mirror of
https://github.com/chatmail/relay.git
synced 2026-05-10 16:04:37 +00:00
40051f7ac3
Add container-based deployment as an alternative to bare-metal pyinfra. - systemd inside container reusing the existing deployer infrastructure - chatmail-init.sh runs `cmdeploy run --ssh-host @local` on first boot, so the container self-deploys using the same code path as bare-metal - Config via MAIL_DOMAIN env var (simple) or mounted chatmail.ini (advanced) - External TLS support via TLS_EXTERNAL_CERT_AND_KEY for reverse proxy setups - Image version tracking in /etc/chatmail-image-version for upgrade detection - .git/ excluded, but version file mocked so git revparse still works - Health check verifies postfix, dovecot, and nginx are listening Files added: - docker/chatmail_relay.dockerfile: multi-stage build (build + runtime) - docker/chatmail-init.sh: first-boot deployment script - docker/chatmail-init.service: systemd unit for init script - docker/entrypoint.sh: container entrypoint (starts systemd) - docker/healthcheck.sh: container health check - docker/docker-compose.yaml: main compose config - docker/docker-compose.ci.yaml: CI override (uses GHCR image) - docker/docker-compose.override.yaml.example: customization template - docker/build.sh: helper script - doc/source/docker.rst: documentation - .dockerignore: build context filter
45 lines
1.9 KiB
Plaintext
45 lines
1.9 KiB
Plaintext
# Local overrides: copy to docker-compose.override.yaml in this directory.
|
|
# Compose automatically merges this with docker-compose.yaml.
|
|
#
|
|
# cp docker-compose.override.yaml.example docker-compose.override.yaml
|
|
#
|
|
# Volumes are APPENDED to the base file's volumes list, environment and other scalar keys are MERGED by key.
|
|
services:
|
|
chatmail:
|
|
volumes:
|
|
## Data paths — bind-mount to host directories for easy access/backup.
|
|
|
|
# - ./data/dkim:/etc/dkimkeys
|
|
# - ./data/certs:/var/lib/acme
|
|
|
|
# - ./data/mail:/home/vmail
|
|
## Or mount from an existing bare-metal install.
|
|
# - /home/vmail:/home/vmail
|
|
|
|
## Mount your own chatmail.ini (skips auto-generation):
|
|
# - ./chatmail.ini:/etc/chatmail/chatmail.ini
|
|
|
|
## Custom website:
|
|
# - ./custom/www:/opt/chatmail-www
|
|
|
|
## Debug — mount scripts for live editing:
|
|
# - ./chatmail-init.sh:/chatmail-init.sh
|
|
# - ./entrypoint.sh:/entrypoint.sh
|
|
|
|
# environment:
|
|
## Mount certs (above) and set TLS_EXTERNAL_CERT_AND_KEY to in-container paths.
|
|
## A tls-cert-reload.path watcher inside the container reloads services
|
|
## when the cert file changes. However, inotify does not cross bind-mount
|
|
## boundaries, so host-side renewals (certbot, acmetool, etc.) must
|
|
## notify the container explicitly. Add this to your renewal hook:
|
|
##
|
|
## docker exec chatmail systemctl start tls-cert-reload.service
|
|
##
|
|
## Host acmetool (bare-metal migration): create mount above, and
|
|
## rsync -a /var/lib/acme/live data/certs
|
|
# TLS_EXTERNAL_CERT_AND_KEY: "/var/lib/acme/live/${MAIL_DOMAIN}/fullchain /var/lib/acme/live/${MAIL_DOMAIN}/privkey"
|
|
##
|
|
## (Untested) Traefik certs-dumper (see docker/docker-compose-traefik.yaml) - also add volume:
|
|
## - traefik-certs:/certs:ro
|
|
# TLS_EXTERNAL_CERT_AND_KEY: "/certs/${MAIL_DOMAIN}/certificate.crt /certs/${MAIL_DOMAIN}/privatekey.key"
|