build

2025-12-13 18:04:54 +01:00 · 2025-11-13 02:03:38 +01:00
parent e71867f77c
commit 680961397f
5 changed files with 524 additions and 0 deletions
--- a/immich/docker-compose
+++ b/immich/docker-compose
@@ -0,0 +1,88 @@
+name: immich
+services:
+  database:
+    command: postgres -c shared_preload_libraries=vectors.so -c 'search_path="$$user",
+      public, vectors' -c logging_collector=on -c max_wal_size=2GB -c shared_buffers=512MB
+      -c wal_compression=on
+    container_name: immich_postgres
+    env_file:
+    - stack.env
+    environment:
+      POSTGRES_INITDB_ARGS: --data-checksums
+    healthcheck:
+      interval: 5m
+      start_interval: 30s
+      start_period: 5m
+      test: pg_isready --dbname="$${DB_PASSWORD}" --username="$${DB_USERNAME}" ||
+        exit 1; Chksum="$$(psql --dbname="$${DB_DATABASE_NAME}" --username="$${DB_USERNAME}"
+        --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures),
+        0) FROM pg_stat_database')"; echo "checksum failure count is $$Chksum"; [
+        "$$Chksum" = '0' ] || exit 1
+    image: ${DOCKER_REGISTRY:-}docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/immich/db:/var/lib/postgresql/data
+  immich-machine-learning:
+    container_name: immich_machine_learning
+    env_file:
+    - stack.env
+    extends:
+      file: hwaccel.ml.yml
+      service: ${HW_MODE2:-cpu}
+    healthcheck:
+      disable: false
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - model-cache:/cache
+  immich-server:
+    container_name: immich_server
+    depends_on:
+    - redis
+    - database
+    env_file:
+    - stack.env
+    extends:
+      file: hwaccel.transcoding.yml
+      service: ${HW_MODE1:-cpu}
+    healthcheck:
+      disable: false
+    image: ${DOCKER_REGISTRY:-}ghcr.io/immich-app/immich-server:${IMMICH_VERSION:-release}
+    labels:
+      homepage.container: immich_server
+      homepage.description: Photo server
+      homepage.group: Media
+      homepage.href: https://${APPNAME}.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Immich
+      homepage.server: my-docker
+      homepage.widget.key: wVxjlztA8MpeuzKkNGCSUPK2WjAY55qq4cfs9Zr5opU
+      homepage.widget.type: ${APPNAME}
+      homepage.widget.url: https://${APPNAME}.sectorq.eu
+      homepage.widget.version: '2'
+      wud.watch: true
+      wud.watch.digest: true
+    ports:
+    - 2283:2283
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/immich/library:/usr/src/app/upload
+    - /media/nas/nas-photo:/mnt/photos2
+    - /etc/localtime:/etc/localtime:ro
+  redis:
+    container_name: immich_redis
+    healthcheck:
+      test: redis-cli ping || exit 1
+    image: ${DOCKER_REGISTRY:-}docker.io/redis:6.2-alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+volumes:
+  model-cache: null
--- a/mailu3/.env
+++ b/mailu3/.env
@@ -0,0 +1,4 @@
+APPNAME=mailu
+DOCKER_REGISTRY=r.sectorq.eu/library/
+MAILU_VERSION=2024.06
+LOGGING=syslog
--- a/mailu3/docker-compose.yml
+++ b/mailu3/docker-compose.yml
@@ -0,0 +1,247 @@
+networks:
+  clamav:
+    driver: bridge
+  default:
+    driver: bridge
+    ipam:
+      config:
+      - subnet: 192.168.205.0/24
+      driver: default
+  fts_attachments:
+    driver: bridge
+    internal: true
+  oletools:
+    driver: bridge
+    internal: true
+  radicale:
+    driver: bridge
+  webmail:
+    driver: bridge
+services:
+  admin:
+    depends_on:
+      - redis
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/data:/data
+      - /share/docker_data/mailu3/dkim:/dkim
+  antispam:
+    depends_on:
+      - front
+      - redis
+      - oletools
+      - antivirus
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    hostname: antispam
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - oletools
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter:/var/lib/rspamd
+      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
+  antivirus:
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`
+      timeout: 5s
+    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.2.0-6
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - clamav
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
+  fetchmail:
+    depends_on:
+      - admin
+      - smtp
+      - imap
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+    - /share/docker_data/mailu3/data/fetchmail:/data
+  front:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    extends:
+      file: logging.yml
+      service: ${LOGGING:-syslog}
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+      homepage.container: mailu3-front-1
+      homepage.description: eMail server
+      homepage.group: Utilities
+      homepage.href: https://mail.sectorq.eu
+      homepage.icon: ${APPNAME}.png
+      homepage.name: Mailu
+      homepage.server: my-docker
+      homepage.weight: 1
+
+    networks:
+      - default
+      - webmail
+      - radicale
+    ports:
+      - 0.0.0.0:8880:80
+      - 0.0.0.0:8443:443
+      - 0.0.0.0:25:25
+      - 0.0.0.0:465:465
+      - 0.0.0.0:587:587
+      - 0.0.0.0:110:110
+      - 0.0.0.0:995:995
+      - 0.0.0.0:143:143
+      - 0.0.0.0:993:993
+      - 0.0.0.0:4190:4190
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/certs:/certs
+      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
+  fts_attachments:
+    depends_on:
+     - resolver
+    dns:
+      - 192.168.205.254
+    healthcheck:
+      interval: 10s
+      retries: 3
+      start_period: 10s
+      test:
+        - CMD-SHELL
+        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
+      timeout: 5s
+    hostname: tika
+    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+  imap:
+    depends_on:
+      - front
+      - fts_attachments
+      - resolver
+    dns:
+      - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - default
+      - fts_attachments
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/mail:/mail
+      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
+  oletools:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    hostname: oletools
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - oletools
+    restart: ${RESTART:-unless-stopped}
+  redis:
+    depends_on:
+      - resolver
+    dns:
+      - 192.168.205.254
+    image: ${DOCKER_REGISTRY:-}redis:alpine
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: unless-stopped
+    volumes:
+    - /share/docker_data/mailu3/redis:/data
+  resolver:
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      default:
+        ipv4_address: 192.168.205.254
+    restart: ${RESTART:-unless-stopped}
+  smtp:
+    depends_on:
+      - front
+      - resolver
+    dns:
+     - 192.168.205.254
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+     - /share/docker_data/mailu3/mailqueue:/queue
+     - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
+  webdav:
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - radicale
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/dav:/data
+  webmail:
+    depends_on:
+      - front
+    env_file: stack.env
+    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
+    labels:
+      wud.watch: true
+      wud.watch.digest: true
+    networks:
+      - webmail
+    restart: ${RESTART:-unless-stopped}
+    volumes:
+      - /share/docker_data/mailu3/webmail:/data
+      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro
--- a/mailu3/logging.yml
+++ b/mailu3/logging.yml
@@ -0,0 +1,18 @@
+---
+services:
+  syslog:
+    logging:
+      driver: syslog
+      options:
+        tag: mailu-front
+  journald:
+    logging:
+      driver: journald
+      options:
+        tag: mailu-front
+  loki:
+    logging:
+      driver: loki
+      options:
+        loki-url: "http://192.168.77.101:3100/loki/api/v1/push"
+
--- a/mailu3/stack.env
+++ b/mailu3/stack.env
@@ -0,0 +1,167 @@
+# Mailu main configuration file
+#
+# This file is autogenerated by the configuration management wizard for compose flavor.
+# For a detailed list of configuration variables, see the documentation at
+# https://mailu.io
+
+###################################
+# Common configuration variables
+###################################
+
+# Set to a randomly generated 16 bytes string
+SECRET_KEY=T1GSGDDBVRYF7UR7
+
+# Subnet of the docker network. This should not conflict with any networks to which your system is connected. (Internal and external!)
+SUBNET=192.168.205.0/24
+
+# Main mail domain
+DOMAIN=mail.sectorq.eu
+
+# Hostnames for this server, separated with commas
+HOSTNAMES=mail.sectorq.eu,sectorq.eu
+
+# Postmaster local part (will append the main mail domain)
+POSTMASTER=admin
+
+# Choose how secure connections will behave (value: letsencrypt, cert, notls, mail, mail-letsencrypt)
+#TLS_FLAVOR=cert
+TLS_FLAVOR=letsencrypt
+# Authentication rate limit per IP (per /24 on ipv4 and /48 on ipv6)
+AUTH_RATELIMIT_IP=5/hour
+
+# Authentication rate limit per user (regardless of the source-IP)
+AUTH_RATELIMIT_USER=50/day
+
+# Opt-out of statistics, replace with "True" to opt out
+DISABLE_STATISTICS=True
+
+###################################
+# Optional features
+###################################
+
+# Expose the admin interface (value: true, false)
+ADMIN=true
+
+# Choose which webmail to run if any (values: roundcube, snappymail, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBMAIL=roundcube
+
+# Expose the API interface (value: true, false)
+API=true
+
+# Dav server implementation (value: radicale, none). To enable this feature, recreate the docker-compose.yml file via setup.
+WEBDAV=radicale
+
+# Antivirus solution (value: clamav, none). To enable this feature, recreate the docker-compose.yml file via setup.
+ANTIVIRUS=clamav
+
+# Scan Macros solution (value: true, false). To enable this feature, recreate the docker-compose.yml file via setup.
+SCAN_MACROS=true
+
+###################################
+# Mail settings
+###################################
+
+# Message size limit in bytes
+# Default: accept messages up to 50MB
+# Max attachment size will be 33% smaller
+MESSAGE_SIZE_LIMIT=50000000
+
+# Message rate limit (per user)
+MESSAGE_RATELIMIT=200/day
+
+# Networks granted relay permissions
+# Use this with care, all hosts in this networks will be able to send mail without authentication!
+RELAYNETS=
+
+# Will relay all outgoing mails if configured
+RELAYHOST=
+
+# Enable fetchmail
+FETCHMAIL_ENABLED=true
+
+# Fetchmail delay
+FETCHMAIL_DELAY=600
+
+# Recipient delimiter, character used to delimiter localpart from custom address part
+RECIPIENT_DELIMITER=+
+
+# DMARC rua and ruf email
+DMARC_RUA=admin
+DMARC_RUF=admin
+
+# Welcome email, enable and set a topic and body if you wish to send welcome
+# emails to all users.
+WELCOME=false
+WELCOME_SUBJECT=Welcome to your new email account
+WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
+
+# Maildir Compression
+# choose compression-method, default: none (value: gz, bz2, zstd)
+COMPRESSION=
+# change compression-level, default: 6 (value: 1-9)
+COMPRESSION_LEVEL=
+
+# IMAP full-text search is enabled by default.
+# Set the following variable to off in order to disable the feature
+# or a comma separated list of language codes to support
+FULL_TEXT_SEARCH=en
+
+###################################
+# Web settings
+###################################
+
+# Path to redirect / to
+WEBROOT_REDIRECT=/webmail
+
+# Path to the admin interface if enabled
+WEB_ADMIN=/admin
+
+# Path to the webmail if enabled
+WEB_WEBMAIL=/webmail
+
+# Path to the API interface if enabled
+WEB_API=/api
+
+# Website name
+SITENAME=sectorq
+
+# Linked Website URL
+WEBSITE=https://mail.sectorq.eu
+
+
+
+###################################
+# Advanced settings
+###################################
+
+# Docker-compose project name, this will prepended to containers names.
+COMPOSE_PROJECT_NAME=mailu
+
+# Number of rounds used by the password hashing scheme
+CREDENTIAL_ROUNDS=12
+
+# Header to take the real ip from
+REAL_IP_HEADER=X-Real-IP
+
+# IPs for nginx set_real_ip_from (CIDR list separated by commas)
+REAL_IP_FROM=192.168.77.101
+
+# choose wether mailu bounces (no) or rejects (yes) mail when recipient is unknown (value: yes, no)
+REJECT_UNLISTED_RECIPIENT=
+
+# Log level threshold in start.py (value: CRITICAL, ERROR, WARNING, INFO, DEBUG, NOTSET)
+LOG_LEVEL=INFO
+
+# Timezone for the Mailu containers. See this link for all possible values https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+TZ=EU/Bratislava
+
+# Default spam threshold used for new users
+DEFAULT_SPAM_THRESHOLD=80
+
+# API token required for authenticating to the RESTful API.
+# This is a mandatory setting for using the RESTful API.
+API_TOKEN=WM4QHB7FA6YBOQHC0M98CGM2LDG2OP4N
+
+# Whether tika should be enabled (scan/OCR email attachements). To enable this feature, recreate the docker-compose.yml file via setup.
+FULL_TEXT_SEARCH_ATTACHMENTS=true
+LD_PRELOAD=/usr/lib/libhardened_malloc.so