updated layout for webmail and added http dns letsencrypt

docker-deploy/.env.example

@@ -5,5 +5,6 @@ SMTP_PORT=25
 SMTP_TLS_PORT=465
 IMAP_PORT=143
 IMAP_TLS_PORT=993
+ACME_HTTP_PORT=80
 WEB_HTTP_PORT=5000
 WEB_HTTPS_PORT=5001

docker-deploy/Dockerfile

@@ -39,8 +39,10 @@ VOLUME ["/app/data"]
 # SMTP 465, IMAP 143, direct-TLS IMAP 993 (the actual standard ports — binding them
 # needs no setcap/capability here since this container runs as root), admin/webmail
 # HTTP 5000, HTTPS 5001 (deliberately non-privileged; put a reverse proxy or the host's
-# own 80/443 in front if you want those too).
-EXPOSE 25 465 143 993 5000 5001
+# own 80/443 in front if you want those too). Port 80 is only actually bound while
+# [LetsEncrypt] challenge_type=http-01 is enabled and an obtain/renew is in flight —
+# harmless to expose even when unused.
+EXPOSE 25 465 143 993 80 5000 5001
 
 # --host 0.0.0.0 is required: the binary's own default is 127.0.0.1, which would only
 # be reachable from inside this container, never through a published port.

docker-deploy/Dockerfile.rspamd

@@ -39,7 +39,9 @@ RUN chmod +x /usr/local/bin/entrypoint-rspamd.sh
 WORKDIR /app/data
 VOLUME ["/app/data", "/var/lib/rspamd"]
 
-EXPOSE 25 465 143 993 5000 5001
+# Port 80 is only actually bound while [LetsEncrypt] challenge_type=http-01 is enabled
+# and an obtain/renew is in flight — harmless to expose even when unused.
+EXPOSE 25 465 143 993 80 5000 5001
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
     CMD curl -fs http://127.0.0.1:5000/health || exit 1

docker-deploy/README.md

@@ -23,11 +23,12 @@ docker compose --profile with-rspamd up -d --build
 Either way, the app itself now binds the real standard mail ports by default — 25
 (SMTP), 465 (direct-TLS SMTP), 143 (IMAP), 993 (direct-TLS IMAP) — and the admin/webmail
 UI on its usual non-privileged 5000/5001 (HTTP/HTTPS); put your own reverse proxy or a
-`80:5000`/`443:5001` port mapping in front if you want those on 80/443 too. Binding the
-low mail ports needs no extra capability here since the container runs as root. Copy
-`.env.example` to `.env` in this folder to change any host-side port — useful if
-something else on the host already owns 25/143/etc., or if you want to run both
-profiles side by side.
+`80:5000`/`443:5001` port mapping in front if you want those on 80/443 too (note port 80
+is already published here for Let's Encrypt HTTP-01, see below — pick a different host
+port for the web UI's 80 mapping if you use both). Binding the low mail ports needs no
+extra capability here since the container runs as root. Copy `.env.example` to `.env` in
+this folder to change any host-side port — useful if something else on the host already
+owns 25/143/etc., or if you want to run both profiles side by side.
 
 ## What happens on first boot
 
@@ -76,6 +77,25 @@ This bundle intentionally skips Redis — rspamd runs fine without it for SPF/DK
 regexp-based scoring, but Bayes learning and greylisting need it. Add a `redis` service
 to `docker-compose.yml` and point rspamd's `redis.conf` at it if you need those.
 
+## Let's Encrypt HTTP-01 (no DNS provider needed)
+
+If this domain's DNS isn't hosted anywhere the app can automate, enable HTTP-01 on the
+admin dashboard's Let's Encrypt page and restart the container — it runs independently
+alongside (or instead of) the DNS-01 flow above, obtaining its own separate certificate.
+Port 80 (already published by `docker-compose.yml`) stays bound for the container's
+whole lifetime once enabled, not just during an obtain — `curl` it and you should get a
+plain `200 ok`, the quickest way to confirm your port-forwarding/reverse-proxy setup
+actually reaches this container. Optionally also request the certificate for this
+container's public IP address (autodetected, or a manual override) so clients connecting
+by bare IP get a trusted cert too — note this uses Let's Encrypt's `shortlived` profile,
+so those certificates renew roughly every few days instead of every couple months
+(handled automatically).
+
+Which listener actually uses which certificate — the DNS-01 cert, the HTTP-01 cert, or
+the custom/self-signed one — is chosen independently per listener (SMTP-TLS, IMAP-TLS,
+web UI) on the admin dashboard's Settings page. A common setup: HTTP-01 for
+SMTP/IMAP, DNS-01 (or a real custom cert) for the web UI.
+
 ## Persistence
 
 | Volume | What's in it |

docker-deploy/docker-compose.yml

@@ -4,9 +4,11 @@
 #   docker compose --profile with-rspamd up -d --build    # mailserver + rspamd, same container
 #
 # Both default to the standard mail ports on the host (25/465/143/993) — the app itself
-# now binds those directly, no port remapping needed — plus the app's own non-privileged
-# web ports (5000/5001; put a reverse proxy or your own 80/443 mapping in front of those
-# if you want the dashboard on standard web ports too). Only run one profile at a time
+# now binds those directly, no port remapping needed — plus port 80 (only actually used
+# while Let's Encrypt HTTP-01 is enabled, see internal/webui's Let's Encrypt page) and
+# the app's own non-privileged web ports (5000/5001; put a reverse proxy or your own
+# 80/443 mapping in front of those if you want the dashboard on standard web ports too —
+# note port 80 is already claimed here for HTTP-01 if you enable it). Only run one profile at a time
 # unless you've overridden the host ports for one of them (see .env.example) — they'd
 # otherwise both try to bind the same host ports.
 services:
@@ -22,6 +24,7 @@ services:
       - "${SMTP_TLS_PORT:-465}:465"
       - "${IMAP_PORT:-143}:143"
       - "${IMAP_TLS_PORT:-993}:993"
+      - "${ACME_HTTP_PORT:-80}:80"
       - "${WEB_HTTP_PORT:-5000}:5000"
       - "${WEB_HTTPS_PORT:-5001}:5001"
     volumes:
@@ -39,6 +42,7 @@ services:
       - "${SMTP_TLS_PORT:-465}:465"
       - "${IMAP_PORT:-143}:143"
       - "${IMAP_TLS_PORT:-993}:993"
+      - "${ACME_HTTP_PORT:-80}:80"
       - "${WEB_HTTP_PORT:-5000}:5000"
       - "${WEB_HTTPS_PORT:-5001}:5001"
     volumes: