diff --git a/.github/workflows/check_prs_if_on_staging.yml b/.github/workflows/check_prs_if_on_staging.yml index 7f840c568..d951e2819 100644 --- a/.github/workflows/check_prs_if_on_staging.yml +++ b/.github/workflows/check_prs_if_on_staging.yml @@ -12,7 +12,7 @@ jobs: - name: Send message uses: thollander/actions-comment-pull-request@v3.0.1 with: - GITHUB_TOKEN: ${{ secrets.CHECKIFPRISSTAGING_ACTION_PAT }} + github-token: ${{ secrets.CHECKIFPRISSTAGING_ACTION_PAT }} message: | Thanks for contributing! diff --git a/.github/workflows/pr_to_nightly.yml b/.github/workflows/pr_to_nightly.yml index e629e5e9a..0cf59eeac 100644 --- a/.github/workflows/pr_to_nightly.yml +++ b/.github/workflows/pr_to_nightly.yml @@ -12,7 +12,7 @@ jobs: with: fetch-depth: 0 - name: Run the Action - uses: devops-infra/action-pull-request@v0.5.5 + uses: devops-infra/action-pull-request@v0.6.0 with: github_token: ${{ secrets.PRTONIGHTLY_ACTION_PAT }} title: Automatic PR to nightly from ${{ github.event.repository.updated_at}} diff --git a/.gitignore b/.gitignore index 418e474dd..c225dc090 100644 --- a/.gitignore +++ b/.gitignore @@ -48,7 +48,9 @@ data/conf/sogo/plist_ldap data/conf/sogo/plist_ldap.sh data/conf/sogo/sieve.creds data/conf/sogo/cron.creds -data/conf/sogo/sogo-full.svg +data/conf/sogo/custom-fulllogo.svg +data/conf/sogo/custom-shortlogo.svg +data/conf/sogo/custom-fulllogo.png data/gitea/ data/gogs/ data/hooks/dovecot/* diff --git a/data/Dockerfiles/dovecot/quota_notify.py b/data/Dockerfiles/dovecot/quota_notify.py index c2c73e7a9..598134e22 100755 --- a/data/Dockerfiles/dovecot/quota_notify.py +++ b/data/Dockerfiles/dovecot/quota_notify.py @@ -23,7 +23,7 @@ else: while True: try: - r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, password=os.environ['REDISPASS']) + r = redis.StrictRedis(host='redis', decode_responses=True, port=6379, db=0, username='quota_notify', password='') r.ping() except Exception as ex: print('%s - trying again...' % (ex)) diff --git a/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf b/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf index 4b9bf287c..c028bcdbf 100644 --- a/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf +++ b/data/Dockerfiles/dovecot/syslog-ng-redis_slave.conf @@ -38,8 +38,13 @@ filter f_replica { not match("User has no mail_replica in userdb" value("MESSAGE")); not match("Error: sync: Unknown user in remote" value("MESSAGE")); }; +filter f_dovecot_auth_try { + not match("- trying the next passdb" value("MESSAGE")) and + not match("- trying the next userdb" value("MESSAGE")); +}; log { source(s_dgram); + filter(f_dovecot_auth_try); filter(f_replica); destination(d_stdout); filter(f_mail); diff --git a/data/Dockerfiles/dovecot/syslog-ng.conf b/data/Dockerfiles/dovecot/syslog-ng.conf index c79eb92ee..1918f4a23 100644 --- a/data/Dockerfiles/dovecot/syslog-ng.conf +++ b/data/Dockerfiles/dovecot/syslog-ng.conf @@ -38,8 +38,13 @@ filter f_replica { not match("User has no mail_replica in userdb" value("MESSAGE")); not match("Error: sync: Unknown user in remote" value("MESSAGE")); }; +filter f_dovecot_auth_try { + not match("- trying the next passdb" value("MESSAGE")) and + not match("- trying the next userdb" value("MESSAGE")); +}; log { source(s_dgram); + filter(f_dovecot_auth_try); filter(f_replica); destination(d_stdout); filter(f_mail); diff --git a/data/Dockerfiles/netfilter/main.py b/data/Dockerfiles/netfilter/main.py index 36304bf0c..2b332d205 100644 --- a/data/Dockerfiles/netfilter/main.py +++ b/data/Dockerfiles/netfilter/main.py @@ -85,11 +85,10 @@ def refreshF2bregex(): f2bregex[3] = r'warning: .*\[([0-9a-f\.:]+)\]: SASL .+ authentication failed: (?!.*Connection lost to authentication server).+' f2bregex[4] = r'warning: non-SMTP command from .*\[([0-9a-f\.:]+)]:.+' f2bregex[5] = r'NOQUEUE: reject: RCPT from \[([0-9a-f\.:]+)].+Protocol error.+' - f2bregex[6] = r'-login: Disconnected.+ \(auth failed, .+\): user=.*, method=.+, rip=([0-9a-f\.:]+),' - f2bregex[7] = r'-login: Aborted login.+ \(auth failed .+\): user=.+, rip=([0-9a-f\.:]+), lip.+' - f2bregex[8] = r'-login: Aborted login.+ \(tried to use disallowed .+\): user=.+, rip=([0-9a-f\.:]+), lip.+' - f2bregex[9] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked' - f2bregex[10] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+' + f2bregex[6] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): Password mismatch \(SHA1 of given password: [a-f0-9]+\)' + f2bregex[7] = r'\w+\([^,]+,([0-9a-f\.:]+),<[^>]+>\): unknown user \(SHA1 of given password: [a-f0-9]+\)' + f2bregex[8] = r'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked' + f2bregex[9] = r'([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+' r.set('F2B_REGEX', json.dumps(f2bregex, ensure_ascii=False)) else: try: diff --git a/data/Dockerfiles/nginx/bootstrap.py b/data/Dockerfiles/nginx/bootstrap.py index ab95c2a6b..11e6fc202 100644 --- a/data/Dockerfiles/nginx/bootstrap.py +++ b/data/Dockerfiles/nginx/bootstrap.py @@ -43,10 +43,11 @@ def nginx_conf(env, template_vars): def prepare_template_vars(): ipv4_network = os.getenv("IPV4_NETWORK", "172.22.1") additional_server_names = os.getenv("ADDITIONAL_SERVER_NAMES", "") + trusted_proxies = os.getenv("TRUSTED_PROXIES", "") template_vars = { 'IPV4_NETWORK': ipv4_network, - 'TRUSTED_NETWORK': os.getenv("TRUSTED_NETWORK", False), + 'TRUSTED_PROXIES': [item.strip() for item in trusted_proxies.split(",") if item.strip()], 'SKIP_RSPAMD': os.getenv("SKIP_RSPAMD", "n").lower() in ("y", "yes"), 'SKIP_SOGO': os.getenv("SKIP_SOGO", "n").lower() in ("y", "yes"), 'NGINX_USE_PROXY_PROTOCOL': os.getenv("NGINX_USE_PROXY_PROTOCOL", "n").lower() in ("y", "yes"), diff --git a/data/Dockerfiles/postfix/postfix.sh b/data/Dockerfiles/postfix/postfix.sh index 9a4c023f1..e5dbf88fc 100755 --- a/data/Dockerfiles/postfix/postfix.sh +++ b/data/Dockerfiles/postfix/postfix.sh @@ -416,10 +416,11 @@ postscreen_dnsbl_sites = wl.mailspike.net=127.0.0.[18;19;20]*-2 bl.mailspike.net=127.0.0.[10;11;12]*4 EOF fi -DNSBL_CONFIG=$(grep -v '^#' /opt/postfix/conf/dns_blocklists.cf | grep '\S') -# Remove discontinued Nixspam DNSBL from existing dns_blocklists.cf -sed -i '/ix\.dnsbl\.manitu\.net\*2/d' /opt/postfix/conf/dns_blocklists.cf +# Remove discontinued DNSBLs from existing dns_blocklists.cf +sed -i '/ix\.dnsbl\.manitu\.net\*2/d' /opt/postfix/conf/dns_blocklists.cf # Nixspam + +DNSBL_CONFIG=$(grep -v '^#' /opt/postfix/conf/dns_blocklists.cf | grep '\S') if [ ! -z "$DNSBL_CONFIG" ]; then echo -e "\e[33mChecking if ASN for your IP is listed for Spamhaus Bad ASN List...\e[0m" diff --git a/data/Dockerfiles/rspamd/Dockerfile b/data/Dockerfiles/rspamd/Dockerfile index 152874b42..be26e89cd 100644 --- a/data/Dockerfiles/rspamd/Dockerfile +++ b/data/Dockerfiles/rspamd/Dockerfile @@ -2,7 +2,7 @@ FROM debian:bookworm-slim LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive -ARG RSPAMD_VER=rspamd_3.10.2-1~b8a232043 +ARG RSPAMD_VER=rspamd_3.11.0-1~90a175b45 ARG CODENAME=bookworm ENV LC_ALL=C diff --git a/data/Dockerfiles/sogo/Dockerfile b/data/Dockerfiles/sogo/Dockerfile index 4eb36638a..f2981ad04 100644 --- a/data/Dockerfiles/sogo/Dockerfile +++ b/data/Dockerfiles/sogo/Dockerfile @@ -4,7 +4,7 @@ LABEL maintainer="The Infrastructure Company GmbH " ARG DEBIAN_FRONTEND=noninteractive ARG DEBIAN_VERSION=bookworm -ARG SOGO_DEBIAN_REPOSITORY=http://www.axis.cz/linux/debian +ARG SOGO_DEBIAN_REPOSITORY=https://packagingv2.sogo.nu/sogo-nightly-debian/ # renovate: datasource=github-releases depName=tianon/gosu versioning=semver-coerced extractVersion=^(?.*)$ ARG GOSU_VERSION=1.17 ENV LC_ALL=C @@ -33,9 +33,8 @@ RUN echo "Building from repository $SOGO_DEBIAN_REPOSITORY" \ && gosu nobody true \ && mkdir /usr/share/doc/sogo \ && touch /usr/share/doc/sogo/empty.sh \ - && wget http://www.axis.cz/linux/debian/axis-archive-keyring.deb -O /tmp/axis-archive-keyring.deb \ - && apt install -y /tmp/axis-archive-keyring.deb \ - && echo "deb [trusted=yes] ${SOGO_DEBIAN_REPOSITORY} ${DEBIAN_VERSION} sogo-v5" > /etc/apt/sources.list.d/sogo.list \ + && wget -O- https://keys.openpgp.org/vks/v1/by-fingerprint/74FFC6D72B925A34B5D356BDF8A27B36A6E2EAE9 | gpg --dearmor | apt-key add - \ + && echo "deb [trusted=yes] ${SOGO_DEBIAN_REPOSITORY} ${DEBIAN_VERSION} main" > /etc/apt/sources.list.d/sogo.list \ && apt-get update && apt-get install -y --no-install-recommends \ sogo \ sogo-activesync \ diff --git a/data/Dockerfiles/sogo/bootstrap-sogo.sh b/data/Dockerfiles/sogo/bootstrap-sogo.sh index 566d812fc..ac7ab6596 100755 --- a/data/Dockerfiles/sogo/bootstrap-sogo.sh +++ b/data/Dockerfiles/sogo/bootstrap-sogo.sh @@ -140,8 +140,8 @@ if patch -R -sfN --dry-run /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox patch -R /usr/lib/GNUstep/SOGo/Templates/UIxTopnavToolbar.wox < /navMailcowBtns.diff; fi -# Copy logo, if any -[[ -f /etc/sogo/sogo-full.svg ]] && cp /etc/sogo/sogo-full.svg /usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg +# Rename custom logo, if any +[[ -f /etc/sogo/sogo-full.svg ]] && mv /etc/sogo/sogo-full.svg /etc/sogo/custom-fulllogo.svg # Rsync web content echo "Syncing web content with named volume" diff --git a/data/assets/ssl-example/dhparams.pem b/data/assets/ssl-example/dhparams.pem index b245f051e..9b182b720 100644 --- a/data/assets/ssl-example/dhparams.pem +++ b/data/assets/ssl-example/dhparams.pem @@ -1,8 +1,8 @@ -----BEGIN DH PARAMETERS----- -MIIBCAKCAQEA9iHB0CRDhV8wfBgqnmvuJpl0fzL3qL75R4ZvQHlfMNLrxuIz2x9D -9zcDhPcBTVzV5Ay0AAkke4wP6r6wDQqXqBP4Y8IOkYAyLh3jM40jfHQzQt+5JdQl -ond3kiscBsFOch/vMfSLMu3lAb0YhPNTvrxhMz7LcVAWYl82swASupdiKR+MgaQr -XsugpmDKsHW60VmIM9B7K9Y+rNHwvMWkmISd0KxA8oOy1WJvsVEissMALZDE3c4w -2xHmO2lXxgEx3aez28736t4m/KW3g9Zr31a1M0KusmfY//fGkPk4NUrLBOS2xrgp -Y/rG1qSBdcVyerM0Ki93qCyHKYu4ene0OwIBAg== +MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz ++8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a +87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 +YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi +7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD +ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== -----END DH PARAMETERS----- diff --git a/data/conf/dovecot/dovecot.conf b/data/conf/dovecot/dovecot.conf index e6744ee40..15be77fce 100644 --- a/data/conf/dovecot/dovecot.conf +++ b/data/conf/dovecot/dovecot.conf @@ -280,6 +280,7 @@ auth_cache_verify_password_with_worker = yes auth_cache_negative_ttl = 60s auth_cache_ttl = 300s auth_cache_size = 10M +auth_verbose_passwords = sha1:6 service replicator { process_min_avail = 1 } diff --git a/data/conf/mysql/my.cnf b/data/conf/mysql/my.cnf index 489b973c4..24d6123bb 100644 --- a/data/conf/mysql/my.cnf +++ b/data/conf/mysql/my.cnf @@ -1,7 +1,7 @@ [mysqld] character-set-client-handshake = FALSE character-set-server = utf8mb4 -collation-server = utf8mb4_unicode_ci +collation-server = utf8mb4_general_ci #innodb_file_per_table = TRUE #innodb_file_format = barracuda #innodb_large_prefix = TRUE @@ -20,7 +20,7 @@ thread_cache_size = 8 query_cache_type = 0 query_cache_size = 0 max_heap_table_size = 48M -thread_stack = 192K +thread_stack = 256K skip-host-cache skip-name-resolve log-warnings = 0 diff --git a/data/conf/nginx/templates/sites-default.conf.j2 b/data/conf/nginx/templates/sites-default.conf.j2 index 23bce6cea..574bdb052 100644 --- a/data/conf/nginx/templates/sites-default.conf.j2 +++ b/data/conf/nginx/templates/sites-default.conf.j2 @@ -52,10 +52,12 @@ set_real_ip_from 10.0.0.0/8; set_real_ip_from 172.16.0.0/12; set_real_ip_from 192.168.0.0/16; set_real_ip_from fc00::/7; -{% if not TRUSTED_NETWORK %} +{% for TRUSTED_PROXY in TRUSTED_PROXIES %} +set_real_ip_from {{ TRUSTED_PROXY }}; +{% endfor %} +{% if not NGINX_USE_PROXY_PROTOCOL %} real_ip_header X-Forwarded-For; {% else %} -set_real_ip_from {{ TRUSTED_NETWORK }}; real_ip_header proxy_protocol; {% endif %} real_ip_recursive on; diff --git a/data/conf/postfix/main.cf b/data/conf/postfix/main.cf index 6721204cb..07065f045 100644 --- a/data/conf/postfix/main.cf +++ b/data/conf/postfix/main.cf @@ -162,10 +162,9 @@ transport_maps = pcre:/opt/postfix/conf/custom_transport.pcre, proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf, proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf smtp_sasl_auth_soft_bounce = no -postscreen_discard_ehlo_keywords = silent-discard, dsn, chunking -smtpd_discard_ehlo_keywords = chunking, silent-discard +postscreen_discard_ehlo_keywords = chunking, silent-discard, smtputf8, dsn +smtpd_discard_ehlo_keywords = chunking, silent-discard, smtputf8 compatibility_level = 3.7 -smtputf8_enable = no # Define protocols for SMTPS and submission service submission_smtpd_tls_mandatory_protocols = >=TLSv1.2 smtps_smtpd_tls_mandatory_protocols = >=TLSv1.2 diff --git a/data/conf/redis/redis-conf.sh b/data/conf/redis/redis-conf.sh index 95d50a39a..7e2672a31 100755 --- a/data/conf/redis/redis-conf.sh +++ b/data/conf/redis/redis-conf.sh @@ -2,6 +2,11 @@ cat < /redis.conf requirepass $REDISPASS +user quota_notify on nopass ~QW_* -@all +get +hget +ping EOF +if [ -n "$REDISMASTERPASS" ]; then + echo "masterauth $REDISMASTERPASS" >> /redis.conf +fi + exec redis-server /redis.conf diff --git a/data/conf/rspamd/local.d/options.inc b/data/conf/rspamd/local.d/options.inc index 99197ff55..f83ddf0fc 100644 --- a/data/conf/rspamd/local.d/options.inc +++ b/data/conf/rspamd/local.d/options.inc @@ -3,6 +3,7 @@ dns { } map_watch_interval = 30s; task_timeout = 30s; +enable_mime_utf = true; disable_monitoring = true; # In case a task times out (like DNS lookup), soft reject the message # instead of silently accepting the message without further processing. diff --git a/data/conf/sogo/custom-fulllogo.png b/data/conf/sogo/custom-fulllogo.png new file mode 100644 index 000000000..f5d3a7556 Binary files /dev/null and b/data/conf/sogo/custom-fulllogo.png differ diff --git a/data/conf/sogo/custom-fulllogo.svg b/data/conf/sogo/custom-fulllogo.svg new file mode 100644 index 000000000..98ff2fc3b --- /dev/null +++ b/data/conf/sogo/custom-fulllogo.svg @@ -0,0 +1,44 @@ + + + +]> + + + diff --git a/data/conf/sogo/custom-shortlogo.svg b/data/conf/sogo/custom-shortlogo.svg new file mode 100644 index 000000000..b5adf534c --- /dev/null +++ b/data/conf/sogo/custom-shortlogo.svg @@ -0,0 +1,16 @@ + + + +]> + + + diff --git a/data/web/lang/lang.es-es.json b/data/web/lang/lang.es-es.json index f0c015d57..5547692ff 100644 --- a/data/web/lang/lang.es-es.json +++ b/data/web/lang/lang.es-es.json @@ -24,7 +24,9 @@ "protocol_access": "Cambiar protocolo de acceso", "quarantine_category": "Cambiar categoría de las notificaciones de cuarentena", "domain_relayhost": "Cambiar relayhost por un dominio", - "extend_sender_acl": "Permitir extender la ACL del remitente por direcciones externas" + "extend_sender_acl": "Permitir extender la ACL del remitente por direcciones externas", + "pw_reset": "Permitir el reset de la contraseña del usario mailcow", + "sogo_access": "Permitir la gestión del acceso a SOGo" }, "add": { "activate_filter_warn": "Todos los demás filtros se desactivarán cuando este filtro se active.", @@ -95,7 +97,10 @@ "app_password": "Añadir contraseña para la app", "public_comment": "Comentarios públicos", "disable_login": "Desactivar login (el correo entrante seguirá activo)", - "comment_info": "Los comentarios privados no son visibles al usuario, mientras que los comentarios públicos aparecerán sobre la información general del usuario" + "comment_info": "Los comentarios privados no son visibles al usuario, mientras que los comentarios públicos aparecerán sobre la información general del usuario", + "dry": "Simular la sincronización", + "private_comment": "Comentario privado", + "app_passwd_protocols": "Protocolos autorizados para la contraseña de la aplicación" }, "admin": { "access": "Acceso", @@ -777,4 +782,4 @@ "fuzzy_learn_error": "Error aprendiendo hash: %s", "ip_invalid": "IP inválida omitida: %s" } -} \ No newline at end of file +} diff --git a/data/web/sogo-auth.php b/data/web/sogo-auth.php index dbc54d7c2..5e0f3c39b 100644 --- a/data/web/sogo-auth.php +++ b/data/web/sogo-auth.php @@ -75,7 +75,12 @@ elseif (isset($_GET['login'])) { // only check for admin-login on sogo GUI requests elseif (isset($_SERVER['HTTP_X_ORIGINAL_URI']) && strcasecmp(substr($_SERVER['HTTP_X_ORIGINAL_URI'], 0, 9), "/SOGo/so/") === 0) { // this is an nginx auth_request call, we check for existing sogo-sso session variables - session_start(); + require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.inc.php'; + if (file_exists($_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php')) { + include_once $_SERVER['DOCUMENT_ROOT'] . '/inc/vars.local.inc.php'; + } + require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/sessions.inc.php'; + // extract email address from "/SOGo/so/user@domain/xy" $url_parts = explode("/", $_SERVER['HTTP_X_ORIGINAL_URI']); $email_list = array( diff --git a/docker-compose.yml b/docker-compose.yml index a37c6982f..3b39c0805 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -17,7 +17,7 @@ services: - unbound mysql-mailcow: - image: mariadb:10.5 + image: mariadb:10.11 depends_on: - unbound-mailcow - netfilter-mailcow @@ -43,7 +43,7 @@ services: redis-mailcow: image: redis:7-alpine - entrypoint: /redis-conf.sh + entrypoint: ["/bin/sh","/redis-conf.sh"] volumes: - redis-vol-1:/data/ - ./data/conf/redis/redis-conf.sh:/redis-conf.sh:z @@ -55,6 +55,7 @@ services: environment: - TZ=${TZ} - REDISPASS=${REDISPASS} + - REDISMASTERPASS=${REDISMASTERPASS:-} sysctls: - net.core.somaxconn=4096 networks: @@ -83,7 +84,7 @@ services: - clamd rspamd-mailcow: - image: mailcow/rspamd:1.99 + image: mailcow/rspamd:2.0 stop_grace_period: 30s depends_on: - dovecot-mailcow @@ -198,7 +199,7 @@ services: - phpfpm sogo-mailcow: - image: mailcow/sogo:nightly-20250115 + image: mailcow/sogo:nightly-20250224 environment: - DBNAME=${DBNAME} - DBUSER=${DBUSER} @@ -223,6 +224,9 @@ services: - ./data/conf/sogo/:/etc/sogo/:z - ./data/web/inc/init_db.inc.php:/init_db.inc.php:z - ./data/conf/sogo/custom-favicon.ico:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo.ico:z + - ./data/conf/sogo/custom-shortlogo.svg:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-compact.svg:z + - ./data/conf/sogo/custom-fulllogo.svg:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-full.svg:z + - ./data/conf/sogo/custom-fulllogo.png:/usr/lib/GNUstep/SOGo/WebServerResources/img/sogo-logo.png:z - ./data/conf/sogo/custom-theme.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/theme.js:z - ./data/conf/sogo/custom-sogo.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js:z - mysql-socket-vol-1:/var/run/mysqld/ @@ -246,7 +250,7 @@ services: - sogo dovecot-mailcow: - image: mailcow/dovecot:nightly-20250211 + image: mailcow/dovecot:nightly-20250224 depends_on: - mysql-mailcow - netfilter-mailcow @@ -333,7 +337,7 @@ services: - dovecot postfix-mailcow: - image: mailcow/postfix:1.79 + image: mailcow/postfix:1.80 depends_on: mysql-mailcow: condition: service_started @@ -389,7 +393,7 @@ services: - php-fpm-mailcow - sogo-mailcow - rspamd-mailcow - image: mailcow/nginx:1.02 + image: mailcow/nginx:1.03 dns: - ${IPV4_NETWORK:-172.22.1}.254 environment: @@ -407,6 +411,8 @@ services: - RSPAMDHOST=${RSPAMDHOST:-} - REDISHOST=${REDISHOST:-} - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1} + - NGINX_USE_PROXY_PROTOCOL=${NGINX_USE_PROXY_PROTOCOL:-n} + - TRUSTED_PROXIES=${TRUSTED_PROXIES:-} volumes: - ./data/web:/web:ro,z - ./data/conf/rspamd/dynmaps:/dynmaps:ro,z @@ -471,7 +477,7 @@ services: - acme netfilter-mailcow: - image: mailcow/netfilter:1.60 + image: mailcow/netfilter:1.61 stop_grace_period: 30s restart: always privileged: true diff --git a/generate_config.sh b/generate_config.sh index 94ec23a42..052764a6b 100755 --- a/generate_config.sh +++ b/generate_config.sh @@ -26,7 +26,7 @@ for bin in openssl curl docker git awk sha1sum grep cut; do done # Check Docker Version (need at least 24.X) -docker_version=$(docker -v | grep -oP '\d+\.\d+\.\d+' | head -n 1 | cut -d '.' -f 1) +docker_version=$(docker version --format '{{.Server.Version}}' | cut -d '.' -f 1) if [[ $docker_version -lt 24 ]]; then echo -e "\e[31mCannot find Docker with a Version higher or equals 24.0.0\e[0m"