mirror of
https://github.com/chatmail/relay.git
synced 2026-05-10 16:04:37 +00:00
3ef59c3def
Add Docker-based deployment: Dockerfile based on systemd image, docker-compose.yaml, build script, entrypoint, external certificate monitoring, CI workflow, and documentation. This builds on the chatmaild/cmdeploy preparation in the previous commit (j4n/docker-prep-chatmail) which added the env-var-driven feature flags (CHATMAIL_NOSYSCTL, CHATMAIL_NOPORTCHECK, CHATMAIL_NOACME) and @local deployment support needed by the container. This is commit 2 of 3 to merge squashed changes on j4n/docker and docker branches, original commits were beef0ec..606f36e Architecture overview (mostly by original author Keonik1): - Debian-systemd image wrapping the existing cmdeploy install - Host networking to not manually expose the many ports needed - Config via MAIL_DOMAIN env var or (new) mounted chatmail.ini - New: cmdeploy stages: install at build, configure+activate at startup - New: Monitoring service for external certs via systemd timer (chatmail-certmon) - New: Image version tracking for automatic upgrade detection (cm + config hash) - New: docker-compose.override.yaml pattern for user customizations - New: GitHub Actions CI for ghcr.io image builds Traefik reverse-proxy support is prepared but the specific files are excluded from this PR and will be submitted separately. TODO: - [ ] Pull out CHATMAIL_NOACME as PR #855 introduced a proper mechanism - [ ] Check if underlying image could be based on regular debian-slim images with a step to enable systemd, similar to https://github.com/alexdzyoba/docker-debian-systemd Files added: .dockerignore .github/workflows/docker-build.yaml docker-compose.yaml docker-compose.override.yaml.example docker/build.sh docker/chatmail_relay.dockerfile docker/files/chatmail-certmon.{service,sh,timer} docker/files/entrypoint.sh docker/files/setup_chatmail.service docker/files/setup_chatmail_docker.sh env.example doc/source/docker.rst Files modified: .gitignore doc/source/getting_started.rst doc/source/index.rst Co-authored-by: Keonik1 <keonik.dev@gmail.com> Co-authored-by: missytake <missytake@systemli.org>
29 lines
957 B
Bash
29 lines
957 B
Bash
#!/bin/bash
|
|
# Check if TLS certificates have changed and reload services if so.
|
|
# Called by chatmail-certmon.timer (systemd timer, default every 60s).
|
|
set -eo pipefail
|
|
|
|
PATH_TO_SSL="${PATH_TO_SSL:-/var/lib/acme/live/${MAIL_DOMAIN}}"
|
|
HASH_FILE="/run/chatmail-certmon.hash"
|
|
|
|
if [ ! -d "$PATH_TO_SSL" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
current_hash=$(find "$PATH_TO_SSL" -type f -exec sha1sum {} \; | sort | sha1sum | awk '{print $1}')
|
|
previous_hash=""
|
|
if [ -f "$HASH_FILE" ]; then
|
|
previous_hash=$(cat "$HASH_FILE")
|
|
fi
|
|
|
|
if [ -n "$current_hash" ] && [ "$current_hash" != "$previous_hash" ]; then
|
|
echo "[INFO] Certificate hash changed, reloading nginx, dovecot and postfix."
|
|
echo "$current_hash" > "$HASH_FILE"
|
|
# On first run (no previous hash), don't reload — services may not be up yet
|
|
if [ -n "$previous_hash" ]; then
|
|
systemctl reload nginx.service
|
|
systemctl reload dovecot.service
|
|
systemctl reload postfix.service
|
|
fi
|
|
fi
|