mixandClaude Opus 5.5
dd950364a3
Security audit 2026-10-17, finding I3 (low), stage 4. No compose file set pids_limit: a fork bomb from a compromised panel or postfix had the host's pid space as its limit. Now 1024 for SelfPost - the plan said 512, but Postfix starts up to default_process_limit (100) processes per service, and a busy server runs three smtpd services, cleanup and smtp at once - 256 for nginx, Caddy, Traefik and rspamd, 64 for certbot. The comment that said root runs "very briefly" now says which root processes stay. e2e: checkPidsLimit reads /sys/fs/cgroup/pids.max in the container. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
2.7 KiB
YAML
62 lines
2.7 KiB
YAML
|
|
# Alternative reverse-proxy: Caddy — the simplest option, fully automatic ACME
|
|
# with no separate certbot container. Caddy writes certificates as plain PEM
|
|
# under its own data directory, which this fragment bind-mounts to the host so
|
|
# SelfPost can read the same files.
|
|
#
|
|
# NOTE: Caddy's on-disk cert path includes
|
|
# the ACME CA's name as a path segment, e.g.
|
|
# <data>/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<hostname>/<hostname>.crt
|
|
# This has been stable across recent Caddy releases but is an internal
|
|
# storage detail, not a documented public API — VERIFY the exact path against
|
|
# the Caddy version you deploy (`docker compose exec caddy find /data/caddy/certificates -name '*.crt'`)
|
|
# before wiring it into the volume mount below.
|
|
# Read in the source (caddyserver/certmagic, storage.go, KeyBuilder.SiteCert():
|
|
# certificates/<issuer key>/<domain>/<domain>.crt; acmeissuer.go, issuerKey():
|
|
# the CA URL's host and path, "acme-v02.api.letsencrypt.org-directory" for Let's
|
|
# Encrypt). caddy/modules/caddytls/automation.go, DefaultIssuers(): ZeroSSL is a
|
|
# second issuer only when an email is configured, and the Caddyfile below sets
|
|
# none. Read at the projects' master of 2026-10-14: `caddy:2` is a moving tag.
|
|
#
|
|
# Merge with the base file — run this from the deploy/ directory (Compose
|
|
# resolves every relative path in both files against the directory of the
|
|
# FIRST -f file, i.e. deploy/, which is why paths below are ./caddy/... -
|
|
# docs.docker.com/compose/how-tos/multiple-compose-files/merge/: "Paths are
|
|
# evaluated relative to the base file"):
|
|
#
|
|
# docker compose -f docker-compose.yml -f caddy/docker-compose.caddy.yml up -d
|
|
|
|
services:
|
|
selfpost:
|
|
ports: !override
|
|
- "465:465"
|
|
- "587:587"
|
|
- "25:25"
|
|
environment:
|
|
# Caddy names certificate files after the hostname, not
|
|
# fullchain.pem/privkey.pem like certbot — override the base file's
|
|
# paths to match.
|
|
TLS_CERT_FILE: /etc/postfix/tls/<hostname>.crt
|
|
TLS_KEY_FILE: /etc/postfix/tls/<hostname>.key
|
|
volumes: !override
|
|
- ./data:/data
|
|
- .:/selfpost-deploy:ro
|
|
# Replace <hostname> with your actual mail/panel hostname, matching
|
|
# the Caddyfile below and SELFPOST_HOSTNAME.
|
|
- ./caddy/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/<hostname>:/etc/postfix/tls:ro
|
|
|
|
caddy:
|
|
image: caddy:2
|
|
restart: unless-stopped
|
|
# A ceiling on processes and threads (security audit 2026-10-17, I3).
|
|
pids_limit: 256
|
|
depends_on:
|
|
- selfpost
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- ./caddy/Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- ./caddy/caddy-data:/data
|
|
- ./caddy/caddy-config:/config
|