Some last changes

.gitignore

@@ -1,4 +1,6 @@
 data/db/mysql/*
+data/assets/ssl/*
+!data/assets/ssl/.empty
 !data/db/mysql/.mysql_data
 data/db/redis/*
 !data/db/redis/.redis_data

000-build-certs.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+. mailcow.conf
+
+openssl dhparam -out data/assets/ssl/dhparams.pem 2048
+
+docker run \
+	--rm \
+	-v ${PWD}/data/assets/ssl:/certs \
+	ehazlett/certm \
+	-d /certs ca generate -o=mailcow
+
+docker run \
+	--rm \
+	-v ${PWD}/data/assets/ssl:/certs \
+	ehazlett/certm \
+	-d /certs client generate --common-name=${MAILCOW_HOSTNAME} -o=mailcow

002-build-pdns.sh

@@ -25,12 +25,9 @@ else
 	build
 fi
 
-sed -i "s#allow-from.*#allow-from=127.0.0.0/8 ${DOCKER_SUBNET}#" data/conf/pdns/recursor.conf
-
 docker run \
 	-v ${PWD}/data/conf/pdns/:/etc/powerdns/ \
 	--network=${DOCKER_NETWORK} \
-	--network-alias pdns \
 	-h pdns \
 	--name ${NAME} \
 	-d pdns

003-build-sql.sh

@@ -83,12 +83,11 @@ fi
 
 docker run \
 	-v ${PWD}/data/db/mysql/:/var/lib/mysql/ \
-	-v ${PWD}/data/conf/mysql/:/etc/mysql/conf.d/ \
-	-v ${PWD}/data/assets/mysql:/assets \
+	-v ${PWD}/data/conf/mysql/:/etc/mysql/conf.d/:ro \
+	-v ${PWD}/data/assets/mysql:/assets:ro \
 	--name=${NAME} \
 	--network=${DOCKER_NETWORK} \
 	-h mysql \
-	--network-alias mysql \
 	-e MYSQL_ROOT_PASSWORD=${DBROOT} \
 	-e MYSQL_DATABASE=${DBNAME} \
 	-e MYSQL_USER=${DBUSER} \

004-build-redis.sh

@@ -34,6 +34,5 @@ docker run \
 	-v ${PWD}/data/db/redis/:/data/ \
 	--network=${DOCKER_NETWORK} \
 	-h redis \
-	--network-alias redis \
 	--name=${NAME} \
 	-d redis:${REDISVERS} --appendonly yes

005-build-rspamd.sh

@@ -32,15 +32,14 @@ else
 fi
 
 docker run \
-	-v ${PWD}/data/conf/rspamd/override.d/:/etc/rspamd/override.d/ \
-	-v ${PWD}/data/conf/rspamd/local.d/:/etc/rspamd/local.d/ \
-	-v ${PWD}/data/conf/rspamd/lua/:/etc/rspamd/lua/ \
+	-v ${PWD}/data/conf/rspamd/override.d/:/etc/rspamd/override.d/ro \
+	-v ${PWD}/data/conf/rspamd/local.d/:/etc/rspamd/local.d/ro \
+	-v ${PWD}/data/conf/rspamd/lua/:/etc/rspamd/lua/:ro \
 	-v ${PWD}/data/dkim/txt/:/etc/rspamd/dkim/txt/:ro \
 	-v ${PWD}/data/dkim/keys/:/etc/rspamd/dkim/keys/:ro \
 	--dns=${PDNS_IP} \
-    --dns-search=${DOCKER_NETWORK} \
+	--dns-search=${DOCKER_NETWORK} \
 	--network=${DOCKER_NETWORK} \
-	--network-alias rspamd \
 	-h rspamd \
 	--name ${NAME} \
 	-d rspamd

006-build-php-fpm.sh

@@ -22,10 +22,12 @@ docker run \
 	-v ${PWD}/data/conf/rspamd/dynmaps:/dynmaps:ro \
     -v ${PWD}/data/dkim/:/shared/dkim/ \
 	-d --network=${DOCKER_NETWORK} \
-	--name ${NAME} --network-alias phpfpm -h phpfpm php:${PHPVERS}
+	--name ${NAME} \
+	-h phpfpm \
+	php:${PHPVERS}
 
 echo "Installing intl and mysql pdo extension..."
-docker exec ${NAME} /bin/bash -c "apt-get update && apt-get install -y zlib1g-dev libicu-dev g++ libidn11-dev dovecot-core"
+docker exec ${NAME} /bin/bash -c "apt-get update && apt-get install -y zlib1g-dev libicu-dev g++ libidn11-dev"
 docker exec ${NAME} docker-php-ext-configure intl pdo pdo_mysql
 docker exec ${NAME} docker-php-ext-install intl pdo pdo_mysql
 echo "Restarting container..."

007-build-nginx.sh

@@ -31,7 +31,6 @@ docker run \
 	-v ${PWD}/data/assets/ssl/:/etc/ssl/mail/:ro \
 	-v ${PWD}/data/conf/nginx/:/etc/nginx/conf.d/:ro \
 	--network=${DOCKER_NETWORK} \
-	--network-alias nginx \
 	-h nginx \
 	-d nginx:${NGINXVERS}
 

008-build-rmilter.sh

@@ -26,9 +26,8 @@ else
 fi
 
 docker run \
-	-v ${PWD}/data/conf/rmilter/:/etc/rmilter.conf.d/ \
+	-v ${PWD}/data/conf/rmilter/:/etc/rmilter.conf.d/:ro \
 	--network=${DOCKER_NETWORK} \
-	--network-alias rmilter \
 	-h rmilter \
 	--name ${NAME} \
 	-d rmilter

011-build-memcached.sh

@@ -21,6 +21,5 @@ fi
 docker run \
 	--network=${DOCKER_NETWORK} \
 	-h memcached \
-	--network-alias memcached \
 	--name=${NAME} \
 	-d memcached

README.md

@@ -7,22 +7,22 @@ All configurations were written with security in mind.
 
 ### Exposed ports:
 
-| Service               | External bindings                            | Internal bindings              |
-|:----------------------|:---------------------------------------------|:-------------------------------|
-| Postfix               | 25/tcp, 465/tcp, 587/tcp                     | 588/tcp                        |
-| Dovecot               | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp              |
-| Nginx                 | 443/tcp                                      | 80/tcp, 8081/tcp               |
-| PowerDNS Recursor     | -                                            | 53/udp                         |
-| Rspamd                | -                                            | 11333/tcp, 11334/tcp           |
-| MariaDB               | -                                            | 3306/tcp                       |
-| Rmilter               | -                                            | 9000/tcp                       |
-| PHP FPM               | -                                            | 9000/tcp                       |
-| SOGo                  | -                                            | 9000/tcp                       |
-| Redis                 | -                                            | 6379/tcp                       |
-| Memcached             | -                                            | 11211/tcp                      |
-
-
-All containers share a network "mailcow-network" (name can be changed, but remove all containers and rebuild them after changing).
+| Service      | Hostname, Alias                | External bindings                            | Internal bindings              |
+|:-------------|:-------------------------------|:---------------------------------------------|:-------------------------------|
+| Postfix      | ${MAILCOW_HOSTNAME}, postfix   | 25/tcp, 465/tcp, 587/tcp                     | 588/tcp                        |
+| Dovecot      | ${MAILCOW_HOSTNAME}, dovecot   | 110/tcp, 143/tcp, 993/tcp, 995/tcp, 4190/tcp | 24/tcp, 10001/tcp              |
+| Nginx        | nginx                          | 443/tcp                                      | 80/tcp, 8081/tcp               |
+| PowerDNS     | pdns                           | -                                            | 53/udp                         |
+| Rspamd       | rspamd                         | -                                            | 11333/tcp, 11334/tcp           |
+| MariaDB      | mysql                          | -                                            | 3306/tcp                       |
+| Rmilter      | rmilter                        | -                                            | 9000/tcp                       |
+| PHP FPM      | phpfpm                         | -                                            | 9000/tcp                       |
+| SOGo         | sogo                           | -                                            | 9000/tcp                       |
+| Redis        | redis                          | -                                            | 6379/tcp                       |
+| Memcached    | memcached                      | -                                            | 11211/tcp                      |
+
+All containers share a network ${MAILCOW_NETWORK} (name can be changed, but remove all containers and rebuild them after changing).
+IPs are dynamic and taken from subnet ${DOCKER_SUBNET}.
 
 ## Installation
 
@@ -59,16 +59,8 @@ docker restart rspamd-mailcow
 
 Open https://${MAILCOW_HOSTNAME}/rspamd in a browser.
 
-### SSL (or: How to use Let's Encrypt)
-mailcow dockerized comes with a self-signed certificate. Certificates and DH parameters are saved as `data/assets/ssl/{dhparams.pem,mail.{crt,key}}`.
-
-First you should renew the DH parameters. 
-Soem say you should use 4096, but be prepared for a long waiting period when generating such a file.
-
-Assuming you are in the mailcow root folder:
-```
-openssl dhparam -out ./data/assets/ssl/dhparams.pem 2048
-```
+### SSL (and: How to use Let's Encrypt)
+mailcow dockerized generates a CA named "mailcow" with a self-signed server certificate in `data/assets/ssl` via `000-build-certs.sh`.
 
 Get the certbot client:
 ```
@@ -87,8 +79,8 @@ certbot-auto certonly \
 
 Create hard links to the full path of the new certificates. Assuming you are still in the mailcow root folder:
 ```
-mv data/assets/ssl/mail.{crt,crt_old}
-mv data/assets/ssl/mail.{key,key_old}
+mv data/assets/ssl/cert.{pem,pem.backup}
+mv data/assets/ssl/key.{pem,pem.backup}
 ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/fullchain.pem) data/assets/ssl/mail.crt
 ln $(readlink -f /etc/letsencrypt/live/${MAILCOW_HOSTNAME}/privkey.pem) data/assets/ssl/mail.key
 ```
@@ -113,11 +105,11 @@ When renewing certificates, run the last two steps (link + restart) as post-hook
 No persistent data is deleted at any time.
 If an image exists, you will be asked wether or not to repull/rebuild it.
 
-### Logs
+Build files are numbered "nnn" for dependencies.
 
-You can use docker logs $name for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter reponses.
+### Logs
 
-When a process dies, the container dies, too. Except for Postfix' container.
+You can use docker logs $name for almost all containers. Only rmilter does not log to stdout. You can check rspamd logs for rmilter responses.
 
 ### MariaDB
 

data/assets/ssl/dhparams.pem

@@ -1,8 +0,0 @@
------BEGIN DH PARAMETERS-----
-MIIBCAKCAQEAytfW/P+fV4BLTcJhlHG49Vq7hQrmyUPP+NZ/6MUIG8FNlFaXxbFl
-NtarS/gfOpj+Q5LhS91gToQOqJIij03Jr7t3PdUkkDuIs11y5Ux6zsEQdBhok+yY
-tYvdYT4lbex1dLX36u/tn2VnPdh2jLltRjWN2jiUxjh/O+vXtfej8u4Rc2oOOOFS
-f0e2Ye2WeWXvQlhkcGu87kKIqklxbjmqVtE1fx5Ydvrl1P/HQiCq4YQLIx5skgQn
-e4LyvBdiuA44v1WhXSa0Lb4PcXUQcGhesGJZ/A3M1K/h/ZO47oUyL93odyAO8x3e
-mLHHsOWAh5MGO0ID2jANwuziri5LEeW4+wIBAg==
------END DH PARAMETERS-----

data/assets/ssl/mail.crt

@@ -1,32 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFezCCA2OgAwIBAgIJALl64rYl1fjjMA0GCSqGSIb3DQEBCwUAMFQxCzAJBgNV
-BAYTAkRFMQwwCgYDVQQIDANOUlcxCzAJBgNVBAcMAktSMRIwEAYDVQQKDAlTZXJ2
-ZXJjb3cxFjAUBgNVBAMMDW1haWxjb3cubG9jYWwwHhcNMTYxMjA4MjEzMDM2WhcN
-MjYxMjA2MjEzMDM2WjBUMQswCQYDVQQGEwJERTEMMAoGA1UECAwDTlJXMQswCQYD
-VQQHDAJLUjESMBAGA1UECgwJU2VydmVyY293MRYwFAYDVQQDDA1tYWlsY293Lmxv
-Y2FsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvd/79BmtXZcgzwJw
-8i76C8e0waehYypibOkBqnFi4bF6Q7mhB1j/bA4LmXG4UpcX7ULlDozzaM7Hfi9Q
-v1STYR/S9ShXZNStwDYibOa1q/FG+b4qTjtFiWBW8wH/XxIv6JHX8/IjqwHIs/3B
-EVEl0LEs1RdNMKgSEJ9wbK3q+0pOvw9B6FnhCE2414SE1e7wYL50+NaKTHQcbft3
-ZcRGDTEh4euRKMmVTrBwmpYnNtiljJvHU4F9cdAFg8ZailwJerod1VXB93YX3Jtc
-qRQ9akNjFzLQ/6a4PhKAB8uaStEzri0yBdp+O0Qs/tbloAArAJW3dgE7Omxzso79
-Du4idDHyRmcLu5rsQzST+7kwaCHHWQ4c2mjlhibICGMUzwks39s1QI8CtjmU6AIy
-7F/XpYAJ70Fl7qy99ugrz8X50cPBFtLTYX18wZTUjl/s4qy+JPvUBt2MALPj/YnR
-fXck/emkwscmE1UhaycMW4U21/+5gOhWpFIBCKWnsvRn0SHi7lUzuWBnXvL5tmrA
-gsaFrm/L2JhW2WerZ61UpOVookYtUbk4Hr+Pq6yTgJShUw2i/B71Qr173PIxRV7u
-1qJeOWY3UMPLcfiAnEZFAo7cfLRvqZmHiNp6lALdmoiWllnVvzcRwR/DBvg4gaFt
-R6FeLDArhCdu04WENTd5E3XHRrUCAwEAAaNQME4wHQYDVR0OBBYEFFBMhsQlfxCI
-1GaT1ZGvGheUOGRkMB8GA1UdIwQYMBaAFFBMhsQlfxCI1GaT1ZGvGheUOGRkMAwG
-A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBADujbXk9XVhkF6/WVTxANXVB
-tpIojCPEsXYqEhvMGtDGfqd8sJlEWM0vmuUvM52G7ULMf8aVfiOhLUkEFWpadL9v
-/uZ8EPUc+ZWxxBOEnJbszqrxs94u7K9dxmQnL1rjrW1UtkrT0ptuzJBBQcjdicwe
-VIl5Cn/eq+mkKZRVlctGtD4r1z8u5rUHoOE4RCOU5mfSafu15zzwiglh9wLuuXHC
-bi7Onau9gB1EfmhZwUAL2xZZwvlNGRc6Dz1LG+OXVIOgRHeyfnZQa1ErC4FY5J0Y
-NR+KT7JQW9zivyu0MsV3E2J7GzRAywKyP0m/F/qHJFWxPymILAyWVUlwtJswR5sE
-bT19zPeajrVrbpUMtQv3FhFObtSyw/eI/yRWUuhBapkk95DWl7OkffkQ5OUHG+fs
-QWj1d2Mdhf+jkpgqyL1DyPILsG7ADT0dL/3kZoJf1wjeqNfW3dDo0Ex9DlbznP2h
-ldnMeIQYuyNBqzNfaZGW2WManwHWtASV2Hn76QMVrMfLDnf3RRdEUplW3fsIfLQ0
-f2YVunLJNvll+2QGdCkmJUbLEvvvWmz0Ve+RalGtKi+VTd2I3u4fvFsAXad48wwq
-oK5xd6Se0MsTkcOukaPEkggjffmITyg5Hpqmg1yBSoaH5D/wujTy9X3QcQA30fU/
-ttoPblK2hlItcK4hHnkK
------END CERTIFICATE-----

data/assets/ssl/mail.key

@@ -1,51 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIJKAIBAAKCAgEAvd/79BmtXZcgzwJw8i76C8e0waehYypibOkBqnFi4bF6Q7mh
-B1j/bA4LmXG4UpcX7ULlDozzaM7Hfi9Qv1STYR/S9ShXZNStwDYibOa1q/FG+b4q
-TjtFiWBW8wH/XxIv6JHX8/IjqwHIs/3BEVEl0LEs1RdNMKgSEJ9wbK3q+0pOvw9B
-6FnhCE2414SE1e7wYL50+NaKTHQcbft3ZcRGDTEh4euRKMmVTrBwmpYnNtiljJvH
-U4F9cdAFg8ZailwJerod1VXB93YX3JtcqRQ9akNjFzLQ/6a4PhKAB8uaStEzri0y
-Bdp+O0Qs/tbloAArAJW3dgE7Omxzso79Du4idDHyRmcLu5rsQzST+7kwaCHHWQ4c
-2mjlhibICGMUzwks39s1QI8CtjmU6AIy7F/XpYAJ70Fl7qy99ugrz8X50cPBFtLT
-YX18wZTUjl/s4qy+JPvUBt2MALPj/YnRfXck/emkwscmE1UhaycMW4U21/+5gOhW
-pFIBCKWnsvRn0SHi7lUzuWBnXvL5tmrAgsaFrm/L2JhW2WerZ61UpOVookYtUbk4
-Hr+Pq6yTgJShUw2i/B71Qr173PIxRV7u1qJeOWY3UMPLcfiAnEZFAo7cfLRvqZmH
-iNp6lALdmoiWllnVvzcRwR/DBvg4gaFtR6FeLDArhCdu04WENTd5E3XHRrUCAwEA
-AQKCAgEArhCYOb8QX6wcN6pVQLAwKnx6CM5T9UT11kIFdOtdaun42/1g0guUnMqD
-d7f48j3xgWDB/ATbYEmwOM3HiJ9QPMmf63+AHr+aSYtXI96czXPzTSA4SF+t77KS
-A1Thd5aEtQB+qPRiHnMUO211gRqTQC4sm20xJlntta90sSz/Lj+A0UZ7dTZwRdx6
-h5jE7hqN4yK2uSh0wIHxTiIp4vF8Brv0A9igynOCnRDDKfRdHrqdibmFkdgz2BKL
-+7HrbsvRJOFaWCi2GNX6KhODbr1PUAtW2/2J+9QrMzxigsL0P4JpjlOAeD1FW6+0
-UCtRdsywn2ihN10JnxWtOxQ6iWVlzut52uDnwUa09GThSVnurJihV9mSWyk9lNuy
-0kILtSmYn6UbokOgmfjH0E2Ks1qbskD8GlI9g/wkhs5YC+ZYW2MP9FG39n4/QSnk
-boOTqht8JylWPVyzmvvcRf5nfEOZ5mF82L28Y/OfPn0gakYARxn1EnzpguF3ffFD
-NEn9lWzEAbldlnDslzi6YPOeyQwA6iLCesag5LSGdADrM7kAGHksJggeUb02BSd6
-Nmy6MVMF6tzQYdaqgKXoqKs5nRJLZR1k70ftju2UNWEN24aUd6U2lDOlkaYoucSk
-NohTUKXX0dibSGd9eU7hCNS75YoG1x2gCEOatVelG4EZQfIU/EECggEBAN6gBjv4
-kDuIZ1wk0BBt/ijARH8FAzHm0hr8oyWpq6Sdrq5y9iAbvFNwEXJ/ft6NNcCF9maT
-e5oG5NpoaV0FN5W8qQ8rGnESV/fZOxJEr1yJPEq4yDIspHEXkBjvTgYWjuXRve9n
-NtsSv1crRFxW5IizPkZklbJUZD7oH5iHB15UGfdpKr5Fx3JpsaXht3dMEJ4YQetF
-Mr9jcBGwYCYmlWgpKkD+HadgjbNdG4ztKTFEU7/ElEIIR86IDcqJsz0XsmZIjwUU
-3lsPhVo8Km8ohvGA/WqAaf6ebN9PXjiUFXfjHlveHPTtrd5MCutnxUk0kY4/srmB
-5avH3bxXbKiufiMCggEBANpXEGY9f020vHFUC0vNOeCym8XuXqFyvx6Cl6tTlj8S
-dZCWoHljnJg2HbbJcdh92rri9f+ahNNpZ9/0PQi9yBThWt9aP90Tw3+BhxUyvlPL
-FsFX5IdNq403Ls9iyZuj1Rf9lc65d9lr7TVC5CMI7+BN3CftjvOw3yGucJno+MLW
-AvENx3+NnZ2Hy9nNJp54lbDJe8anP57kvDIKcbmmvVW2ktQKcZqAyBUq0E8mOtkz
-66ZRV+/pSnwugb0Eols3s54OvtOoGBnq1r8GVhf/x23J0UvBoHqqURQFJ5oTKxQW
-zAJ7suGn3xUKBOatypXgg8ZL67rQqo0PxoNK0RcJuUcCggEAHWrf6ATMalF39wEW
-TVV7hD8DzhUHewyZLt+7XzqwZ6w+bObcBxojJJNmes7GIPpf4/TPvnY2mv/WNdYe
-NiB+W9b2L/7uG4rk/OdDmwJgecXYpbcNHTQw9pC6hdD5amyIrW2tv3jQEtrDVe1t
-txX0VOv6iqq37Tyhkn5xzmHpY1mRpNPMxh/KXyAATX8qEyWF/J4P99rI/elR4cSA
-sAnhLEZkQvpRSNDFaLIg9dpQ2yXAO1LqlF8rverUh7LycFw1QrbLz0wWpcnDQU05
-/j5Itpjo463cU7zzff6q4KcQvyrP1Cvhf6v4katSthCcTTQZF8brAwBbLPvYHQ8g
-WJnWKQKCAQAVJ8ZxAZhqIQ75NBl8GMB44xVw0i3dGs8l16V2djzik5lMjyuxV1N+
-9A9g/JfJUDh3TzJit8gS6+2ip3madTkDvOofJhF2DEou+o/qH+aNG+pyhV+hNIdg
-wW4Jrhq2t+MX1fxD8XiJWom7VWXhdyY255RjUgM93W9hRhOm9gnUZwQV8y3XUBNr
-hhLcYaJSTIDEhmE12FKzxJnvh0+Jm3xQ58XGQdTMEZpRYrqYUK33Ca7ViKAqoMIU
-0jTD6cUJbZY7xFX9EBZ1vGleTPDelmvuWVWsL3CrMgF1HSK/LQhJhAP0YaPtdWSK
-F1RuPXyZlQ1vkz+d9EXyMQsdAYzM3KZVAoIBAF0gvM4fY0EvSDKevWnZtLyINHZV
-TC2HhElAREmblbziQ1GO00nCw+RXYmA7fMHuMNnHMcB/QubpMQxEPetAbtcX9jXW
-iBNIpHTQwNWBe+IGd1I7n6FA6Cqis4tdNFmaWxXv1aMpzU7K/aVcO3sK3SsjSy6A
-4bDJ9mlGCnIv5zc1on3lpMARBUGRF8mAQ6ejMuUjubtPa8cSUhUv3hoH0xG9bLJh
-0VDZ6bZ7QFLpNxFUlX7muSj8DNsjR77TBuN+Buk+pI68GDl6177Gm6UkZRYx4yi5
-xFCP9932L2tufcQaRsiIHdNEFAGMMPe2M22DUmSI0cSNgx4xKuLGJI4PkTM=
------END RSA PRIVATE KEY-----

data/conf/dovecot/dovecot.conf

@@ -183,8 +183,8 @@ service lmtp {
   user = vmail
 }
 listen = *,[::]
-ssl_cert = </etc/ssl/mail/mail.crt
-ssl_key = </etc/ssl/mail/mail.key
+ssl_cert = </etc/ssl/mail/cert.pem
+ssl_key = </etc/ssl/mail/key.pem
 userdb {
   args = /etc/dovecot/sql/dovecot-mysql.conf
   driver = sql

data/conf/nginx/site.conf

@@ -1,8 +1,8 @@
 server {
 		listen 443;
 		ssl on;
-		ssl_certificate /etc/ssl/mail/mail.crt;
-		ssl_certificate_key /etc/ssl/mail/mail.key;
+		ssl_certificate /etc/ssl/mail/cert.pem;
+		ssl_certificate_key /etc/ssl/mail/key.pem;
 		ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 		ssl_prefer_server_ciphers on;
 		ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

data/conf/pdns/recursor.conf

@@ -1,4 +1,4 @@
-allow-from=127.0.0.0/8 172.18.0.0/16
+allow-from=127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8
 config-dir=/etc/powerdns
 daemon=no
 disable-syslog=yes

data/conf/postfix/main.cf

@@ -1,7 +1,7 @@
 biff = no
 append_dot_mydomain = no
-smtpd_tls_cert_file = /etc/ssl/mail/mail.crt
-smtpd_tls_key_file = /etc/ssl/mail/mail.key
+smtpd_tls_cert_file = /etc/ssl/mail/cert.pem
+smtpd_tls_key_file = /etc/ssl/mail/key.pem
 smtpd_use_tls=yes
 smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
 smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
@@ -45,8 +45,8 @@ relay_domains = proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mxdomain_maps.cf
 relay_recipient_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf
 sender_dependent_default_transport_maps = proxy:mysql:/opt/postfix/conf/sql/mysql_tls_enforce_out_policy.cf
 smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
-smtp_tls_cert_file = /etc/ssl/mail/mail.crt
-smtp_tls_key_file = /etc/ssl/mail/mail.key
+smtp_tls_cert_file = /etc/ssl/mail/cert.pem
+smtp_tls_key_file = /etc/ssl/mail/key.pem
 smtp_tls_loglevel = 1
 smtp_dns_support_level = dnssec
 smtp_tls_security_level = dane

data/web/inc/functions.inc.php

@@ -1,12 +1,7 @@
 <?php
 function hash_password($password) {
 	$salt_str = bin2hex(openssl_random_pseudo_bytes(8));
-	if ($GLOBALS['HASHING'] == "SHA512-CRYPT") {
-		return "{SHA512-CRYPT}".crypt($password, '$6$'.$salt_str.'$');
-	}
-	else {
-		return "{SSHA256}".base64_encode(hash('sha256', $password.$salt_str, true).$salt_str);
-	}
+	return "{SSHA256}".base64_encode(hash('sha256', $password.$salt_str, true).$salt_str);
 }
 function hasDomainAccess($username, $role, $domain) {
 	global $pdo;
@@ -37,6 +32,23 @@ function hasDomainAccess($username, $role, $domain) {
 	}
 	return false;
 }
+function verify_ssha256($password, $hash) {
+	// Remove tag if any
+	$hash = ltrim($hash, '{SSHA256}');
+	// Decode hash
+	$dhash = base64_decode($hash);
+	// Get first 32 bytes of binary which equals a SHA256 hash
+	$ohash = substr($dhash, 0, 32);
+	// Remove SHA256 hash from decoded hash to get original salt string
+	$osalt = str_replace($ohash, '', $dhash);
+	// Check single salted SHA256 hash against extracted hash
+	if (hash('sha256', $password . $osalt, true) == $ohash) {
+		return true;
+	}
+	else {
+		return false;
+	}
+}
 function doveadm_authenticate($hash, $algorithm, $password) {
 	$descr = array(0 => array('pipe', 'r'), 1 => array('pipe', 'w'), 2 => array('pipe', 'w'));
 	$pipes = array();
@@ -76,7 +88,7 @@ function check_login($user, $pass) {
 	$stmt->execute(array(':user' => $user));
 	$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
 	foreach ($rows as $row) {
-		if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
+		if (verify_ssha256($row['password'], $pass) !== false) {
 			unset($_SESSION['ldelay']);
 			return "admin";
 		}
@@ -88,7 +100,7 @@ function check_login($user, $pass) {
 	$stmt->execute(array(':user' => $user));
 	$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
 	foreach ($rows as $row) {
-		if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
+		if (doveadm_authenticate($row['password'], $pass) !== false) {
 			unset($_SESSION['ldelay']);
 			return "domainadmin";
 		}
@@ -99,7 +111,7 @@ function check_login($user, $pass) {
 	$stmt->execute(array(':user' => $user));
 	$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
 	foreach ($rows as $row) {
-		if (doveadm_authenticate($row['password'], $GLOBALS['HASHING'], $pass) !== false) {
+		if (doveadm_authenticate($row['password'], $pass) !== false) {
 			unset($_SESSION['ldelay']);
 			return "user";
 		}

data/web/inc/vars.inc.php

@@ -31,6 +31,4 @@ $DEFAULT_LANG = "en";
 // See https://bootswatch.com/
 $DEFAULT_THEME = "lumen";
 
-$HASHING = "SSHA256";
-
 ?>

port-check.sh

@@ -2,9 +2,11 @@
 
 . mailcow.conf
 
+if [[ -z $(which ss) ]]; then echo "Please install the ss util first."; exit 1; fi
+
 for port in ${SMTP_PORT} ${SMTPS_PORT} ${SUBMISSION_PORT} ${IMAP_PORT} ${IMAPS_PORT} ${POP_PORT} ${POPS_PORT} ${SIEVE_PORT} 443; do
 	if [[ ! -z $(ss -tlnp "( sport = :$port )" 2> /dev/null | grep LISTEN | grep -vi docker) ]]; then
-		echo "Port $port is in use by other process."
+		echo "Port $port is in use by another process."
 		err=1
 	fi
 done