mox/docker-compose-integration.yml at main · iwanofski/mox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
services:
  # We run integration_test.go from this container, it connects to the other mox instances.
  test:
    hostname: test.mox1.example
    image: mox_integration_test
    # We add our cfssl-generated CA (which is in the repo) and acme pebble CA
    # (generated each time pebble starts) to the list of trusted CA's, so the TLS
    # dials in integration_test.go succeed.
    command: ["sh", "-c", "set -ex; cat /integration/tmp-pebble-ca.pem /integration/tls/ca.pem >>/etc/ssl/certs/ca-certificates.crt; go test -tags integration"]
    volumes:
      - ./.go:/.go:z
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
      - ./testdata/integration/moxsubmit.conf:/etc/moxsubmit.conf:z
      - .:/mox:z
    environment:
      GOCACHE: /.go/.cache/go-build
    depends_on:
      dns:
        condition: service_healthy
      # moxmail2 depends on moxacmepebble, we connect to both.
      moxmail2:
        condition: service_healthy
      postfixmail:
        condition: service_healthy
      localserve:
        condition: service_healthy
      moxacmepebblealpn:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.50

  # First mox instance that uses ACME with pebble.
  moxacmepebble:
    hostname: moxacmepebble.mox1.example
    domainname: mox1.example
    image: mox_integration_moxmail
    environment:
      MOX_UID: "${MOX_UID}"
    command: ["sh", "-c", "/integration/moxacmepebble.sh"]
    volumes:
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
    healthcheck:
      test: netstat -nlt | grep ':25 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
      acmepebble:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.10

  # Second mox instance, with TLS cert/keys from files.
  moxmail2:
    hostname: moxmail2.mox2.example
    domainname: mox2.example
    image: mox_integration_moxmail
    environment:
      MOX_UID: "${MOX_UID}"
    command: ["sh", "-c", "/integration/moxmail2.sh"]
    volumes:
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
    healthcheck:
      test: netstat -nlt | grep ':25 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
      acmepebble:
        condition: service_healthy
      # moxacmepebble creates tmp-pebble-ca.pem, needed by moxmail2 to trust the certificates offered by moxacmepebble.
      moxacmepebble:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.20

  # Third mox instance that uses ACME with pebble and has ALPN enabled.
  moxacmepebblealpn:
    hostname: moxacmepebblealpn.mox1.example
    domainname: mox1.example
    image: mox_integration_moxmail
    environment:
      MOX_UID: "${MOX_UID}"
    command: ["sh", "-c", "/integration/moxacmepebblealpn.sh"]
    volumes:
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
    healthcheck:
      test: netstat -nlt | grep ':25 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
      acmepebble:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.80

  localserve:
    hostname: localserve.mox1.example
    domainname: mox1.example
    image: mox_integration_moxmail
    command: ["sh", "-c", "set -e; chmod o+r /etc/resolv.conf; mox -checkconsistency localserve -ip 172.28.1.60"]
    volumes:
      - ./.go:/.go:z
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - .:/mox:z
    environment:
      GOCACHE: /.go/.cache/go-build
    healthcheck:
      test: netstat -nlt | grep ':1025 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.60

  postfixmail:
    hostname: postfixmail.postfix.example
    domainname: postfix.example
    build:
      dockerfile: Dockerfile.postfix
      context: testdata/integration
    volumes:
      # todo: figure out how to mount files with a uid that the process in the container can read...
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
    command: ["sh", "-c", "set -e; chmod o+r /etc/resolv.conf; (echo 'maillog_file = /dev/stdout'; echo 'mydestination = $$myhostname, localhost.$$mydomain, localhost, $$mydomain'; echo 'smtp_tls_security_level = may') >>/etc/postfix/main.cf; echo 'root: postfix@mox1.example' >>/etc/postfix/aliases; newaliases; postfix start-fg"]
    healthcheck:
      test: netstat -nlt | grep ':25 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.70

  dns:
    hostname: dns.example
    build:
      dockerfile: Dockerfile.dns
      # todo: figure out how to build from dockerfile with empty context without creating empty dirs in file system.
      context: testdata/integration
    volumes:
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
    # We start with a base example.zone, but moxacmepebble appends its records,
    # followed by moxmail2. They restart unbound after appending records.
    command: ["sh", "-c", "set -ex; ls -l /etc/resolv.conf; chmod o+r /etc/resolv.conf; install -m 640 -o unbound /integration/unbound.conf /etc/unbound/; chmod 755 /integration; chmod 644 /integration/*.zone; cp /integration/example.zone /integration/example-integration.zone; ls -ld /integration /integration/reverse.zone; unbound -d -p -v"]
    healthcheck:
      test: netstat -nlu | grep '172.28.1.30:53 '
      interval: 1s
      timeout: 1s
      retries: 10
    networks:
      mailnet1:
        ipv4_address: 172.28.1.30

  # pebble is a small acme server useful for testing. It creates a new CA
  # certificate each time it starts, so we go through some trouble to configure the
  # certificate in moxacmepebble and moxmail2.
  acmepebble:
    hostname: acmepebble.example
    image: docker.io/letsencrypt/pebble:v2.3.1@sha256:fc5a537bf8fbc7cc63aa24ec3142283aa9b6ba54529f86eb8ff31fbde7c5b258
    volumes:
      - ./testdata/integration/resolv.conf:/etc/resolv.conf:z
      - ./testdata/integration:/integration:z
    command: ["sh", "-c", "set -ex; mount; ls -l /etc/resolv.conf; chmod o+r /etc/resolv.conf; pebble -config /integration/pebble-config.json"]
    ports:
      - 14000:14000  # ACME port
      - 15000:15000  # Management port
    healthcheck:
      test: netstat -nlt | grep ':14000 '
      interval: 1s
      timeout: 1s
      retries: 10
    depends_on:
      dns:
        condition: service_healthy
    networks:
      mailnet1:
        ipv4_address: 172.28.1.40

networks:
  mailnet1:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: "172.28.1.0/24"