Move Mailcow copy hook into image behind MAILCOW_ENABLED #3

Merged

MHE merged 1 commit from evaluate-dockerfile-version-variables into main 2026-11-01 12:45:03 +01:00

Conversation 0 Commits 1 Files changed 6 +885 -25

MHE commented 2026-11-01 12:43:17 +01:00

Owner

Copy link

What changed

• The Mailcow certificate copy hook is now baked into the image as /usr/local/bin/mailcow-hook.sh instead of being mounted at runtime via POST_HOOK. The POST_HOOK variable is removed.
• MAILCOW_ENABLED (true/false, default false) controls whether the hook runs. Any other value exits before the poll loop.
• With false, the container only dumps PEM files and becomes ready after the first successful dump. SSH keys and the DNS token are not read.
• With true, after a changed dump the hook copies the SMTP certificate to Mailcow over pinned SSH, updates the existing _25._tcp. TLSA record (Cloudflare or deSEC, DNSSEC-checked), and restarts postfix-mailcow, dovecot-mailcow, and nginx-mailcow. Remote certificates are backed up and rolled back on failure.
• .dockerignore allows mailcow-hook.sh; the Dockerfile copies and marks it executable.
• README documents the new variables, secret paths, and the compose example (no post-hook mount, MAILCOW_ENABLED: "false").
• Adds .openso/memory/mailcow-hook.md recording the image-specific decision.

Why

The Mailcow hook previously lived in docker-templates and was mounted at runtime, which meant each deployment had to ship and keep in sync its own copy. Baking it into the image makes behaviour versioned with the image, and the explicit MAILCOW_ENABLED switch keeps dump-only deployments free of SSH and DNS secrets by default.

## What changed - The Mailcow certificate copy hook is now baked into the image as `/usr/local/bin/mailcow-hook.sh` instead of being mounted at runtime via `POST_HOOK`. The `POST_HOOK` variable is removed. - `MAILCOW_ENABLED` (`true`/`false`, default `false`) controls whether the hook runs. Any other value exits before the poll loop. - With `false`, the container only dumps PEM files and becomes ready after the first successful dump. SSH keys and the DNS token are not read. - With `true`, after a changed dump the hook copies the SMTP certificate to Mailcow over pinned SSH, updates the existing `_25._tcp.` TLSA record (Cloudflare or deSEC, DNSSEC-checked), and restarts `postfix-mailcow`, `dovecot-mailcow`, and `nginx-mailcow`. Remote certificates are backed up and rolled back on failure. - `.dockerignore` allows `mailcow-hook.sh`; the Dockerfile copies and marks it executable. - README documents the new variables, secret paths, and the compose example (no post-hook mount, `MAILCOW_ENABLED: "false"`). - Adds `.openso/memory/mailcow-hook.md` recording the image-specific decision. ## Why The Mailcow hook previously lived in `docker-templates` and was mounted at runtime, which meant each deployment had to ship and keep in sync its own copy. Baking it into the image makes behaviour versioned with the image, and the explicit `MAILCOW_ENABLED` switch keeps dump-only deployments free of SSH and DNS secrets by default.

MHE added 1 commit 2026-11-01 12:43:17 +01:00

Add Mailcow certificate hook and make it opt-in via MAILCOW_ENABLED 675882bd1e

MHE merged commit bddab8a314 into main 2026-11-01 12:45:03 +01:00

MHE referenced this pull request from a commit 2026-11-01 12:45:03 +01:00

Move Mailcow copy hook into image behind MAILCOW_ENABLED (#3)

MHE deleted branch evaluate-dockerfile-version-variables 2026-11-01 13:52:17 +01:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

openso/traefik-certs-dumper!3

No description provided.