Lucas RayanandClaude Opus 5
7a4ca10a39
The auth service refuses to start with a JWT_SECRET under 32 characters, which is the point - but .env.example still carried a 30-character value, so the stack could not come up with the file it ships with. CI caught it on the compose-up job: auth reported unhealthy and everything depending on it stopped. Reproduced locally against the same file before and after; the stack now starts from a clean checkout. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
82 lines
3.1 KiB
Bash
82 lines
3.1 KiB
Bash
# --- Container images ---
|
|
# Published to GHCR by .github/workflows/release.yml, multi-architecture
|
|
# (linux/amd64 and linux/arm64). The deploy host pulls these instead of
|
|
# compiling: `docker compose pull && docker compose up -d`. Running
|
|
# `docker compose build` locally still overrides them with a local build.
|
|
# Pin IMAGE_TAG to a released version (e.g. 1.2.3) or a sha- tag to roll back.
|
|
IMAGE_NAMESPACE=ghcr.io/lucasrguerra/lambdamail
|
|
IMAGE_TAG=latest
|
|
|
|
# --- Postgres ---
|
|
POSTGRES_DB=lambdamail
|
|
POSTGRES_USER=lambdamail
|
|
POSTGRES_PASSWORD=change-me-in-local-dev
|
|
|
|
# --- Redis ---
|
|
REDIS_PASSWORD=change-me-in-local-dev
|
|
|
|
# --- Shared secrets (local dev values — never reuse in production) ---
|
|
JWT_SECRET=local-dev-jwt-secret-change-me-at-least-32-chars
|
|
# Encrypts DKIM private keys and provider tokens at rest. Losing it makes every
|
|
# stored secret unrecoverable — back it up separately from the database.
|
|
LAMBDAMAIL_MASTER_KEY=local-dev-master-key-32-bytes-minimum-value
|
|
|
|
# --- Host identity ---
|
|
PRIMARY_MAIL_HOST=mail.localhost
|
|
MAIL_DOMAIN=localhost
|
|
PUBLIC_IPV4=127.0.0.1
|
|
PUBLIC_IPV6=
|
|
|
|
# --- DNS automation (Cloudflare) ---
|
|
# The token needs Zone.DNS:Edit plus Zone.Zone:Read on the zone. Leave it empty
|
|
# to disable reconciliation; the service then logs that DNS sync is off.
|
|
CLOUDFLARE_API_TOKEN=
|
|
DNS_SYNC_INTERVAL_SECONDS=21600
|
|
|
|
# --- TLS ---
|
|
# traefik: read the certificate Traefik manages (default, DANE not possible).
|
|
# acme: obtain the certificate ourselves via DNS-01. Required for DANE,
|
|
# because only this mode can reuse a pre-generated key.
|
|
TLS_MODE=traefik
|
|
# Used only when TLS_MODE=acme. Leave ACME_DIRECTORY_URL empty for Let's
|
|
# Encrypt production; point it at the staging directory while testing, since
|
|
# production rate limits can lock a domain out for a week.
|
|
ACME_EMAIL=
|
|
ACME_DIRECTORY_URL=
|
|
COOLIFY_PROXY_DIR=./local/acme
|
|
TRAEFIK_ACME_FILENAME=acme.json
|
|
CERT_POLL_INTERVAL_SECONDS=60
|
|
# Static certificate files, used when no ACME store is available (local dev).
|
|
PROTOCOLS_CERT_PATH=/etc/lambdamail/certs/cert.pem
|
|
PROTOCOLS_KEY_PATH=/etc/lambdamail/certs/key.pem
|
|
PROTOCOLS_SPOOL_DIR=/var/lambdamail/spool
|
|
|
|
# --- Transport security policy ---
|
|
# Start at "testing": senders honour the policy but do not hard-fail on it.
|
|
# Promote to "enforce" only once TLS-RPT reports come back clean.
|
|
MTA_STS_MODE=testing
|
|
OUTBOUND_MTA_STS_ENABLED=true
|
|
# DANE stays off unless TLS_MODE=acme. Under Traefik-managed certificates the
|
|
# key changes at every renewal and the published TLSA record stops matching,
|
|
# which permanently rejects mail at every validating MTA.
|
|
OUTBOUND_DANE_ENABLED=false
|
|
DNSSEC_RESOLVER=1.1.1.1:53
|
|
MAX_MESSAGE_BYTES=52428800
|
|
|
|
# ARC seals accepted messages so a downstream receiver can still tell that the
|
|
# mail authenticated at the first hop. Only worth enabling on a host that
|
|
# forwards mail onward.
|
|
ARC_SEAL_ENABLED=false
|
|
|
|
# --- Smarthost (for hosts where outbound port 25 is blocked) ---
|
|
# Setting RELAY_HOST routes all delivery through the relay and adds it to the
|
|
# published SPF record, without which every relayed message fails SPF.
|
|
RELAY_HOST=
|
|
RELAY_PORT=587
|
|
RELAY_USER=
|
|
RELAY_PASS=
|
|
|
|
# --- Webmail ---
|
|
WEBMAIL_HOST=localhost:3000
|
|
ADMIN_HOST=
|