$ free -h
               total        used        free      shared  buff/cache   available
Mem:            31Gi       8.7Gi       1.6Gi        53Mi        20Gi        21Gi

$ docker image ls --format '{{.Repository}}:{{.Tag}}\t{{.Size}}' | grep -E 'mailu|redis' | sort
ghcr.io/mailu/admin:2024.06.65  362MB
ghcr.io/mailu/dovecot:2024.06.65        441MB
ghcr.io/mailu/nginx:2024.06.65  415MB
ghcr.io/mailu/postfix:2024.06.65        359MB
ghcr.io/mailu/rspamd:2024.06.65 432MB
ghcr.io/mailu/unbound:2024.06.65        358MB
redis:alpine    161MB

$ docker version --format '{{.Server.Version}}'
29.8.1
$ docker compose version
Docker Compose version v5.5.1

# 客户机上执行（内容追加到 /etc/hosts）
192.168.146.128 mail.example.com

$ ss -ltn | grep -E ':(8128|8129|8130|8131|8132)\b' || echo '端口段 8128-8132 空闲'
端口段 8128-8132 空闲

$ mkdir -p /opt/data/quzuo/tmp/mailu/compose \
           /opt/data/quzuo/tmp/mailu/data/{certs,redis,mail,mailqueue,filter,dkim,main} \
           /opt/data/quzuo/tmp/mailu/data/overrides/{nginx,dovecot,postfix,rspamd}
$ cd /opt/data/quzuo/tmp/mailu/compose

$ cd /opt/data/quzuo/tmp/mailu/data/certs
$ openssl req -new -x509 -days 3650 -nodes \
    -out cert.pem -keyout key.pem \
    -subj "/CN=mail.example.com/O=Mailu Demo" \
    -addext "subjectAltName=DNS:mail.example.com,IP:127.0.0.1"
$ openssl x509 -in cert.pem -noout -subject -ext subjectAltName
subject=CN = mail.example.com, O = Mailu Demo
X509v3 Subject Alternative Name:
    DNS:mail.example.com, IP Address:127.0.0.1

$ chmod 600 key.pem && ls -l
total 8
-rw-r--r-- 1 root root 1237 10月 21 08:39 cert.pem
-rw------- 1 root root 1704 10月 21 08:39 key.pem

# ============ 通用 ============
# 16 字节随机串，每次部署必须唯一（可用 openssl rand -base64 12 生成）
SECRET_KEY=5ku+ABoBFSidF23i
# 服务栈网段，必须与编排文件里的网桥子网一致
SUBNET=10.89.56.0/24
# 主邮件域（生成 postmaster 等技术地址、退信发件人）
DOMAIN=example.com
# 对外主机名，逗号分隔，第一个为主主机名（证书 CN 也要覆盖它）
HOSTNAMES=mail.example.com
# postmaster 的本地部分
POSTMASTER=admin
# TLS 策略：letsencrypt/mail-letsencrypt/cert/mail/notls
TLS_FLAVOR=cert
# 认证限速：按 IP 段 / 按账号
AUTH_RATELIMIT_IP=60/hour
AUTH_RATELIMIT_USER=100/day
# 关闭匿名统计上报
DISABLE_STATISTICS=True

# ============ 可选功能 ============
ADMIN=true
WEBMAIL=none
API=true
WEBDAV=none
ANTIVIRUS=none
SCAN_MACROS=false

# ============ 邮件设置 ============
MESSAGE_SIZE_LIMIT=50000000
RELAYNETS=
RELAYHOST=
FETCHMAIL_ENABLED=False
FETCHMAIL_DELAY=600
RECIPIENT_DELIMITER=+
DMARC_RUA=admin
DMARC_RUF=admin
WELCOME=false
WELCOME_SUBJECT=Welcome to your new email account
WELCOME_BODY=Welcome to your new email account, if you can read this, then it is configured properly!
COMPRESSION=
COMPRESSION_LEVEL=6
FULL_TEXT_SEARCH=en
# front 对外启用的邮件端口清单；默认 25,80,443,465,993,995,4190，
# Submission(587)/IMAP(143)/POP3(110) 必须显式加入
PORTS=25,80,443,465,587,993,995,4190

# ============ Web 设置 ============
WEBROOT_REDIRECT=/admin
WEB_ADMIN=/admin
WEB_WEBMAIL=/webmail
WEB_API=/api
SITENAME=Mailu
WEBSITE=https://mail.example.com

# ============ 高级设置 ============
COMPOSE_PROJECT_NAME=mailu-2024.06.65-stack
CREDENTIAL_ROUNDS=12
REAL_IP_HEADER=
REAL_IP_FROM=
REJECT_UNLISTED_RECIPIENT=yes
LOG_LEVEL=INFO
TZ=Asia/Shanghai
DEFAULT_SPAM_THRESHOLD=80
# RESTful API 令牌（最短 3 字符），API=true 时必配
API_TOKEN=q1w2e3r4
# 首启自动创建管理员：create/ifmissing/update 三种模式
INITIAL_ADMIN_ACCOUNT=admin
INITIAL_ADMIN_DOMAIN=example.com
INITIAL_ADMIN_PW=q1w2e3r4
INITIAL_ADMIN_MODE=ifmissing
FULL_TEXT_SEARCH_ATTACHMENTS=false

name: mailu-2024.06.65-stack

services:

  redis:
    image: redis:alpine
    restart: always
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/redis:/data"
    depends_on:
      - resolver
    dns:
      - 10.89.56.254

  front:
    image: ghcr.io/mailu/nginx:2024.06.65
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-front
    ports:
      - "8128:25"
      - "8129:465"
      - "8130:587"
      - "8131:993"
      - "8132:443"
    networks:
      - default
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/certs:/certs"
      - "/opt/data/quzuo/tmp/mailu/data/overrides/nginx:/overrides:ro"
    depends_on:
      - resolver
    dns:
      - 10.89.56.254

  resolver:
    image: ghcr.io/mailu/unbound:2024.06.65
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-resolver
    restart: always
    networks:
      default:
        ipv4_address: 10.89.56.254

  admin:
    image: ghcr.io/mailu/admin:2024.06.65
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-admin
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/main:/data"
      - "/opt/data/quzuo/tmp/mailu/data/dkim:/dkim"
    depends_on:
      - redis
      - resolver
    dns:
      - 10.89.56.254

  imap:
    image: ghcr.io/mailu/dovecot:2024.06.65
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-imap
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/mail:/mail"
      - "/opt/data/quzuo/tmp/mailu/data/overrides/dovecot:/overrides:ro"
    networks:
      - default
    depends_on:
      - front
      - resolver
    dns:
      - 10.89.56.254

  smtp:
    image: ghcr.io/mailu/postfix:2024.06.65
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-smtp
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/mailqueue:/queue"
      - "/opt/data/quzuo/tmp/mailu/data/overrides/postfix:/overrides:ro"
    depends_on:
      - front
      - resolver
    dns:
      - 10.89.56.254

  antispam:
    image: ghcr.io/mailu/rspamd:2024.06.65
    hostname: antispam
    restart: always
    env_file: mailu.env
    logging:
      driver: journald
      options:
        tag: mailu-antispam
    networks:
      - default
    volumes:
      - "/opt/data/quzuo/tmp/mailu/data/filter:/var/lib/rspamd"
      - "/opt/data/quzuo/tmp/mailu/data/overrides/rspamd:/overrides:ro"
    depends_on:
      - front
      - redis
      - resolver
    dns:
      - 10.89.56.254

networks:
  default:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 10.89.56.0/24

$ cd /opt/data/quzuo/tmp/mailu/compose
$ docker compose up -d
 Container mailu-20240665-stack-resolver-1 Starting
 Container mailu-20240665-stack-resolver-1 Started
 Container mailu-20240665-stack-front-1 Starting
 Container mailu-20240665-stack-redis-1 Starting
 Container mailu-20240665-stack-front-1 Started
 Container mailu-20240665-stack-imap-1 Starting
 Container mailu-20240665-stack-smtp-1 Starting
 Container mailu-20240665-stack-redis-1 Started
 Container mailu-20240665-stack-antispam-1 Starting
 Container mailu-20240665-stack-admin-1 Starting
 Container mailu-20240665-stack-imap-1 Started
 Container mailu-20240665-stack-smtp-1 Started
 Container mailu-20240665-stack-antispam-1 Started
 Container mailu-20240665-stack-admin-1 Started

$ docker compose ps --format 'table {{.Service}}\t{{.Status}}'
SERVICE    STATUS
admin      Up 28 seconds (health: starting)
antispam   Up 29 seconds (healthy)
front      Up 29 seconds (healthy)
imap       Up 29 seconds (health: starting)
redis      Up 29 seconds
resolver   Up 29 seconds (health: starting)
smtp       Up 29 seconds (healthy)

$ docker compose logs admin 2>&1 | grep -i 'creating initial'
admin-1  | INFO:root:Creating initial admin account admin@example.com with mode ifmissing

$ docker compose exec -T admin flask mailu config-export user.email user.global_admin
user:
  - email: admin@example.com
    global_admin: true
  - email: user1@example.com
    global_admin: false

$ curl -sk -o /dev/null -w '%{http_code} -> %{redirect_url}\n' https://127.0.0.1:8132/
308 -> https://127.0.0.1:8132/admin/?homepage
$ curl -skL -o /dev/null -w 'admin UI final: %{http_code} %{url_effective}\n' https://127.0.0.1:8132/admin/
admin UI final: 200 https://127.0.0.1:8132/sso/login?url=https://127.0.0.1:8132/admin/

$ docker compose exec -T admin flask mailu user user1 example.com 'q1w2e3r4'
$ docker compose exec -T admin flask mailu config-export user.email user.enabled
user:
  - email: admin@example.com
    enabled: true
  - email: user1@example.com
    enabled: true

$ ss -ltn | grep -E ':(8128|8129|8130|8131|8132)\b'
LISTEN 0      4096         0.0.0.0:8132       0.0.0.0:*
LISTEN 0      4096         0.0.0.0:8128       0.0.0.0:*
LISTEN 0      4096         0.0.0.0:8129       0.0.0.0:*
LISTEN 0      4096         0.0.0.0:8130       0.0.0.0:*
LISTEN 0      4096         0.0.0.0:8131       0.0.0.0:*

$ (printf 'EHLO test.example.org\r\nQUIT\r\n'; sleep 2) | \
    timeout 8 openssl s_client -connect 127.0.0.1:8129 -quiet 2>&1 | head -12
Can't use SSL_get_servername
depth=0 CN = mail.example.com, O = Mailu Demo
verify error:num=18:self-signed certificate
verify return:1
depth=0 CN = mail.example.com, O = Mailu Demo
verify return:1
220 mail.example.com Dovecot ready.
250-mail.example.com
250-8BITMIME
250-AUTH PLAIN LOGIN
250-BURL imap
250-CHUNKING

$ swaks --from admin@example.com --to user1@example.com \
    --server mail.example.com:8128 --h-Subject 'B2 inbound test'
<-  250-ENHANCEDSTATUSCODES
<-  250-8BITMIME
<-  250-DSN
<-  250 STARTTLS
 -> MAIL FROM:<admin@example.com>
<-  250 2.0.0 OK
 -> RCPT TO:<user1@example.com>
<-  250 2.1.5 Ok
 -> DATA
<-  354 End data with <CR><LF>.<CR><LF>
 -> Date: Wed, 21 Oct 2026 00:43:04 +0000
 -> To: user1@example.com
 -> From: admin@example.com
 -> Subject: B2 inbound test
 -> Message-Id: <20261021004304.000416@64e0fe571313>
 -> X-Mailer: swaks v20201014.0 jetmore.org/john/code/swaks/
 ->
 -> This is a test mailing
 ->
 ->
 -> .
<-  250 2.0.0 Ok: queued as 21BD58C227B
 -> QUIT
<-  221 2.0.0 Bye
=== Connection closed with remote host.

$ swaks --from user1@example.com --to admin@example.com \
    --server mail.example.com:8130 \
    --auth PLAIN --auth-user user1@example.com --auth-password q1w2e3r4 --tls
<~  220 mail.example.com Dovecot ready.
<~  250-mail.example.com
<~  250-8BITMIME
<~  250-SIZE 50000000
<~  250-STARTTLS
<~  220 2.0.0 Begin TLS negotiation now.
（TLS 协商成功，后续为密文会话）
 ~> RCPT TO:<admin@example.com>
<~  250 2.1.5 Ok
 ~> DATA
<~  354 End data with <CR><LF>.<CR><LF>
 ~> .
<~  250 2.0.0 Ok: queued as E012B8C22CE
 ~> QUIT
<~  221 2.0.0 Bye

$ (printf 'a1 LOGIN user1@example.com q1w2e3r4\r\na2 SELECT INBOX\r\na3 FETCH 1 (BODY[HEADER.FIELDS (FROM SUBJECT)])\r\na4 LOGOUT\r\n'; sleep 3) | \
    timeout 10 openssl s_client -connect 127.0.0.1:8131 -quiet 2>/dev/null
* OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
a1 OK [CAPABILITY IMAP4rev1 ... QUOTA] Logged in
* 1 EXISTS
* 1 RECENT
* OK [UNSEEN 1] First unseen.
a2 OK [READ-WRITE] Select completed (0.001 + 0.000 secs).
* 1 FETCH (FLAGS (\Seen \Recent) BODY[HEADER.FIELDS (FROM SUBJECT)] {53}
From: admin@example.com
Subject: B2 inbound test
)

$ (printf 'b1 LOGIN admin@example.com q1w2e3r4\r\nb2 SELECT INBOX\r\nb3 FETCH 1 (BODY[HEADER.FIELDS (FROM SUBJECT)])\r\nb4 LOGOUT\r\n'; sleep 3) | \
    timeout 10 openssl s_client -connect 127.0.0.1:8131 -quiet 2>/dev/null | grep -E '^(b[0-9]|From:|Subject:|\* 1)'
b1 OK [CAPABILITY IMAP4rev1 ... QUOTA] Logged in
* 1 FETCH (FLAGS (\Seen \Recent) BODY[HEADER.FIELDS (FROM SUBJECT)] {74}
From: user1@example.com
Subject: test Wed, 21 Oct 2026 00:44:20 +0000
b3 OK Fetch completed (0.001 + 0.000 secs).
b4 OK Logout completed (0.001 + 0.000 secs.)

# 查看服务状态
$ docker compose ps
# 查看某服务日志（journald tag 均已打上 mailu-<角色> 标签）
$ docker compose logs --tail 50 admin
# 跟随 antispam 日志
$ docker compose logs -f antispam
# 手动拉取新版并滚动升级（锁定版部署时，把两份文件里的 2024.06.65 改成新锁定版号）
$ docker compose pull && docker compose up -d
# 重启单个服务
$ docker compose restart front
# 重建某服务（改了 overrides 或环境变量后）
$ docker compose up -d --force-recreate admin
# 停止 / 彻底移除（数据在 bind mount，down 不删数据）
$ docker compose down

*** Error connecting to mail.example.com:8130:
***     IO::Socket::INET6: connect: Connection refused