make docker-compose easier to use (also by introducing variables and a setup script)

update Dockerfiles/Makefile for use with kopano supported build
introduce a local ldap image with some demo users
include caddy for reverse proxying
add proper documentation and remove obsolete build and push scripts

Signed-off-by: Felix Bartels <felix@host-consultants.de>

docker-compose.yml-example

@@ -1,208 +1,108 @@
-version: '3'
+version: "3"
 
 services:
-
-  kserver:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    hostname: kserver
-    container_name: kopano_server
+  web:
+    build: caddy/
+    #image: abiosoft/caddy:0.10.4
+    container_name: web
+    restart: always
+    privileged: true
     links:
-      - db
-    depends_on:
-      - "kssl"
-    environment:
-      - SERVICE_TO_START=server
-      - TZ=Europe/Berlin
-      - KCCONF_SERVER_COREDUMP_ENABLED=no
-      - KCCONF_SERVER_LOG_LEVEL=4
-      - KCCONF_SERVER_MYSQL_HOST=db
-      - KCCONF_SERVER_MYSQL_PORT=3306
-      - KCCONF_SERVER_MYSQL_DATABASE=kopano
-      - KCCONF_SERVER_MYSQL_USER=root
-      - KCCONF_SERVER_MYSQL_PASSWORD=YOUR_MYSQL_ROOT_PASSWORD  #change here
-      - KCCONF_SERVER_SERVER_SSL_KEY_FILE=/kopano/ssl/kserver.pem
-      - KCCONF_SERVER_SERVER_SSL_CA_FILE=/kopano/ssl/ca.pem
-      - KCCONF_SERVER_SSLKEYS_PATH=/kopano/ssl/clients
-      - KCCONF_SERVER_PROXY_HEADER=* # delete line if webapp is not behind reverse proxy
-      - KCCONF_SERVER_SYSTEM_EMAIL_ADDRESS=hostmaster@domain.tld  #change here
-      - KCCONF_SERVER_DISABLED_FEATURES=pop3
-      - KCCONF_SERVER_SEARCH_SOCKET=http://ksearch:2380/
-      - KCCONF_LDAP_LDAP_URI=ldaps://ldapserver:ldapport  #change here
-      - KCCONF_LDAP_LDAP_BIND_USER=cn=SOME_STANDARD_USER,OU=MyUsers,DC=domain,DC=tld #change here
-      - KCCONF_LDAP_LDAP_BIND_PASSWD=PASSWORD_OF_STANDARD_USER  #change here
-      - KCCONF_LDAP_LDAP_SEARCH_BASE=OU=MyUsers,dc=domain,dc=tld  #change here
-      - KCCOMMENT_LDAP_1=!include /usr/share/kopano/ldap.openldap.cfg #delete if you want openldap
-      - KCUNCOMMENT_LDAP_1=!include /usr/share/kopano/ldap.active-directory.cfg #delete if you want openldap
-    networks:
-      - kopanonet
+      - kwebapp
+      #- kzpush
+    ports:
+      - "2015:2015"
+      - "${HTTP}:80"
+      - "${HTTPS}:443"
     volumes:
-      - data:/kopano/data
-      - sslcerts:/kopano/ssl
-
-  kdagent:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_dagent
-    links:
-      - kserver
-    volumes:
-      - sslcerts:/kopano/ssl
-    environment:
-      - SERVICE_TO_START=dagent
-      - TZ=Europe/Berlin
-      - KCCONF_DAGENT_LOG_LEVEL=6
-      - KCCONF_DAGENT_SERVER_SOCKET=https://kserver:237/
-      - KCCONF_DAGENT_SSLKEY_FILE=/kopano/ssl/kdagent.pem
-    networks:
-      - kopanonet
-
-  kgateway:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_gateway
-    links:
-      - kserver
-    volumes:
-      - ./gatewaycerts/:/kopano/certs/
-    environment:
-      - SERVICE_TO_START=gateway
-      - TZ=Europe/Berlin
-      - KCCONF_GATEWAY_SERVER_SOCKET=http://kserver:236/
-      - KCCONF_GATEWAY_SSL_PRIVATE_KEY_FILE=/kopano/certs/yourcert.key # change here
-      - KCCONF_GATEWAY_SSL_CERTIFICATE_FILE=/kopano/certs/yourcert.pem # change here
-    networks:
-      - kopanonet
-
-  kical:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_ical
-    links:
-      - kserver
-    environment:
-      - SERVICE_TO_START=ical
-      - TZ=Europe/Berlin
-      - KCCONF_ICAL_SERVER_SOCKET=http://kserver:236/
-    networks:
-      - kopanonet
-
-  kmonitor:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_monitor
-    links:
-      - kserver
-    volumes:
-      - sslcerts:/kopano/ssl
-    environment:
-      - SERVICE_TO_START=monitor
-      - TZ=Europe/Berlin
-      - KCCONF_MONITOR_SERVER_SOCKET=https://kserver:237/
-      - KCCONF_MONITOR_SSLKEY_FILE=/kopano/ssl/kmonitor.pem
-    networks:
-      - kopanonet
-
-  ksearch:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_search
-    links:
-      - kserver
-    volumes:
-      - sslcerts:/kopano/ssl
-    environment:
-      - SERVICE_TO_START=search
-      - TZ=Europe/Berlin
-      - KCCONF_SEARCH_SERVER_BIND_NAME=http://ksearch:2380
-      - KCCONF_SEARCH_SERVER_SOCKET=https://kserver:237/
-      - KCCONF_SEARCH_SSLKEY_FILE=/kopano/ssl/ksearch.pem
-    networks:
-      - kopanonet
-
-  kspooler:
-    image: zokradonh/kopano_core:${CORE_VERSION}
-    container_name: kopano_spooler
-    links:
-      - kserver
-    volumes:
-      - sslcerts:/kopano/ssl
-    environment:
-      - SERVICE_TO_START=spooler
-      - TZ=Europe/Berlin
-      - KCCONF_SPOOLER_SERVER_SOCKET=https://kserver:237/
-      - KCCONF_SPOOLER_LOG_LEVEL=4
-      - KCCONF_SPOOLER_SMTP_SERVER=kmta
-      - KCCONF_SPOOLER_SSLKEY_FILE=/kopano/ssl/kspooler.pem
-    networks:
-      - kopanonet
-
-  kwebapp:
-    image: zokradonh/kopano_webapp:${WEBAPP_VERSION}
-    hostname: kwebapp
-    container_name: kopano_webapp
-    links:
-      - kserver
-    #ports:
-    #  - "8236:80"
-    #  - "8237:443"
-    volumes:
-      - syncstates:/var/lib/z-push/
-      - sslcerts:/kopano/ssl
-    environment:
-      - TZ=Europe/Berlin
-      - KCCONF_SERVERHOSTNAME=kserver
-      - KCCONF_SERVERPORT=237
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ./data/web:/root/.caddy
     networks:
       - web
+
+  ldap:
+    build: ldap/
+    #image: osixia/openldap:1.2.2
+    container_name: ldap
+    ports:
+      - 389:389
+    environment:
+      - LDAP_ORGANISATION=${LDAP_ORGANISATION}
+      - LDAP_DOMAIN=${LDAP_DOMAIN}
+      - LDAP_BASE_DN=${LDAP_BASE_DN}
+      - LDAP_ADMIN_PASSWORD=${LDAP_ADMIN_PASSWORD}
+      - LDAP_READONLY_USER=true
+      - LDAP_READONLY_USER_PASSWORD=${LDAP_READONLY_USER_PASSWORD}
+    command: "--loglevel debug --copy-service"
+    volumes:
+      - ./data/ldap/var/lib/ldap:/var/lib/ldap
+      - ./data/ldap/etc/ldap/slapd.d:/etc/ldap/slapd.d
+    networks:
       - kopanonet
 
-  kssl:
-    image: zokradonh/kopano_ssl
-    container_name: kopano_ssl
-    volumes:
-      - sslcerts:/kopano/ssl
 
-  kmta:
-    image: tvial/docker-mailserver:latest
-    hostname: myhost #change here
-    domainname: domain.tld #change here
-    #dns: 127.0.0.1
-    container_name: kopano_mta
-    #links:
-    #  - adtunnel
+  ldap-admin:
+    image: osixia/phpldapadmin:0.7.2
+    container_name: ldap-admin
+    depends_on:
+      - ldap
+    environment:
+      - PHPLDAPADMIN_LDAP_HOSTS=ldap
+      - PHPLDAPADMIN_HTTPS=false
+      - CADDY_HOST=${LDAP_HOST}
+      - CADDY_PORT=80
+      - CADDY_PROXY_PARAMS=transparent
+      - CADDY_TLS_SELFSIGNED
+    command: -l debug
+    links:
+      - ldap
+    networks:
+      - web
+
+  mail:
+    image: tvial/docker-mailserver:release-v6.1.0
+    restart: always
+    hostname: mail
+    domainname: ${LDAP_DOMAIN}
+    container_name: mail
+    depends_on:
+      - ldap
+    links:
+      - ldap
     ports:
       - "25:25"
-    #  - "143:143"
-    #  - "587:587"
-    #  - "993:993"
     volumes:
-      - tmpmaildata:/var/mail
-      - tmpmailstate:/var/mail-state
-      - ./mtaconfig/:/tmp/docker-mailserver/ # create this dir
+      - ./data/mail/data:/var/mail
+      - ./data/mail/state:/var/mail-state
+      - ./data/mtaconfig:/tmp/docker-mailserver/
     environment:
-      - TZ=Europe/Berlin
+      - TZ=${TZ}
       - ENABLE_SPAMASSASSIN=1
       - ENABLE_CLAMAV=1
       - ENABLE_FAIL2BAN=1
       - ENABLE_POSTGREY=1
-      - TLS_LEVEL=intermediate
-      - POSTGREY_DELAY=10
       - ONE_DIR=1
       - DMS_DEBUG=0
+      - SSL_TYPE=self-signed
       - ENABLE_LDAP=1
-      - LDAP_SERVER_HOST=ldaps://ldapserver:ldapport #change here
-      - LDAP_SEARCH_BASE=OU=MyUsers,DC=domain,DC=tld #change here
-      - LDAP_BIND_DN=cn=SOME_STANDARD_USER,OU=MyUsers,DC=domain,DC=tld #change here
-      - LDAP_BIND_PW=PASSWORD_OF_SOME_STANDARD_USER #change here
-      - LDAP_QUERY_FILTER_USER=(&(objectClass=user)(|(mail=%s)(otherMailbox=%s)))
-      - LDAP_QUERY_FILTER_GROUP=(&(objectclass=group)(mail=%s))
-      - LDAP_QUERY_FILTER_ALIAS=(&(objectClass=user)(otherMailbox=%s))
-      - LDAP_QUERY_FILTER_DOMAIN=(&(|(mail=*@%s)(otherMailbox=*@%s)(mailGroupMember=*@%s))(kopanoAccount=1)(|(objectClass=user)(objectclass=group)))
+      - LDAP_SERVER_HOST=${LDAP_SERVER}
+      - LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
+      - LDAP_BIND_DN=${LDAP_BIND_DN}
+      - LDAP_BIND_PW=${LDAP_BIND_PW}
+      - LDAP_QUERY_FILTER_USER=${LDAP_QUERY_FILTER_USER}
+      - LDAP_QUERY_FILTER_GROUP=${LDAP_QUERY_FILTER_GROUP}
+      - LDAP_QUERY_FILTER_ALIAS=${LDAP_QUERY_FILTER_ALIAS}
+      - LDAP_QUERY_FILTER_DOMAIN=${LDAP_QUERY_FILTER_DOMAIN}
       - ENABLE_SASLAUTHD=1
-      - SASLAUTHD_LDAP_SERVER=ldaps://ldapserver:ldapport #change here
-      - SASLAUTHD_LDAP_BIND_DN=cn=SOME_STANDARD_USER,OU=MyUsers,DC=domain,DC=tld #change here
-      - SASLAUTHD_LDAP_PASSWORD=PASSWORD_OF_SOME_STANDARD_USER  #change here
-      - SASLAUTHD_LDAP_SEARCH_BASE=OU=MyUsers,DC=domain,DC=tld  #change here
-      - SASLAUTHD_LDAP_FILTER=(&(sAMAccountName=%U)(objectClass=person))
+      - SASLAUTHD_LDAP_SERVER=${LDAP_SERVER}
+      - SASLAUTHD_LDAP_BIND_DN=${LDAP_BIND_DN}
+      - SASLAUTHD_LDAP_PASSWORD=${LDAP_BIND_PW}
+      - SASLAUTHD_LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
+      - SASLAUTHD_LDAP_FILTER=${SASLAUTHD_LDAP_FILTER}
       - SASLAUTHD_MECHANISMS=ldap
-      - POSTMASTER_ADDRESS=postmaster@domain.tld #change here
+      - POSTMASTER_ADDRESS=${POSTMASTER_ADDRESS}
       - SMTP_ONLY=1
-      - PERMIT_DOCKER=network
+      - PERMIT_DOCKER=host
       - ENABLE_POSTFIX_VIRTUAL_TRANSPORT=1
       - POSTFIX_DAGENT=lmtp:kdagent:2003
       - REPORT_RECIPIENT=1
@@ -213,30 +113,186 @@ services:
       - SYS_PTRACE
 
   db:
-    image: mariadb
+    image: mariadb:10.3.10-bionic
     restart: always
     container_name: kopano_db
     volumes:
-      - db:/var/lib/mysql
+      - ./data/mysql/:/var/lib/mysql
     environment:
-      - MYSQL_ROOT_PASSWORD=YOUR_MYSQL_ROOT_PASSWORD  #change here
-      - MYSQL_PASSWORD=YOUR_PASSWORD #change here
-      - MYSQL_DATABASE=kopano
-      - MYSQL_USER=kopano
+      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
+      - MYSQL_USER=${MYSQL_USER}
+      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - MYSQL_DATABASE=${MYSQL_DATABASE}
+    healthcheck:
+      test: ["CMD-SHELL", 'mysql --database=$$MYSQL_DATABASE --password=$$MYSQL_ROOT_PASSWORD --execute="SELECT count(table_name) > 0 FROM information_schema.tables;" --skip-column-names -B']
+      interval: 30s
+      timeout: 10s
+      retries: 4
+    networks:
+      - kopanonet
+  
+  kssl:
+    image: ${docker_repo:?err}/kopano_ssl
+    container_name: kopano_ssl
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+
+  kserver:
+    image: ${docker_repo}/kopano_core:${CORE_VERSION}
+    hostname: kserver
+    container_name: kopano_server
+    links:
+      - db
+      - ldap
+    depends_on:
+      - db
+      - ldap
+      - kssl
+    environment:
+      - SERVICE_TO_START=server
+      - TZ=${TZ}
+      - KCCONF_SERVER_COREDUMP_ENABLED=no
+      - KCCONF_SERVER_LOG_LEVEL=4
+      - KCCONF_SERVER_MYSQL_HOST=${MYSQL_HOST}
+      - KCCONF_SERVER_MYSQL_PORT=3306
+      - KCCONF_SERVER_MYSQL_DATABASE=${MYSQL_DATABASE}
+      - KCCONF_SERVER_MYSQL_USER=${MYSQL_USER}
+      - KCCONF_SERVER_MYSQL_PASSWORD=${MYSQL_PASSWORD}
+      - KCCONF_SERVER_SERVER_SSL_KEY_FILE=/kopano/ssl/kserver.pem
+      - KCCONF_SERVER_SERVER_SSL_CA_FILE=/kopano/ssl/ca.pem
+      - KCCONF_SERVER_SERVER_NAME=Kopano
+      - KCCONF_SERVER_SSLKEYS_PATH=/kopano/ssl/clients
+      - KCCONF_SERVER_PROXY_HEADER=* # delete line if webapp is not behind reverse proxy
+      - KCCONF_SERVER_SYSTEM_EMAIL_ADDRESS=${POSTMASTER_ADDRESS}
+      - KCCONF_LDAP_LDAP_URI=${LDAP_SERVER}
+      - KCCONF_LDAP_LDAP_BIND_USER=${LDAP_BIND_DN}
+      - KCCONF_LDAP_LDAP_BIND_PASSWD=${LDAP_BIND_PW}
+      - KCCONF_LDAP_LDAP_SEARCH_BASE=${LDAP_SEARCH_BASE}
+      - KCUNCOMMENT_LDAP_1=${KCUNCOMMENT_LDAP_1}
+      - KCCOMMENT_LDAP_1=${KCCOMMENT_LDAP_1}
+      #- ADDITIONAL_KOPANO_PACKAGES=kopano-migration-imap
+    networks:
+      - kopanonet
+    volumes:
+      - ./data/kopano/:/kopano/data
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+
+  kwebapp:
+    image: ${docker_repo:?err}/kopano_webapp:${WEBAPP_VERSION}
+    hostname: kwebapp
+    container_name: kopano_webapp
+    links:
+      - kserver
+    volumes:
+      - ./data/z-push-states/:/var/lib/z-push/
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - TZ=${TZ}
+      - CADDY_HOST=${WEBAPP_HOST}
+      - CADDY_PROXY_PARAMS=transparent
+      - CADDY_TLS_SELFSIGNED
+    networks:
+      - web
+      - kopanonet
+
+  kdagent:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_dagent
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=dagent
+      - TZ=${TZ}
+      - KCCONF_DAGENT_LOG_LEVEL=6
+      - KCCONF_DAGENT_SSLKEY_FILE=/kopano/ssl/kdagent.pem
     networks:
       - kopanonet
 
-volumes:
-  db:
-  data:
-  syncstates:
-  sslcerts:
-  tmpmaildata:
-  tmpmailstate:
+  kspooler:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_spooler
+    hostname: spooler
+    domainname: ${LDAP_DOMAIN}
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=spooler
+      - TZ=${TZ}
+      - KCCONF_SPOOLER_LOG_LEVEL=4
+      - KCCONF_SPOOLER_SMTP_SERVER=mail
+      - KCCONF_SPOOLER_SSLKEY_FILE=/kopano/ssl/kspooler.pem
+    networks:
+      - kopanonet
+
+  kgateway:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_gateway
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=gateway
+      - TZ=${TZ}
+      - KCCONF_GATEWAY_SERVER_SOCKET=http://kserver:236/
+      - KCCONF_GATEWAY_SSL_PRIVATE_KEY_FILE=/kopano/certs/yourcert.key # change here
+      - KCCONF_GATEWAY_SSL_CERTIFICATE_FILE=/kopano/certs/yourcert.pem # change here
+    networks:
+      - kopanonet
+
+  kical:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_ical
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=ical
+      - TZ=${TZ}
+      - KCCONF_ICAL_SERVER_SOCKET=http://kserver:236/
+    networks:
+      - kopanonet
+
+  kmonitor:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_monitor
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=monitor
+      - TZ=${TZ}
+    networks:
+      - kopanonet
+
+  ksearch:
+    image: ${docker_repo:?err}/kopano_core:${CORE_VERSION}
+    container_name: kopano_search
+    links:
+      - kserver
+    volumes:
+      - ./data/ssl/:/kopano/ssl
+      - ./data/socket/:/run/kopano
+    environment:
+      - SERVICE_TO_START=search
+      - TZ=${TZ}
+    networks:
+      - kopanonet
 
 networks:
-  web: # this requires an external docker container that is a http reverse proxy (e.g. haproxy)
-    external:
-      name: haproxy_webrproxynet
+  web:
   kopanonet:
     driver: bridge