add docker setup

2026-08-15 06:22:02 +01:00
parent 892f366a16
commit 310700407e
11 changed files with 410 additions and 19 deletions
@@ -0,0 +1,47 @@
+# syntax=docker/dockerfile:1
+#
+# mailgoserver + the latest rspamd, bundled in one container. Both processes share this
+# container's network namespace, so rspamd's default "normal" worker
+# (127.0.0.1:11333, the /checkv2 scanning API — see internal/mailstore/rspamd.go) is
+# already exactly what [Rspamd] url defaults to in settings.ini. Just set
+# [Rspamd] enabled = true after first boot (see docker-deploy/README.md) and restart.
+#
+# Build from the repo root:
+#   docker build -f docker-deploy/Dockerfile.rspamd -t mailgoserver-rspamd .
+
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/mailgoserver .
+
+FROM debian:bookworm-slim
+# rspamd is installed from its own APT repo (rspamd.com), not Debian's bundled
+# package, which tends to lag several releases behind — this is genuinely the latest
+# stable release, matching what was asked for.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        ca-certificates tzdata curl gnupg lsb-release \
+    && mkdir -p /usr/share/keyrings \
+    && curl -fsSL https://rspamd.com/apt-stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/rspamd.gpg \
+    && echo "deb [signed-by=/usr/share/keyrings/rspamd.gpg] https://rspamd.com/apt-stable/ $(lsb_release -cs) main" \
+        > /etc/apt/sources.list.d/rspamd.list \
+    && apt-get update && apt-get install -y --no-install-recommends rspamd \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /out/mailgoserver /usr/local/bin/mailgoserver
+COPY docker-deploy/entrypoint-rspamd.sh /usr/local/bin/entrypoint-rspamd.sh
+RUN chmod +x /usr/local/bin/entrypoint-rspamd.sh
+
+# /app/data: same as the standalone image (settings.ini, DB, mailstore, keys, certs).
+# /var/lib/rspamd: rspamd's own Bayes/fuzzy-hash storage, kept persistent separately so
+# rebuilding the image doesn't reset spam-learning state.
+WORKDIR /app/data
+VOLUME ["/app/data", "/var/lib/rspamd"]
+
+EXPOSE 25 465 143 993 5000 5001
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+    CMD curl -fs http://127.0.0.1:5000/health || exit 1
+
+ENTRYPOINT ["/usr/local/bin/entrypoint-rspamd.sh"]