tests: make sure chatmail-metadata was started

fix a flaky test: https://github.com/chatmail/relay/pull/856#issuecomment-3919881473
since #856 chatmail-metadata is restarted every 5 second, if it didn't come up after that, the failure likely sits deeper.

.dockerignore

@@ -1,18 +0,0 @@
-data/
-venv/
-__pycache__
-*.pyc
-*.orig
-*.ini
-.pytest_cache
-.env
-
-# Slim build context — .git/ alone can be 100s of MB
-.git
-.github/
-docs/
-tests/
-
-# Exclude markdown files but keep www/src/*.md (used by WebsiteDeployer)
-*.md
-!www/**/*.md

.github/workflows/ci.yaml

@@ -15,7 +15,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: download filtermail
-        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.5.2/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
+        run: curl -L https://github.com/chatmail/filtermail/releases/download/v0.5.1/filtermail-x86_64 -o /usr/local/bin/filtermail && chmod +x /usr/local/bin/filtermail
       - name: run chatmaild tests 
         working-directory: chatmaild
         run: pipx run tox

.github/workflows/deploy.yaml

@@ -1,375 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches:
-      - main
-      - j4n/docker-pr
-  pull_request:
-    paths-ignore:
-      - 'scripts/**'
-      - '**/README.md'
-      - 'CHANGELOG.md'
-      - 'LICENSE'
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}
-
-jobs:
-  build-docker:
-    name: Build Docker image
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    outputs:
-      image: ${{ steps.image-ref.outputs.image }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to GHCR
-        if: github.event_name == 'push'
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract metadata (tags, labels)
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            # Tagged releases: v1.2.3 -> :1.2.3, :1.2, :latest
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            # Branch pushes: foo/docker-pr -> :foo-docker-pr
-            type=ref,event=branch
-            # Always: :sha-<hash>
-            type=sha
-
-      - name: Build and push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/chatmail_relay.dockerfile
-          push: ${{ github.event_name == 'push' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          build-args: |
-            GIT_HASH=${{ github.sha }}
-
-      - name: Output image reference
-        id: image-ref
-        run: |
-          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-          IMAGE="${{ env.REGISTRY }}/$(echo "${{ env.IMAGE_NAME }}" | tr '[:upper:]' '[:lower:]'):sha-${SHORT_SHA}"
-          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
-
-  deploy:
-    name: Deploy to ${{ matrix.host }}
-    needs: build-docker
-    # dont do the regular tests on this branch
-    if: >-
-      !cancelled() && (
-        github.event_name == 'push' ||
-        (github.event_name == 'pull_request' && !startsWith(github.head_ref, 'j4n/'))
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - host: staging2.testrun.org
-            acme_dir: acme
-            dkim_dir: dkimkeys
-            zone_file: staging.testrun.org-default.zone
-            disable_ipv6: false
-            add_ssh_keys: true
-          - host: staging-ipv4.testrun.org
-            acme_dir: acme-ipv4
-            dkim_dir: dkimkeys-ipv4
-            zone_file: staging-ipv4.testrun.org-default.zone
-            disable_ipv6: true
-            add_ssh_keys: false
-    environment:
-      name: ${{ matrix.host }}
-      url: https://${{ matrix.host }}/
-    concurrency: ${{ matrix.host }}
-    steps:
-      # --- Common setup ---
-
-      - uses: actions/checkout@v4
-
-      - name: prepare SSH and save ACME/DKIM
-        env:
-          HOST: ${{ matrix.host }}
-          ACME_DIR: ${{ matrix.acme_dir }}
-          DKIM_DIR: ${{ matrix.dkim_dir }}
-          ZONE: ${{ matrix.zone_file }}
-        run: |
-          mkdir ~/.ssh
-          echo "${{ secrets.STAGING_SSH_KEY }}" >> ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan ${HOST} > ~/.ssh/known_hosts
-          # save previous acme & dkim state (trailing slash = copy contents)
-          rsync -avz root@${HOST}:/var/lib/acme/ ${ACME_DIR}/ || true
-          rsync -avz root@${HOST}:/etc/dkimkeys/ ${DKIM_DIR}/ || true
-          # backup to ns.testrun.org if contents are useful
-          if [ -f ${DKIM_DIR}/opendkim.private ]; then
-            rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" ${DKIM_DIR}/ root@ns.testrun.org:/tmp/${DKIM_DIR}/ || true
-          fi
-          if [ "$(ls -A ${ACME_DIR}/certs 2>/dev/null)" ]; then
-            rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" ${ACME_DIR}/ root@ns.testrun.org:/tmp/${ACME_DIR}/ || true
-          fi
-          # make sure CAA record isn't set
-          scp -o StrictHostKeyChecking=accept-new .github/workflows/${ZONE} root@ns.testrun.org:/etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org sed -i '/CAA/d' /etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org nsd-checkzone ${HOST} /etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org systemctl reload nsd
-
-      - name: rebuild VPS
-        env:
-          SERVER_ID: ${{ matrix.host == 'staging2.testrun.org' && secrets.STAGING_SERVER_ID || secrets.STAGING_IPV4_SERVER_ID }}
-        run: |
-          curl -X POST \
-            -H "Authorization: Bearer ${{ secrets.HETZNER_API_TOKEN }}" \
-            -H "Content-Type: application/json" \
-            -d '{"image":"debian-12"}' \
-            "https://api.hetzner.cloud/v1/servers/${SERVER_ID}/actions/rebuild"
-
-      - run: scripts/initenv.sh
-      - name: append venv/bin to PATH
-        run: echo venv/bin >>$GITHUB_PATH
-
-      - name: wait for VPS rebuild
-        id: wait-for-vps
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          rm ~/.ssh/known_hosts
-          while ! ssh -o ConnectTimeout=180 -o StrictHostKeyChecking=accept-new root@${HOST} id -u ; do sleep 1 ; done
-
-      - name: restore ACME/DKIM
-        env:
-          HOST: ${{ matrix.host }}
-          ACME_DIR: ${{ matrix.acme_dir }}
-          DKIM_DIR: ${{ matrix.dkim_dir }}
-        run: |
-          # download from ns.testrun.org
-          rsync -e "ssh -o StrictHostKeyChecking=accept-new" -avz root@ns.testrun.org:/tmp/${ACME_DIR}/ acme-restore/ || true
-          rsync -avz root@ns.testrun.org:/tmp/${DKIM_DIR}/ dkimkeys-restore/ || true
-          # restore to VPS
-          rsync -avz acme-restore/ root@${HOST}:/var/lib/acme/ || true
-          rsync -avz dkimkeys-restore/ root@${HOST}:/etc/dkimkeys/ || true
-          ssh root@${HOST} chown root:root -R /var/lib/acme || true
-
-      - name: bare offline tests
-        if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
-        run: pytest --pyargs cmdeploy
-
-      - name: bare deploy
-        if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
-        env:
-          HOST: ${{ matrix.host }}
-          DISABLE_IPV6: ${{ matrix.disable_ipv6 }}
-        run: |
-          ssh root@${HOST} 'apt update && apt install -y git python3.11-venv python3-dev gcc'
-          ssh root@${HOST} 'git clone https://github.com/chatmail/relay'
-          ssh root@${HOST} "cd relay && git checkout ${{ github.head_ref || github.ref_name }}"
-          ssh root@${HOST} 'cd relay && scripts/initenv.sh'
-          ssh root@${HOST} "cd relay && scripts/cmdeploy init ${HOST}"
-          if [ "${DISABLE_IPV6}" = "true" ]; then
-            ssh root@${HOST} "sed -i 's#disable_ipv6 = False#disable_ipv6 = True#' relay/chatmail.ini"
-          fi
-          ssh root@${HOST} "sed -i 's/#\s*mtail_address/mtail_address/' relay/chatmail.ini"
-          ssh root@${HOST} "cd relay && scripts/cmdeploy run --verbose --skip-dns-check --ssh-host localhost"
-
-      - name: bare DNS
-        if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
-        env:
-          HOST: ${{ matrix.host }}
-          ZONE: ${{ matrix.zone_file }}
-        run: |
-          ssh root@${HOST} chown opendkim:opendkim -R /etc/dkimkeys
-          ssh root@${HOST} "cd relay && scripts/cmdeploy dns --zonefile staging-generated.zone --ssh-host localhost"
-          ssh root@${HOST} cat relay/staging-generated.zone >> .github/workflows/${ZONE}
-          cat .github/workflows/${ZONE}
-          scp .github/workflows/${ZONE} root@ns.testrun.org:/etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org nsd-checkzone ${HOST} /etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org systemctl reload nsd
-
-      - name: bare integration tests
-        if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
-        env:
-          HOST: ${{ matrix.host }}
-        run: ssh root@${HOST} "cd relay && CHATMAIL_DOMAIN2=ci-chatmail.testrun.org scripts/cmdeploy test --slow --ssh-host localhost"
-
-      - name: bare final DNS check
-        if: github.ref == 'refs/heads/main' || github.event_name == 'pull_request'
-        env:
-          HOST: ${{ matrix.host }}
-        run: ssh root@${HOST} "cd relay && scripts/cmdeploy dns -v --ssh-host localhost"
-
-      # --- Docker deploy (push only, runs even if bare failed) ---
-
-      - name: stop bare services
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          ssh root@${HOST} 'systemctl stop postfix dovecot nginx opendkim unbound filtermail doveauth chatmail-metadata iroh-relay mtail fcgiwrap acmetool 2>/dev/null || true'
-
-      - name: install Docker on VPS
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          ssh root@${HOST} 'apt-get update && apt-get install -y ca-certificates curl'
-          ssh root@${HOST} 'install -m 0755 -d /etc/apt/keyrings'
-          ssh root@${HOST} 'curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc && chmod a+r /etc/apt/keyrings/docker.asc'
-          ssh root@${HOST} 'echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo $VERSION_CODENAME) stable" > /etc/apt/sources.list.d/docker.list'
-          ssh root@${HOST} 'apt-get update && apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin'
-
-      - name: prepare Docker bind mounts
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          ssh root@${HOST} 'mkdir -p /srv/chatmail/certs /srv/chatmail/dkim'
-          ssh root@${HOST} 'cp -a /var/lib/acme/. /srv/chatmail/certs/ && cp -a /etc/dkimkeys/. /srv/chatmail/dkim/' || true
-
-      - name: generate and upload chatmail.ini
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          cmdeploy init ${HOST}
-          sed -i 's/#\s*mtail_address/mtail_address/' chatmail.ini
-          scp chatmail.ini root@${HOST}:/srv/chatmail/chatmail.ini
-
-      - name: deploy with Docker
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          GHCR_IMAGE="${{ needs.build-docker.outputs.image }}"
-          rsync -avz --exclude='.git' --exclude='venv' --exclude='__pycache__' ./ root@${HOST}:/srv/chatmail/relay/
-          # Login to GHCR on VPS and pull pre-built image
-          echo "${{ secrets.GITHUB_TOKEN }}" | ssh root@${HOST} 'docker login ghcr.io -u ${{ github.actor }} --password-stdin'
-          ssh root@${HOST} "docker pull ${GHCR_IMAGE}"
-          ssh root@${HOST} "cd /srv/chatmail/relay && CHATMAIL_IMAGE=${GHCR_IMAGE} MAIL_DOMAIN=${HOST} docker compose -f docker-compose.yaml -f docker/docker-compose.ci.yaml up -d"
-
-      - name: wait for container healthy
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          # Stream journald inside the container
-          ssh root@${HOST} 'docker exec chatmail journalctl -f --no-pager' &
-          LOG_PID=$!
-          trap "kill $LOG_PID 2>/dev/null || true" EXIT
-          for i in $(seq 1 60); do
-            status=$(ssh root@${HOST} 'docker inspect --format={{.State.Health.Status}} chatmail 2>/dev/null' || echo "missing")
-            echo "  [$i/60] status=$status"
-            if [ "$status" = "healthy" ]; then
-              echo "Container is healthy."
-              exit 0
-            fi
-            if [ "$status" = "unhealthy" ]; then
-              echo "Container is unhealthy!"
-              break
-            fi
-            sleep 5
-          done
-          echo "Container did not become healthy."
-          kill $LOG_PID 2>/dev/null || true
-          echo "--- failed units ---"
-          ssh root@${HOST} 'docker exec chatmail systemctl --failed --no-pager' || true
-          echo "--- service logs ---"
-          ssh root@${HOST} 'docker exec chatmail journalctl -u dovecot -u postfix -u nginx -u unbound --no-pager -n 50' || true
-          echo "--- listening ports ---"
-          ssh root@${HOST} 'docker exec chatmail ss -tlnp' || true
-          echo "--- chatmail.ini ---"
-          ssh root@${HOST} 'docker exec chatmail cat /etc/chatmail/chatmail.ini' || true
-          exit 1
-
-      - name: show container state
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: |
-          echo "--- listening ports ---"
-          ssh root@${HOST} 'docker exec chatmail ss -tlnp'
-          echo "--- chatmail.ini ---"
-          ssh root@${HOST} 'docker exec chatmail cat /etc/chatmail/chatmail.ini'
-
-      - name: Docker offline tests
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        run: CHATMAIL_DOCKER=chatmail pytest --pyargs cmdeploy
-
-      - name: Docker DNS
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-          ZONE: ${{ matrix.zone_file }}
-        run: |
-          # Reset zone file in case bare DNS already appended to it
-          git checkout .github/workflows/${ZONE}
-          ssh root@${HOST} 'docker exec chatmail chown opendkim:opendkim -R /etc/dkimkeys'
-          ssh root@${HOST} 'docker exec chatmail cmdeploy dns --ssh-host @local --zonefile /opt/chatmail/staging.zone --verbose'
-          ssh root@${HOST} 'docker cp chatmail:/opt/chatmail/staging.zone /tmp/staging.zone'
-          scp root@${HOST}:/tmp/staging.zone staging-generated.zone
-          cat staging-generated.zone >> .github/workflows/${ZONE}
-          cat .github/workflows/${ZONE}
-          scp .github/workflows/${ZONE} root@ns.testrun.org:/etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org nsd-checkzone ${HOST} /etc/nsd/${HOST}.zone
-          ssh root@ns.testrun.org systemctl reload nsd
-
-      - name: Docker integration tests
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        run: CHATMAIL_DOCKER=chatmail CHATMAIL_DOMAIN2=ci-chatmail.testrun.org cmdeploy test --slow
-
-      - name: Docker final DNS check
-        if: >-
-          !cancelled() && github.event_name == 'push'
-          && steps.wait-for-vps.outcome == 'success'
-        env:
-          HOST: ${{ matrix.host }}
-        run: ssh root@${HOST} 'docker exec chatmail cmdeploy dns -v --ssh-host @local'
-
-      # --- Cleanup ---
-
-      - name: add SSH keys
-        if: >-
-          !cancelled() && matrix.add_ssh_keys
-          && steps.wait-for-vps.outcome == 'success'
-        run: ssh root@${{ matrix.host }} 'curl -s https://github.com/hpk42.keys https://github.com/j4n.keys >> .ssh/authorized_keys'

.github/workflows/test-and-deploy-ipv4only.yaml

@@ -0,0 +1,105 @@
+name: deploy on staging-ipv4.testrun.org, and run tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths-ignore:
+      - 'scripts/**'
+      - '**/README.md'
+      - 'CHANGELOG.md'
+      - 'LICENSE'
+
+jobs:
+  deploy:
+    name: deploy on staging-ipv4.testrun.org, and run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: staging-ipv4.testrun.org
+      url: https://staging-ipv4.testrun.org/
+    concurrency: staging-ipv4.testrun.org
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: prepare SSH
+        run: |
+          mkdir ~/.ssh
+          echo "${{ secrets.STAGING_SSH_KEY }}" >> ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan staging-ipv4.testrun.org > ~/.ssh/known_hosts
+          # save previous acme & dkim state
+          rsync -avz root@staging-ipv4.testrun.org:/var/lib/acme acme-ipv4 || true
+          rsync -avz root@staging-ipv4.testrun.org:/etc/dkimkeys dkimkeys-ipv4 || true
+          # store previous acme & dkim state on ns.testrun.org, if it contains useful certs
+          if [ -f dkimkeys-ipv4/dkimkeys/opendkim.private ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" dkimkeys-ipv4 root@ns.testrun.org:/tmp/ || true; fi
+          if [ "$(ls -A acme-ipv4/acme/certs)" ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" acme-ipv4 root@ns.testrun.org:/tmp/ || true; fi
+          # make sure CAA record isn't set
+          scp -o StrictHostKeyChecking=accept-new .github/workflows/staging-ipv4.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging-ipv4.testrun.org.zone
+          ssh root@ns.testrun.org sed -i '/CAA/d' /etc/nsd/staging-ipv4.testrun.org.zone
+          ssh root@ns.testrun.org nsd-checkzone staging-ipv4.testrun.org /etc/nsd/staging-ipv4.testrun.org.zone
+          ssh root@ns.testrun.org systemctl reload nsd
+
+      - name: rebuild staging-ipv4.testrun.org to have a clean VPS
+        run: |
+            curl -X POST \
+            -H "Authorization: Bearer ${{ secrets.HETZNER_API_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{"image":"debian-12"}' \
+            "https://api.hetzner.cloud/v1/servers/${{ secrets.STAGING_IPV4_SERVER_ID }}/actions/rebuild"
+
+      - run: scripts/initenv.sh
+
+      - name: append venv/bin to PATH
+        run: echo venv/bin >>$GITHUB_PATH
+
+      - name: upload TLS cert after rebuilding
+        run: |
+          echo " --- wait until staging-ipv4.testrun.org VPS is rebuilt --- "
+          rm ~/.ssh/known_hosts
+          while ! ssh -o ConnectTimeout=180 -o StrictHostKeyChecking=accept-new -v root@staging-ipv4.testrun.org id -u ; do sleep 1 ; done
+          ssh -o StrictHostKeyChecking=accept-new -v root@staging-ipv4.testrun.org id -u
+          # download acme & dkim state from ns.testrun.org
+          rsync -e "ssh -o StrictHostKeyChecking=accept-new" -avz root@ns.testrun.org:/tmp/acme-ipv4/acme acme-restore || true
+          rsync -avz root@ns.testrun.org:/tmp/dkimkeys-ipv4/dkimkeys dkimkeys-restore || true
+          # restore acme & dkim state to staging2.testrun.org
+          rsync -avz acme-restore/acme root@staging-ipv4.testrun.org:/var/lib/ || true
+          rsync -avz dkimkeys-restore/dkimkeys root@staging-ipv4.testrun.org:/etc/ || true
+          ssh -o StrictHostKeyChecking=accept-new -v root@staging-ipv4.testrun.org chown root:root -R /var/lib/acme || true
+
+      - name: run deploy-chatmail offline tests 
+        run: pytest --pyargs cmdeploy 
+
+      - name: setup dependencies
+        run: |
+          ssh root@staging-ipv4.testrun.org apt update
+          ssh root@staging-ipv4.testrun.org apt install -y git python3.11-venv python3-dev gcc
+          ssh root@staging-ipv4.testrun.org git clone https://github.com/chatmail/relay
+          ssh root@staging-ipv4.testrun.org "cd relay && git checkout " ${{ github.head_ref }}
+          ssh root@staging-ipv4.testrun.org "cd relay && scripts/initenv.sh"
+
+      - name: initialize config
+        run: |
+          ssh root@staging-ipv4.testrun.org "cd relay && scripts/cmdeploy init staging-ipv4.testrun.org"
+          ssh root@staging-ipv4.testrun.org "sed -i 's#disable_ipv6 = False#disable_ipv6 = True#' relay/chatmail.ini"
+          ssh root@staging-ipv4.testrun.org "sed -i 's/#\s*mtail_address/mtail_address/' relay/chatmail.ini"
+
+      - run: ssh root@staging-ipv4.testrun.org "cd relay && scripts/cmdeploy run --verbose --skip-dns-check --ssh-host localhost"
+
+      - name: set DNS entries
+        run: |
+          ssh root@staging-ipv4.testrun.org chown opendkim:opendkim -R /etc/dkimkeys
+          ssh root@staging-ipv4.testrun.org "cd relay && scripts/cmdeploy dns --zonefile staging-generated.zone --ssh-host localhost"
+          ssh root@staging-ipv4.testrun.org cat relay/staging-generated.zone >> .github/workflows/staging-ipv4.testrun.org-default.zone
+          cat .github/workflows/staging-ipv4.testrun.org-default.zone
+          scp .github/workflows/staging-ipv4.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging-ipv4.testrun.org.zone
+          ssh root@ns.testrun.org nsd-checkzone staging-ipv4.testrun.org /etc/nsd/staging-ipv4.testrun.org.zone
+          ssh root@ns.testrun.org systemctl reload nsd
+
+      - name: cmdeploy test
+        run: ssh root@staging-ipv4.testrun.org "cd relay && CHATMAIL_DOMAIN2=ci-chatmail.testrun.org scripts/cmdeploy test --slow --ssh-host localhost"
+
+      - name: cmdeploy dns
+        run: ssh root@staging-ipv4.testrun.org "cd relay && scripts/cmdeploy dns -v --ssh-host localhost"
+

.github/workflows/test-and-deploy.yaml

@@ -0,0 +1,98 @@
+name: deploy on staging2.testrun.org, and run tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths-ignore:
+      - 'scripts/**'
+      - '**/README.md'
+      - 'CHANGELOG.md'
+      - 'LICENSE'
+
+jobs:
+  deploy:
+    name: deploy on staging2.testrun.org, and run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: staging2.testrun.org
+      url: https://staging2.testrun.org/
+    concurrency: staging2.testrun.org
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: prepare SSH
+        run: |
+          mkdir ~/.ssh
+          echo "${{ secrets.STAGING_SSH_KEY }}" >> ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan staging2.testrun.org > ~/.ssh/known_hosts
+          # save previous acme & dkim state
+          rsync -avz root@staging2.testrun.org:/var/lib/acme . || true
+          rsync -avz root@staging2.testrun.org:/etc/dkimkeys . || true
+          # store previous acme & dkim state on ns.testrun.org, if it contains useful certs
+          if [ -f dkimkeys/opendkim.private ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" dkimkeys root@ns.testrun.org:/tmp/ || true; fi
+          if [ "$(ls -A acme/certs)" ]; then rsync -avz -e "ssh -o StrictHostKeyChecking=accept-new" acme root@ns.testrun.org:/tmp/ || true; fi
+          # make sure CAA record isn't set
+          scp -o StrictHostKeyChecking=accept-new .github/workflows/staging.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging2.testrun.org.zone
+          ssh root@ns.testrun.org sed -i '/CAA/d' /etc/nsd/staging2.testrun.org.zone
+          ssh root@ns.testrun.org nsd-checkzone staging2.testrun.org /etc/nsd/staging2.testrun.org.zone
+          ssh root@ns.testrun.org systemctl reload nsd
+
+      - name: rebuild staging2.testrun.org to have a clean VPS
+        run: |
+            curl -X POST \
+            -H "Authorization: Bearer ${{ secrets.HETZNER_API_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d '{"image":"debian-12"}' \
+            "https://api.hetzner.cloud/v1/servers/${{ secrets.STAGING_SERVER_ID }}/actions/rebuild"
+
+      - run: scripts/initenv.sh
+
+      - name: append venv/bin to PATH
+        run: echo venv/bin >>$GITHUB_PATH
+
+      - name: upload TLS cert after rebuilding
+        run: |
+          echo " --- wait until staging2.testrun.org VPS is rebuilt --- "
+          rm ~/.ssh/known_hosts
+          while ! ssh -o ConnectTimeout=180 -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org id -u ; do sleep 1 ; done
+          ssh -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org id -u
+          # download acme & dkim state from ns.testrun.org
+          rsync -e "ssh -o StrictHostKeyChecking=accept-new" -avz root@ns.testrun.org:/tmp/acme acme-restore || true
+          rsync -avz root@ns.testrun.org:/tmp/dkimkeys dkimkeys-restore || true
+          # restore acme & dkim state to staging2.testrun.org
+          rsync -avz acme-restore/acme root@staging2.testrun.org:/var/lib/ || true
+          rsync -avz dkimkeys-restore/dkimkeys root@staging2.testrun.org:/etc/ || true
+          ssh -o StrictHostKeyChecking=accept-new -v root@staging2.testrun.org chown root:root -R /var/lib/acme || true
+
+      - name: add hpk42 key to staging server
+        run: ssh root@staging2.testrun.org 'curl -s https://github.com/hpk42.keys >> .ssh/authorized_keys'
+
+      - name: run deploy-chatmail offline tests 
+        run: pytest --pyargs cmdeploy 
+
+      - run: |
+          cmdeploy init staging2.testrun.org
+          sed -i 's/#\s*mtail_address/mtail_address/' chatmail.ini
+
+      - run: cmdeploy run --verbose --skip-dns-check
+
+      - name: set DNS entries
+        run: |
+          ssh -o StrictHostKeyChecking=accept-new root@staging2.testrun.org chown opendkim:opendkim -R /etc/dkimkeys
+          cmdeploy dns --zonefile staging-generated.zone --verbose
+          cat staging-generated.zone >> .github/workflows/staging.testrun.org-default.zone
+          cat .github/workflows/staging.testrun.org-default.zone
+          scp .github/workflows/staging.testrun.org-default.zone root@ns.testrun.org:/etc/nsd/staging2.testrun.org.zone
+          ssh root@ns.testrun.org nsd-checkzone staging2.testrun.org /etc/nsd/staging2.testrun.org.zone
+          ssh root@ns.testrun.org systemctl reload nsd
+
+      - name: cmdeploy test
+        run: CHATMAIL_DOMAIN2=ci-chatmail.testrun.org cmdeploy test --slow
+
+      - name: cmdeploy dns
+        run: cmdeploy dns -v
+

.gitignore

@@ -164,9 +164,3 @@ cython_debug/
 #.idea/
 
 chatmail.zone
-
-# docker
-/data/
-/custom/
-docker-compose.override.yaml
-.env

chatmaild/src/chatmaild/fsreport.py

@@ -13,20 +13,9 @@ to show storage summaries only for first 1000 mailboxes
 
     python -m chatmaild.fsreport /path/to/chatmail.ini --maxnum 1000
 
-to write Prometheus textfile for node_exporter
-
-    python -m chatmaild.fsreport --textfile /var/lib/prometheus/node-exporter/
-
-writes to /var/lib/prometheus/node-exporter/fsreport.prom
-
-to also write legacy metrics.py style output (default: /var/www/html/metrics):
-
-    python -m chatmaild.fsreport --textfile /var/lib/prometheus/node-exporter/ --legacy-metrics
-
 """
 
 import os
-import tempfile
 from argparse import ArgumentParser
 from datetime import datetime
 
@@ -59,19 +48,7 @@ class Report:
         self.num_ci_logins = self.num_all_logins = 0
         self.login_buckets = {x: 0 for x in (1, 10, 30, 40, 80, 100, 150)}
 
-        KiB = 1024
-        MiB = 1024 * KiB
-        self.message_size_thresholds = (
-            0,
-            100 * KiB,
-            MiB // 2,
-            1 * MiB,
-            2 * MiB,
-            5 * MiB,
-            10 * MiB,
-        )
-        self.message_buckets = {x: 0 for x in self.message_size_thresholds}
-        self.message_count_buckets = {x: 0 for x in self.message_size_thresholds}
+        self.message_buckets = {x: 0 for x in (0, 160000, 500000, 2000000)}
 
     def process_mailbox_stat(self, mailbox):
         # categorize login times
@@ -91,10 +68,9 @@ class Report:
             for size in self.message_buckets:
                 for msg in mailbox.messages:
                     if msg.size >= size:
-                        if self.mdir and f"/{self.mdir}/" not in msg.path:
+                        if self.mdir and not msg.relpath.startswith(self.mdir):
                             continue
                         self.message_buckets[size] += msg.size
-                        self.message_count_buckets[size] += 1
 
         self.size_messages += sum(entry.size for entry in mailbox.messages)
         self.size_extra += sum(entry.size for entry in mailbox.extrafiles)
@@ -117,10 +93,9 @@ class Report:
 
         pref = f"[{self.mdir}] " if self.mdir else ""
         for minsize, sumsize in self.message_buckets.items():
-            count = self.message_count_buckets[minsize]
             percent = (sumsize / all_messages * 100) if all_messages else 0
             print(
-                f"{pref}larger than {HSize(minsize)}: {HSize(sumsize)} ({percent:.2f}%), {count} msgs"
+                f"{pref}larger than {HSize(minsize)}: {HSize(sumsize)} ({percent:.2f}%)"
             )
 
         user_logins = self.num_all_logins - self.num_ci_logins
@@ -136,75 +111,6 @@ class Report:
         for days, active in self.login_buckets.items():
             print(f"last {days:3} days: {HSize(active)} {p(active)}")
 
-    def _write_atomic(self, filepath, content):
-        """Atomically write content to filepath via tmp+rename."""
-        dirpath = os.path.dirname(os.path.abspath(filepath))
-        fd, tmppath = tempfile.mkstemp(dir=dirpath, suffix=".tmp")
-        try:
-            with os.fdopen(fd, "w") as f:
-                f.write(content)
-            os.chmod(tmppath, 0o644)
-            os.rename(tmppath, filepath)
-        except BaseException:
-            try:
-                os.unlink(tmppath)
-            except OSError:
-                pass
-            raise
-
-    def dump_textfile(self, filepath):
-        """Dump metrics in Prometheus exposition format."""
-        lines = []
-
-        lines.append("# HELP chatmail_storage_bytes Mailbox storage in bytes.")
-        lines.append("# TYPE chatmail_storage_bytes gauge")
-        lines.append(f'chatmail_storage_bytes{{kind="messages"}} {self.size_messages}')
-        lines.append(f'chatmail_storage_bytes{{kind="extra"}} {self.size_extra}')
-        total = self.size_extra + self.size_messages
-        lines.append(f'chatmail_storage_bytes{{kind="total"}} {total}')
-
-        lines.append("# HELP chatmail_messages_bytes Sum of msg bytes >= threshold.")
-        lines.append("# TYPE chatmail_messages_bytes gauge")
-        for minsize, sumsize in self.message_buckets.items():
-            lines.append(f'chatmail_messages_bytes{{min_size="{minsize}"}} {sumsize}')
-
-        lines.append("# HELP chatmail_messages_count Number of msgs >= size threshold.")
-        lines.append("# TYPE chatmail_messages_count gauge")
-        for minsize, count in self.message_count_buckets.items():
-            lines.append(f'chatmail_messages_count{{min_size="{minsize}"}} {count}')
-
-        lines.append("# HELP chatmail_accounts Number of accounts.")
-        lines.append("# TYPE chatmail_accounts gauge")
-        user_logins = self.num_all_logins - self.num_ci_logins
-        lines.append(f'chatmail_accounts{{kind="all"}} {self.num_all_logins}')
-        lines.append(f'chatmail_accounts{{kind="ci"}} {self.num_ci_logins}')
-        lines.append(f'chatmail_accounts{{kind="user"}} {user_logins}')
-
-        lines.append(
-            "# HELP chatmail_accounts_active Non-CI accounts active within N days."
-        )
-        lines.append("# TYPE chatmail_accounts_active gauge")
-        for days, active in self.login_buckets.items():
-            lines.append(f'chatmail_accounts_active{{days="{days}"}} {active}')
-
-        self._write_atomic(filepath, "\n".join(lines) + "\n")
-
-    def dump_compat_textfile(self, filepath):
-        """Dump legacy metrics.py style metrics."""
-        user_logins = self.num_all_logins - self.num_ci_logins
-        lines = [
-            "# HELP total number of accounts",
-            "# TYPE accounts gauge",
-            f"accounts {self.num_all_logins}",
-            "# HELP number of CI accounts",
-            "# TYPE ci_accounts gauge",
-            f"ci_accounts {self.num_ci_logins}",
-            "# HELP number of non-CI accounts",
-            "# TYPE nonci_accounts gauge",
-            f"nonci_accounts {user_logins}",
-        ]
-        self._write_atomic(filepath, "\n".join(lines) + "\n")
-
 
 def main(args=None):
     """Report about filesystem storage usage of all mailboxes and messages"""
@@ -221,21 +127,19 @@ def main(args=None):
         "--days",
         default=0,
         action="store",
-        help="assume date to be DAYS older than now",
+        help="assume date to be days older than now",
     )
     parser.add_argument(
         "--min-login-age",
         default=0,
-        metavar="DAYS",
         dest="min_login_age",
         action="store",
-        help="only sum up message size if last login is at least DAYS days old",
+        help="only sum up message size if last login is at least min-login-age days old",
     )
     parser.add_argument(
         "--mdir",
-        metavar="{cur,new,tmp}",
         action="store",
-        help="only consider messages in specified Maildir subdirectory for summary",
+        help="only consider 'cur' or 'new' or 'tmp' messages for summary",
     )
 
     parser.add_argument(
@@ -244,21 +148,6 @@ def main(args=None):
         action="store",
         help="maximum number of mailboxes to iterate on",
     )
-    parser.add_argument(
-        "--textfile",
-        metavar="PATH",
-        default=None,
-        help="write Prometheus textfile to PATH (directory or file); "
-        "if PATH is a directory, writes 'fsreport.prom' inside it",
-    )
-    parser.add_argument(
-        "--legacy-metrics",
-        metavar="FILENAME",
-        nargs="?",
-        const="/var/www/html/metrics",
-        default=None,
-        help="write legacy metrics.py textfile (default: /var/www/html/metrics)",
-    )
 
     args = parser.parse_args(args)
 
@@ -272,15 +161,7 @@ def main(args=None):
     rep = Report(now=now, min_login_age=int(args.min_login_age), mdir=args.mdir)
     for mbox in iter_mailboxes(str(config.mailboxes_dir), maxnum=maxnum):
         rep.process_mailbox_stat(mbox)
-    if args.textfile:
-        path = args.textfile
-        if os.path.isdir(path):
-            path = os.path.join(path, "fsreport.prom")
-        rep.dump_textfile(path)
-    if args.legacy_metrics:
-        rep.dump_compat_textfile(args.legacy_metrics)
-    if not args.textfile and not args.legacy_metrics:
-        rep.dump_summary()
+    rep.dump_summary()
 
 
 if __name__ == "__main__":

cmdeploy/src/cmdeploy/cmdeploy.py

@@ -108,7 +108,10 @@ def run_cmd(args, out):
     pyinf = "pyinfra --dry" if args.dry_run else "pyinfra"
 
     cmd = f"{pyinf} --ssh-user root {ssh_host} {deploy_path} -y"
-    if ssh_host == "localhost":
+    if ssh_host in ["localhost", "@docker"]:
+        if ssh_host == "@docker":
+            env["CHATMAIL_NOPORTCHECK"] = "True"
+            env["CHATMAIL_NOSYSCTL"] = "True"
         cmd = f"{pyinf} @local {deploy_path} -y"
 
     if version.parse(pyinfra.__version__) < version.parse("3"):
@@ -319,7 +322,7 @@ def add_ssh_host_option(parser):
     parser.add_argument(
         "--ssh-host",
         dest="ssh_host",
-        help="Run commands on 'localhost' or on a specific SSH host "
+        help="Run commands on 'localhost', via '@docker', or on a specific SSH host "
         "instead of chatmail.ini's mail_domain.",
     )
 
@@ -381,7 +384,9 @@ def get_parser():
 
 def get_sshexec(ssh_host: str, verbose=True):
     if ssh_host in ["localhost", "@local"]:
-        return LocalExec(verbose)
+        return LocalExec(verbose, docker=False)
+    elif ssh_host == "@docker":
+        return LocalExec(verbose, docker=True)
     if verbose:
         print(f"[ssh] login to {ssh_host}")
     return SSHExec(ssh_host, verbose=verbose)

cmdeploy/src/cmdeploy/dovecot/deployer.py

@@ -1,5 +1,4 @@
 import os
-import urllib.request
 
 from chatmaild.config import Config
 from pyinfra import host
@@ -52,21 +51,10 @@ class DovecotDeployer(Deployer):
         self.need_restart = False
 
 
-def _pick_url(primary, fallback):
-    try:
-        req = urllib.request.Request(primary, method="HEAD")
-        urllib.request.urlopen(req, timeout=10)
-        return primary
-    except Exception:
-        return fallback
-
-
 def _install_dovecot_package(package: str, arch: str):
     arch = "amd64" if arch == "x86_64" else arch
     arch = "arm64" if arch == "aarch64" else arch
-    primary_url = f"https://download.delta.chat/dovecot/dovecot-{package}_2.3.21%2Bdfsg1-3_{arch}.deb"
-    fallback_url = f"https://github.com/chatmail/dovecot/releases/download/upstream%2F2.3.21%2Bdfsg1/dovecot-{package}_2.3.21%2Bdfsg1-3_{arch}.deb"
-    url = _pick_url(primary_url, fallback_url)
+    url = f"https://download.delta.chat/dovecot/dovecot-{package}_2.3.21%2Bdfsg1-3_{arch}.deb"
     deb_filename = "/root/" + url.split("/")[-1]
 
     match (package, arch):

cmdeploy/src/cmdeploy/filtermail/deployer.py

@@ -14,10 +14,10 @@ class FiltermailDeployer(Deployer):
 
     def install(self):
         arch = host.get_fact(facts.server.Arch)
-        url = f"https://github.com/chatmail/filtermail/releases/download/v0.5.2/filtermail-{arch}"
+        url = f"https://github.com/chatmail/filtermail/releases/download/v0.5.1/filtermail-{arch}"
         sha256sum = {
-            "x86_64": "ce24ca0075aa445510291d775fb3aea8f4411818c7b885ae51a0fe18c5f789ce",
-            "aarch64": "c5d783eefa5332db3d97a0e6a23917d72849e3eb45da3d16ce908a9b4e5a797d",
+            "x86_64": "adce2ddb461c5fd744df699f3b0b3c33b6d52413c641f18695b93826e5e0d234",
+            "aarch64": "b51cf4248c6c443308f21b1811da1cc919b98b719a2138f4b60940ea093a5422",
         }[arch]
         self.need_restart |= files.download(
             name="Download filtermail",

cmdeploy/src/cmdeploy/opendkim/deployer.py

@@ -103,13 +103,6 @@ class OpendkimDeployer(Deployer):
         )
         need_restart |= service_file.changed
 
-        files.file(
-            name="chown opendkim: /etc/dkimkeys/opendkim.private",
-            path="/etc/dkimkeys/opendkim.private",
-            user="opendkim",
-            group="opendkim",
-        )
-
         self.need_restart = need_restart
 
     def activate(self):

cmdeploy/src/cmdeploy/service/chatmail-fsreport.service.f

@@ -5,5 +5,5 @@ After=network.target
 [Service]
 Type=oneshot
 User=vmail
-ExecStart=/usr/local/lib/chatmaild/venv/bin/chatmail-fsreport /usr/local/lib/chatmaild/chatmail.ini
+ExecStart=/usr/local/lib/chatmaild/venv/bin/chatmail-fsreport /usr/local/lib/chatmaild/chatmail.ini 
 

cmdeploy/src/cmdeploy/sshexec.py

@@ -50,9 +50,6 @@ class SSHExec:
     FuncError = FuncError
 
     def __init__(self, host, verbose=False, python="python3", timeout=60):
-        docker_container = os.environ.get("CHATMAIL_DOCKER")
-        if docker_container:
-            python = f"docker exec -i {docker_container} python3"
         self.gateway = execnet.makegateway(f"ssh=root@{host}//python={python}")
         self._remote_cmdloop_channel = bootstrap_remote(self.gateway, remote)
         self.timeout = timeout
@@ -90,8 +87,9 @@ class SSHExec:
 class LocalExec:
     FuncError = FuncError
 
-    def __init__(self, verbose=False):
+    def __init__(self, verbose=False, docker=False):
         self.verbose = verbose
+        self.docker = docker
 
     def __call__(self, call, kwargs=None, log_callback=None):
         if kwargs is None:
@@ -103,6 +101,10 @@ class LocalExec:
         if not title:
             title = call.__name__
         where = "locally"
+        if self.docker:
+            if call == remote.rdns.perform_initial_checks:
+                kwargs["pre_command"] = "docker exec chatmail "
+                where = "in docker"
         if self.verbose:
             print_stderr(f"Running {where}: {title}(**{kwargs})")
             return self(call, kwargs, log_callback=print_stderr)

cmdeploy/src/cmdeploy/tests/plugin.py

@@ -402,9 +402,6 @@ class Remote:
             case "@local": command = []
             case "localhost": command = []
             case _: command = ["ssh", f"root@{self.sshdomain}"]
-        docker_container = os.environ.get("CHATMAIL_DOCKER")
-        if docker_container:
-            command += ["docker", "exec", docker_container]
         [command.append(arg) for arg in getjournal.split()]
         self.popen = subprocess.Popen(
             command,

doc/source/docker.rst

@@ -1,266 +0,0 @@
-Docker installation
-===================
-
-This section provides instructions for installing a chatmail relay
-using Docker Compose.
-
-.. note::
-
-    - Docker support is experimental, CI builds and tests the image automatically, but please report bugs.
-    - The image wraps the cmdeploy process detailed in the :doc:`getting_started` instructions in a Debian-systemd image with r/w access to `/sys/fs`
-    - Currently amd64-only (arm64 should work but is untested).
-
-
-Setup Preparation
------------------
-
-We use ``chat.example.org`` as the chatmail domain in the following
-steps. Please substitute it with your own domain.
-
-1. Install docker and docker compose v2 (check with `docker compose version`), install, e.g., through
-    - Debian 12 through the `official install instructions <https://docs.docker.com/engine/install/debian/#install-using-the-repository>`_
-    - Debian 13+ with `apt install docker docker-compose`
-
-   If you must use v1 (EOL since 2023), use `docker-compose` in the following and modify the `docker-compose.yaml` to use `privileged: true` instead of `cgroup: host`, though that gives the container full privileges.
-
-2. Setup the initial DNS records.
-   The following is an example in the familiar BIND zone file format with
-   a TTL of 1 hour (3600 seconds).
-   Please substitute your domain and IP addresses.
-
-   ::
-
-       chat.example.org. 3600 IN A 198.51.100.5
-       chat.example.org. 3600 IN AAAA 2001:db8::5
-       www.chat.example.org. 3600 IN CNAME chat.example.org.
-       mta-sts.chat.example.org. 3600 IN CNAME chat.example.org.
-
-3. Configure kernel parameters on the host, as these can not be set from the container::
-
-       echo "fs.inotify.max_user_instances=65536" | sudo tee -a /etc/sysctl.d/99-inotify.conf
-       echo "fs.inotify.max_user_watches=65536" | sudo tee -a /etc/sysctl.d/99-inotify.conf
-       sudo sysctl --system
-
-
-Docker Compose Setup
---------------------
-
-Pre-built images are available from GitHub Container Registry. The
-``main`` branch and tagged releases are pushed automatically by CI::
-
-    docker pull ghcr.io/chatmail/relay:main      # latest main branch
-    docker pull ghcr.io/chatmail/relay:1.2.3     # tagged release
-
-
-Create service directory
-^^^^^^^^^^^^^^^^^^^^^^^^
-
-Either:
-
-- Create a service directory, e.g., `/srv/chatmail-relay`::
-
-    mkdir -p /srv/chatmail-relay && cd /srv/chatmail-relay
-    wget https://raw.githubusercontent.com/chatmail/relay/refs/heads/main/docker-compose.yaml
-    wget https://raw.githubusercontent.com/chatmail/relay/refs/heads/main/docker-compose.override.yaml.example -O docker-compose.override.yaml
-
-- or clone the chatmail repo ::
-
-   git clone https://github.com/chatmail/relay
-   cd relay
-
-
-Customize and start
-^^^^^^^^^^^^^^^^^^^
-
-1. Set the fully qualified domain name of the relay::
-
-       echo 'MAIL_DOMAIN=chat.example.org' > .env
-
-   The container generates a ``chatmail.ini`` with defaults from
-   ``MAIL_DOMAIN`` on first start. To customize chatmail settings, mount
-   your own ``chatmail.ini`` instead (see `Custom chatmail.ini`_ below).
-
-2. All local customizations (data paths, extra volumes, config mounts) go in
-   ``docker-compose.override.yaml``, which Compose merges automatically with
-   the base file. By default, all data is stored in docker volumes, you will
-   likely want to at least create and configure the mail storage location, but
-   you might also want to configure external TLS certificates there.
-
-3. Start the container::
-
-       docker compose up -d
-       docker compose logs -f chatmail   # view logs, Ctrl+C to exit
-
-4. After installation is complete, open ``https://chat.example.org`` in
-   your browser.
-
-Finish install and test
------------------------
-
-You can test the installation with::
-
-        pip install cmping chat.example.org # or
-        uvx cmping chat.example.org # if you use https://docs.astral.sh/uv/
-
-You should check and extend your DNS records for better interoperability::
-
-    # Show required DNS records
-    docker exec chatmail cmdeploy dns --ssh-host @local
-
-You can check server status with::
-
-    docker exec chatmail cmdeploy status --ssh-host @local
-
-You can run some benchmarks (can also run from any machine with cmdeploy installed)::
-
-    docker exec chatmail cmdeploy bench
-
-You can run the test suite with::
-
-    docker exec chatmail cmdeploy test --ssh-host localhost
-
-You can look at logs::
-
-    docker exec chatmail journalctl -fu postfix@-
-
-
-Customization
--------------
-
-Website
-^^^^^^^^^^^^^^
-
-You can customize the chatmail landing page by mounting a directory with
-your own website source files.
-
-1. Create a directory with your custom website source::
-
-       mkdir -p ./custom/www/src
-       nano ./custom/www/src/index.md
-
-2. Add the volume mount in ``docker-compose.override.yaml``::
-
-       services:
-         chatmail:
-           volumes:
-             - ./custom/www:/opt/chatmail-www
-
-3. Restart the service::
-
-       docker compose down
-       docker compose up -d
-
-
-Custom chatmail.ini
-^^^^^^^^^^^^^^^^^^^
-
-If you want to go beyond simply setting the ``MAIL_DOMAIN`` in ``.env``, you
-can use a regular `chatmail.ini` to give you full control.
-
-1. Extract the generated config from a running container::
-
-       docker cp chatmail:/etc/chatmail/chatmail.ini ./chatmail.ini
-
-2. Edit ``chatmail.ini`` as needed.
-
-3. Add the volume mount in ``docker-compose.override.yaml`` ::
-
-       services:
-         chatmail:
-           volumes:
-             - ./chatmail.ini:/etc/chatmail/chatmail.ini
-
-4. Restart the container, the container skips generating a new one: ::
-
-       docker compose down && docker compose up -d
-
-
-External TLS certificates
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-If TLS certificates are managed outside the container (e.g. by certbot,
-acmetool, or Traefik on the host), mount them into the container and set
-``TLS_EXTERNAL_CERT_AND_KEY`` in ``docker-compose.override.yaml``.
-Changed certificates are picked up automatically via inotify.
-See the examples in the example override and :ref:`external-tls` in the getting started guide for details.
-
-
-Migrating from a bare-metal install
-------------------------------------
-
-If you have an existing bare-metal chatmail installation and want to
-switch to Docker:
-
-1. Stop all existing services::
-
-       systemctl stop postfix dovecot doveauth nginx opendkim unbound \
-         acmetool-redirector filtermail filtermail-incoming chatmail-turn \
-         iroh-relay chatmail-metadata lastlogin mtail
-       systemctl disable postfix dovecot doveauth nginx opendkim unbound \
-         acmetool-redirector filtermail filtermail-incoming chatmail-turn \
-         iroh-relay chatmail-metadata lastlogin mtail
-
-2. Copy your existing ``chatmail.ini`` and mount it into the container
-   (see `Custom chatmail.ini`_ above)::
-
-       cp /usr/local/lib/chatmaild/chatmail.ini ./chatmail.ini
-
-3. Copy persistent data into the ``./data/`` subdirectories (for example, as configured in `Customize and start`_) ::
-
-       mkdir -p data/dkim data/certs data/mail
-
-       # DKIM keys
-       cp -a /etc/dkimkeys/* data/dkim/
-
-       # TLS certificates
-       rsync -a /var/lib/acme/ data/certs/
-
-   Note that ownership of dkim and acme is adjusted on container start.
-
-   For the mail directory::
-
-       rsync -a /home/vmail/ data/mail/
-
-   Alternatively, mount ``/home/vmail`` directly by changing the volume
-   in ``docker-compose-override.yaml``::
-
-       - /home/vmail:/home/vmail
-
-   The three ``./data/`` subdirectories cover all persistent state.
-   Everything else is regenerated by the ``configure`` and ``activate``
-   stages on container start.
-
-Building the image
-------------------
-
-Clone the repository and build the Docker image::
-
-    git clone https://github.com/chatmail/relay
-    cd relay
-    docker/build.sh
-
-The build bakes all binaries, Python packages, and the install stage
-into the image. After building, only ``docker-compose.yaml`` and a ``.env``
-with ``MAIL_DOMAIN`` are needed to run the container. The `build.sh` passes the
-git hash onto the docker build so it can be determined if there has been a
-change that warrants a redeploy.
-
-You can transfer a locally built image to your server directly (pigz is parallel `gzip` which can be used instead as well) ::
-
-    docker save chatmail-relay:latest | pigz | ssh chat.example.org 'pigz -d | docker load'
-
-
-Forcing a full reinstall
-------------------------
-
-On container start, only the ``configure`` and ``activate`` stages run by default.
-
-To force a full reinstall (e.g. after updating the source), either
-rebuild the image::
-
-    docker compose build chatmail
-    docker compose up -d
-
-Or override the stages at runtime without rebuilding::
-
-    CMDEPLOY_STAGES="install,configure,activate" docker compose up -d

doc/source/getting_started.rst

@@ -98,12 +98,6 @@ steps. Please substitute it with your own domain.
    configure at your DNS provider (it can take some time until they are
    public).
 
-Docker installation
--------------------
-
-There is experimental support for running chatmail via Docker Compose.
-See :doc:`docker` for full setup instructions.
-
 Other helpful commands
 ----------------------
 

doc/source/index.rst

@@ -13,7 +13,6 @@ Contributions and feedback welcome through the https://github.com/chatmail/relay
     :maxdepth: 5
 
     getting_started
-    docker
     proxy
     migrate
     overview

docker-compose.override.yaml.example

@@ -1,44 +0,0 @@
-# Local overrides: copy to docker-compose.override.yaml in the repo root.
-# Compose automatically merges this with docker-compose.yaml.
-#
-#   cp docker-compose.override.yaml.example docker-compose.override.yaml
-#
-# Volumes are APPENDED to the base file's volumes list, environment and other scalar keys are MERGED by key.
-services:
-  chatmail:
-    volumes:
-      ## Data paths — bind-mount to host directories for easy access/backup.
-
-      # - ./data/dkim:/etc/dkimkeys
-      # - ./data/certs:/var/lib/acme
-
-      # - ./data/mail:/home/vmail
-      ## Or mount from an existing bare-metal install.
-      # - /home/vmail:/home/vmail
-
-      ## Mount your own chatmail.ini (skips auto-generation):
-      # - ./chatmail.ini:/etc/chatmail/chatmail.ini
-
-      ## Custom website:
-      # - ./custom/www:/opt/chatmail-www
-
-      ## Debug — mount scripts from the repo for live editing:
-      # - ./docker/chatmail-init.sh:/chatmail-init.sh
-      # - ./docker/entrypoint.sh:/entrypoint.sh
-
-    # environment:
-      ## Mount certs (above) and set TLS_EXTERNAL_CERT_AND_KEY to in-container paths.
-      ## A tls-cert-reload.path watcher inside the container reloads services
-      ## when the cert file changes. However, inotify does not cross bind-mount
-      ## boundaries, so host-side renewals (certbot, acmetool, etc.) must
-      ## notify the container explicitly. Add this to your renewal hook:
-      ##
-      ##   docker exec chatmail systemctl start tls-cert-reload.service
-      ##
-      ## Host acmetool (bare-metal migration): create mount above, and
-      ##   rsync -a /var/lib/acme/live data/certs
-      # TLS_EXTERNAL_CERT_AND_KEY: "/var/lib/acme/live/${MAIL_DOMAIN}/fullchain /var/lib/acme/live/${MAIL_DOMAIN}/privkey"
-      ##
-      ## (Untested) Traefik certs-dumper (see docker/docker-compose-traefik.yaml) - also add volume:
-      ##   - traefik-certs:/certs:ro
-      # TLS_EXTERNAL_CERT_AND_KEY: "/certs/${MAIL_DOMAIN}/certificate.crt /certs/${MAIL_DOMAIN}/privatekey.key"

docker-compose.yaml

@@ -1,48 +0,0 @@
-# Base compose file — do not edit. Put customizations (data paths, extra
-# volumes, env overrides) in docker-compose.override.yaml instead.
-# See docker/docker-compose.override.yaml.example for a starting point.
-#
-# Security notes: this container uses 
-#  - network_mode:host chatmail needs many ports (25, 53, 80, 143, 443, 465,
-#  587, 993, 3340, 8443) and needs to operate from the real IP, which bridging
-#  would make tricky
-#  - cgroup:host (required for systemd). 
-#  Together these give the container near-host-level access. This is acceptable
-#  for a dedicated mail server, but be aware that the container can bind any
-#  port and see all host network traffic.
-
-services:
-  chatmail:
-    build:
-      context: ./
-      dockerfile: docker/chatmail_relay.dockerfile
-      args:
-        GIT_HASH: ${GIT_HASH:-unknown}
-    image: chatmail-relay:latest
-    restart: unless-stopped
-    container_name: chatmail
-    # Required for systemd — use only one of the following:
-    cgroup: host          # compose v2
-    # privileged: true    # compose v1 (less restricted)
-    tty: true # required for logs
-    tmpfs: # required for systemd
-      - /tmp
-      - /run
-      - /run/lock
-    logging:
-      driver: none
-    environment:
-      MAIL_DOMAIN: $MAIL_DOMAIN
-    network_mode: "host"
-    volumes:
-      ## system (required)
-      - /sys/fs/cgroup:/sys/fs/cgroup:rw
-      ## data (defaults — override in docker-compose.override.yaml)
-      - mail:/home/vmail
-      - dkim:/etc/dkimkeys
-      - certs:/var/lib/acme
-
-volumes:
-  mail:
-  dkim:
-  certs:

docker/build.sh

@@ -1,9 +0,0 @@
-#!/bin/sh
-# Build the chatmail Docker image with the current git hash baked in.
-# Usage: ./docker/build.sh [extra docker-compose build args...]
-#
-# .git/ is excluded from the build context (.dockerignore) so the hash
-# must be passed as a build arg from the host.
-
-export GIT_HASH=$(git rev-parse HEAD)
-exec docker compose build "$@"

docker/chatmail-init.service

@@ -1,14 +0,0 @@
-[Unit]
-Description=Run container setup commands
-After=multi-user.target
-ConditionPathExists=/chatmail-init.sh
-
-[Service]
-Type=oneshot
-ExecStart=/bin/bash /chatmail-init.sh
-RemainAfterExit=true
-WorkingDirectory=/opt/chatmail
-PassEnvironment=<envs_list>
-
-[Install]
-WantedBy=multi-user.target

docker/chatmail-init.sh

@@ -1,87 +0,0 @@
-#!/bin/bash
-
-set -euo pipefail
-export CHATMAIL_INI="${CHATMAIL_INI:-/etc/chatmail/chatmail.ini}"
-export CHATMAIL_NOSYSCTL=True
-export CHATMAIL_NOPORTCHECK=True
-
-CMDEPLOY=/opt/cmdeploy/bin/cmdeploy
-
-if [ -z "$MAIL_DOMAIN" ]; then
-    echo "ERROR: Environment variable 'MAIL_DOMAIN' must be set!" >&2
-    exit 1
-fi
-
-# Generate DKIM keys if not mounted
-if [ ! -f /etc/dkimkeys/opendkim.private ]; then
-    /usr/sbin/opendkim-genkey -D /etc/dkimkeys -d "$MAIL_DOMAIN" -s opendkim
-fi
-# Fix ownership for bind-mounted keys (host opendkim UID may differ from container)
-chown -R opendkim:opendkim /etc/dkimkeys
-
-# Create chatmail.ini, skip if mounted
-mkdir -p "$(dirname "$CHATMAIL_INI")"
-if [ ! -f "$CHATMAIL_INI" ]; then
-    $CMDEPLOY init --config "$CHATMAIL_INI" "$MAIL_DOMAIN"
-fi
-
-# Auto-detect IPv6: if the host has no IPv6 connectivity, set disable_ipv6
-# in the ini so dovecot/postfix/nginx bind to IPv4 only.
-# Uses network_mode:host so /proc/net/if_inet6 reflects the host's stack.
-if [ ! -e /proc/net/if_inet6 ]; then
-    if grep -q '^disable_ipv6 = False' "$CHATMAIL_INI"; then
-        sed -i 's/^disable_ipv6 = False/disable_ipv6 = True/' "$CHATMAIL_INI"
-        echo "[INFO] IPv6 not available, set disable_ipv6 = True"
-    fi
-fi
-
-# Inject external TLS paths from env var unless defined in chatmail.ini
-if [ -n "${TLS_EXTERNAL_CERT_AND_KEY:-}" ]; then
-    if ! grep -q '^tls_external_cert_and_key' "$CHATMAIL_INI"; then
-        echo "tls_external_cert_and_key = $TLS_EXTERNAL_CERT_AND_KEY" >> "$CHATMAIL_INI"
-    fi
-fi
-
-# Ensure mailboxes directory exists (chatmail-metadata needs it at startup,
-# but Dovecot only creates it on first mail delivery)
-mkdir -p "/home/vmail/mail/${MAIL_DOMAIN}"
-chown vmail:vmail "/home/vmail/mail/${MAIL_DOMAIN}"
-
-# --- Deploy fingerprint: skip cmdeploy run if nothing changed ---
-# On restart with identical image+config, systemd already brings up all
-# enabled services only configure+activate are needed here.
-IMAGE_VERSION_FILE="/etc/chatmail-image-version"
-FINGERPRINT_FILE="/etc/chatmail/.deploy-fingerprint"
-image_ver="none"
-[ -f "$IMAGE_VERSION_FILE" ] && image_ver=$(cat "$IMAGE_VERSION_FILE")
-config_hash=$(sha256sum "$CHATMAIL_INI" | cut -c1-16)
-current_fp="${image_ver}:${config_hash}"
-
-# CMDEPLOY_STAGES non-empty in env = operator override -> always run.
-# Otherwise, if fingerprint matches the last successful deploy, skip.
-if [ -z "${CMDEPLOY_STAGES:-}" ] \
-    && [ -f "$FINGERPRINT_FILE" ] \
-    && [ "$(cat "$FINGERPRINT_FILE")" = "$current_fp" ]; then
-    echo "[INFO] No changes detected ($current_fp), skipping deploy."
-else
-    export CMDEPLOY_STAGES="${CMDEPLOY_STAGES:-configure,activate}"
-
-    # Skip DNS check when MAIL_DOMAIN is a bare IP address
-    SKIP_DNS=""
-    if [[ "$MAIL_DOMAIN" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || [[ "$MAIL_DOMAIN" =~ : ]]; then
-        SKIP_DNS="--skip-dns-check"
-    fi
-    $CMDEPLOY run --config "$CHATMAIL_INI" --ssh-host @local $SKIP_DNS
-
-    # Restore the build-time hash
-    cp /etc/chatmail-image-version /etc/chatmail-version
-    echo "$current_fp" > "$FINGERPRINT_FILE"
-fi
-
-# Signal success to Docker healthcheck
-touch /run/chatmail-init.done
-
-# Forward journald to console so `docker compose logs` works
-grep -q '^ForwardToConsole=yes' /etc/systemd/journald.conf \
-    || echo "ForwardToConsole=yes" >> /etc/systemd/journald.conf
-systemctl restart systemd-journald

docker/chatmail_relay.dockerfile

@@ -1,101 +0,0 @@
-# syntax=docker/dockerfile:1
-FROM jrei/systemd-debian:12 AS base
-
-ENV LANG=en_US.UTF-8
-
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
-    echo 'APT::Install-Recommends "0";' > /etc/apt/apt.conf.d/01norecommend && \
-    echo 'APT::Install-Suggests "0";' >> /etc/apt/apt.conf.d/01norecommend && \
-    apt-get update && \
-    DEBIAN_FRONTEND=noninteractive TZ=UTC \
-    apt-get install -y \
-        ca-certificates \
-        gcc \
-        git \
-        python3 \
-        python3-dev \
-        python3-venv \
-        tzdata \
-        locales && \
-    sed -i -e "s/# $LANG.*/$LANG UTF-8/" /etc/locale.gen && \
-    dpkg-reconfigure --frontend=noninteractive locales && \
-    update-locale LANG=$LANG
-
-# --- Build-time: install cmdeploy venv and run install stage ---
-# Editable install so importlib.resources reads directly from the source tree.
-# On container start only "configure,activate" stages run.
-
-# Copy dependency metadata first so pip install layer is cached
-COPY cmdeploy/pyproject.toml /opt/chatmail/cmdeploy/pyproject.toml
-COPY chatmaild/pyproject.toml /opt/chatmail/chatmaild/pyproject.toml
-
-# Dummy scaffolding so editable install can discover packages
-RUN mkdir -p /opt/chatmail/cmdeploy/src/cmdeploy \
-             /opt/chatmail/chatmaild/src/chatmaild && \
-    touch /opt/chatmail/cmdeploy/src/cmdeploy/__init__.py \
-          /opt/chatmail/chatmaild/src/chatmaild/__init__.py
-
-# Dummy git repo: .git/ is excluded from the build context (.dockerignore)
-# but setuptools calls `git ls-files` when building the sdist.
-WORKDIR /opt/chatmail
-RUN --mount=type=cache,target=/root/.cache/pip \
-    git init -q && \
-    python3 -m venv /opt/cmdeploy && \
-    /opt/cmdeploy/bin/pip install -e chatmaild/ -e cmdeploy/
-
-# Full source copy (editable install's .egg-link still points here)
-COPY . /opt/chatmail/
-
-# Minimal chatmail.ini
-RUN printf '[params]\nmail_domain = build.local\n' > /tmp/chatmail.ini
-
-RUN CMDEPLOY_STAGES=install \
-    CHATMAIL_INI=/tmp/chatmail.ini \
-    CHATMAIL_NOSYSCTL=True \
-    CHATMAIL_NOPORTCHECK=True \
-    /opt/cmdeploy/bin/pyinfra @local \
-        /opt/chatmail/cmdeploy/src/cmdeploy/run.py -y
-
-RUN cp -a www/ /opt/chatmail-www/
-
-# Remove build-only packages and their deps — not needed at runtime
-RUN apt-get purge -y gcc git python3-dev && \
-    apt-get autoremove -y && \
-    rm -f /tmp/chatmail.ini
-
-# Record image version (used in deploy fingerprint at runtime).
-# GIT_HASH is passed as a build arg (from docker-compose or CI) so that
-# .git/ can be excluded from the build context via .dockerignore.
-# Two files: chatmail-image-version is the immutable build hash (survives
-# deploys); chatmail-version is overwritten by cmdeploy run and restored
-# from the image version after each deploy in chatmail-init.sh.
-ARG GIT_HASH=unknown
-RUN echo "$GIT_HASH" > /etc/chatmail-image-version && \
-    echo "$GIT_HASH" > /etc/chatmail-version
-# --- End build-time install ---
-
-ENV TZ=:/etc/localtime
-ENV PATH="/opt/cmdeploy/bin:${PATH}"
-RUN ln -s /etc/chatmail/chatmail.ini /opt/chatmail/chatmail.ini
-
-ARG CHATMAIL_INIT_SERVICE_PATH=/lib/systemd/system/chatmail-init.service
-COPY ./docker/chatmail-init.service "$CHATMAIL_INIT_SERVICE_PATH"
-RUN ln -sf "$CHATMAIL_INIT_SERVICE_PATH" "/etc/systemd/system/multi-user.target.wants/chatmail-init.service"
-
-# Remove default nginx site config at build time (not in entrypoint)
-RUN rm -f /etc/nginx/sites-enabled/default
-
-COPY --chmod=555 ./docker/chatmail-init.sh /chatmail-init.sh
-COPY --chmod=555 ./docker/entrypoint.sh /entrypoint.sh
-COPY --chmod=555 ./docker/healthcheck.sh /healthcheck.sh
-
-HEALTHCHECK --interval=10s --start-period=180s --timeout=10s --retries=3 \
-  CMD /healthcheck.sh
-
-STOPSIGNAL SIGRTMIN+3
-
-ENTRYPOINT ["/entrypoint.sh"]
-
-CMD [   "--default-standard-output=journal+console", \
-        "--default-standard-error=journal+console" ]

docker/docker-compose.ci.yaml

@@ -1,11 +0,0 @@
-# Used by .github/workflows/docker-ci.yaml
-# The GHCR image is set via CHATMAIL_IMAGE env var at deploy time.
-services:
-  chatmail:
-    image: ${CHATMAIL_IMAGE:-chatmail-relay:latest}
-    volumes:
-      - /srv/chatmail/chatmail.ini:/etc/chatmail/chatmail.ini
-      - /srv/chatmail/dkim:/etc/dkimkeys
-      - /srv/chatmail/certs:/var/lib/acme
-    environment:
-      TLS_EXTERNAL_CERT_AND_KEY: /var/lib/acme/live/${MAIL_DOMAIN}/fullchain /var/lib/acme/live/${MAIL_DOMAIN}/privkey

docker/entrypoint.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-set -eo pipefail
-
-CHATMAIL_INIT_SERVICE_PATH="${CHATMAIL_INIT_SERVICE_PATH:-/lib/systemd/system/chatmail-init.service}"
-
-env_vars="MAIL_DOMAIN CMDEPLOY_STAGES CHATMAIL_INI TLS_EXTERNAL_CERT_AND_KEY PATH"
-sed -i "s|<envs_list>|$env_vars|g" "$CHATMAIL_INIT_SERVICE_PATH"
-
-exec /lib/systemd/systemd "$@"

docker/healthcheck.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-# returns 0 when chatmail-init succeeded and all expected services are running.
-
-set -e
-
-test -f /run/chatmail-init.done
-
-# Core services
-services="chatmail-metadata doveauth dovecot filtermail filtermail-incoming nginx postfix unbound"
-
-# Optional services
-for svc in iroh-relay turnserver; do
-    systemctl is-enabled "$svc" 2>/dev/null && services="$services $svc"
-done
-
-exec systemctl is-active $services

env.example

@@ -1 +0,0 @@
-MAIL_DOMAIN=chat.example.com