init

2026-08-10 14:37:39 +12:00
commit d53e7eef37
4 changed files with 105 additions and 0 deletions
@@ -0,0 +1,16 @@
+# Domain Information
+DOMAIN_NAME=example.com
+
+# Subdomain Information (DO NOT EDIT AFTER RUNNING ONCE)
+WEBMAIL_SUBDOMAIN=mail
+MAIL_SUBDOMAIN=mx
+AUTH_SUBDOMAIN=auth
+
+# Secret Keys
+# This should be generated automatically.
+BULWARK_SECRET=
+OAUTH_SECRET=
+
+# Testing Stuff
+# Leave CADDY_TLS blank to automatically obtain a certificate.
+CADDY_TLS=
@@ -0,0 +1 @@
+.env
@@ -0,0 +1,69 @@
+services:
+    reverse_proxy:
+        image: caddy:latest
+        container_name: reverse_proxy
+        ports:
+            - "80:80"
+            - "443:443"
+        volumes:
+            - ./service_data/reverse_proxy:/etc/caddy
+            - caddy-data:/data
+        environment:
+            - CADDY_TLS=${CADDY_TLS}
+            - DOMAIN_NAME=${DOMAIN_NAME}
+            - MAIL_SUBDOMAIN=${MAIL_SUBDOMAIN}
+            - WEBMAIL_SUBDOMAIN=${WEBMAIL_SUBDOMAIN}
+        networks:
+            - proxy-net
+
+    email_backend:
+        image: stalwartlabs/stalwart:latest
+        container_name: email_backend
+        restart: unless-stopped
+        volumes:
+            - stalwart-etc:/etc/stalwart
+            - stalwart-data:/var/lib/stalwart
+        environment:
+            - STALWART_PUBLIC_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
+        ports:
+            - "25:25"
+            - "587:587"
+            - "465:465"
+            - "143:143"
+            - "993:993"
+            - "110:110"
+            - "995:995"
+            - "4190:4190"
+        networks:
+            - proxy-net
+
+    email_frontend:
+        image: ghcr.io/bulwarkmail/webmail:latest
+        container_name: email_frontend
+        restart: unless-stopped
+        environment:
+            - JMAP_SERVER_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
+            - NODE_TLS_REJECT_UNAUTHORIZED=0 # DEFINITELY REMOVE AFTER TESTING
+            - OAUTH_ALLOW_PRIVATE_ENDPOINTS=true # ALSO DEFINITELY REMOVE THIS
+            - SESSION_SECRET=${BULWARK_SECRET}
+            - OAUTH_ENABLED=true
+            - OAUTH_ONLY=true
+            - OAUTH_CLIENT_ID=bulwark-webmail
+            - OAUTH_CLIENT_SECRET=${OAUTH_SECRET}
+            - AUTO_SSO_ENABLED=true
+        volumes:
+            - bulwark-config:/app/data/admin
+            - bulwark-state:/app/data/admin-state
+        networks:
+            - proxy-net
+
+volumes:
+    stalwart-etc:
+    stalwart-data:
+    caddy-data:
+    bulwark-config:
+    bulwark-state:
+
+networks:
+    proxy-net:
+        external: true
@@ -0,0 +1,19 @@
+{$WEBMAIL_SUBDOMAIN}.{$DOMAIN_NAME} {
+    {$CADDY_TLS}
+    reverse_proxy email_frontend:3000
+}
+
+{$MAIL_SUBDOMAIN}.{$DOMAIN_NAME} {
+    {$CADDY_TLS}
+	reverse_proxy email_backend:8080
+
+	header {
+		Access-Control-Allow-Origin "https://{$WEBMAIL_SUBDOMAIN}.{$DOMAIN_NAME}"
+		Access-Control-Allow-Credentials "true"
+		Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
+		Access-Control-Allow-Headers "Authorization, Content-Type, X-JMAP-Prefix, X-JMAP-Framework"
+	}
+
+	@options method OPTIONS
+	respond @options 204
+}