191 lines
4.9 KiB
HCL
191 lines
4.9 KiB
HCL
job "dockermailserver" {
|
|
datacenters = ["homelab"]
|
|
priority = 90
|
|
type = "service"
|
|
meta {
|
|
forcedeploy = "0"
|
|
}
|
|
constraint {
|
|
attribute = "${attr.cpu.arch}"
|
|
value = "amd64"
|
|
}
|
|
|
|
group "dockermailserver" {
|
|
network {
|
|
mode = "host"
|
|
port "smtp" {
|
|
to = 25
|
|
}
|
|
port "imap" {
|
|
to = 10993
|
|
}
|
|
port "esmtp" {
|
|
to = 465
|
|
}
|
|
port "rspamd" {
|
|
to = 11334
|
|
}
|
|
}
|
|
service {
|
|
name = "smtp"
|
|
port = "smtp"
|
|
tags = [
|
|
"traefik.enable=true",
|
|
"traefik.tcp.routers.smtp.service=smtp",
|
|
"traefik.tcp.routers.smtp.entrypoints=smtp",
|
|
"traefik.tcp.routers.smtp.rule=HostSNI(`*`)",
|
|
"traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=1",
|
|
]
|
|
check {
|
|
name = "smtp_probe"
|
|
type = "tcp"
|
|
interval = "20s"
|
|
timeout = "2s"
|
|
}
|
|
}
|
|
service {
|
|
name = "esmtp"
|
|
port = "esmtp"
|
|
tags = [
|
|
"traefik.enable=true",
|
|
"traefik.tcp.routers.esmtp.service=esmtp",
|
|
"traefik.tcp.routers.esmtp.entrypoints=esmtp",
|
|
"traefik.tcp.routers.esmtp.rule=HostSNI(`*`)",
|
|
"traefik.tcp.routers.esmtp.tls.passthrough=true",
|
|
"traefik.tcp.services.esmtp.loadbalancer.proxyProtocol.version=1",
|
|
]
|
|
check {
|
|
name = "esmtp_probe"
|
|
type = "tcp"
|
|
interval = "20s"
|
|
timeout = "2s"
|
|
}
|
|
}
|
|
service {
|
|
name = "imap"
|
|
port = "imap"
|
|
tags = [
|
|
"traefik.enable=true",
|
|
"traefik.tcp.routers.imap.service=imap",
|
|
"traefik.tcp.routers.imap.entrypoints=imap",
|
|
"traefik.tcp.routers.imap.rule=HostSNI(`*`)",
|
|
"traefik.tcp.routers.imap.tls.passthrough=true",
|
|
"traefik.tcp.services.imap.loadbalancer.proxyProtocol.version=2",
|
|
]
|
|
check {
|
|
name = "imap_probe"
|
|
type = "tcp"
|
|
interval = "20s"
|
|
timeout = "2s"
|
|
}
|
|
}
|
|
service {
|
|
name = "certmail"
|
|
tags =[
|
|
"traefik.enable=true",
|
|
"traefik.http.routers.certmail.entrypoints=web,websecure",
|
|
"traefik.http.routers.certmail.tls.domains[0].sans=mail.ducamps.eu",
|
|
"traefik.http.routers.certmail.tls.certresolver=myresolver",
|
|
]
|
|
}
|
|
service {
|
|
name = "rspamdUI"
|
|
port = "rspamd"
|
|
tags = [
|
|
"homer.enable=true",
|
|
"homer.name=RSPAMD",
|
|
"homer.service=Application",
|
|
"homer.logo=http://${NOMAD_ADDR_rspamd}/img/rspamd_logo_navbar.png",
|
|
"homer.target=_blank",
|
|
"homer.url=http://${NOMAD_ADDR_rspamd}/",
|
|
]
|
|
check {
|
|
name = "rspamd_probe"
|
|
type = "http"
|
|
path = "/"
|
|
interval = "60s"
|
|
timeout = "2s"
|
|
}
|
|
}
|
|
|
|
# vault{
|
|
# policies= ["policy_name"]
|
|
#
|
|
#}
|
|
task "docker-mailserver" {
|
|
driver = "docker"
|
|
config {
|
|
image = "ghcr.io/docker-mailserver/docker-mailserver:latest"
|
|
ports = ["smtp", "esmtp", "imap","rspamd"]
|
|
volumes = [
|
|
"/mnt/diskstation/nomad/dms/mail-data:/var/mail",
|
|
"/mnt/diskstation/nomad/dms/mail-state:/var/mail-state",
|
|
"/mnt/diskstation/nomad/dms/mail-logs:/var/log/mail",
|
|
"/mnt/diskstation/nomad/dms/config:/tmp/docker-mailserver",
|
|
"/etc/localtime:/etc/localtime",
|
|
"local/postfix-main.cf:/tmp/docker-mailserver/postfix-main.cf",
|
|
"local/postfix-master.cf:/tmp/docker-mailserver/postfix-master.cf",
|
|
"local/dovecot.cf:/tmp/docker-mailserver/dovecot.cf",
|
|
"/mnt/diskstation/nomad/traefik/acme.json:/etc/letsencrypt/acme.json"
|
|
]
|
|
}
|
|
|
|
env {
|
|
OVERRIDE_HOSTNAME = "mail.ducamps.eu"
|
|
DMS_VMAIL_UID = 1000000
|
|
DMS_VMAIL_GID = 984
|
|
SSL_TYPE= "letsencrypt"
|
|
LOG_LEVEL="info"
|
|
POSTMASTER_ADDRESS="vincent@ducamps.eu"
|
|
ENABLE_RSPAMD=1
|
|
ENABLE_OPENDKIM=0
|
|
ENABLE_OPENDMARC=0
|
|
ENABLE_POLICYD_SPF=0
|
|
ENABLE_UPDATE_CHECK=0
|
|
UPDATE_CHECK_INTERVAL="1d"
|
|
RSPAMD_CHECK_AUTHENTICATED=0
|
|
|
|
}
|
|
template {
|
|
data = <<EOH
|
|
|
|
EOH
|
|
destination = "secrets/config"
|
|
env = true
|
|
}
|
|
|
|
template {
|
|
data = <<EOH
|
|
postscreen_upstream_proxy_protocol = haproxy
|
|
EOH
|
|
destination = "local/postfix-main.cf"
|
|
}
|
|
template {
|
|
data = <<EOH
|
|
submission/inet/smtpd_upstream_proxy_protocol=haproxy
|
|
submissions/inet/smtpd_upstream_proxy_protocol=haproxy
|
|
EOH
|
|
destination = "local/postfix-master.cf"
|
|
}
|
|
template {
|
|
data = <<EOH
|
|
haproxy_trusted_networks = 10.0.0.0/24, 127.0.0.0/8, 172.17.0.1
|
|
haproxy_timeout = 3 secs
|
|
service imap-login {
|
|
inet_listener imaps {
|
|
haproxy = yes
|
|
ssl = yes
|
|
port = 10993
|
|
}
|
|
}
|
|
EOH
|
|
destination = "local/dovecot.cf"
|
|
}
|
|
resources {
|
|
memory = 1000
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|