|
1 | | -# Mailauth |
2 | 1 |
|
3 | | -Mailauth is a Mailbox Manager which enables you too select between your Mailboxes and authenticate with your Mailserver (like [mailcow](https://github.com/mailcow/mailcow-dockerized)) |
4 | | - |
5 | | -## Showcase |
6 | | - |
7 | | - |
8 | | - |
9 | | -## Getting Started |
10 | | - |
11 | | -Get the latest version of the `docker-compose.yaml` file: |
12 | | - |
13 | | -```yaml |
14 | | ---- |
15 | | -services: |
16 | | - mailauth: |
17 | | - image: ghcr.io/codeshelldev/mailauth:latest |
18 | | - container_name: mailauth |
19 | | - ports: |
20 | | - - "80:80" |
21 | | - env_file: |
22 | | - - .env |
23 | | - restart: unless-stopped |
24 | | - networks: |
25 | | - mailauth: |
26 | | - aliases: |
27 | | - - mailauth |
28 | | - |
29 | | - mongodb: |
30 | | - image: mongo:latest # Use arm64v8/mongo for ARM Architecture |
31 | | - container_name: mailauth-db |
32 | | - volumes: |
33 | | - - db:/data/db |
34 | | - - ./init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js |
35 | | - env_file: |
36 | | - - .env |
37 | | - networks: |
38 | | - mailauth: |
39 | | - aliases: |
40 | | - - mongo |
41 | | - restart: unless-stopped |
42 | | - |
43 | | - redis: |
44 | | - image: redis:latest |
45 | | - container_name: mailauth-redis |
46 | | - command: ["redis-server", "--requirepass", ""] |
47 | | - env_file: |
48 | | - - .env |
49 | | - networks: |
50 | | - mailauth: |
51 | | - aliases: |
52 | | - - redis |
53 | | - restart: unless-stopped |
54 | | - |
55 | | -networks: |
56 | | - mailauth: |
57 | | - |
58 | | -volumes: |
59 | | - db: |
60 | | -``` |
61 | | -
|
62 | | -### Setup |
63 | | -
|
64 | | -Mailauth _currently_ works by modifying the `email` claim during Token Exchange and Userinfo, |
65 | | -this means that you **will have to** use a IdP (like [authentik](https://goauthentik.io)). |
66 | | - |
67 | | -Create a `.env` file inside of you `docker-compose.yaml` directory and copy the template below |
68 | | - |
69 | | -```dotenv |
70 | | -# Mail |
71 | | -
|
72 | | -# Get from your IdP (for your mailserver) |
73 | | -MAIL_CLIENT_ID= |
74 | | -MAIL_CLIENT_SECRET= |
75 | | -
|
76 | | -MAIL_AUTHORIZATION_ENDPOINT= |
77 | | -MAIL_TOKEN_ENDPOINT= |
78 | | -MAIL_USERINFO_ENDPOINT= |
79 | | -
|
80 | | -MAIL_REDIRECT_URIS=https://mailauth.domain.com/oauth/mail/callback,https://mailauth.yourdomain.com/oauth/mail/callback |
81 | | -MAIL_CALLBACK_URIS=https://mail.domain.com,https://mail.yourdomain.com # This is your mailservers oauth callback url |
82 | | -
|
83 | | -# App |
84 | | -
|
85 | | -# Get this from your IdP (for mailauth) |
86 | | -APP_CLIENT_ID= |
87 | | -APP_CLIENT_SECRET= |
88 | | -
|
89 | | -APP_ISSUER= |
90 | | -APP_AUTHORIZATION_ENDPOINT= |
91 | | -APP_TOKEN_ENDPOINT= |
92 | | -APP_USERINFO_ENDPOINT= |
93 | | -APP_LOGOUT_ENDPOINT= |
94 | | -
|
95 | | -APP_REDIRECT_PATH=/oauth/app/callback |
96 | | -
|
97 | | -# DB |
98 | | -
|
99 | | -MONGO_INITDB_ROOT_USERNAME=admin |
100 | | -MONGO_INITDB_ROOT_PASSWORD=SECURE_ROOT_PW |
101 | | -MONGO_INITDB_DATABASE=mailauth |
102 | | -
|
103 | | -MONGO_USER=mailauth |
104 | | -MONGO_PW=SECURE_PW |
105 | | -
|
106 | | -# ---- # |
107 | | -
|
108 | | -REDIS_PASSWORD=SECURE_REDIS_PW |
109 | | -
|
110 | | -# General |
111 | | -
|
112 | | -SESSION_SECRET=SECURE_KEY # Gen with openssl |
113 | | -
|
114 | | -HOST=https://mailauth.domain.com |
115 | | -
|
116 | | -PREFIX=/ # Optional |
117 | | -
|
118 | | -DB_HOST=mongodb://::27017/ |
119 | | -REDIS_HOST=redis://default::6379 |
120 | | -``` |
121 | | - |
122 | | -Now you need to setup a Oauth Authentication Method in your mailserver, |
123 | | -but instead of using your IdP's endpoints you use: |
124 | | - |
125 | | -- `/oauth/mail/authorize` |
126 | | -- `/oauth/mail/token` |
127 | | -- `/oauth/mail/userinfo` |
128 | | - |
129 | | -And set Redirect URI to the one from your `.env` file. |
130 | | - |
131 | | -Next create `init-mongo.js` in your working directory: |
132 | | - |
133 | | -```js |
134 | | -const PASSWORD = process.env.MONGO_PW |
135 | | -const USER = process.env.MONGO_USER |
136 | | -const DB = process.env.MONGO_INITDB_DATABASE |
137 | | -
|
138 | | -db = db.getSiblingDB(DB) // Switch to your target database |
139 | | -db.createUser({ |
140 | | - user: USER, |
141 | | - pwd: PASSWORD, |
142 | | - roles: [ |
143 | | - { role: "readWrite", db: DB }, // Give read/write access to 'mailauth' |
144 | | - ], |
145 | | -}) |
146 | | -``` |
147 | | - |
148 | | -### Reverse Proxy |
149 | | - |
150 | | -When working with Oauth2 and Auth in general it is recommended to be sure to use secure connections, |
151 | | -here you will see a Reverse Proxy implementation with traefik: |
152 | | - |
153 | | -```yaml |
154 | | ---- |
155 | | -services: |
156 | | - mailauth: |
157 | | - image: ghcr.io/codeshelldev/mailauth:latest |
158 | | - container_name: mailauth |
159 | | - labels: |
160 | | - - traefik.enable=true |
161 | | - - traefik.http.routers.mailauth-secure.entrypoints=websecure |
162 | | - - traefik.http.routers.mailauth-secure.rule=Host(`mailauth.domain.com`) |
163 | | - - traefik.http.routers.mailauth-secure.tls=true |
164 | | - - traefik.http.routers.mailauth-secure.tls.certresolver=resolver |
165 | | - - traefik.http.routers.mailauth-secure.service=mailauth-svc |
166 | | - - traefik.http.services.mailauth-svc.loadbalancer.server.port=80 |
167 | | - - traefik.docker.network=proxy |
168 | | - env_file: |
169 | | - - .env |
170 | | - restart: unless-stopped |
171 | | - networks: |
172 | | - mailauth: |
173 | | - aliases: |
174 | | - - mailauth |
175 | | - proxy: |
176 | | - |
177 | | - mongodb: |
178 | | - image: mongo:latest # Use arm64v8/mongo for ARM Architecture |
179 | | - container_name: mailauth-db |
180 | | - volumes: |
181 | | - - db:/data/db |
182 | | - - ./init-mongo.js:/docker-entrypoint-initdb.d/init-mongo.js |
183 | | - env_file: |
184 | | - - .env |
185 | | - networks: |
186 | | - mailauth: |
187 | | - aliases: |
188 | | - - mongo |
189 | | - restart: unless-stopped |
190 | | - |
191 | | - redis: |
192 | | - image: redis:latest |
193 | | - container_name: mailauth-redis |
194 | | - command: ["redis-server", "--requirepass", ""] |
195 | | - env_file: |
196 | | - - .env |
197 | | - networks: |
198 | | - mailauth: |
199 | | - aliases: |
200 | | - - redis |
201 | | - restart: unless-stopped |
202 | | - |
203 | | -networks: |
204 | | - mailauth: |
205 | | - proxy: |
206 | | - external: true |
207 | | - |
208 | | -volumes: |
209 | | - db: |
210 | | -``` |
211 | | -
|
212 | | -## Usage |
213 | | -
|
214 | | -When authenticating via mailauth you get redirected to your actual IdP then to `/select`, |
215 | | -where you will be able to select your mailbox, mailauth changes the `email` claim and now you're logged in. |
216 | | - |
217 | | -## Contributing |
218 | | - |
219 | | -Found an Issue or want to see something implemented into Mailauth? |
220 | | -Open up an Issue or start a Pull Request! |
221 | | - |
222 | | -But always be respectful and patient, we are all volunteers after all. |
223 | | - |
224 | | -## Supporting |
225 | | - |
226 | | -Found this Project useful? Let others know about Mailauth by ⭐️ this Repo! |
227 | | - |
228 | | -## License |
229 | | - |
230 | | -[MIT](https://choosealicense.com/licenses/mit/) |
0 commit comments