lukas/webmail-client
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deploy: a release that adds a service must actually start it

Browse Source 
Three things stood between v1.1.0 and a working anti-spam engine on an existing
install, each silent:

`update` rolled only worker-sync, worker-jobs, api and web. A release that adds
a service — this one adds two — would report success while never creating it.
It now converges the rest with `up -d --no-recreate`, which creates what is
absent and leaves the rolled services alone.

.env.prod.example pinned ENABLED_PLUGINS to the four plugins that existed when it
was written. The entrypoint's default includes antispam, but an explicit value in
.env wins, so migrate would skip the plugin's tables and every antispam request
would fail at runtime rather than at install. The template is fixed for new
installs; `doctor` now warns existing ones, comparing .env against the
entrypoint's default so there is still one list, not two.

And the runbook now documents what the engine costs (~150-300 MB), that nothing
depends on it by design, that `init` must be re-run for the controller password,
and that its Bayes database is derived data like the search index.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo
This commit is contained in:
lukas
2026-09-17 20:44:25 +02:00
co-authored by Claude Opus 5
parent 5aa133e18c
commit b54ccbe653
3 changed files with 45 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/nas-install.md
+19 -1
View File
@@ -556,12 +556,30 @@ Steady state for one or two mail accounts, `SEARCH_BACKEND=pg`:
| worker-sync | 120-250 MB | `WORKER_SYNC_MEM_LIMIT=512m` |
| worker-jobs | 150-350 MB | `WORKER_JOBS_MEM_LIMIT=640m` |
| redis / web / backup | < 100 MB total | — |
| **total** | **~0.7-1.2 GB** | ~2.2 GB of limits |
| rspamd + its redis | 150-300 MB | `RSPAMD_MEM_LIMIT=256m`, `RSPAMD_REDIS_MEM_LIMIT=160m` |
| **total** | **~0.9-1.5 GB** | ~2.6 GB of limits |
| meilisearch (optional) | 300-800 MB | `MEILI_MEM_LIMIT=1g` |
On a 2 GB NAS: stay on `SEARCH_BACKEND=pg` and drop `PG_SHARED_BUFFERS` to
`128MB`. Tight but workable. On 4 GB+ you have room for Meilisearch.
### The anti-spam engine
`rspamd` and `redis-rspamd` start with everything else — spam filtering is part
of the stack, not an add-on. Two things follow from that:
- **Nothing waits for them.** No service declares `depends_on: rspamd`, so an
engine that is down, slow or restarting cannot delay mail. Classification is
best-effort; delivery is not. The health gate ignores it for the same reason.
- **`webmail.sh init` generates `RSPAMD_CONTROLLER_PASSWORD`.** It is internal —
nobody types it — but the engine will not start without it. Upgrading an
install that predates the engine means re-running `init`, which only fills in
values that are empty and never touches `MASTER_KEY`.
Its Bayes database lives in `$DATA_ROOT/rspamd-redis`. Like the search index,
that is derived data: it rides along in backups but never needs restoring, and
retraining rebuilds it.
Two NAS-specific realities worth knowing:
- **Disk hibernation won't happen.** Active accounts hold IMAP IDLE connections