Hello, excuse my - maybe - stupid question but I cannot find any official documentation on the configuration concept below {mailcow}/data/conf like when to create a new file, when to ceate something in an "override" directory and who (user/group) should own the file. I am sure it is documented somewhere, but I cannot find it. Could you give me a hint, please? Thanks a lot in advance, Thomas

It is documented where it is relevant. data/conf gathers all persistant config data which needs to survive redeployment. Don't try to fix things which are working ;) Or which are not documented, because they can have side effects

Here and there I only found some information about single modules to configure, but nothing about the general idea behind the configuration concept of mailcow. Especially nothing abozt the required access rights in term of user/group of the config files (also not at the places where I have seen some other information about the configuration of single modules). The files in my setup have at the moment the user sshd and the group was crond, ist this the normal way if access rights? I would have expected something like mail or e.g. mailcow as user and group.

Mailcow Configuration Files

esackbauer

Your setup is unknown to us. Where are those rights? on the docker hosts? inside the containers?

thn80

My setup is based on Debian 12 and was simply installed via
git clone https://github.com/mailcow/mailcow-dockerized
So, the access rights should be the mailcow defaults, but the concept mailcow ueses is still unclear to me.

esackbauer

I dont know where you see those rights. All my /data/conf files have root:root

mlcwuser

thn80 The files in my setup have at the moment the user sshd and the group was crond

How did you manage to make this happen? If you don’t know the answer to that, I wouldn’t recommend changing anything in your mailcow directory except for the mailcow.conf file. And maybe also consider reinstalling the whole thing on a fresh Debian instance, by using the exact steps in the documentation.

thn80

Please see the screenshot attached. There you can see that some files/folders belong to root:root while others belong to sshd:crontab (I have changed no rights after mailcow installation).

Which rights should new files have which are created (e.g. files referenced in existing files)?

When some files are root:root does this mean that mailcow runs as root?

[unknown] what I have is a fresh Debian system with a fresh mailcow setup, done as described in the manual.

mlcwuser

Hmm, not sure why these files belong to sshd:crontab on your server… On my server it looks like this:

root@mail:/opt/mailcow-dockerized/data/conf/rspamd# ls -al
total 44
drwxr-xr-x  9 root       root       4096 Apr 30  2022 .
drwxr-xr-x 11 root       root       4096 Apr 30  2022 ..
drwxr-xr-x  2 messagebus messagebus 4096 Aug  6 08:56 custom
drwxr-xr-x  2 root       root       4096 Apr 30  2022 dynmaps
drwxr-xr-x  2 messagebus messagebus 4096 Jul 29 10:35 local.d
drwxr-xr-x  2 root       root       4096 Jul 29 10:35 lua
drwxr-xr-x  2 root       root       4096 Dec 27  2022 meta_exporter
drwxr-xr-x  2 messagebus messagebus 4096 Apr 30  2022 override.d
drwxr-xr-x  2 messagebus messagebus 4096 Apr 30  2022 plugins.d
-rw-r--r--  1 messagebus messagebus   20 Aug  4 08:56 rspamd.conf.local
-rw-r--r--  1 messagebus messagebus   24 Aug  4 08:56 rspamd.conf.override

thn80 When some files are root:root does this mean that mailcow runs as root?

Well yes, sort of. The Docker deamon is running as root, and honestly I don’t see any issue with that, as long as you don’t run any other things on your server, but others might be able to explain this better, as I’m not really an expert on Docker.

thn80

Maybe, soone else here has an idea why some files belong to sshd:crontab?

accolon

These files belong to specific UIDs and GIDs set inside their respective Docker containers.

If you run e.g. ps faux | grep rspamd on your Docker host, you will see that several child processes of rspamd run with the same UID.

For me, it’s 100:101 (try ls -lan to see the numerical IDs), which is mapped to _apt:systemd-timesync on my Debian host system.

You can run the following command inside your mailcow folder:
docker exec -it mailcowdockerized-rspamd-mailcow-1 id _rspamd

It should output something like:
uid=100(_rspamd) gid=101(_rspamd) groups=101(_rspamd)

This means the _rspamd user inside the container happens to have the same UID and GID as above, i.e. 100:101.

Long story short: This is normal behaviour when using Docker and nothing to worry about.

thn80

Does this mean I have to do this analysis for each config file I create to know which user/group is required? I would have expected that there is a more unique way in mailcow.
Are those details documented somewhere for mailcow? Or is there any advanced titorial or book available with some more details than in the official mailcow manual?

accolon

thn80 Does this mean I have to do this analysis for each config file I create to know which user/group is required?

Your question was:

Maybe, soone else here has an idea why some files belong to sshd:crontab?

I tried to give you an explanation why some files seem to have a seemingly strange UID/GID set.

Everything you need to know about mailcow configuration is in the official documentation (see “Docs” at the top of this page). You should not fiddle with anything else unless you exactly know what you are doing.

esackbauer

Why do you want to analyse something you obviously do not really understand? Like how Docker actually works?

thn80

esackbauer I just want to know how to configure my mailcow system. The mailcow developers want that I dig into Docker.

esackbauer

thn80 No, they don’t. This is why they provide the ready made docker images and compose stack. They are not meant to be fiddled around it. I can tell you: The more options you are documenting, the more problems will happen because users try to tweak them without understanding the consequences.
What you need for configuring mailcow is in the docs.

thn80

Why I came to this topic is the question I asked in another thread –> https://community.mailcow.email/d/2699-rspamd-whitelist-single-ip-for-ratelimit

Maybe, does someone of you have an idea on that topic? I do not want to fiddle around or mess-up the mailcow system, but need to disable the Ratelimit for a single IP address and don’t get it to work correctly. Even after seeing the “whitelisted_ip” parameter in the Rspamd configuration. I assume that I don’t understand the configuration paths correctly and, therefore, I tried in this thread here to get a better understanding.