blob: 4780e79d53687a48bc4e270945dd15e9622dcde4 [file] [log] [blame]
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +01001#!/usr/bin/env bash
2
3set -o pipefail
4
5if [[ "$(uname -r)" =~ ^4\.15\.0-60 ]]; then
6 echo "DO NOT RUN mailcow ON THIS UBUNTU KERNEL!";
7 echo "Please update to 5.x or use another distribution."
8 exit 1
9fi
10
11if [[ "$(uname -r)" =~ ^4\.4\. ]]; then
12 if grep -q Ubuntu <<< $(uname -a); then
13 echo "DO NOT RUN mailcow ON THIS UBUNTU KERNEL!";
14 echo "Please update to linux-generic-hwe-16.04 by running \"apt-get install --install-recommends linux-generic-hwe-16.04\""
Matthias Andreas Benkard12a57352021-12-28 18:02:04 +010015 exit 1
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +010016 fi
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +010017fi
18
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +010019if grep --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo "BusyBox grep detected, please install gnu grep, \"apk add --no-cache --upgrade grep\""; exit 1; fi
20# This will also cover sort
21if cp --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo "BusyBox cp detected, please install coreutils, \"apk add --no-cache --upgrade coreutils\""; exit 1; fi
22if sed --help 2>&1 | head -n 1 | grep -q -i "busybox"; then echo "BusyBox sed detected, please install gnu sed, \"apk add --no-cache --upgrade sed\""; exit 1; fi
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +010023
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +010024for bin in openssl curl docker git awk sha1sum grep cut; do
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +010025 if [[ -z $(which ${bin}) ]]; then echo "Cannot find ${bin}, exiting..."; exit 1; fi
26done
27
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +010028if docker compose > /dev/null 2>&1; then
29 if docker compose version --short | grep "^2." > /dev/null 2>&1; then
30 COMPOSE_VERSION=native
31 echo -e "\e[31mFound Docker Compose Plugin (native).\e[0m"
32 echo -e "\e[31mSetting the DOCKER_COMPOSE_VERSION Variable to native\e[0m"
33 sleep 2
34 echo -e "\e[33mNotice: You´ll have to update this Compose Version via your Package Manager manually!\e[0m"
35 else
36 echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +010037 echo -e "\e[31mPlease update/install it manually regarding to this doc site: https://docs.mailcow.email/i_u_m/i_u_m_install/\e[0m"
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +010038 exit 1
39 fi
40elif docker-compose > /dev/null 2>&1; then
41 if ! [[ $(alias docker-compose 2> /dev/null) ]] ; then
42 if docker-compose version --short | grep "^2." > /dev/null 2>&1; then
43 COMPOSE_VERSION=standalone
44 echo -e "\e[31mFound Docker Compose Standalone.\e[0m"
45 echo -e "\e[31mSetting the DOCKER_COMPOSE_VERSION Variable to standalone\e[0m"
46 sleep 2
47 echo -e "\e[33mNotice: For an automatic update of docker-compose please use the update_compose.sh scripts located at the helper-scripts folder.\e[0m"
48 else
49 echo -e "\e[31mCannot find Docker Compose with a Version Higher than 2.X.X.\e[0m"
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +010050 echo -e "\e[31mPlease update/install manually regarding to this doc site: https://docs.mailcow.email/i_u_m/i_u_m_install/\e[0m"
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +010051 exit 1
52 fi
53 fi
54
55else
56 echo -e "\e[31mCannot find Docker Compose.\e[0m"
57 echo -e "\e[31mPlease install it regarding to this doc site: https://mailcow.github.io/mailcow-dockerized-docs/i_u_m/i_u_m_install/\e[0m"
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +010058 exit 1
59 fi
60 fi
61
62else
63 echo -e "\e[31mCannot find Docker Compose.\e[0m"
64 echo -e "\e[31mPlease install it regarding to this doc site: https://docs.mailcow.email/i_u_m/i_u_m_install/\e[0m"
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +010065 exit 1
66fi
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +010067
68detect_bad_asn() {
69 echo -e "\e[33mDetecting if your IP is listed on Spamhaus Bad ASN List...\e[0m"
70 response=$(curl --connect-timeout 15 --max-time 30 -s -o /dev/null -w "%{http_code}" "https://asn-check.mailcow.email")
71 if [ "$response" -eq 503 ]; then
72 if [ -z "$SPAMHAUS_DQS_KEY" ]; then
73 echo -e "\e[33mYour server's public IP uses an AS that is blocked by Spamhaus to use their DNS public blocklists for Postfix.\e[0m"
74 echo -e "\e[33mmailcow did not detected a value for the variable SPAMHAUS_DQS_KEY inside mailcow.conf!\e[0m"
75 sleep 2
76 echo ""
77 echo -e "\e[33mTo use the Spamhaus DNS Blocklists again, you will need to create a FREE account for their Data Query Service (DQS) at: https://www.spamhaus.com/free-trial/sign-up-for-a-free-data-query-service-account\e[0m"
78 echo -e "\e[33mOnce done, enter your DQS API key in mailcow.conf and mailcow will do the rest for you!\e[0m"
79 echo ""
80 sleep 2
81
82 else
83 echo -e "\e[33mYour server's public IP uses an AS that is blocked by Spamhaus to use their DNS public blocklists for Postfix.\e[0m"
84 echo -e "\e[32mmailcow detected a Value for the variable SPAMHAUS_DQS_KEY inside mailcow.conf. Postfix will use DQS with the given API key...\e[0m"
85 fi
86 elif [ "$response" -eq 200 ]; then
87 echo -e "\e[33mCheck completed! Your IP is \e[32mclean\e[0m"
88 elif [ "$response" -eq 429 ]; then
89 echo -e "\e[33mCheck completed! \e[31mYour IP seems to be rate limited on the ASN Check service... please try again later!\e[0m"
90 else
91 echo -e "\e[31mCheck failed! \e[0mMaybe a DNS or Network problem?\e[0m"
92 fi
93}
94
95### If generate_config.sh is started with --dev or -d it will not check out nightly or master branch and will keep on the current branch
96if [[ ${1} == "--dev" || ${1} == "-d" ]]; then
97 SKIP_BRANCH=y
98else
99 SKIP_BRANCH=n
100fi
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100101
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100102if [ -f mailcow.conf ]; then
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200103 read -r -p "A config file exists and will be overwritten, are you sure you want to continue? [y/N] " response
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100104 case $response in
105 [yY][eE][sS]|[yY])
106 mv mailcow.conf mailcow.conf_backup
107 chmod 600 mailcow.conf_backup
108 ;;
109 *)
110 exit 1
111 ;;
112 esac
113fi
114
115echo "Press enter to confirm the detected value '[value]' where applicable or enter a custom value."
116while [ -z "${MAILCOW_HOSTNAME}" ]; do
117 read -p "Mail server hostname (FQDN) - this is not your mail domain, but your mail servers hostname: " -e MAILCOW_HOSTNAME
118 DOTS=${MAILCOW_HOSTNAME//[^.]};
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100119 if [ ${#DOTS} -lt 1 ]; then
120 echo -e "\e[31mMAILCOW_HOSTNAME (${MAILCOW_HOSTNAME}) is not a FQDN!\e[0m"
121 sleep 1
122 echo "Please change it to a FQDN and redeploy the stack with docker(-)compose up -d"
123 exit 1
124 elif [[ "${MAILCOW_HOSTNAME: -1}" == "." ]]; then
125 echo "MAILCOW_HOSTNAME (${MAILCOW_HOSTNAME}) is ending with a dot. This is not a valid FQDN!"
126 exit 1
127 elif [ ${#DOTS} -eq 1 ]; then
128 echo -e "\e[33mMAILCOW_HOSTNAME (${MAILCOW_HOSTNAME}) does not contain a Subdomain. This is not fully tested and may cause issues.\e[0m"
129 echo "Find more information about why this message exists here: https://github.com/mailcow/mailcow-dockerized/issues/1572"
130 read -r -p "Do you want to proceed anyway? [y/N] " response
131 if [[ "$response" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
132 echo "OK. Procceding."
133 else
134 echo "OK. Exiting."
135 exit 1
136 fi
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100137 fi
138done
139
140if [ -a /etc/timezone ]; then
141 DETECTED_TZ=$(cat /etc/timezone)
142elif [ -a /etc/localtime ]; then
143 DETECTED_TZ=$(readlink /etc/localtime|sed -n 's|^.*zoneinfo/||p')
144fi
145
146while [ -z "${MAILCOW_TZ}" ]; do
147 if [ -z "${DETECTED_TZ}" ]; then
148 read -p "Timezone: " -e MAILCOW_TZ
149 else
150 read -p "Timezone [${DETECTED_TZ}]: " -e MAILCOW_TZ
151 [ -z "${MAILCOW_TZ}" ] && MAILCOW_TZ=${DETECTED_TZ}
152 fi
153done
154
155MEM_TOTAL=$(awk '/MemTotal/ {print $2}' /proc/meminfo)
156
157if [ ${MEM_TOTAL} -le "2621440" ]; then
158 echo "Installed memory is <= 2.5 GiB. It is recommended to disable ClamAV to prevent out-of-memory situations."
159 echo "ClamAV can be re-enabled by setting SKIP_CLAMD=n in mailcow.conf."
160 read -r -p "Do you want to disable ClamAV now? [Y/n] " response
161 case $response in
162 [nN][oO]|[nN])
163 SKIP_CLAMD=n
164 ;;
165 *)
166 SKIP_CLAMD=y
167 ;;
168 esac
169else
170 SKIP_CLAMD=n
171fi
172
173if [ ${MEM_TOTAL} -le "2097152" ]; then
174 echo "Disabling Solr on low-memory system."
175 SKIP_SOLR=y
176elif [ ${MEM_TOTAL} -le "3670016" ]; then
177 echo "Installed memory is <= 3.5 GiB. It is recommended to disable Solr to prevent out-of-memory situations."
178 echo "Solr is a prone to run OOM and should be monitored. The default Solr heap size is 1024 MiB and should be set in mailcow.conf according to your expected load."
179 echo "Solr can be re-enabled by setting SKIP_SOLR=n in mailcow.conf but will refuse to start with less than 2 GB total memory."
180 read -r -p "Do you want to disable Solr now? [Y/n] " response
181 case $response in
182 [nN][oO]|[nN])
183 SKIP_SOLR=n
184 ;;
185 *)
186 SKIP_SOLR=y
187 ;;
188 esac
189else
190 SKIP_SOLR=n
191fi
192
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100193if [[ ${SKIP_BRANCH} != y ]]; then
194 echo "Which branch of mailcow do you want to use?"
195 echo ""
196 echo "Available Branches:"
197 echo "- master branch (stable updates) | default, recommended [1]"
198 echo "- nightly branch (unstable updates, testing) | not-production ready [2]"
199 sleep 1
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100200
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100201 while [ -z "${MAILCOW_BRANCH}" ]; do
202 read -r -p "Choose the Branch with it´s number [1/2] " branch
203 case $branch in
204 [2])
205 MAILCOW_BRANCH="nightly"
206 ;;
207 *)
208 MAILCOW_BRANCH="master"
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100209 ;;
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100210 esac
211 done
212
213 git fetch --all
214 git checkout -f $MAILCOW_BRANCH
215
216elif [[ ${SKIP_BRANCH} == y ]]; then
217 echo -e "\033[33mEnabled Dev Mode.\033[0m"
218 echo -e "\033[33mNot checking out a different branch!\033[0m"
219 MAILCOW_BRANCH=$(git rev-parse --short $(git rev-parse @{upstream}))
220
221else
222 echo -e "\033[31mCould not determine branch input..."
223 echo -e "\033[31mExiting."
224 exit 1
225fi
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100226
227if [ ! -z "${MAILCOW_BRANCH}" ]; then
228 git_branch=${MAILCOW_BRANCH}
229fi
230
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100231[ ! -f ./data/conf/rspamd/override.d/worker-controller-password.inc ] && echo '# Placeholder' > ./data/conf/rspamd/override.d/worker-controller-password.inc
232
233cat << EOF > mailcow.conf
234# ------------------------------
235# mailcow web ui configuration
236# ------------------------------
237# example.org is _not_ a valid hostname, use a fqdn here.
238# Default admin user is "admin"
239# Default password is "moohoo"
240
241MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
242
243# Password hash algorithm
244# Only certain password hash algorithm are supported. For a fully list of supported schemes,
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100245# see https://docs.mailcow.email/models/model-passwd/
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100246MAILCOW_PASS_SCHEME=BLF-CRYPT
247
248# ------------------------------
249# SQL database configuration
250# ------------------------------
251
252DBNAME=mailcow
253DBUSER=mailcow
254
255# Please use long, random alphanumeric strings (A-Za-z0-9)
256
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100257DBPASS=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
258DBROOT=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100259
260# ------------------------------
261# HTTP/S Bindings
262# ------------------------------
263
264# You should use HTTPS, but in case of SSL offloaded reverse proxies:
265# Might be important: This will also change the binding within the container.
266# If you use a proxy within Docker, point it to the ports you set below.
267# Do _not_ use IP:PORT in HTTP(S)_BIND or HTTP(S)_PORT
268# IMPORTANT: Do not use port 8081, 9081 or 65510!
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200269# Example: HTTP_BIND=1.2.3.4
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100270# For IPv4 leave it as it is: HTTP_BIND= & HTTPS_PORT=
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100271# For IPv6 see https://docs.mailcow.email/post_installation/firststeps-ip_bindings/
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100272
273HTTP_PORT=80
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200274HTTP_BIND=
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100275
276HTTPS_PORT=443
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200277HTTPS_BIND=
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100278
279# ------------------------------
280# Other bindings
281# ------------------------------
282# You should leave that alone
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200283# Format: 11.22.33.44:25 or 12.34.56.78:465 etc.
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100284
285SMTP_PORT=25
286SMTPS_PORT=465
287SUBMISSION_PORT=587
288IMAP_PORT=143
289IMAPS_PORT=993
290POP_PORT=110
291POPS_PORT=995
292SIEVE_PORT=4190
293DOVEADM_PORT=127.0.0.1:19991
294SQL_PORT=127.0.0.1:13306
295SOLR_PORT=127.0.0.1:18983
296REDIS_PORT=127.0.0.1:7654
297
298# Your timezone
299# See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for a list of timezones
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100300# Use the column named 'TZ identifier' + pay attention for the column named 'Notes'
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100301
302TZ=${MAILCOW_TZ}
303
304# Fixed project name
305# Please use lowercase letters only
306
307COMPOSE_PROJECT_NAME=mailcowdockerized
308
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100309# Used Docker Compose version
310# Switch here between native (compose plugin) and standalone
311# For more informations take a look at the mailcow docs regarding the configuration options.
312# Normally this should be untouched but if you decided to use either of those you can switch it manually here.
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100313# Please be aware that at least one of those variants should be installed on your machine or mailcow will fail.
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100314
315DOCKER_COMPOSE_VERSION=${COMPOSE_VERSION}
316
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100317# Set this to "allow" to enable the anyone pseudo user. Disabled by default.
318# When enabled, ACL can be created, that apply to "All authenticated users"
319# This should probably only be activated on mail hosts, that are used exclusivly by one organisation.
320# Otherwise a user might share data with too many other users.
321ACL_ANYONE=disallow
322
323# Garbage collector cleanup
324# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring
325# How long should objects remain in the garbage until they are being deleted? (value in minutes)
326# Check interval is hourly
327
328MAILDIR_GC_TIME=7200
329
330# Additional SAN for the certificate
331#
332# You can use wildcard records to create specific names for every domain you add to mailcow.
333# Example: Add domains "example.com" and "example.net" to mailcow, change ADDITIONAL_SAN to a value like:
334#ADDITIONAL_SAN=imap.*,smtp.*
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100335# This will expand the certificate to "imap.example.com", "smtp.example.com", "imap.example.net", "smtp.example.net"
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100336# plus every domain you add in the future.
337#
338# You can also just add static names...
339#ADDITIONAL_SAN=srv1.example.net
340# ...or combine wildcard and static names:
341#ADDITIONAL_SAN=imap.*,srv1.example.com
342#
343
344ADDITIONAL_SAN=
345
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200346# Additional server names for mailcow UI
347#
348# Specify alternative addresses for the mailcow UI to respond to
349# This is useful when you set mail.* as ADDITIONAL_SAN and want to make sure mail.maildomain.com will always point to the mailcow UI.
350# If the server name does not match a known site, Nginx decides by best-guess and may redirect users to the wrong web root.
351# You can understand this as server_name directive in Nginx.
352# Comma separated list without spaces! Example: ADDITIONAL_SERVER_NAMES=a.b.c,d.e.f
353
354ADDITIONAL_SERVER_NAMES=
355
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100356# Skip running ACME (acme-mailcow, Let's Encrypt certs) - y/n
357
358SKIP_LETS_ENCRYPT=n
359
360# Create seperate certificates for all domains - y/n
361# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100362# see https://doc.dovecot.org/admin_manual/ssl/sni_support
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100363ENABLE_SSL_SNI=n
364
365# Skip IPv4 check in ACME container - y/n
366
367SKIP_IP_CHECK=n
368
369# Skip HTTP verification in ACME container - y/n
370
371SKIP_HTTP_VERIFICATION=n
372
373# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n
374
375SKIP_CLAMD=${SKIP_CLAMD}
376
377# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n
378
379SKIP_SOGO=n
380
381# Skip Solr on low-memory systems or if you do not want to store a readable index of your mails in solr-vol-1.
382
383SKIP_SOLR=${SKIP_SOLR}
384
385# Solr heap size in MB, there is no recommendation, please see Solr docs.
386# Solr is a prone to run OOM and should be monitored. Unmonitored Solr setups are not recommended.
387
388SOLR_HEAP=1024
389
390# Allow admins to log into SOGo as email user (without any password)
391
392ALLOW_ADMIN_EMAIL_LOGIN=n
393
394# Enable watchdog (watchdog-mailcow) to restart unhealthy containers
395
396USE_WATCHDOG=y
397
398# Send watchdog notifications by mail (sent from watchdog@MAILCOW_HOSTNAME)
399# CAUTION:
400# 1. You should use external recipients
401# 2. Mails are sent unsigned (no DKIM)
402# 3. If you use DMARC, create a separate DMARC policy ("v=DMARC1; p=none;" in _dmarc.MAILCOW_HOSTNAME)
403# Multiple rcpts allowed, NO quotation marks, NO spaces
404
405#WATCHDOG_NOTIFY_EMAIL=a@example.com,b@example.com,c@example.com
406#WATCHDOG_NOTIFY_EMAIL=
407
408# Notify about banned IP (includes whois lookup)
409WATCHDOG_NOTIFY_BAN=n
410
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200411# Subject for watchdog mails. Defaults to "Watchdog ALERT" followed by the error message.
412#WATCHDOG_SUBJECT=
413
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100414# Checks if mailcow is an open relay. Requires a SAL. More checks will follow.
415# https://www.servercow.de/mailcow?lang=en
416# https://www.servercow.de/mailcow?lang=de
417# No data is collected. Opt-in and anonymous.
418# Will only work with unmodified mailcow setups.
419WATCHDOG_EXTERNAL_CHECKS=n
420
Matthias Andreas Benkard12a57352021-12-28 18:02:04 +0100421# Enable watchdog verbose logging
422WATCHDOG_VERBOSE=n
423
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100424# Max log lines per service to keep in Redis logs
425
426LOG_LINES=9999
427
428# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24)
429# Use private IPv4 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses
430
431IPV4_NETWORK=172.22.1
432
433# Internal IPv6 subnet in fc00::/7
434# Use private IPv6 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses
435
436IPV6_NETWORK=fd4d:6169:6c63:6f77::/64
437
438# Use this IPv4 for outgoing connections (SNAT)
439
440#SNAT_TO_SOURCE=
441
442# Use this IPv6 for outgoing connections (SNAT)
443
444#SNAT6_TO_SOURCE=
445
446# Create or override an API key for the web UI
447# You _must_ define API_ALLOW_FROM, which is a comma separated list of IPs
448# An API key defined as API_KEY has read-write access
449# An API key defined as API_KEY_READ_ONLY has read-only access
450# Allowed chars for API_KEY and API_KEY_READ_ONLY: a-z, A-Z, 0-9, -
451# You can define API_KEY and/or API_KEY_READ_ONLY
452
453#API_KEY=
454#API_KEY_READ_ONLY=
455#API_ALLOW_FROM=172.22.1.1,127.0.0.1
456
457# mail_home is ~/Maildir
458MAILDIR_SUB=Maildir
459
460# SOGo session timeout in minutes
461SOGO_EXPIRE_SESSION=480
462
463# DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars.
464# Empty by default to auto-generate master user and password on start.
465# User expands to DOVECOT_MASTER_USER@mailcow.local
466# LEAVE EMPTY IF UNSURE
467DOVECOT_MASTER_USER=
468# LEAVE EMPTY IF UNSURE
469DOVECOT_MASTER_PASS=
470
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200471# Let's Encrypt registration contact information
472# Optional: Leave empty for none
473# This value is only used on first order!
474# Setting it at a later point will require the following steps:
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100475# https://docs.mailcow.email/troubleshooting/debug-reset_tls/
Matthias Andreas Benkard7b2a3a12021-08-16 10:57:25 +0200476ACME_CONTACT=
477
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100478# WebAuthn device manufacturer verification
479# After setting WEBAUTHN_ONLY_TRUSTED_VENDORS=y only devices from trusted manufacturers are allowed
480# root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates
481WEBAUTHN_ONLY_TRUSTED_VENDORS=n
482
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100483# Spamhaus Data Query Service Key
484# Optional: Leave empty for none
485# Enter your key here if you are using a blocked ASN (OVH, AWS, Cloudflare e.g) for the unregistered Spamhaus Blocklist.
486# If empty, it will completely disable Spamhaus blocklists if it detects that you are running on a server using a blocked AS.
487# Otherwise it will work normally.
488SPAMHAUS_DQS_KEY=
489
Matthias Andreas Benkardb382b102021-01-02 15:32:21 +0100490EOF
491
492mkdir -p data/assets/ssl
493
494chmod 600 mailcow.conf
495
496# copy but don't overwrite existing certificate
497echo "Generating snake-oil certificate..."
498# Making Willich more popular
499openssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl-example/key.pem -out data/assets/ssl-example/cert.pem -days 365 -subj "/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${MAILCOW_HOSTNAME}" -sha256 -nodes
500echo "Copying snake-oil certificate..."
501cp -n -d data/assets/ssl-example/*.pem data/assets/ssl/
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100502
503# Set app_info.inc.php
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100504case ${git_branch} in
505 master)
506 mailcow_git_version=$(git describe --tags `git rev-list --tags --max-count=1`)
507 ;;
508 nightly)
509 mailcow_git_version=$(git rev-parse --short $(git rev-parse @{upstream}))
510 mailcow_last_git_version=""
511 ;;
512 *)
513 mailcow_git_version=$(git rev-parse --short HEAD)
514 mailcow_last_git_version=""
515 ;;
516esac
517# if [ ${git_branch} == "master" ]; then
518# mailcow_git_version=$(git describe --tags `git rev-list --tags --max-count=1`)
519# elif [ ${git_branch} == "nightly" ]; then
520# mailcow_git_version=$(git rev-parse --short $(git rev-parse @{upstream}))
521# mailcow_last_git_version=""
522# else
523# mailcow_git_version=$(git rev-parse --short HEAD)
524# mailcow_last_git_version=""
525# fi
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100526
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100527if [[ $SKIP_BRANCH != "y" ]]; then
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100528mailcow_git_commit=$(git rev-parse origin/${git_branch})
529mailcow_git_commit_date=$(git log -1 --format=%ci @{upstream} )
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100530else
531mailcow_git_commit=$(git rev-parse ${git_branch})
532mailcow_git_commit_date=$(git log -1 --format=%ci @{upstream} )
533git_branch=$(git rev-parse --abbrev-ref HEAD)
534fi
Matthias Andreas Benkard1ba53812022-12-27 17:32:58 +0100535
536if [ $? -eq 0 ]; then
537 echo '<?php' > data/web/inc/app_info.inc.php
538 echo ' $MAILCOW_GIT_VERSION="'$mailcow_git_version'";' >> data/web/inc/app_info.inc.php
539 echo ' $MAILCOW_LAST_GIT_VERSION="";' >> data/web/inc/app_info.inc.php
540 echo ' $MAILCOW_GIT_OWNER="mailcow";' >> data/web/inc/app_info.inc.php
541 echo ' $MAILCOW_GIT_REPO="mailcow-dockerized";' >> data/web/inc/app_info.inc.php
542 echo ' $MAILCOW_GIT_URL="https://github.com/mailcow/mailcow-dockerized";' >> data/web/inc/app_info.inc.php
543 echo ' $MAILCOW_GIT_COMMIT="'$mailcow_git_commit'";' >> data/web/inc/app_info.inc.php
544 echo ' $MAILCOW_GIT_COMMIT_DATE="'$mailcow_git_commit_date'";' >> data/web/inc/app_info.inc.php
545 echo ' $MAILCOW_BRANCH="'$git_branch'";' >> data/web/inc/app_info.inc.php
546 echo ' $MAILCOW_UPDATEDAT='$(date +%s)';' >> data/web/inc/app_info.inc.php
547 echo '?>' >> data/web/inc/app_info.inc.php
548else
549 echo '<?php' > data/web/inc/app_info.inc.php
550 echo ' $MAILCOW_GIT_VERSION="'$mailcow_git_version'";' >> data/web/inc/app_info.inc.php
551 echo ' $MAILCOW_LAST_GIT_VERSION="";' >> data/web/inc/app_info.inc.php
552 echo ' $MAILCOW_GIT_OWNER="mailcow";' >> data/web/inc/app_info.inc.php
553 echo ' $MAILCOW_GIT_REPO="mailcow-dockerized";' >> data/web/inc/app_info.inc.php
554 echo ' $MAILCOW_GIT_URL="https://github.com/mailcow/mailcow-dockerized";' >> data/web/inc/app_info.inc.php
555 echo ' $MAILCOW_GIT_COMMIT="";' >> data/web/inc/app_info.inc.php
556 echo ' $MAILCOW_GIT_COMMIT_DATE="";' >> data/web/inc/app_info.inc.php
557 echo ' $MAILCOW_BRANCH="'$git_branch'";' >> data/web/inc/app_info.inc.php
558 echo ' $MAILCOW_UPDATEDAT='$(date +%s)';' >> data/web/inc/app_info.inc.php
559 echo '?>' >> data/web/inc/app_info.inc.php
560 echo -e "\e[33mCannot determine current git repository version...\e[0m"
561fi
Matthias Andreas Benkardd1f5b682023-11-18 13:18:30 +0100562
563detect_bad_asn