67 lines
3.5 KiB
Docker
67 lines
3.5 KiB
Docker
# syntax=docker/dockerfile:1
|
|
#
|
|
# mailgoserver + the latest rspamd, bundled in one container. Both processes share this
|
|
# container's network namespace, so rspamd's default "normal" worker
|
|
# (127.0.0.1:11333, the /checkv2 scanning API — see internal/mailstore/rspamd.go) is
|
|
# already exactly what [Rspamd] url defaults to in settings.ini. Just set
|
|
# [Rspamd] enabled = true after first boot (see docker-deploy/README.md) and restart.
|
|
# No redis here by design — see Dockerfile.aio for the variant that adds it (Bayes
|
|
# learning + greylisting).
|
|
#
|
|
# Build from the repo root:
|
|
# docker build -f docker-deploy/Dockerfile.rspamd -t mailgoserver-rspamd .
|
|
|
|
FROM golang:1.26-bookworm AS build
|
|
WORKDIR /src
|
|
COPY go.mod go.sum ./
|
|
RUN go mod download
|
|
COPY . .
|
|
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/mailgoserver .
|
|
|
|
FROM debian:bookworm-slim
|
|
# rspamd is installed from its own APT repo (rspamd.com), not Debian's bundled
|
|
# package, which tends to lag several releases behind — this is genuinely the latest
|
|
# stable release, matching what was asked for.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates tzdata curl gnupg lsb-release libcap2-bin \
|
|
&& mkdir -p /usr/share/keyrings \
|
|
&& curl -fsSL https://rspamd.com/apt-stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/rspamd.gpg \
|
|
&& echo "deb [signed-by=/usr/share/keyrings/rspamd.gpg] https://rspamd.com/apt-stable/ $(lsb_release -cs) main" \
|
|
> /etc/apt/sources.list.d/rspamd.list \
|
|
&& apt-get update && apt-get install -y --no-install-recommends rspamd \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Redirect rspamd's own persistent state (fuzzy storage, DNS/maps cache) into
|
|
# server_data/rspamd at container-start (see entrypoint-rspamd.sh, which creates and
|
|
# chowns that directory — it doesn't exist yet at build time, since it lives on the
|
|
# volume) rather than the package default /var/lib/rspamd, so this whole image only
|
|
# ever needs one volume mounted: server_data/, matching mailgoserver's own layout.
|
|
RUN mkdir -p /etc/rspamd/local.d && printf 'dbdir = "/app/server_data/rspamd";\n' > /etc/rspamd/local.d/options.inc
|
|
|
|
COPY --from=build /out/mailgoserver /usr/local/bin/mailgoserver
|
|
RUN setcap 'cap_net_bind_service=+ep' /usr/local/bin/mailgoserver
|
|
COPY docker-deploy/entrypoint-rspamd.sh /usr/local/bin/entrypoint-rspamd.sh
|
|
RUN chmod +x /usr/local/bin/entrypoint-rspamd.sh
|
|
|
|
# rspamd's own .deb postinst already creates the "rspamd" system user; mailgoserver
|
|
# gets one here for the same reason as the standalone Dockerfile — neither process runs
|
|
# as root (see entrypoint-rspamd.sh for how each is dropped to its own user).
|
|
RUN useradd --system --create-home --home-dir /app --shell /usr/sbin/nologin mailgoserver \
|
|
&& mkdir -p /app/server_data \
|
|
&& chown -R mailgoserver:mailgoserver /app \
|
|
&& chmod 755 /app
|
|
WORKDIR /app
|
|
VOLUME ["/app/server_data"]
|
|
# Deliberately stays root here (unlike the standalone Dockerfile's USER mailgoserver) —
|
|
# the entrypoint script itself needs root just long enough to chown server_data/rspamd
|
|
# and drop privileges for each child process individually; see entrypoint-rspamd.sh.
|
|
|
|
# Port 80 is only actually bound while [LetsEncrypt] challenge_type=http-01 is enabled
|
|
# and an obtain/renew is in flight — harmless to expose even when unused.
|
|
EXPOSE 25 465 143 993 80 5000 5001
|
|
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
|
|
CMD curl -fs http://127.0.0.1:5000/health || exit 1
|
|
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint-rspamd.sh"]
|