Lucas RayanandClaude Opus 5
8dab254729
The site returned 504 on every request while the web container was healthy and
Next was serving. The container sits on three networks - backend, proxy, and
the per-app network Coolify adds - and the label meant to tell Traefik which
one to use reached it as the literal text '${COOLIFY_PROXY_NETWORK:-coolify}'.
Coolify escapes $ to $$ when it rewrites compose labels, so the variable was
never interpolated, the label matched no network, and Traefik fell back to
picking one itself. Choosing 'backend' - internal: true, no route to the proxy
- produces exactly this: a gateway timeout in front of a working app.
The label has been wrong since it was added; container recreation during the
last deploy changed which network Traefik happened to pick and turned a latent
fault into an outage.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
368 lines
16 KiB
YAML
368 lines
16 KiB
YAML
x-logging: &default-logging
|
|
driver: json-file
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
x-restart: &restart unless-stopped
|
|
|
|
services:
|
|
# ---------------------------------------------------------------- DB
|
|
db:
|
|
image: postgres:16-alpine
|
|
restart: *restart
|
|
logging: *default-logging
|
|
environment:
|
|
POSTGRES_DB: ${POSTGRES_DB:?required}
|
|
POSTGRES_USER: ${POSTGRES_USER:?required}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?required} # no default: fail fast
|
|
POSTGRES_INITDB_ARGS: "--data-checksums"
|
|
command: >
|
|
postgres -c shared_buffers=256MB -c max_connections=200
|
|
-c wal_level=replica
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
mem_limit: 1g
|
|
cpus: 1.0
|
|
networks: [backend]
|
|
|
|
# ------------------------------------------------------------- REDIS
|
|
redis:
|
|
image: redis:7-alpine
|
|
restart: *restart
|
|
logging: *default-logging
|
|
command: >
|
|
redis-server --appendonly yes --appendfsync everysec
|
|
--requirepass ${REDIS_PASSWORD:?required}
|
|
--maxmemory 384mb --maxmemory-policy noeviction
|
|
# REDIS_PASSWORD has to exist inside the container for the healthcheck:
|
|
# $${VAR} expands in the container shell, not in Compose.
|
|
environment:
|
|
REDIS_PASSWORD: ${REDIS_PASSWORD}
|
|
volumes: [redis_data:/data]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "redis-cli --no-auth-warning -a $${REDIS_PASSWORD} ping | grep -q PONG"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
mem_limit: 512m
|
|
cpus: 0.5
|
|
networks: [backend]
|
|
|
|
# ----------------------------------------------------------- MIGRATE
|
|
# The only service with no healthcheck, deliberately: it is a one-shot job
|
|
# that applies the migrations and exits. Everything that depends on it waits
|
|
# on service_completed_successfully, which is a stronger guarantee than a
|
|
# probe - a health check on a container that is meant to stop would report
|
|
# unhealthy exactly when it has done its job.
|
|
migrate:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/migrations:${IMAGE_TAG:-latest}
|
|
restart: "no"
|
|
logging: *default-logging
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
entrypoint:
|
|
- migrate
|
|
- -path=/migrations
|
|
- -database
|
|
- postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?sslmode=disable
|
|
- up
|
|
networks: [backend]
|
|
|
|
# ------------------------------------------------------------ RSPAMD
|
|
rspamd:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/rspamd:${IMAGE_TAG:-latest}
|
|
restart: *restart
|
|
logging: *default-logging
|
|
environment:
|
|
REDIS_PASSWORD: ${REDIS_PASSWORD}
|
|
volumes:
|
|
- rspamd_data:/var/lib/rspamd
|
|
# Rspamd does NOT expand environment variables in its UCL config - a
|
|
# "${REDIS_PASSWORD}" written into a .conf reaches Redis as that literal
|
|
# string. The credential is therefore rendered at startup into override.d,
|
|
# which is a tmpfs so the secret never touches the image or a volume.
|
|
# Without this, greylisting and ratelimit silently do nothing: both keep
|
|
# their state in Redis.
|
|
tmpfs:
|
|
- /etc/rspamd/override.d:uid=11333,gid=11333,mode=0700
|
|
entrypoint:
|
|
- sh
|
|
- -c
|
|
- >-
|
|
printf 'servers = "redis:6379";\npassword = "%s";\n' "$$REDIS_PASSWORD"
|
|
> /etc/rspamd/override.d/redis.conf && exec /usr/bin/rspamd -f
|
|
depends_on:
|
|
redis: { condition: service_healthy }
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "rspamadm control stat >/dev/null 2>&1 || exit 1"]
|
|
interval: 30s
|
|
# Without an explicit timeout Docker allows 30s, which overlaps the next
|
|
# probe; and without a start_period the first checks run while the
|
|
# worker is still loading maps and mark the container unhealthy.
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 60s
|
|
mem_limit: 768m
|
|
networks: [backend, egress] # egress: RBL/DNSBL lookups and fuzzy storage
|
|
|
|
# ------------------------------------------------------------ CLAMAV
|
|
clamav:
|
|
# The Debian variant, not the default Alpine one: Alpine is published for
|
|
# amd64 only, and the deploy target is arm64. Same upstream project, same
|
|
# clamdcheck.sh healthcheck.
|
|
image: clamav/clamav:1.5.3-debian
|
|
restart: *restart
|
|
logging: *default-logging
|
|
volumes: [clamav_data:/var/lib/clamav]
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "clamdcheck.sh || exit 1"]
|
|
interval: 60s
|
|
timeout: 15s # clamd answers slowly while scanning
|
|
retries: 5
|
|
start_period: 300s # the initial signature load is slow
|
|
mem_limit: 2g # ClamAV genuinely needs this
|
|
networks: [backend, egress] # egress: freshclam signature updates
|
|
|
|
# -------------------------------------------------------------- AUTH
|
|
auth:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/auth:${IMAGE_TAG:-latest}
|
|
restart: *restart
|
|
logging: *default-logging
|
|
environment:
|
|
# Drives the Secure attribute on session cookies. Without it the cookies
|
|
# are issued unsecured, which behind a TLS terminator is a downgrade
|
|
# waiting to happen.
|
|
NODE_ENV: ${NODE_ENV:-production}
|
|
PORT: 3001
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?sslmode=disable
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
JWT_SECRET: ${JWT_SECRET:?required}
|
|
LAMBDAMAIL_MASTER_KEY: ${LAMBDAMAIL_MASTER_KEY:?required} # KEK for sealed secrets
|
|
CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
|
|
PRIMARY_MAIL_HOST: ${PRIMARY_MAIL_HOST:?required}
|
|
PUBLIC_IPV4: ${PUBLIC_IPV4:?required}
|
|
PUBLIC_IPV6: ${PUBLIC_IPV6:-}
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
redis: { condition: service_healthy }
|
|
migrate: { condition: service_completed_successfully }
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:3001/health/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
mem_limit: 512m
|
|
networks: [backend, egress] # egress: Cloudflare API. Without it DNS sync
|
|
# fails silently, since backend is internal.
|
|
|
|
# ----------------------------------------------------------- STORAGE
|
|
storage:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/storage:${IMAGE_TAG:-latest}
|
|
restart: *restart
|
|
logging: *default-logging
|
|
environment:
|
|
NODE_ENV: ${NODE_ENV:-production}
|
|
PORT: 3002
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?sslmode=disable
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
STORAGE_DRIVER: ${STORAGE_DRIVER:-local}
|
|
STORAGE_LOCAL_PATH: /var/lambdamail/mails
|
|
S3_ENDPOINT: ${S3_ENDPOINT:-}
|
|
S3_BUCKET: ${S3_BUCKET:-}
|
|
S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
|
|
S3_SECRET_KEY: ${S3_SECRET_KEY:-}
|
|
volumes: [mail_storage:/var/lambdamail/mails]
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
redis: { condition: service_healthy }
|
|
migrate: { condition: service_completed_successfully }
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:3002/health/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 20s
|
|
mem_limit: 1g
|
|
cpus: 1.0
|
|
networks: [backend, egress] # egress: external S3 when STORAGE_DRIVER=s3
|
|
|
|
# --------------------------------------------------------- PROTOCOLS
|
|
protocols:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/protocols:${IMAGE_TAG:-latest}
|
|
restart: *restart
|
|
logging: *default-logging
|
|
ports:
|
|
- "25:25" # SMTP MX
|
|
- "587:587" # Submission (STARTTLS)
|
|
- "465:465" # Submission (implicit TLS)
|
|
- "143:143" # IMAP (STARTTLS)
|
|
- "993:993" # IMAPS
|
|
- "110:110" # POP3 (STARTTLS)
|
|
- "995:995" # POP3S
|
|
- "4190:4190" # ManageSieve
|
|
environment:
|
|
DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?sslmode=disable
|
|
REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
|
|
# Shared with the auth service: it mints the webmail sessions and this
|
|
# service verifies them on /api/v1/mail/*.
|
|
JWT_SECRET: ${JWT_SECRET:?required}
|
|
RSPAMD_URL: http://rspamd:11333
|
|
CLAMAV_ADDR: clamav:3310
|
|
PRIMARY_MAIL_HOST: ${PRIMARY_MAIL_HOST:?required}
|
|
MAIL_DOMAIN: ${MAIL_DOMAIN:?required}
|
|
LAMBDAMAIL_MASTER_KEY: ${LAMBDAMAIL_MASTER_KEY:?required} # required for DKIM keys
|
|
# --- TLS ---
|
|
TLS_MODE: ${TLS_MODE:-traefik} # traefik | acme
|
|
TRAEFIK_ACME_DIR: /etc/traefik # the DIRECTORY, not the file (section 8.2)
|
|
TRAEFIK_ACME_FILENAME: acme.json
|
|
CERT_POLL_INTERVAL_SECONDS: "60"
|
|
# --- Policy ---
|
|
MTA_STS_MODE: ${MTA_STS_MODE:-testing} # promote to enforce once TLS-RPT is clean
|
|
# DANE requires TLS_MODE=acme; the preflight refuses the combination
|
|
# with Traefik-managed certificates (section 5.1).
|
|
OUTBOUND_DANE_ENABLED: ${OUTBOUND_DANE_ENABLED:-false}
|
|
OUTBOUND_MTA_STS_ENABLED: "true"
|
|
DNSSEC_RESOLVER: ${DNSSEC_RESOLVER:-1.1.1.1:53}
|
|
# ARC only earns its keep on a host that forwards mail onward.
|
|
ARC_SEAL_ENABLED: ${ARC_SEAL_ENABLED:-false}
|
|
# Smarthost, for providers that block outbound port 25 (section 10.4).
|
|
# Setting RELAY_HOST also adds the relay to the published SPF record.
|
|
RELAY_HOST: ${RELAY_HOST:-}
|
|
RELAY_PORT: ${RELAY_PORT:-587}
|
|
RELAY_USER: ${RELAY_USER:-}
|
|
RELAY_PASS: ${RELAY_PASS:-}
|
|
MAX_MESSAGE_BYTES: "52428800"
|
|
# --- Self-managed ACME (mode B, section 8.3) ---
|
|
ACME_EMAIL: ${ACME_EMAIL:-}
|
|
ACME_DIRECTORY_URL: ${ACME_DIRECTORY_URL:-}
|
|
# --- DNS automation ---
|
|
CLOUDFLARE_API_TOKEN: ${CLOUDFLARE_API_TOKEN:-}
|
|
PUBLIC_IPV4: ${PUBLIC_IPV4:?required}
|
|
PUBLIC_IPV6: ${PUBLIC_IPV6:-}
|
|
DNS_SYNC_INTERVAL_SECONDS: "21600" # 6 h drift detection
|
|
PROTOCOLS_SPOOL_DIR: /var/lambdamail/spool
|
|
volumes:
|
|
# Bind-mount the DIRECTORY: Traefik's atomic rename breaks a
|
|
# file-scoped mount and the watcher would go blind (section 8.2).
|
|
- ${COOLIFY_PROXY_DIR:-/data/coolify/proxy}:/etc/traefik:ro
|
|
- protocols_spool:/var/lambdamail/spool
|
|
depends_on:
|
|
db: { condition: service_healthy }
|
|
redis: { condition: service_healthy }
|
|
migrate: { condition: service_completed_successfully }
|
|
rspamd: { condition: service_started }
|
|
clamav: { condition: service_started }
|
|
healthcheck:
|
|
test: ["CMD", "/app/lambdamail-protocols", "healthcheck"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
mem_limit: 1g
|
|
cpus: 1.5
|
|
ulimits:
|
|
nofile: { soft: 65536, hard: 65536 }
|
|
networks: [backend, egress] # egress: port 25 delivery, DNSSEC, MTA-STS fetch
|
|
|
|
# -------------------------------------------------------------- WEB
|
|
web:
|
|
image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/webmail:${IMAGE_TAG:-latest}
|
|
restart: *restart
|
|
logging: *default-logging
|
|
environment:
|
|
NODE_ENV: ${NODE_ENV:-production}
|
|
PORT: 3000
|
|
AUTH_SERVICE_URL: http://auth:3001
|
|
STORAGE_SERVICE_URL: http://storage:3002
|
|
# The mail screens read and send through the protocols service, which
|
|
# owns the folder, UID, flag and blob logic.
|
|
PROTOCOLS_SERVICE_URL: http://protocols:8080
|
|
NEXT_PUBLIC_APP_URL: https://${WEBMAIL_HOST:?required}
|
|
# Isolation of the two surfaces (section 14.1). With ADMIN_HOST set the
|
|
# console answers only on that host; otherwise it lives under
|
|
# ${WEBMAIL_HOST}/admin.
|
|
ADMIN_HOST: ${ADMIN_HOST:-}
|
|
TOTP_ISSUER: ${TOTP_ISSUER:-LambdaMail}
|
|
MFA_CHALLENGE_TTL_SECONDS: "300"
|
|
ADMIN_SESSION_TTL_SECONDS: "28800" # 8 h
|
|
ADMIN_STEPUP_INTERVAL_SECONDS: "900" # re-require TOTP every 15 min
|
|
USER_SESSION_TTL_SECONDS: "2592000" # 30 d
|
|
TRUSTED_DEVICE_TTL_SECONDS: "2592000"
|
|
depends_on:
|
|
auth: { condition: service_healthy }
|
|
storage: { condition: service_healthy }
|
|
protocols: { condition: service_healthy }
|
|
labels:
|
|
- traefik.enable=true
|
|
# Pins Traefik to the proxy network. The container sits on three -
|
|
# backend, proxy, and the per-app network Coolify adds - and with no
|
|
# usable value here Traefik picks one arbitrarily. When it picks
|
|
# "backend" (internal: true, no route to the proxy) every request ends in
|
|
# a 504 while the container itself is perfectly healthy.
|
|
#
|
|
# The name is written out rather than taken from ${COOLIFY_PROXY_NETWORK}
|
|
# because Coolify escapes $ to $$ when it rewrites labels: the variable
|
|
# reached Traefik as the literal text "${COOLIFY_PROXY_NETWORK:-coolify}",
|
|
# which matches no network, so this label silently did nothing. Change it
|
|
# here if your proxy network is not called "coolify".
|
|
- traefik.docker.network=coolify
|
|
# Webmail (/user/*)
|
|
- traefik.http.routers.lm-web.rule=Host(`${WEBMAIL_HOST}`)
|
|
- traefik.http.routers.lm-web.tls.certresolver=letsencrypt
|
|
- traefik.http.services.lm-web.loadbalancer.server.port=3000
|
|
# Admin console. Nested fallback: with no ADMIN_HOST the console lives
|
|
# under the webmail host at /admin. Never use a fictitious host as the
|
|
# default - Traefik would loop on ACME for it and risk a rate limit.
|
|
- traefik.http.routers.lm-admin.rule=Host(`${ADMIN_HOST:-${WEBMAIL_HOST}}`) && PathPrefix(`/admin`)
|
|
- traefik.http.routers.lm-admin.priority=20
|
|
- traefik.http.routers.lm-admin.tls.certresolver=letsencrypt
|
|
# MTA-STS needs a valid certificate on mta-sts.<domain>
|
|
- traefik.http.routers.lm-mtasts.rule=Host(`mta-sts.${MAIL_DOMAIN}`)
|
|
- traefik.http.routers.lm-mtasts.tls.certresolver=letsencrypt
|
|
# Autoconfig (Thunderbird)
|
|
- traefik.http.routers.lm-autoconfig.rule=Host(`autoconfig.${MAIL_DOMAIN}`)
|
|
- traefik.http.routers.lm-autoconfig.tls.certresolver=letsencrypt
|
|
# CRITICAL: forces Traefik to issue a certificate for the mail host.
|
|
# Without this router mail.<domain> never appears in acme.json and every
|
|
# TLS listener comes up without a certificate (section 8.2, trap 2).
|
|
- traefik.http.routers.lm-mailhost.rule=Host(`${PRIMARY_MAIL_HOST}`)
|
|
- traefik.http.routers.lm-mailhost.tls.certresolver=letsencrypt
|
|
# The one service that was never probed, despite being the only one users
|
|
# reach directly: a wedged Next process kept its container "running" and
|
|
# Traefik kept routing to it. The image ships no curl or wget, so this uses
|
|
# node's own fetch, as auth and storage do.
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 15s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 30s
|
|
mem_limit: 512m
|
|
networks: [backend, proxy]
|
|
|
|
volumes:
|
|
postgres_data:
|
|
redis_data:
|
|
mail_storage:
|
|
rspamd_data:
|
|
clamav_data:
|
|
protocols_spool:
|
|
|
|
networks:
|
|
backend:
|
|
internal: true # no route to the internet: internal traffic only
|
|
# Controlled egress: only the services that must reach the internet join it
|
|
# (auth -> Cloudflare API; protocols -> remote MX, DNS, MTA-STS fetch;
|
|
# rspamd -> RBLs; clamav -> freshclam; storage -> external S3).
|
|
egress:
|
|
driver: bridge
|
|
proxy:
|
|
external: true
|
|
name: ${COOLIFY_PROXY_NETWORK:-coolify}
|