOG_NOTIFY_EMAIL}
+        WATCHDOG_NOTIFY_BAN: ${WATCHDOG_NOTIFY_BAN:-y}
+        WATCHDOG_SUBJECT: ${WATCHDOG_SUBJECT:-Watchdog ALERT}
+        WATCHDOG_EXTERNAL_CHECKS: ${WATCHDOG_EXTERNAL_CHECKS:-n}
+        WATCHDOG_MYSQL_REPLICATION_CHECKS: ${WATCHDOG_MYSQL_REPLICATION_CHECKS:-n}
+        WATCHDOG_VERBOSE: ${WATCHDOG_VERBOSE:-n}
+        MAILCOW_HOSTNAME: ${MAILCOW_HOSTNAME}
+        COMPOSE_PROJECT_NAME: ${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+        IPV4_NETWORK: ${IPV4_NETWORK:-172.22.1}
+        IP_BY_DOCKER_API: ${IP_BY_DOCKER_API:-0}
+        CHECK_UNBOUND: ${CHECK_UNBOUND:-1}
+        SKIP_CLAMD: ${SKIP_CLAMD:-n}
+        SKIP_LETS_ENCRYPT: ${SKIP_LETS_ENCRYPT:-n}
+        SKIP_SOGO: ${SKIP_SOGO:-n}
+        HTTPS_PORT: ${HTTPS_PORT:-443}
+        REDIS_SLAVEOF_IP: ${REDIS_SLAVEOF_IP:-}
+        REDIS_SLAVEOF_PORT: ${REDIS_SLAVEOF_PORT:-}
+        EXTERNAL_CHECKS_THRESHOLD: ${EXTERNAL_CHECKS_THRESHOLD:-1}
+        NGINX_THRESHOLD: ${NGINX_THRESHOLD:-5}
+        UNBOUND_THRESHOLD: ${UNBOUND_THRESHOLD:-5}
+        REDIS_THRESHOLD: ${REDIS_THRESHOLD:-5}
+        MYSQL_THRESHOLD: ${MYSQL_THRESHOLD:-5}
+        MYSQL_REPLICATION_THRESHOLD: ${MYSQL_REPLICATION_THRESHOLD:-1}
+        SOGO_THRESHOLD: ${SOGO_THRESHOLD:-3}
+        POSTFIX_THRESHOLD: ${POSTFIX_THRESHOLD:-8}
+        CLAMD_THRESHOLD: ${CLAMD_THRESHOLD:-15}
+        DOVECOT_THRESHOLD: ${DOVECOT_THRESHOLD:-12}
+        DOVECOT_REPL_THRESHOLD: ${DOVECOT_REPL_THRESHOLD:-20}
+        PHPFPM_THRESHOLD: ${PHPFPM_THRESHOLD:-5}
+        RATELIMIT_THRESHOLD: ${RATELIMIT_THRESHOLD:-1}
+        FAIL2BAN_THRESHOLD: ${FAIL2BAN_THRESHOLD:-1}
+        ACME_THRESHOLD: ${ACME_THRESHOLD:-1}
+        RSPAMD_THRESHOLD: ${RSPAMD_THRESHOLD:-5}
+        OLEFY_THRESHOLD: ${OLEFY_THRESHOLD:-5}
+        MAILQ_THRESHOLD: ${MAILQ_THRESHOLD:-20}
+        ILQ_CRIT: ${MAILQ_CRIT:-30}
       networks:
         mailcow-network:
           aliases:
@@ -507,15 +517,15 @@ services:
 
     dockerapi-mailcow:
       image: mailcow/dockerapi:1.41
+      restart: unless-stopped
       security_opt:
         - label=disable
-      restart: always
-      oom_kill_disable: true
+        # oom_kill_disable: true
       dns:
         - ${IPV4_NETWORK:-172.22.1}.254
       environment:
-        - DBROOT=${DBROOT}
-        - TZ=${TZ}
+        DBROOT: ${DBROOT}
+        TZ: ${TZ}
       volumes:
         - /var/run/docker.sock:/var/run/docker.sock:ro
       networks:
@@ -525,15 +535,15 @@ services:
 
     solr-mailcow:
       image: mailcow/solr:1.8.1
-      restart: always
+      restart: unless-stopped
       volumes:
         - solr-vol-1:/opt/solr/server/solr/dovecot-fts/data:Z
       ports:
         - "${SOLR_PORT:-127.0.0.1:18983}:8983"
       environment:
-        - TZ=${TZ}
-        - SOLR_HEAP=${SOLR_HEAP:-1024}
-        - SKIP_SOLR=${SKIP_SOLR:-y}
+        TZ: ${TZ}
+        SOLR_HEAP: ${SOLR_HEAP:-1024}
+        SKIP_SOLR: ${SKIP_SOLR:-y}
       networks:
         mailcow-network:
           aliases:
@@ -541,17 +551,17 @@ services:
 
     olefy-mailcow:
       image: mailcow/olefy:1.8.1
-      restart: always
+      restart: unless-stopped
       environment:
-        - TZ=${TZ}
-        - OLEFY_BINDADDRESS=0.0.0.0
-        - OLEFY_BINDPORT=10055
-        - OLEFY_TMPDIR=/tmp
-        - OLEFY_PYTHON_PATH=/usr/bin/python3
-        - OLEFY_OLEVBA_PATH=/usr/bin/olevba3
-        - OLEFY_LOGLVL=20
-        - OLEFY_MINLENGTH=500
-        - OLEFY_DEL_TMP=1
+        TZ: ${TZ}
+        OLEFY_BINDADDRESS: 0.0.0.0
+        OLEFY_BINDPORT: 10055
+        OLEFY_TMPDIR: /tmp
+        OLEFY_PYTHON_PATH: /usr/bin/python3
+        OLEFY_OLEVBA_PATH: /usr/bin/olevba3
+        OLEFY_LOGLVL: 20
+        OLEFY_MINLENGTH: 500
+        OLEFY_DEL_TMP: 1
       networks:
         mailcow-network:
           aliases:
@@ -559,7 +569,7 @@ services:
 
     ofelia-mailcow:
       image: mcuadros/ofelia:latest
-      restart: always
+      restart: unless-stopped
       command: daemon --docker
       environment:
         - TZ=${TZ}
@@ -577,38 +587,39 @@ services:
           aliases:
             - ofelia
 
-    ipv6nat-mailcow:
-      depends_on:
-        - unbound-mailcow
-        - mysql-mailcow
-        - redis-mailcow
-        - clamd-mailcow
-        - rspamd-mailcow
-        - php-fpm-mailcow
-        - sogo-mailcow
-        - dovecot-mailcow
-        - postfix-mailcow
-        - memcached-mailcow
-        - nginx-mailcow
-        - acme-mailcow
-        - netfilter-mailcow
-        - watchdog-mailcow
-        - dockerapi-mailcow
-        - solr-mailcow
-      environment:
-        - TZ=${TZ}
-      image: robbertkl/ipv6nat
-      security_opt:
-        - label=disable
-      restart: always
-      privileged: true
-      network_mode: "host"
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock:ro
-        - /lib/modules:/lib/modules:ro
+    # ipv6nat-mailcow:
+    #   image: robbertkl/ipv6nat
+    #   restart: unless-stopped
+    #   depends_on:
+    #     - unbound-mailcow
+    #     - mysql-mailcow
+    #     - redis-mailcow
+    #     - clamd-mailcow
+    #     - rspamd-mailcow
+    #     - php-fpm-mailcow
+    #     - sogo-mailcow
+    #     - dovecot-mailcow
+    #     - postfix-mailcow
+    #     - memcached-mailcow
+    #     - nginx-mailcow
+    #     - acme-mailcow
+    #     - netfilter-mailcow
+    #     - watchdog-mailcow
+    #     - dockerapi-mailcow
+    #     - solr-mailcow
+    #   environment:
+    #     - TZ=${TZ}
+    #   security_opt:
+    #     - label=disable
+    #   privileged: true
+    #   network_mode: "host"
+    #   volumes:
+    #     - /var/run/docker.sock:/var/run/docker.sock:ro
+    #     - /lib/modules:/lib/modules:ro
 
 networks:
   mailcow-network:
+    # driver: overlay
     driver: bridge
     driver_opts:
       com.docker.network.bridge.name: br-mailcow
@@ -618,6 +629,10 @@ networks:
       config:
         - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
         - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+  caddy:
+    external: true
+    # driver: overlay
+    # attachable: true
 
 volumes:
   vmail-vol-1:

run.sh

@@ -0,0 +1 @@
+export $(grep -v '^#' .env | xargs -0)