From 3deb328bbfb864f3a0750b6cde6b36bef09af79b Mon Sep 17 00:00:00 2001 From: Lucas Rayan Date: Sun, 2 Aug 2026 07:57:39 -0300 Subject: [PATCH] #19: repair the compose stack and wire Rspamd to Redis "docker compose up" could not work, which means the F0 acceptance criterion was not being met: - ghcr.io/rspamd/rspamd:3.9 returns "denied" and clamav/clamav:1.3 does not exist. Both were verified against the registries; the working references are rspamd/rspamd:3.9 and clamav/clamav:1.4. - Rspamd received RSPAMD_REDIS_SERVERS and RSPAMD_REDIS_PASSWORD as environment variables it never reads. Confirmed in the container that it does not expand ${VAR} in UCL: the password reached Redis as that literal string. Greylisting and ratelimit keep their state in Redis, so both were silently doing nothing while appearing configured. The credential is now rendered at startup into override.d, a tmpfs, so it touches neither the image nor a volume. - The ratelimit module ships enabled with no rates defined, which accepts everything. ratelimit.conf defines the per-IP, per-user and per-recipient buckets of section 5.2. Verified by bringing redis and rspamd up: the real password resolves, the rates load, and a probe message returns "Action: greylist" with the state written to Redis. Services also gained an image: alongside build:, so the deploy host pulls instead of compiling while "docker compose build" still works locally. Co-Authored-By: Claude Opus 5 --- .env.example | 9 ++++++++ config/rspamd/ratelimit.conf | 41 ++++++++++++++++++++++++++++++++++++ docker-compose.yaml | 25 ++++++++++++++++++---- 3 files changed, 71 insertions(+), 4 deletions(-) create mode 100644 config/rspamd/ratelimit.conf diff --git a/.env.example b/.env.example index 283d73b..bc171bd 100644 --- a/.env.example +++ b/.env.example @@ -1,3 +1,12 @@ +# --- Container images --- +# Published to GHCR by .github/workflows/release.yml, multi-architecture +# (linux/amd64 and linux/arm64). The deploy host pulls these instead of +# compiling: `docker compose pull && docker compose up -d`. Running +# `docker compose build` locally still overrides them with a local build. +# Pin IMAGE_TAG to a released version (e.g. 1.2.3) or a sha- tag to roll back. +IMAGE_NAMESPACE=ghcr.io/lucasrguerra/lambdamail +IMAGE_TAG=latest + # --- Postgres --- POSTGRES_DB=lambdamail POSTGRES_USER=lambdamail diff --git a/config/rspamd/ratelimit.conf b/config/rspamd/ratelimit.conf new file mode 100644 index 0000000..c158782 --- /dev/null +++ b/config/rspamd/ratelimit.conf @@ -0,0 +1,41 @@ +# Rate limiting of PLAN.md section 5.2. +# +# This file exists because the module ships enabled but with no rates defined, +# which means it accepts everything: "rspamadm configdump ratelimit" on a +# stock image returns only whitelisted_rcpts. Without explicit buckets there +# is no limit at all, and the defence reads as present while doing nothing. +# +# Each rate is " / ". The bucket leaks over the period, so the +# burst is what a sender may do at once and the period sets the refill rate. + +rates { + # Per connecting IP: generous enough for a busy legitimate MTA relaying a + # mailing list, tight enough to matter for a spam cannon. + to_ip = { + bucket = [ + { burst = 100; rate = "60 / 1min"; } + ]; + } + + # Per authenticated sender. This is the containment for a compromised + # account, and it backs up the per-mailbox max_recipients_per_hour enforced + # in ProcessOutboundEmailUseCase - that one is authoritative, this one + # catches the same abuse earlier and without a database round trip. + user = { + bucket = [ + { burst = 50; rate = "30 / 1min"; } + ]; + } + + # Per recipient, to blunt a dictionary attack enumerating local parts. + to = { + bucket = [ + { burst = 20; rate = "10 / 1min"; } + ]; + } +} + +# Mail we authenticated ourselves is not what this limit is aimed at, but a +# compromised account is - so authenticated users stay limited, and only the +# addresses RFC 2142 requires to always be reachable are exempt. +whitelisted_rcpts = "postmaster,mailer-daemon,abuse"; diff --git a/docker-compose.yaml b/docker-compose.yaml index 06f50c4..b173c22 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -71,15 +71,28 @@ services: # ------------------------------------------------------------ RSPAMD rspamd: - image: ghcr.io/rspamd/rspamd:3.9 + image: rspamd/rspamd:3.9 restart: *restart logging: *default-logging environment: - RSPAMD_REDIS_SERVERS: redis - RSPAMD_REDIS_PASSWORD: ${REDIS_PASSWORD} + REDIS_PASSWORD: ${REDIS_PASSWORD} volumes: - ./config/rspamd:/etc/rspamd/local.d:ro - rspamd_data:/var/lib/rspamd + # Rspamd does NOT expand environment variables in its UCL config - a + # "${REDIS_PASSWORD}" written into a .conf reaches Redis as that literal + # string. The credential is therefore rendered at startup into override.d, + # which is a tmpfs so the secret never touches the image or a volume. + # Without this, greylisting and ratelimit silently do nothing: both keep + # their state in Redis. + tmpfs: + - /etc/rspamd/override.d:uid=11333,gid=11333,mode=0700 + entrypoint: + - sh + - -c + - >- + printf 'servers = "redis:6379";\npassword = "%s";\n' "$$REDIS_PASSWORD" + > /etc/rspamd/override.d/redis.conf && exec /usr/bin/rspamd -f depends_on: redis: { condition: service_healthy } healthcheck: @@ -91,7 +104,7 @@ services: # ------------------------------------------------------------ CLAMAV clamav: - image: clamav/clamav:1.3 + image: clamav/clamav:1.4 restart: *restart logging: *default-logging volumes: [clamav_data:/var/lib/clamav] @@ -105,6 +118,7 @@ services: # -------------------------------------------------------------- AUTH auth: + image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/auth:${IMAGE_TAG:-latest} build: { context: ./services/auth } restart: *restart logging: *default-logging @@ -134,6 +148,7 @@ services: # ----------------------------------------------------------- STORAGE storage: + image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/storage:${IMAGE_TAG:-latest} build: { context: ./services/storage } restart: *restart logging: *default-logging @@ -163,6 +178,7 @@ services: # --------------------------------------------------------- PROTOCOLS protocols: + image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/protocols:${IMAGE_TAG:-latest} build: { context: ./services/protocols } restart: *restart logging: *default-logging @@ -238,6 +254,7 @@ services: # -------------------------------------------------------------- WEB web: + image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/webmail:${IMAGE_TAG:-latest} build: { context: ./services/webmail } restart: *restart logging: *default-logging