networks:
  clamav:
    driver: overlay
  default:
    driver: overlay
    ipam:
      config:
        - subnet: 192.168.205.0/24
      driver: default
  fts_attachments:
    driver: overlay
    internal: true
  oletools:
    driver: overlay
    internal: true
  radicale:
    driver: overlay
  webmail:
    driver: overlay

services:
  admin:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}admin:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/data:/data
      - /share/docker_data/mailu3/dkim:/dkim
    networks:
      # Swarm uses service discovery, but requires network connection
      - default
      # DNS is handled by Swarm's internal DNS resolver (the resolver service will be discoverable by name)
  
  antispam:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}rspamd:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    hostname: antispam
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/filter:/var/lib/rspamd
      - /share/docker_data/mailu3/overrides/rspamd:/overrides:ro
    networks:
      - default
      - oletools
      - clamav

  antivirus:
    image: ${DOCKER_REGISTRY:-}clamav/clamav-debian:1.2.0-6
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/filter/clamav:/var/lib/clamav
    networks:
      - clamav
    healthcheck:
      test:
        - CMD-SHELL
        - kill -0 `cat /tmp/clamd.pid` && kill -0 `cat /tmp/freshclam.pid`
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s

  fetchmail:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}fetchmail:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/data/fetchmail:/data
    networks:
      - default # Connect to 'default' for service discovery


  front:
    # NOTE: 'extends' is removed. You must manually define logging or accept default.
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}nginx:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
      homepage.container: mailu3-front-1
      homepage.description: eMail server
      homepage.group: Utilities
      homepage.href: https://mail.sectorq.eu
      homepage.icon: ${APPNAME}.png
      homepage.name: Mailu
      homepage.server: my-docker
      homepage.weight: 1
    volumes:
      - /share/docker_data/mailu3/certs:/certs
      - /share/docker_data/mailu3/overrides/nginx:/overrides:ro
    networks:
      - default
      - webmail
      - radicale
    ports:
      - target: 80
        published: 8880
        protocol: tcp
        mode: ingress
      - target: 443
        published: 8443
        protocol: tcp
        mode: ingress
      - target: 25
        published: 25
        protocol: tcp
        mode: ingress
      - target: 465
        published: 465
        protocol: tcp
        mode: ingress
      - target: 587
        published: 587
        protocol: tcp
        mode: ingress
      - target: 110
        published: 110
        protocol: tcp
        mode: ingress
      - target: 995
        published: 995
        protocol: tcp
        mode: ingress
      - target: 143
        published: 143
        protocol: tcp
        mode: ingress
      - target: 993
        published: 993
        protocol: tcp
        mode: ingress
      - target: 4190
        published: 4190
        protocol: tcp
        mode: ingress


  fts_attachments:
    image: ${DOCKER_REGISTRY:-}apache/tika:2.9.2.1-full
    hostname: tika
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    networks:
      - fts_attachments
    healthcheck:
      test:
        - CMD-SHELL
        - wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s


  imap:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}dovecot:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/mail:/mail
      - /share/docker_data/mailu3/overrides/dovecot:/overrides:ro
    networks:
      - default
      - fts_attachments


  oletools:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}oletools:${MAILU_VERSION:-2024.06}
    hostname: oletools
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    networks:
      - oletools


  redis:
    image: ${DOCKER_REGISTRY:-}redis:alpine
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/redis:/data
    networks:
      - default # Connect to default network


  resolver:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}unbound:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    networks:
      default:
        # NOTE: Swarm does not support static IPs for scaling. 
        # This will fail standard 'docker stack deploy'. 
        # For mailu, the static IP is critical, so we attempt to enforce it 
        # via the deploy key, but be aware this is highly non-standard.
        # It's better to configure Mailu to use the service name 'resolver' instead of the static IP.
        # If using a customized deployer:
        # deploy:
        #   placement:
        #     constraints:
        #       - node.hostname == your-swarm-manager
        #   endpoint_mode: dnsrr
        #   mode: global
        #   replicas: 1
        #   labels:
        #     com.docker.stack.static_ips: 192.168.205.254
        #     com.docker.stack.static_network: default
        ipv4_address: 192.168.205.254


  smtp:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}postfix:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/mailqueue:/queue
      - /share/docker_data/mailu3/overrides/postfix:/overrides:ro
    networks:
      - default # Connect to default network

  webdav:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}radicale:${MAILU_VERSION:-2024.06}
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/dav:/data
    networks:
      - radicale


  webmail:
    image: ${DOCKER_REGISTRY:-}ghcr.io/mailu/${DOCKER_PREFIX:-}webmail:${MAILU_VERSION:-2024.06}
    env_file: stack.env
    labels:
      wud.watch: 'true'
      wud.watch.digest: 'true'
    volumes:
      - /share/docker_data/mailu3/webmail:/data
      - /share/docker_data/mailu3/overrides/roundcube:/overrides:ro
    networks:
      - webmail