lukasandClaude Opus 5
cc26ae7eaf
Synology Container Manager and QNAP Container Station build a project from a folder and look for `docker-compose.yml` in it. Pointing either at `docker/` finds the DEV service stack and starts the wrong thing, so production now has a root-level entry point. - docker-compose.yml at the repo root: `include`s the prod stack (relative paths resolve against the included file's directory, so the build context and backup.sh still resolve) and pins `name: webmail-prod`. A project name typed into the GUI overrides the file's, so the docs say to type the same one. - webmail.sh init now drops a `.env` symlink to docker/.env.prod in the repo root: the GUI reads `.env` from the project folder, and a symlink keeps one file to edit instead of two copies that drift. - Required-variable guards on DATA_ROOT / MASTER_KEY / POSTGRES_PASSWORD / APP_DOMAIN. A bare `docker compose up` with no env file used to interpolate DATA_ROOT to "" and bind-mount /postgres at the root of the filesystem; it now aborts with a message naming the variable. - require_env no longer sources the env file. Sourcing executed it as shell: ENABLED_PLUGINS=calendar contacts labels filters ran `contacts` as a command and broke every subcommand, and anything else in the file that holds the master key would have been executed too. Replaced with a compose-compatible KEY=VALUE parser; the template quotes the value as well. - doctor: no longer aborts on a not-yet-created DATA_ROOT (set -e + pipefail killed it inside a `df` assignment — on exactly the pre-install run where its NFS/SMB check is the one that matters), and probes the nearest existing ancestor so that check works before the directory exists. - docs §2.5 rewritten with what the GUI can and cannot do: no compose profiles (so no Meilisearch), no health-gated update, no restore; plus the Task Scheduler route for generating MASTER_KEY without enabling SSH, and why init/migrate showing "Exited (0)" is correct. Verified by running `docker compose up -d --wait` from the repo root with no -f and no --env-file (what the GUI does): all services healthy, migrations applied, app served, and deploy/webmail.sh manages the same project. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw
112 lines
4.1 KiB
Bash
112 lines
4.1 KiB
Bash
# ============================================================================
|
|
# Webmail production configuration.
|
|
#
|
|
# Copy to docker/.env.prod, fill in the three REQUIRED values, keep it safe:
|
|
# cp docker/.env.prod.example docker/.env.prod && chmod 600 docker/.env.prod
|
|
#
|
|
# THIS FILE IS A BACKUP ARTEFACT. MASTER_KEY is not stored anywhere else: lose
|
|
# it and every saved mail-account password becomes permanently undecryptable,
|
|
# even from a perfect database backup. Keep a copy in a password manager.
|
|
# ============================================================================
|
|
|
|
# --- REQUIRED ---------------------------------------------------------------
|
|
|
|
# Where all persistent data lives on the host. Use a real shared folder your NAS
|
|
# backup tool can see — not a Docker named volume.
|
|
# Synology: /volume1/docker/webmail/data
|
|
# QNAP: /share/Container/webmail/data
|
|
DATA_ROOT=/volume1/docker/webmail/data
|
|
|
|
# 32 random bytes, base64. Generate ONCE, then never change it:
|
|
# openssl rand -base64 32
|
|
MASTER_KEY=
|
|
|
|
# Database password. Generate once:
|
|
# openssl rand -base64 24 | tr -d '/+=' | cut -c1-24
|
|
POSTGRES_PASSWORD=
|
|
|
|
# --- Identity ---------------------------------------------------------------
|
|
# The domain your user handles are minted under (user@APP_DOMAIN) and the issuer
|
|
# shown in 2FA authenticator apps. It does NOT have to be publicly resolvable.
|
|
APP_DOMAIN=mail.home.lan
|
|
|
|
# --- Network ----------------------------------------------------------------
|
|
# The single published port. Avoid 5000/5001 (Synology DSM) and 8080 (QNAP QTS).
|
|
WEB_PORT=8088
|
|
# Bind to one NAS interface instead of every network, e.g. WEB_BIND=192.168.1.185
|
|
WEB_BIND=0.0.0.0
|
|
|
|
TZ=Europe/Warsaw
|
|
|
|
# --- Search -----------------------------------------------------------------
|
|
# pg = Postgres full-text. No extra container, no extra RAM. Default.
|
|
# meili = Meilisearch: typo tolerance, better ranking, faster on large mailboxes.
|
|
# Costs a container and ~0.7-1 GB RAM. Start it with:
|
|
# ./deploy/webmail.sh up --meili
|
|
# and after switching an existing install, rebuild the index:
|
|
# ./deploy/webmail.sh reindex
|
|
SEARCH_BACKEND=pg
|
|
# Required if SEARCH_BACKEND=meili — generate with: openssl rand -base64 32
|
|
MEILI_MASTER_KEY=
|
|
|
|
# --- Images -----------------------------------------------------------------
|
|
# `local` = built on this host from the repo. To deploy prebuilt images from
|
|
# your Gitea registry instead, set both of these (see deploy/build-push.sh):
|
|
# REGISTRY_PREFIX=192.168.1.185:8418/claude/webmail
|
|
# IMAGE_TAG=v1.0.0
|
|
REGISTRY_PREFIX=webmail
|
|
IMAGE_TAG=local
|
|
|
|
# --- Application ------------------------------------------------------------
|
|
LOG_LEVEL=INFO
|
|
UNDO_SECONDS=10
|
|
SESSION_TTL_DAYS=30
|
|
MAX_ATTACHMENT_MB=25
|
|
# Auto-purge Trash/Spam older than N days (0 disables).
|
|
TRASH_RETENTION_DAYS=30
|
|
# Server-side sender avatars (Gravatar + favicon), fetched by the server so
|
|
# senders never see your IP. Set false to make zero outbound web requests.
|
|
SENDER_AVATARS_ENABLED=true
|
|
|
|
GOOGLE_OAUTH_ENABLED=false
|
|
OAUTH_GOOGLE_CLIENT_ID=
|
|
OAUTH_GOOGLE_CLIENT_SECRET=
|
|
OAUTH_MS_CLIENT_ID=
|
|
OAUTH_MS_CLIENT_SECRET=
|
|
|
|
# Plugins whose schema is migrated on every start. Remove one to stop shipping
|
|
# its tables; `hello` is the SDK demo and is intentionally not listed.
|
|
ENABLED_PLUGINS="calendar contacts labels filters"
|
|
|
|
# --- Backups ----------------------------------------------------------------
|
|
BACKUP_AT=03:30
|
|
BACKUP_KEEP_DAYS=14
|
|
|
|
# --- Sizing (defaults suit a personal install on a shared NAS) --------------
|
|
# Peak worker RAM is roughly PARSE_CONCURRENCY x STREAM_PARSE_MB plus overhead.
|
|
INTERACTIVE_CONCURRENCY=8
|
|
BULK_CONCURRENCY=1
|
|
PARSE_CONCURRENCY=2
|
|
STREAM_PARSE_MB=8
|
|
PER_HOST_CONN_CAP=10
|
|
HOT_BUDGET_PER_WORKER=50
|
|
|
|
# Container caps. Total without Meilisearch: ~2.2 GB of *limits*; real steady
|
|
# usage for one or two mail accounts is around 700 MB-1 GB.
|
|
PG_MEM_LIMIT=768m
|
|
PG_SHARED_BUFFERS=256MB
|
|
PG_MAX_CONNECTIONS=100
|
|
PG_WORK_MEM=8MB
|
|
PG_MAINTENANCE_WORK_MEM=128MB
|
|
PG_EFFECTIVE_CACHE_SIZE=768MB
|
|
REDIS_MEM_LIMIT=160m
|
|
REDIS_MAXMEMORY=96mb
|
|
API_MEM_LIMIT=512m
|
|
API_CPUS=1.0
|
|
WORKER_SYNC_MEM_LIMIT=512m
|
|
WORKER_JOBS_MEM_LIMIT=640m
|
|
WORKER_CPUS=1.5
|
|
WEB_MEM_LIMIT=96m
|
|
BACKUP_MEM_LIMIT=256m
|
|
MEILI_MEM_LIMIT=1g
|