# Before launching mox, run the quickstart to create config files for running as
# user the mox user (create it on the host system first, e.g. "useradd -d $PWD mox"):
#
# mkdir config data web
# docker-compose run mox mox quickstart you@yourdomain.example $(id -u mox)
#
# note: if you are running quickstart on a different machine than you will deploy
# mox to, use the "quickstart -hostname ..." flag.
#
# After following the quickstart instructions you can start mox:
#
# docker-compose up
#
#
# If you want to run "mox localserve", you could start it like this:
#
# docker run \
#     -p 127.0.0.1:25:1025 \
#     -p 127.0.0.1:465:1465 \
#     -p 127.0.0.1:587:1587 \
#     -p 127.0.0.1:993:1993 \
#     -p 127.0.0.1:143:1143 \
#     -p 127.0.0.1:443:1443 \
#     -p 127.0.0.1:80:1080 \
#     r.xmox.nl/mox:latest mox localserve -ip 0.0.0.0
#
# The -ip flag ensures connections to the published ports make it to mox, and it
# prevents listening on ::1 (IPv6 is not enabled in docker by default).

services:
  mox:
    # Replace "latest" with the version you want to run, see https://r.xmox.nl/r/mox/.
    # Include the @sha256:... digest to ensure you get the listed image.
    image: r.xmox.nl/mox:latest
    container_name: mox
    environment:
      - MOX_DOCKER=yes # Quickstart won't try to write systemd service file.
    # Mox needs host networking because it needs access to the IPs of the
    # machine, and the IPs of incoming connections for spam filtering.
    network_mode: 'host'
    volumes:
      - ./config:/mox/config:z
      - ./data:/mox/data:z
      # web is optional but recommended to bind in, useful for serving static files with
      # the webserver.
      - ./web:/mox/web:z
      # 挂载 1Panel 的证书目录
      - /cert:/mox/certs:ro
    working_dir: /mox
    restart: on-failure
    healthcheck:
      test: netstat -nlt | grep ':25 '
      interval: 1s
      timeout: 1s
      retries: 10

# Listeners are groups of IP addresses and services enabled on those IP addresses,
# such as SMTP/IMAP or internal endpoints for administration or Prometheus
# metrics. All listeners with SMTP/IMAP services enabled will serve all configured
# domains. If the listener is named 'public', it will get a few helpful additional
# configuration checks, for acme automatic tls certificates and monitoring of ips
# in dnsbls if those are configured.
Listeners:
	public:
		TLS:
			# Keys and certificates to use for this listener. The files are opened by the
			# privileged root process and passed to the unprivileged mox process, so no
			# special permissions are required on the files. If the private key will not be
			# replaced when refreshing certificates, also consider adding the private key to
			# HostPrivateKeyFiles and configuring DANE TLSA DNS records. (optional)
			KeyCerts:
				-

					# Certificate including intermediate CA certificates, in PEM format.
					CertFile: /mox/certs/fullchain.pem

					# Private key for certificate, in PEM format. PKCS8 is recommended, but PKCS1 and
					# EC private keys are recognized as well.
					KeyFile: /mox/certs/privkey.pem

# Transport are mechanisms for delivering messages. Transports can be referenced
# from Routes in accounts, domains and the global configuration. There is always
# an implicit/fallback delivery transport doing direct delivery with SMTP from the
# outgoing message queue. Transports are typically only configured when using
# smarthosts, i.e. when delivering through another SMTP server. Zero or one
# transport methods must be set in a transport, never multiple. When using an
# external party to send email for a domain, keep in mind you may have to add
# their IP address to your domain's SPF record, and possibly additional DKIM
# records. (optional)
Transports:
	Resend:
		# Submission SMTP over a TLS connection to submit email to a remote queue.
		# (optional)
		Submissions:
			# Host name to connect to and for verifying its TLS certificate.
			Host: smtp.resend.com

			# If set, authentication credentials for the remote server. (optional)
			Auth:
				Username: resend
				Password: your_api_key
				Mechanisms:
					# Allowed authentication mechanisms. Defaults to SCRAM-SHA-256-PLUS,
					# SCRAM-SHA-256, SCRAM-SHA-1-PLUS, SCRAM-SHA-1, CRAM-MD5. Not included by default:
					# PLAIN. Specify the strongest mechanism known to be implemented by the server to
					# prevent mechanism downgrade attacks. (optional)

					- PLAIN

# Domains for which email is accepted. For internationalized domains, use their
# IDNA names in UTF-8.
Domains:
	yourdomain.com:

		# Routes for delivering outgoing messages through the queue. Each delivery attempt
		# evaluates account routes, these domain routes and finally global routes. The
		# transport of the first matching route is used in the delivery attempt. If no
		# routes match, which is the default with no configured routes, messages are
		# delivered directly from the queue. (optional)
		Routes:
			-

				# Matches if the envelope from domain matches one of the configured domains, or if
				# the list is empty. If a domain starts with a dot, prefixes of the domain also
				# match. (optional)
				# FromDomain: #
				#  - #

				# Like FromDomain, but matching against the envelope to domain. (optional)
				# ToDomain: #
				#  - #

				# Matches if at least this many deliveries have already been attempted. This can
				# be used to attempt sending through a smarthost when direct delivery has failed
				# for several times. (optional)
				# MinimumAttempts: 0 #
        # use resend transport configured in mox.conf
				Transport: Resend