# Optional anti-spam sidecar for inbound relay (docs/plans/inbound-relay.md).
#
# SelfPost does not ship or start an anti-spam engine. This fragment brings up
# rspamd next to SelfPost and points the inbound smtpd milter at it. Merge it
# only when you want filtering on port 25:
#
#   docker compose -f docker-compose.yml -f antispam/docker-compose.antispam.yml up -d
#
# Requires INBOUND_RELAY_ENABLE=true in .env. The milter sees the real client
# IP, HELO and PTR — unlike the upstream, which only sees SelfPost's address.
#
# Pin the rspamd tag the same way the SelfPost image is pinned; bump it
# deliberately. Default milter action is fail-open (accept) so a down sidecar
# does not block backup-MX. Set INBOUND_ANTISPAM_MILTER_ACTION=tempfail to
# defer instead.

services:
  selfpost:
    environment:
      INBOUND_RELAY_ENABLE: "${INBOUND_RELAY_ENABLE:-true}"
      INBOUND_ANTISPAM_MILTER: "${INBOUND_ANTISPAM_MILTER:-inet:antispam:11332}"
      INBOUND_ANTISPAM_MILTER_ACTION: "${INBOUND_ANTISPAM_MILTER_ACTION:-accept}"
    depends_on:
      - antispam

  antispam:
    # The milter: rspamd 3.11.1, conf/worker-proxy.inc, "milter = yes" for the
    # rspamd_proxy worker, which the image binds to *:11332 (rspamd-docker
    # v3.11.1+3, patches/rspamd-docker-config.diff), and runs as uid 11333
    # (its Dockerfile, USER 11333:11333).
    image: rspamd/rspamd:3.11
    restart: unless-stopped
    # No host ports: only SelfPost talks to the milter on the compose network.
    volumes:
      # The verdict headers SelfPost's inbound journal reads.
      - ./antispam/rspamd/milter_headers.conf:/etc/rspamd/local.d/milter_headers.conf:ro
      # The allow and deny lists kept in the panel: the rules, and the files
      # SelfPost writes them to.
      - ./antispam/rspamd/multimap.conf:/etc/rspamd/local.d/multimap.conf:ro
      - ./data/antispam:/etc/rspamd/selfpost:ro