diff --git a/wiki/docker/mailserver_-_docker-mailserver.md b/wiki/docker/mailserver_-_docker-mailserver.md index 36ce320..8215617 100644 --- a/wiki/docker/mailserver_-_docker-mailserver.md +++ b/wiki/docker/mailserver_-_docker-mailserver.md @@ -7,6 +7,10 @@ It contains dovecot, antispam, antivirus, ssl and many more features. ## Set-up +This section addresses the set-up of the docker-mailserver [Docker](/wiki/docker.md) container. + +### Download + The configuration is done automatically using scripts by mailserver. First you need to download the essential setup files. @@ -18,62 +22,129 @@ wget https://raw.githubusercontent.com/docker-mailserver/docker-mailserver/v9.0. chmod a+x ./setup.sh ``` -After that you need to edit the `.env` and the `mailserver.env<>` files to -configure the mailserver. +After that you need to edit the `docker-compose.yml` and the `mailserver.env` files to configure the +mailserver. + +### Initial configuration Create the file `rebuild.sh`. -You then need to start the container with the `rebuild.sh` and add email -accounts using the following command. +You then need to start the container using `rebuild.sh`. + +After the container is running create the desired mail accounts where `` is the desired +email account consisting of its parts and `` is the password. +It is recommended to create a postmaster account aswell. +It can be either created as a secondary account or just linked to the first account as shown in the +following lines. ```sh -./setup.sh email add () -./setup.sh alias add postmaster@ +./setup.sh email add () +./setup.sh alias add postmaster@ ``` -And finally generate the DCIM keys and rebuild once again. +Then generate the DKIM keys. -``` +```sh ./setup.sh config dkim ``` -In later steps the following command can be used to generate DKIM configuration for a given domain – -which in this case is set to the placeholder ``. +Finally rebuild the container once again. + +The required DNS configuration is explained in the +[corresponding section of the email wiki entry](/wiki/email.md#mail-server-records). +This needs to be set up for the email to work properly with most other providers. + +For the DKIM record the generated configuration has to be retrieved from the following file. + +```txt +config/opendkim/keys//mail.txt +``` + +Afterward run the `rebuild.sh` file again. + +### Reverse proxy + +If setting up this mailserver with [Traefik](/wiki/traefik.md) as a reverse proxy some additional +steps should be taken. + +Although SMTP, IMAP and POP3 do not pass through [Traefik](/wiki/traefik.md), a TLS certificate is +still required. +A simple way to automatically obtain and renew such a certificate is to expose a temporary HTTP +service. +In this case a simple [Traefik](/wiki/traefik.md) `whoami` container is used. + +For a single mail domain the following service is sufficient. +In this case add the following lines to the file `docker-compose.yml` in the `services:` section and +adapt them according to your needs. + +```yml +whoami: + image: docker.io/traefik/whoami:latest + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.whoami.rule=Host(`mail.`)" + - "traefik.http.routers.whoami.tls=true" + - "traefik.http.routers.whoami.tls.certresolver=letsencrypt" +``` + +The mailserver itself does not use this service. +It merely causes [Traefik](/wiki/traefik.md) to request and automatically renew the TLS certificate. + +### Optional: Multiple Mail Domains + +Multiple independent mail domains can share a single mailserver instance. +In this setup only one TLS certificate is used, containing all mail hostnames as Subject Alternative +Names (SANs). + +For two domains the configuration could look as follows. + +```yml +whoami: + image: docker.io/traefik/whoami:latest + networks: + - proxy + labels: + - "traefik.enable=true" + - "traefik.http.routers.whoami.rule=Host(`mail.example.com`) || Host(`mail.example.org`)" + - "traefik.http.routers.whoami.tls=true" + - "traefik.http.routers.whoami.tls.certresolver=letsencrypt" + - "traefik.http.routers.whoami.tls.domains[0].main=mail.example.com" + - "traefik.http.routers.whoami.tls.domains[0].sans=mail.example.org" +``` + +For three domains simply extend both the router rule and the SAN list. + +```yml +- "traefik.http.routers.whoami.rule=Host(`mail.example.com`) || Host(`mail.example.org`) || Host(`mail.example.net`)" +- "traefik.http.routers.whoami.tls.domains[0].main=mail.example.com" +- "traefik.http.routers.whoami.tls.domains[0].sans=mail.example.org,mail.example.net" +``` + +[Traefik](/wiki/traefik.md) will then obtain a single certificate with the following names and keep +it updated in the future. + +- `mail.example.com` as the Common Name (CN) +- `mail.example.org` as a Subject Alternative Name (SAN) +- `mail.example.net` as a Subject Alternative Name (SAN) + +This single certificate is used by the mailserver for all configured mail domains. + +For every additional domain a DKIM key has to be generated. ```sh docker exec mailserver setup config dkim domain '' ``` -Finally, if a reverse proxy is used check the -[traefik entry](/wiki/docker/traefik.md#setup-mailserver) or the [nginx entry](/wiki/nginx.md). +The required DNS records described in the +[corresponding section of the Email entry](/wiki/email.md#mail-server-records) also have to be +created as previously shown in [the previous section](#initial-configuration). -Afterward you're ready to go by once again running the `rebuild.sh` file. +After that mail addresses for the additional domains can simply be created and used. +No further setup is needed and emails using the new domains can simply be created. -If setting up this mailserver with [Traefik](/wiki/traefik.md) as a reverse proxy some additional -steps should be taken. -No http or https is needed. -But a certificate for the mailserver is needed regardless. -In this case add the following lines to the file `docker-compose.yml` in the -`services:` section and adapt them. - -```yml - whoami: - image: docker.io/traefik/whoami:latest - labels: - – "traefik.enable=true" - – "traefik.http.routers.whoami.rule=Host(`.`)" -``` - -To use the mail server multiple [DNS](/wiki/dns.md) [records](/wiki/dns.md#records) have to be -created. -This process is explained in the -[corresponding section of the email wiki entry](/wiki/email.md#mail-server-records) - -For the [DKIM record](/wiki/email.md#dkim-record) the dkim configuration for a given domain has to be -retrieved. -It can be found in the config directory under the following path. - -```txt -config/opendkim/keys//mail.txt +```sh +./setup.sh email add () ``` ### rebuild.sh