mirror of
https://github.com/profullstack/agentbbs.git
synced 2026-08-13 22:37:28 +00:00
Anthony Ettinger
cb09300357
Members get a real <name>@mail.profullstack.com mailbox, served by a
co-located Mailu (Postfix+Dovecot+Roundcube+rspamd) Docker stack. Coexists
with the host Caddy: Mailu owns the mail ports; Caddy fronts the loopback
webmail and supplies the TLS cert (TLS_FLAVOR=mail), the same cert-copy
pattern as the Ergo/IRC and NNTP services.
- deploy/mailu/: docker-compose.yml, mailu.env.example, refresh-certs.sh
(copy Caddy's mail cert into Mailu on renewal), provision-mailbox.sh
(member mailbox + Dovecot gateway master user), README.
- setup.sh: MAIL flag + mail.${DOMAIN#*.} Caddy site + §9e (cert timer,
mail-port firewall, conditional compose bring-up, AGENTBBS_MAIL_* env).
- docs/mail.md: architecture, DNS (MX/SPF/DKIM/DMARC/PTR), gateway
master-user setup, env, provisioning, webmail-only policy.
Apex profullstack.com stays corporate; member mail is only on mail.*.
Infra is inspection-verified (bash -n, YAML lint); deploy pending.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
1.7 KiB
Markdown
53 lines
1.7 KiB
Markdown
# deploy/mailu — self-hosted mail for `mail.profullstack.com`
|
|
|
|
Mailu (Postfix + Dovecot + Roundcube + rspamd) as a Docker Compose stack,
|
|
fronted by the host Caddy. Full setup, DNS, and architecture: [`docs/mail.md`](../../docs/mail.md).
|
|
|
|
## Files
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `docker-compose.yml` | the Mailu services (mail ports on host, HTTP on loopback) |
|
|
| `mailu.env.example` | config template → copy to `mailu.env` and fill secrets |
|
|
| `refresh-certs.sh` | copy Caddy's `mail.$DOMAIN` cert into Mailu, reload (timer) |
|
|
| `provision-mailbox.sh` | create a member mailbox / the gateway master user |
|
|
|
|
`mailu.env`, `certs/`, and `data/` are gitignored (secrets + state).
|
|
|
|
## Gateway master user
|
|
|
|
The agentbbs gateway opens any member's mailbox over IMAP with a single secret,
|
|
using Dovecot's **master user** feature (login `<name>*<master>`). Enable it with
|
|
a Dovecot override so Mailu accepts the `*` separator:
|
|
|
|
`data/overrides/dovecot/auth-master.conf`:
|
|
|
|
```
|
|
auth_master_user_separator = *
|
|
passdb {
|
|
driver = static
|
|
args = nopassword=y
|
|
master = yes
|
|
result_success = continue
|
|
}
|
|
```
|
|
|
|
Then create the master account and point agentbbs at it:
|
|
|
|
```bash
|
|
./provision-mailbox.sh --master "$(openssl rand -hex 16)"
|
|
# AGENTBBS_MAIL_MASTER_USER=gateway, AGENTBBS_MAIL_MASTER_PASS=<that secret>
|
|
```
|
|
|
|
> The exact master-passdb wiring varies by Mailu version; verify against your
|
|
> pinned image before relying on it in production. SMTP submission from the
|
|
> gateway uses the trusted local relay (`127.0.0.1:25`), not the master user.
|
|
|
|
## Ops
|
|
|
|
```bash
|
|
docker compose up -d # start
|
|
docker compose logs -f smtp # tail Postfix
|
|
docker compose exec admin flask mailu config-export # DKIM keys, etc.
|
|
docker compose down # stop
|
|
```
|