From ee0b0c2f75ce9d434032898ab13ebd1d71557b18 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 29 Jan 2026 10:54:04 -0800 Subject: [PATCH 1/5] SYS-656 dovecot 2.4.1 image update --- images/dovecot/Dockerfile | 15 ++--- images/dovecot/README.md | 30 ++++++++- images/dovecot/entrypoint-dovecot.sh | 4 +- images/dovecot/helm/Chart.yaml | 6 +- images/dovecot/helm/templates/configmap.yaml | 50 ++++++++------- images/dovecot/helm/values.yaml | 12 +++- k8s/Makefile.helm | 14 ++--- k8s/Makefile.vars | 2 - k8s/global.yaml | 8 --- k8s/install/gitlab-rbac.yaml | 64 -------------------- k8s/scripts/node_labels.sh.example | 2 - 11 files changed, 78 insertions(+), 129 deletions(-) delete mode 100644 k8s/global.yaml delete mode 100644 k8s/install/gitlab-rbac.yaml diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile index 17c72a4d..2b9cdd14 100644 --- a/images/dovecot/Dockerfile +++ b/images/dovecot/Dockerfile @@ -1,4 +1,4 @@ -FROM instantlinux/postfix:3.10.2-r0 +FROM instantlinux/postfix:3.10.5-r0 ARG BUILD_DATE ARG VCS_REF @@ -9,20 +9,21 @@ LABEL org.opencontainers.image.authors="Rich Braun docker@instantlinux.net" \ org.label-schema.vcs-url=https://github.com/instantlinux/docker-tools ARG DOVECOT_VERSION=2.4.1-r2 +ARG PROCMAIL_VERSION=3.22-r4 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d - +ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9 ENV LDAP_SECRETNAME=ldap-ro-password \ SSL_DH= -# TODO - procmail is missing from 3.12 repo, unsure if support ended -RUN echo '@old http://dl-cdn.alpinelinux.org/alpine/v3.11/main' \ - >>/etc/apk/repositories && \ +RUN cd /tmp && \ + wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/procmail-$PROCMAIL_VERSION.apk && \ + echo "$PROCMAIL_SHA procmail-$PROCMAIL_VERSION.apk" | sha256sum -c && \ apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION \ - procmail@old && \ + procmail-$PROCMAIL_VERSION.apk openldap-clients && \ cd /usr/local/bin && \ wget -q https://raw.githubusercontent.com/dovecot/core/release-2.4.1/doc/mkcert.sh && \ echo "$MKCERT_SHA mkcert.sh" | sha256sum -c && \ - chmod 755 /usr/local/bin/mkcert.sh + rm /tmp/* && chmod 755 /usr/local/bin/mkcert.sh EXPOSE 143 993 VOLUME /etc/dovecot/conf.local /home /var/spool/mail diff --git a/images/dovecot/README.md b/images/dovecot/README.md index 9b64cd06..d914b0cf 100644 --- a/images/dovecot/README.md +++ b/images/dovecot/README.md @@ -11,7 +11,7 @@ Configuration is defined as files in a volume mounted as * Define your local settings as dovecot.conf. -* If you have an LDAP server, put its settings in dovecot-ldap.conf. The helm chart provided here can support either Active Directory or openldap. +* If you have an LDAP server, put its settings in passdb section of dovecot.conf. The helm chart provided here can support either Active Directory or openldap. * (Optional, to save startup time) generate a dh.pem file for TLS: ``` @@ -39,6 +39,14 @@ make dovecot See the Makefile and Makefile.vars files under k8s directory for default values referenced within kubernetes.yaml. +To provide high availability across the cluster, the helm chart here includes an optional data-sync service to keep the inbox, mail and spool directories synchronized across 2 or more worker nodes. Minor data loss can occur when the service shifts from one worker to another, so this feature isn't recommended for large production deployments (when running on a cloud provider, simply use their block storage capabilities). That said, unison-based data-sync service has been rock-solid on a bare-metal cluster for years. + +Auth is the most challenging aspect of implementing dovecot. Use the following command from with the container to verify user authentication: +``` +doveadm auth login +``` +If using openldap, turn on log setting `BER` to view raw packet contents as you troubleshoot login from dovecot. + ### Variables | Variable | Default | Description | @@ -47,7 +55,7 @@ See the Makefile and Makefile.vars files under k8s directory for default values | SSL_DH | | Filename (in conf.local) of DH parameters | | TZ | UTC | time zone | -Need more configurability? Edit the ConfigMap defined in kubernetes.yaml. +Need more configurability? Edit the ConfigMap defined in the helm chart. ### Secrets @@ -65,3 +73,21 @@ If you want to make improvements to this image, see [CONTRIBUTING](https://githu ### Upgrade Notes * When upgrading to 2.3.14+, replace any references to `hash:` with `lmdb:` in your config files. + +* When upgrading to 2.4+, there are a lot of gratuitous [config-directive changes](https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html). The Docker image doesn't contain configs but the helm chart provided here has a configmap template that contains the following changes: + +|Helm var|2.3|2.4|Notes| +|uris|hosts | ldap_uris | becomes ldap://:389 | +| |ldap_version| (unchanged)| | +|base|base| ldap_base| | +|bind|auth_bind| ldap_bind | | +|bind_userdn|auth_bind_userdn|ldap_bind_userdn | | +|tls|tls|ldap_starttls | | +| | |dovecot_config_version|new| +| | |dovecot_storage_version|new| +|filter| |ldap_filter|now required| +| |args|(removed)|directives moved to passdb config| +| |address|listen| | +| |ssl_cert|ssl_server_cert_file|angle bracket removed| +| |ssl_dh|ssl_server_dh_file|angle bracket removed| +| |ssl_key|ssl_server_key_file|angle bracket removed| diff --git a/images/dovecot/entrypoint-dovecot.sh b/images/dovecot/entrypoint-dovecot.sh index efc009c3..c2e675ef 100755 --- a/images/dovecot/entrypoint-dovecot.sh +++ b/images/dovecot/entrypoint-dovecot.sh @@ -27,9 +27,9 @@ if [ -s $ETC/conf.local/dovecot.conf ]; then fi if [ -z "$SSH_DH" ]; then openssl dhparam -dsaparam -out $ETC/dh.pem 4096 - echo "ssl_dh = <$ETC/dh.pem" >> $ETC/dovecot.conf + echo "ssl_server_dh_file = $ETC/dh.pem" >> $ETC/dovecot.conf else - echo "ssl_dh = <$ETC/conf.local/$SSH_DH" >> $ETC/dovecot.conf + echo "ssl_server_dh_file = $ETC/conf.local/$SSH_DH" >> $ETC/dovecot.conf fi if [ -s $ETC/conf.local/dovecot-ldap.conf ]; then cp $ETC/conf.local/dovecot-ldap.conf $ETC diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml index 32209515..f2d74e1a 100644 --- a/images/dovecot/helm/Chart.yaml +++ b/images/dovecot/helm/Chart.yaml @@ -6,9 +6,8 @@ sources: - https://github.com/instantlinux/docker-tools - https://github.com/vdukhovni/dovecot type: application -version: 0.1.12 - # appVersion: "2.4.1-r2" -appVersion: "2.3.21.1-r0" +version: 0.1.13 +appVersion: "2.4.2-r1" dependencies: - name: chartlib version: 0.1.8 @@ -16,3 +15,4 @@ dependencies: - name: data-sync version: 0.1.3 repository: https://instantlinux.github.io/docker-tools + condition: data-sync.enabled diff --git a/images/dovecot/helm/templates/configmap.yaml b/images/dovecot/helm/templates/configmap.yaml index 3f1634f8..9a2991a1 100644 --- a/images/dovecot/helm/templates/configmap.yaml +++ b/images/dovecot/helm/templates/configmap.yaml @@ -7,7 +7,8 @@ metadata: {{- include "local.labels" . | nindent 4 }} data: dovecot.conf: | - dovecot_config_version = 2.4 + dovecot_config_version = {{ .Values.version.config }} + dovecot_storage_version = {{ .Values.version.storage }} auth_mechanisms = plain login auth_allow_cleartext = no mail_access_groups = mail @@ -19,12 +20,29 @@ data: mail_debug = no first_valid_uid = 300 - passdb dovecot { + passdb ldap { driver = ldap - args = /etc/dovecot/dovecot-ldap.conf + ldap_uris = {{ .Values.ldap.uris }} + {{- if .Values.ldap.dn }} + ldap_dn = {{ .Values.ldap.dn }} + ldap_dnpass = PASSWORD + {{- end }} + ldap_version = {{ .Values.ldap.version }} + ldap_base = {{ .Values.ldap.base }} + ldap_bind = {{ .Values.ldap.bind }} + ldap_filter = {{ .Values.ldap.filter }} + {{- if .Values.ldap.bind_userdn }} + ldap_bind_userdn = {{ .Values.ldap.bind_userdn }} + {{- end }} + {{- if .Values.ldap.active_directory }} + ldap_user_attrs = sAMAccountName=home=/home/%$ + ldap_user_filter = (&(ObjectClass=user)(sAMAccountName=%{user})) + ldap_pass_filter = (&(ObjectClass=user)(sAMAccountName=%{user})) + {{- end }} + ldap_starttls = {{ .Values.ldap.tls }} } - userdb dovecot { - driver = passwd + userdb passwd { + use_worker = yes } service auth { user = root @@ -36,33 +54,13 @@ data: } service imap-login { inet_listener imaps { - address = 0.0.0.0 + listen = 0.0.0.0 port = 993 ssl = yes } } - # ssl_cert = Date: Thu, 29 Jan 2026 11:07:51 -0800 Subject: [PATCH 2/5] SYS-656 wip --- images/dovecot/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile index 2b9cdd14..043e6ed4 100644 --- a/images/dovecot/Dockerfile +++ b/images/dovecot/Dockerfile @@ -18,8 +18,8 @@ ENV LDAP_SECRETNAME=ldap-ro-password \ RUN cd /tmp && \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/procmail-$PROCMAIL_VERSION.apk && \ echo "$PROCMAIL_SHA procmail-$PROCMAIL_VERSION.apk" | sha256sum -c && \ - apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION \ - procmail-$PROCMAIL_VERSION.apk openldap-clients && \ + apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION && \ + apk add --allow-untrusted procmail-$PROCMAIL_VERSION.apk && \ cd /usr/local/bin && \ wget -q https://raw.githubusercontent.com/dovecot/core/release-2.4.1/doc/mkcert.sh && \ echo "$MKCERT_SHA mkcert.sh" | sha256sum -c && \ From 8484061c4ee45d6a5ed82a17abfda8ab87fb495b Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 29 Jan 2026 12:33:29 -0800 Subject: [PATCH 3/5] SYS-656 wip --- images/dovecot/Dockerfile | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile index 043e6ed4..7f5a4313 100644 --- a/images/dovecot/Dockerfile +++ b/images/dovecot/Dockerfile @@ -12,12 +12,22 @@ ARG DOVECOT_VERSION=2.4.1-r2 ARG PROCMAIL_VERSION=3.22-r4 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9 +ARG TARGETARCH ENV LDAP_SECRETNAME=ldap-ro-password \ SSL_DH= RUN cd /tmp && \ - wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/procmail-$PROCMAIL_VERSION.apk && \ - echo "$PROCMAIL_SHA procmail-$PROCMAIL_VERSION.apk" | sha256sum -c && \ + case ${TARGETARCH} in \ + amd64) \ + wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/procmail-$PROCMAIL_VERSION.apk && \ + echo "$PROCMAIL_SHA procmail-$PROCMAIL_VERSION.apk" | sha256sum -c ;; \ + arm64) \ + wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/aarch64/procmail-$PROCMAIL_VERSION.apk ;; \ + arm/v6) \ + wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armhf/procmail-$PROCMAIL_VERSION.apk ;; \ + arm/v7) \ + wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armv7/procmail-$PROCMAIL_VERSION.apk ;; \ + esac && \ apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION && \ apk add --allow-untrusted procmail-$PROCMAIL_VERSION.apk && \ cd /usr/local/bin && \ From 666a5571f5aa311010cb5bcc380d23d0b6a94610 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 29 Jan 2026 12:48:16 -0800 Subject: [PATCH 4/5] SYS-656 wip --- images/dovecot/Dockerfile | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/images/dovecot/Dockerfile b/images/dovecot/Dockerfile index 7f5a4313..5420325d 100644 --- a/images/dovecot/Dockerfile +++ b/images/dovecot/Dockerfile @@ -12,21 +12,22 @@ ARG DOVECOT_VERSION=2.4.1-r2 ARG PROCMAIL_VERSION=3.22-r4 ARG MKCERT_SHA=d1efad065f9ef34da372847ff4a4d5ffd86b97410b303d8a43ea25aa2119c86d ARG PROCMAIL_SHA=4ac9f21c3d7dbed5b32e7547da39f4d429de480679b4c856026caea39ca842f9 -ARG TARGETARCH +ARG TARGETPLATFORM ENV LDAP_SECRETNAME=ldap-ro-password \ SSL_DH= RUN cd /tmp && \ - case ${TARGETARCH} in \ - amd64) \ + case ${TARGETPLATFORM} in \ + linux/amd64) \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/procmail-$PROCMAIL_VERSION.apk && \ echo "$PROCMAIL_SHA procmail-$PROCMAIL_VERSION.apk" | sha256sum -c ;; \ - arm64) \ + linux/arm64) \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/aarch64/procmail-$PROCMAIL_VERSION.apk ;; \ - arm/v6) \ + linux/arm/v6) \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armhf/procmail-$PROCMAIL_VERSION.apk ;; \ - arm/v7) \ + linux/arm/v7) \ wget -q https://dl-cdn.alpinelinux.org/alpine/v3.11/main/armv7/procmail-$PROCMAIL_VERSION.apk ;; \ + *) echo Unrecognized ${TARGETPLATFORM} ;; \ esac && \ apk add --no-cache dovecot=$DOVECOT_VERSION dovecot-ldap=$DOVECOT_VERSION && \ apk add --allow-untrusted procmail-$PROCMAIL_VERSION.apk && \ From aa49bdd9f3a7465c8dd67b98f83799875066719e Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 29 Jan 2026 13:00:29 -0800 Subject: [PATCH 5/5] SYS-656 wip --- images/dovecot/helm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/images/dovecot/helm/Chart.yaml b/images/dovecot/helm/Chart.yaml index f2d74e1a..36e75de6 100644 --- a/images/dovecot/helm/Chart.yaml +++ b/images/dovecot/helm/Chart.yaml @@ -7,7 +7,7 @@ sources: - https://github.com/vdukhovni/dovecot type: application version: 0.1.13 -appVersion: "2.4.2-r1" +appVersion: "2.4.1-r2" dependencies: - name: chartlib version: 0.1.8