mailu-traefik-letsencrypt-docker-compose.yml

networks:
  mailu-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: ${SUBNET}
  radicale:
    driver: bridge
  webmail-network:
    driver: bridge
  clamav-network:
    driver: bridge
  oletools-network:
    driver: bridge
    internal: true
  fts-attachments-network:
    driver: bridge
    internal: true
  traefik-network:
    external: true

volumes:
  mailu-data:
  mailu-dav:
  mailu-mail:
  mailu-redis:
  mailu-filter:
  mailu-mailqueue:
  mailu-webmail:
  mailu-certificates:
  mailu-dkim:
  mailu-override:
  traefik-certificates:

services:
  redis:
    image: ${REDIS_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-redis:/data
    networks:
      - mailu-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - resolver

  resolver:
    image: ${RESOLVER_IMAGE_TAG}
    env_file: .env
    networks:
      mailu-network:
        ipv4_address: ${RESOLVER_IP}
    restart: unless-stopped

  front:
    image: ${FRONT_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-certificates:/certs
      - mailu-override:/overrides:ro
    networks:
      - mailu-network
      - webmail-network
      - radicale
      - traefik-network
    dns:
      - ${RESOLVER_IP}
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Define TCP router rules for SMTP on HostSNI
      - "traefik.tcp.routers.smtp.rule=HostSNI(`*`)"
      # Use the SMTP entrypoint for the SMTP service
      - "traefik.tcp.routers.smtp.entrypoints=smtp"
      # Assign the router to the SMTP service
      - "traefik.tcp.routers.smtp.service=smtp"
      # Specify the internal container port for SMTP
      - "traefik.tcp.services.smtp.loadbalancer.server.port=25"
      # Define TCP router rules for SMTPS on HostSNI
      - "traefik.tcp.routers.smtps.rule=HostSNI(`*`)"
      # Use the SMTPS entrypoint for the SMTPS service
      - "traefik.tcp.routers.smtps.entrypoints=smtps"
      # Assign the router to the SMTPS service
      - "traefik.tcp.routers.smtps.service=smtps"
      # Specify the internal container port for SMTPS
      - "traefik.tcp.services.smtps.loadbalancer.server.port=465"
      # Define TCP router rules for Submission on HostSNI
      - "traefik.tcp.routers.submission.rule=HostSNI(`*`)"
      # Use the Submission entrypoint for the Submission service
      - "traefik.tcp.routers.submission.entrypoints=submission"
      # Assign the router to the Submission service
      - "traefik.tcp.routers.submission.service=submission"
      # Specify the internal container port for Submission
      - "traefik.tcp.services.submission.loadbalancer.server.port=587"
      # Define TCP router rules for POP3 on HostSNI
      - "traefik.tcp.routers.pop3.rule=HostSNI(`*`)"
      # Use the POP3 entrypoint for the POP3 service
      - "traefik.tcp.routers.pop3.entrypoints=pop3"
      # Assign the router to the POP3 service
      - "traefik.tcp.routers.pop3.service=pop3"
      # Specify the internal container port for POP3
      - "traefik.tcp.services.pop3.loadbalancer.server.port=110"
      # Define TCP router rules for POP3S on HostSNI
      - "traefik.tcp.routers.pop3s.rule=HostSNI(`*`)"
      # Use the POP3S entrypoint for the POP3S service
      - "traefik.tcp.routers.pop3s.entrypoints=pop3s"
      # Assign the router to the POP3S service
      - "traefik.tcp.routers.pop3s.service=pop3s"
      # Specify the internal container port for POP3S
      - "traefik.tcp.services.pop3s.loadbalancer.server.port=995"
      # Define TCP router rules for IMAP on HostSNI
      - "traefik.tcp.routers.imap.rule=HostSNI(`*`)"
      # Use the IMAP entrypoint for the IMAP service
      - "traefik.tcp.routers.imap.entrypoints=imap"
      # Assign the router to the IMAP service
      - "traefik.tcp.routers.imap.service=imap"
      # Specify the internal container port for IMAP
      - "traefik.tcp.services.imap.loadbalancer.server.port=143"
      # Define TCP router rules for IMAPS on HostSNI
      - "traefik.tcp.routers.imaps.rule=HostSNI(`*`)"
      # Use the IMAPS entrypoint for the IMAPS service
      - "traefik.tcp.routers.imaps.entrypoints=imaps"
      # Assign the router to the IMAPS service
      - "traefik.tcp.routers.imaps.service=imaps"
      # Specify the internal container port for IMAPS
      - "traefik.tcp.services.imaps.loadbalancer.server.port=993"
      # Define TCP router rules for Sieve on HostSNI
      - "traefik.tcp.routers.sieve.rule=HostSNI(`*`)"
      # Use the Sieve entrypoint for the Sieve service
      - "traefik.tcp.routers.sieve.entrypoints=sieve"
      # Assign the router to the Sieve service
      - "traefik.tcp.routers.sieve.service=sieve"
      # Specify the internal container port for Sieve
      - "traefik.tcp.services.sieve.loadbalancer.server.port=4190"
      # Define HTTP router rules for mail service based on hostname
      - "traefik.http.routers.mail.rule=Host(`${MAILU_HOSTNAME}`)"
      # Use the websecure entrypoint for the mail service
      - "traefik.http.routers.mail.entrypoints=websecure"
      # Enable TLS on this router
      - "traefik.http.routers.mail.tls=true"
      # Use Let's Encrypt for TLS certificate management
      - "traefik.http.routers.mail.tls.certresolver=letsencrypt"
      # Specify the internal container port for the HTTP service
      - "traefik.http.services.mail.loadbalancer.server.port=80"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      - resolver

  admin:
    image: ${ADMIN_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-data:/data
      - mailu-dkim:/dkim
    networks:
      - mailu-network
      - traefik-network
    dns:
      - ${RESOLVER_IP}
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.mailu-admin.rule=Host(`${MAILU_ADMIN_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.mailu-admin.service=mailu-admin"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.mailu-admin.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.mailu-admin.loadbalancer.server.port=8080"
      # Enable TLS on this router
      - "traefik.http.routers.mailu-admin.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.mailu-admin.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.mailu-admin.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.mailu-admin.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      - redis
      - resolver

  imap:
    image: ${IMAP_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-mail:/mail
      - mailu-override:/overrides:ro
    networks:
      - mailu-network
      - fts-attachments-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - front
      - fts-attachments
      - resolver

  smtp:
    image: ${SMTP_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-mailqueue:/queue
      - mailu-override:/overrides:ro
    networks:
      - mailu-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - front
      - resolver

  oletools:
    image: ${OLETOOLS_IMAGE_TAG}
    env_file: .env
    hostname: olefy
    networks:
      - oletools-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - resolver

  fts-attachments:
    image: ${FTS_ATTACHMENTS_IMAGE_TAG}
    env_file: .env
    hostname: tika
    networks:
      - fts-attachments-network
    dns:
      - ${RESOLVER_IP}
    healthcheck:
      test: ["CMD-SHELL", "wget -nv -t1 -O /dev/null http://127.0.0.1:9998/tika || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    depends_on:
      - resolver

  antispam:
    image: ${ANTISPAM_IMAGE_TAG}
    env_file: .env
    hostname: antispam
    volumes:
      - mailu-filter:/var/lib/rspamd
      - mailu-override:/overrides:ro
    networks:
      - mailu-network
      - oletools-network
      - clamav-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - front
      - redis
      - oletools
      - antivirus
      - resolver

  antivirus:
    image: ${ANTIVIRUS_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-filter:/var/lib/clamav
    networks:
      - clamav-network
    healthcheck:
      test: ["CMD-SHELL", "kill -0 $(cat /tmp/clamd.pid) && kill -0 $(cat /tmp/freshclam.pid)"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    restart: unless-stopped

  webdav:
    image: ${WEBDAV_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-dav:/data
    networks:
      - radicale
      - traefik-network
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.mailu-webdav.rule=Host(`${MAILU_WEBDAV_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.mailu-webdav.service=mailu-webdav"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.mailu-webdav.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.mailu-webdav.loadbalancer.server.port=5232"
      # Enable TLS on this router
      - "traefik.http.routers.mailu-webdav.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.mailu-webdav.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.mailu-webdav.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.mailu-webdav.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped

  fetchmail:
    image: ${FETCHMAIL_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-data:/data
    networks:
      - mailu-network
    dns:
      - ${RESOLVER_IP}
    restart: unless-stopped
    depends_on:
      - admin
      - smtp
      - imap
      - resolver

  webmail:
    image: ${WEBMAIL_IMAGE_TAG}
    env_file: .env
    volumes:
      - mailu-webmail:/data
      - mailu-override:/overrides:ro
    networks:
      - webmail-network
      - traefik-network
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true"
      # Match incoming requests on a specific hostname
      - "traefik.http.routers.mailu-webmail.rule=Host(`${MAILU_HOSTNAME}`)"
      # Assign the router to a named Traefik service
      - "traefik.http.routers.mailu-webmail.service=mailu-webmail"
      # Use the 'websecure' (HTTPS) entry point
      - "traefik.http.routers.mailu-webmail.entrypoints=websecure"
      # Define the internal container port for routing
      - "traefik.http.services.mailu-webmail.loadbalancer.server.port=80"
      # Enable TLS on this router
      - "traefik.http.routers.mailu-webmail.tls=true"
      # Use Let's Encrypt for certificate management
      - "traefik.http.routers.mailu-webmail.tls.certresolver=letsencrypt"
      # Pass the original Host header to the container
      - "traefik.http.services.mailu-webmail.loadbalancer.passhostheader=true"
      # Apply a compression middleware
      - "traefik.http.routers.mailu-webmail.middlewares=compresstraefik"
      # Define settings for the compression middleware
      - "traefik.http.middlewares.compresstraefik.compress=true"
      # Specify which Docker network Traefik should use for routing
      - "traefik.docker.network=traefik-network"
    restart: unless-stopped
    depends_on:
      - front

  traefik:
    image: ${TRAEFIK_IMAGE_TAG}
    command:
      # Set the log level (DEBUG, INFO, WARN, ERROR)
      - "--log.level=${TRAEFIK_LOG_LEVEL}"
      # Enable the built-in API and web-based dashboard on /dashboard
      - "--api.dashboard=true"
      # Enable the /ping endpoint so we can health-check Traefik
      - "--ping=true"
      # Assign the /ping endpoint to a dedicated entry point on port 8082
      - "--ping.entrypoint=ping"
      - "--entrypoints.ping.address=:8082"
      # Define the primary HTTP entry point on port 80
      - "--entrypoints.web.address=:80"
      # Define the secure (HTTPS) entry point on port 443
      - "--entrypoints.websecure.address=:443"
      # Define the SMTP entry point for email sending on port 25
      - "--entryPoints.smtp.address=:25"
      # Define the SMTPS entry point for secure email sending on port 465
      - "--entryPoints.smtps.address=:465"
      # Define the Submission entry point for email submission on port 587
      - "--entryPoints.submission.address=:587"
      # Define the POP3 entry point for receiving emails on port 110
      - "--entryPoints.pop3.address=:110"
      # Define the secure POP3S entry point for secure email receiving on port 995
      - "--entryPoints.pop3s.address=:995"
      # Define the IMAP entry point for email access on port 143
      - "--entryPoints.imap.address=:143"
      # Define the secure IMAPS entry point for secure email access on port 993
      - "--entryPoints.imaps.address=:993"
      # Define the Sieve entry point for email filtering on port 4190
      - "--entryPoints.sieve.address=:4190"
      # Enable the Docker provider to detect containers and their labels
      - "--providers.docker=true"
      # Point Traefik to the Docker socket
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      # Prevent automatic exposure of all containers; only expose containers
      # with "traefik.enable=true"
      - "--providers.docker.exposedbydefault=false"
      # Use ACME (Let's Encrypt) to generate/renew certificates via TLS challenge
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      # The email address used by Let's Encrypt for renewal notices
      - "--certificatesresolvers.letsencrypt.acme.email=${TRAEFIK_ACME_EMAIL}"
      # The file where ACME certificates are stored inside the container
      - "--certificatesresolvers.letsencrypt.acme.storage=/etc/traefik/acme/acme.json"
      # Enable Prometheus metrics
      - "--metrics.prometheus=true"
      # Configure Prometheus histogram buckets
      - "--metrics.prometheus.buckets=0.1,0.3,1.2,5.0"
      # Check for newer Traefik versions and optionally log that info
      - "--global.checknewversion=true"
      # Disable sending anonymous usage data to the Traefik maintainers
      - "--global.sendanonymoususage=false"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik-certificates:/etc/traefik/acme
    networks:
      - traefik-network
    ports:
      - "25:25"
      - "465:465"
      - "587:587"
      - "110:110"
      - "995:995"
      - "143:143"
      - "993:993"
      - "4190:4190"
      - "80:80"
      - "443:443"
    healthcheck:
      test: ["CMD", "wget", "http://localhost:8082/ping","--spider"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 5s
    labels:
      # Enable Traefik for this container.
      - "traefik.enable=true"
      # A router to expose the Traefik dashboard
      - "traefik.http.routers.dashboard.rule=Host(`${TRAEFIK_HOSTNAME}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      # asic Authentication for the Traefik dashboard
      - "traefik.http.routers.dashboard.middlewares=authtraefik"
      - "traefik.http.middlewares.authtraefik.basicauth.users=${TRAEFIK_BASIC_AUTH}"
      # Specify the internal server port to the dashboard service
      - "traefik.http.services.dashboard.loadbalancer.server.port=8080"
      # Pass the original Host header to the backend
      - "traefik.http.services.dashboard.loadbalancer.passhostheader=true"
      # HTTP -> HTTPS redirect for all hosts
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.entrypoints=web"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
    restart: unless-stopped