aykhans/my-self-host-services
1
0
Fork 0
mirror of https://github.com/aykhans/my-self-host-services.git synced 2026-05-29 15:35:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

stalwart: add caddy IP ot AllowedIP list

Browse Source
This commit is contained in:
Aykhan Shahsuvarov
2026-04-26 14:52:21 +00:00
parent 2464371f38
commit 34bba90d54
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stalwart/docker-compose.yaml
+9 -2
View File
@@ -53,6 +53,7 @@ services:
STALWART_PASSWORD: "${STALWART_BOOTSTRAP_PASSWORD}" STALWART_PASSWORD: "${STALWART_BOOTSTRAP_PASSWORD}"
STALWART_DEFAULT_HOSTNAME: "mail.aykhans.me" STALWART_DEFAULT_HOSTNAME: "mail.aykhans.me"
STALWART_DEFAULT_DOMAIN: "aykhans.me" STALWART_DEFAULT_DOMAIN: "aykhans.me"
STALWART_PROXY_NETWORK: "172.18.0.0/16"
volumes: volumes:
- ./plan.json:/plan.json:ro - ./plan.json:/plan.json:ro
entrypoint: ["/bin/sh", "-c"] entrypoint: ["/bin/sh", "-c"]
@@ -72,10 +73,16 @@ services:
# 3) Idempotent SystemSettings update (singleton) # 3) Idempotent SystemSettings update (singleton)
stalwart-cli update SystemSettings --field "defaultHostname=$$STALWART_DEFAULT_HOSTNAME" --field "defaultDomainId=$$DOMAIN_ID" stalwart-cli update SystemSettings --field "defaultHostname=$$STALWART_DEFAULT_HOSTNAME" --field "defaultDomainId=$$DOMAIN_ID"
# 4) Trust X-Forwarded-* headers from Caddy (real client IP for security/rate-limit) # 4) Trust X-Forwarded-* headers from Caddy (real client IP for HTTP-level checks)
stalwart-cli update Http --field useXForwarded=true stalwart-cli update Http --field useXForwarded=true
# 5) Trigger settings reload so url_https recomputes (no restart needed) # 5) Whitelist the reverse-proxy network from auto-ban (port-scan/loitering counters
# operate at TCP-source-IP level and would otherwise ban Caddy itself).
if ! stalwart-cli query AllowedIp 2>/dev/null | grep -q "$$STALWART_PROXY_NETWORK"; then
stalwart-cli create AllowedIp --field "address=$$STALWART_PROXY_NETWORK" --field "reason=Reverse proxy network"
fi
# 6) Trigger settings reload so url_https recomputes (no restart needed)
stalwart-cli create Action/ReloadSettings --json "{}" stalwart-cli create Action/ReloadSettings --json "{}"
echo "Bootstrap complete" echo "Bootstrap complete"