jcoffey-dev
d19696dec3
deploy stands up Stalwart 0.16, ihasmail and (for a mail host) Caddy as a compose project: completes Stalwart's bootstrap over x:Bootstrap, links ihasmail over the private network, requests certificates for both Caddy (TLS-ALPN-01) and Stalwart (HTTP-01 through Caddy), makes the auto-ban safe behind the proxy, and proves the link by signing in through the webmail. --local gives a loopback-only pair. certs retries Stalwart's certificate; destroy removes a deployment. e2e/public.sh runs the whole mail-host path against Pebble with no internet involved.
60 lines
1.7 KiB
Cheetah
60 lines
1.7 KiB
Cheetah
# Written by ihasmail-oneshot {{.Version}} for {{.Plan.Domain}}.
|
|
#
|
|
# Caddy holds ports 80 and 443 for two things that both want certificates for
|
|
# some of the same names: Caddy itself, to serve HTTPS, and Stalwart, whose
|
|
# IMAP and SMTP listeners need a certificate of their own. They are kept apart
|
|
# by challenge type rather than by name:
|
|
#
|
|
# Caddy TLS-ALPN-01 on 443 -- for Stalwart's names it never uses port 80.
|
|
# Stalwart HTTP-01 on 80, which Caddy forwards to it untouched.
|
|
#
|
|
# So neither answers the other's challenge, and neither needs the other's key.
|
|
|
|
{
|
|
email {{.Plan.Email}}
|
|
{{- if .Plan.ACMEDirectory}}
|
|
acme_ca {{.Plan.ACMEDirectory}}
|
|
{{- end}}
|
|
{{- if .Plan.ACMECARoot}}
|
|
acme_ca_root /etc/caddy/acme-ca-root.pem
|
|
{{- end}}
|
|
}
|
|
|
|
# The webmail. Push arrives as Server-Sent Events, so responses are flushed as
|
|
# they are written rather than buffered.
|
|
{{.Plan.WebmailHost}} {
|
|
encode zstd gzip
|
|
reverse_proxy ihasmail:8080 {
|
|
flush_interval -1
|
|
}
|
|
}
|
|
|
|
# Stalwart's web side: its admin UI, JMAP for other clients, CalDAV, CardDAV,
|
|
# autoconfig and MTA-STS. Stalwart is told to believe the X-Forwarded-For Caddy
|
|
# sets here, so a scanner is banned by its own address and not by Caddy's.
|
|
{{join .Plan.StalwartNames ", "}} {
|
|
tls {
|
|
issuer acme {
|
|
{{- if .Plan.ACMEDirectory}}
|
|
dir {{.Plan.ACMEDirectory}}
|
|
{{- end}}
|
|
{{- if .Plan.ACMECARoot}}
|
|
trusted_roots /etc/caddy/acme-ca-root.pem
|
|
{{- end}}
|
|
email {{.Plan.Email}}
|
|
disable_http_challenge
|
|
}
|
|
}
|
|
reverse_proxy stalwart:8080
|
|
}
|
|
|
|
# Port 80 for Stalwart's names is Stalwart's challenge path and a redirect.
|
|
{{range $i, $n := .Plan.StalwartNames}}{{if $i}}, {{end}}http://{{$n}}{{end}} {
|
|
handle /.well-known/acme-challenge/* {
|
|
reverse_proxy stalwart:8080
|
|
}
|
|
handle {
|
|
redir https://{host}{uri} 308
|
|
}
|
|
}
|