Upgrade to docker-mailserver 17

charts/docker-mailserver/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: "16.0.1"
+appVersion: "17.0.0"
 description: A fullstack but simple mailserver (smtp, imap, antispam, antivirus, ssl...) using Docker.
 name: docker-mailserver
-version: 6.0.0
+version: 7.0.0
 sources:
 - https://github.com/docker-mailserver/docker-mailserver-helm
 maintainers:
@@ -19,9 +19,9 @@ icon: https://avatars.githubusercontent.com/u/76868633?s=400&v=4
 
 annotations:
   artifacthub.io/changes: |
-    - Breaking : Upgrade to docker-mailserver 16 (Debian 13, Dovecot 2.4)
-    - Breaking : Full text search uses Dovecot flatcurve instead of fts-xapian
-    - Breaking : deployment.securityContext is now applied to the pod
-    - Probes use docker-mailserver's dms-healthcheck script
+    - Breaking : Upgrade to docker-mailserver 17
+    - Breaking : ENABLE_RSPAMD_REDIS is renamed to ENABLE_RSPAMD_VALKEY
+    - Breaking : LDAP_QUERY_FILTER_* are renamed to POSTFIX_*_QUERY_FILTER
+    - The chart's home points to this repository
 
 dependencies: []

charts/docker-mailserver/README.md

@@ -18,6 +18,7 @@
   - [Backing Storage](#backing-storage)
     - [Generic / All](#generic--all)
     - [NFS](#nfs)
+- [Upgrading to Version 7](#upgrading-to-version-7)
 - [Upgrading to Version 6](#upgrading-to-version-6)
 - [Upgrading to Version 5](#upgrading-to-version-5)
 - [Upgrading to Version 3.0.0](#upgrading-to-version-3)
@@ -297,6 +298,29 @@ DMS utilizes neither group-only chown as nfsnobody/root, fsGroup applied to all
 
 Quirks from the generic section also apply to NFS-backed PersistentVolumes.
 
+## Upgrading to Version 7
+Version 7.0 upgrades docker-mailserver to version 17. Read the [docker-mailserver v17 changelog](https://github.com/docker-mailserver/docker-mailserver/blob/master/CHANGELOG.md#v1700) before upgrading.
+
+### Environment Variables
+
+docker-mailserver 17 renamed these environment variables, and the chart's `values.yaml` uses the new names. If you set any of the old names in your values, rename them, because docker-mailserver ignores them.
+
+| Version 6 | Version 7 |
+| --- | --- |
+| `ENABLE_RSPAMD_REDIS` | `ENABLE_RSPAMD_VALKEY` |
+| `LDAP_QUERY_FILTER_USER` | `POSTFIX_USERS_QUERY_FILTER` |
+| `LDAP_QUERY_FILTER_GROUP` | `POSTFIX_GROUPS_QUERY_FILTER` |
+| `LDAP_QUERY_FILTER_ALIAS` | `POSTFIX_ALIASES_QUERY_FILTER` |
+| `LDAP_QUERY_FILTER_DOMAIN` | `POSTFIX_DOMAINS_QUERY_FILTER` |
+
+### Valkey
+
+docker-mailserver 17 replaces Redis with Valkey, which Rspamd uses to store its data. If you use the internal Valkey provided by docker-mailserver, Rspamd's data, such as its Bayes training, will not carry over from version 6 (see [Persistence with Valkey](https://docker-mailserver.github.io/docker-mailserver/latest/config/security/rspamd/#persistence-with-valkey)).
+
+### DKIM
+
+If you store Rspamd DKIM keys in `secrets`, note that `setup config dkim` uses a new file name. See the example in [values.yaml](./values.yaml).
+
 ## Upgrading to Version 6
 Version 6.0 upgrades docker-mailserver to version 16, which moves from Debian 12 to Debian 13 and from Dovecot 2.3 to Dovecot 2.4. Read the [docker-mailserver v16 changelog](https://github.com/docker-mailserver/docker-mailserver/blob/master/CHANGELOG.md) before upgrading.
 

charts/docker-mailserver/tests/__snapshot__/deployment_test.yaml.snap

@@ -79,7 +79,7 @@ manifest should match snapshot:
                   value: "1"
                 - name: ENABLE_RSPAMD
                   value: "1"
-                - name: ENABLE_RSPAMD_REDIS
+                - name: ENABLE_RSPAMD_VALKEY
                   value: "1"
                 - name: ENABLE_SASLAUTHD
                   value: "0"
@@ -97,16 +97,12 @@ manifest should match snapshot:
                   value: "0"
                 - name: FETCHMAIL_POLL
                   value: "300"
+                - name: GETMAIL_IDLE
+                  value: null
+                - name: GETMAIL_PARALLEL
+                  value: "0"
                 - name: GETMAIL_POLL
                   value: "5"
-                - name: LDAP_QUERY_FILTER_ALIAS
-                  value: null
-                - name: LDAP_QUERY_FILTER_DOMAIN
-                  value: null
-                - name: LDAP_QUERY_FILTER_GROUP
-                  value: null
-                - name: LDAP_QUERY_FILTER_USER
-                  value: null
                 - name: LDAP_SEARCH_BASE
                   value: null
                 - name: LDAP_SERVER_HOST
@@ -141,8 +137,14 @@ manifest should match snapshot:
                   value: null
                 - name: PFLOGSUMM_TRIGGER
                   value: null
+                - name: POSTFIX_ALIASES_QUERY_FILTER
+                  value: null
                 - name: POSTFIX_DAGENT
                   value: null
+                - name: POSTFIX_DOMAINS_QUERY_FILTER
+                  value: null
+                - name: POSTFIX_GROUPS_QUERY_FILTER
+                  value: null
                 - name: POSTFIX_INET_PROTOCOLS
                   value: all
                 - name: POSTFIX_MAILBOX_SIZE_LIMIT
@@ -151,6 +153,10 @@ manifest should match snapshot:
                   value: null
                 - name: POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME
                   value: "0"
+                - name: POSTFIX_SENDERS_QUERY_FILTER
+                  value: null
+                - name: POSTFIX_USERS_QUERY_FILTER
+                  value: null
                 - name: POSTGREY_AUTO_WHITELIST_CLIENTS
                   value: "5"
                 - name: POSTGREY_DELAY

charts/docker-mailserver/tests/__snapshot__/secret_test.yaml.snap

@@ -79,7 +79,7 @@ manifest should match snapshot:
                   value: "1"
                 - name: ENABLE_RSPAMD
                   value: "1"
-                - name: ENABLE_RSPAMD_REDIS
+                - name: ENABLE_RSPAMD_VALKEY
                   value: "1"
                 - name: ENABLE_SASLAUTHD
                   value: "0"
@@ -97,16 +97,12 @@ manifest should match snapshot:
                   value: "0"
                 - name: FETCHMAIL_POLL
                   value: "300"
+                - name: GETMAIL_IDLE
+                  value: null
+                - name: GETMAIL_PARALLEL
+                  value: "0"
                 - name: GETMAIL_POLL
                   value: "5"
-                - name: LDAP_QUERY_FILTER_ALIAS
-                  value: null
-                - name: LDAP_QUERY_FILTER_DOMAIN
-                  value: null
-                - name: LDAP_QUERY_FILTER_GROUP
-                  value: null
-                - name: LDAP_QUERY_FILTER_USER
-                  value: null
                 - name: LDAP_SEARCH_BASE
                   value: null
                 - name: LDAP_SERVER_HOST
@@ -141,8 +137,14 @@ manifest should match snapshot:
                   value: null
                 - name: PFLOGSUMM_TRIGGER
                   value: null
+                - name: POSTFIX_ALIASES_QUERY_FILTER
+                  value: null
                 - name: POSTFIX_DAGENT
                   value: null
+                - name: POSTFIX_DOMAINS_QUERY_FILTER
+                  value: null
+                - name: POSTFIX_GROUPS_QUERY_FILTER
+                  value: null
                 - name: POSTFIX_INET_PROTOCOLS
                   value: all
                 - name: POSTFIX_MAILBOX_SIZE_LIMIT
@@ -151,6 +153,10 @@ manifest should match snapshot:
                   value: null
                 - name: POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME
                   value: "0"
+                - name: POSTFIX_SENDERS_QUERY_FILTER
+                  value: null
+                - name: POSTFIX_USERS_QUERY_FILTER
+                  value: null
                 - name: POSTGREY_AUTO_WHITELIST_CLIENTS
                   value: "5"
                 - name: POSTGREY_DELAY

charts/docker-mailserver/values.yaml

@@ -86,7 +86,7 @@ deployment:
     ENABLE_IMAP: 1
     ENABLE_CLAMAV: 0
     ENABLE_RSPAMD: 1
-    ENABLE_RSPAMD_REDIS: 1
+    ENABLE_RSPAMD_VALKEY: 1
     RSPAMD_LEARN: 0
     RSPAMD_CHECK_AUTHENTICATED: 0
     RSPAMD_GREYLISTING: 0
@@ -148,6 +148,8 @@ deployment:
     FETCHMAIL_PARALLEL: 0
     ENABLE_GETMAIL: 0
     GETMAIL_POLL: 5
+    GETMAIL_PARALLEL: 0
+    GETMAIL_IDLE:
 
     # -----------------------------------------------
     # --- LDAP Section ------------------------------
@@ -158,10 +160,12 @@ deployment:
     # set those unless you're using a secret
     #LDAP_BIND_DN:
     #LDAP_BIND_PW:
-    LDAP_QUERY_FILTER_USER:
-    LDAP_QUERY_FILTER_GROUP:
-    LDAP_QUERY_FILTER_ALIAS:
-    LDAP_QUERY_FILTER_DOMAIN:
+    # A Postfix lookup table without a query filter is disabled
+    POSTFIX_USERS_QUERY_FILTER:
+    POSTFIX_GROUPS_QUERY_FILTER:
+    POSTFIX_ALIASES_QUERY_FILTER:
+    POSTFIX_DOMAINS_QUERY_FILTER:
+    POSTFIX_SENDERS_QUERY_FILTER:
 
     # -----------------------------------------------
     # --- Dovecot Section ---------------------------
@@ -354,7 +358,7 @@ persistent_volume_claims:
     storageClass:
     selector: {}
 
-  # Stores state for Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Redis
+  # Stores state for Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Valkey
   # https://docker-mailserver.github.io/docker-mailserver/edge/faq/#what-about-the-docker-datadmsmail-state-directory
   mail-state:
     enabled: true
@@ -391,7 +395,7 @@ persistence:
     mountPath: /var/mail
     subPath:
 
-  # Stores state for Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Redis
+  # Stores state for Postfix, Dovecot, Fail2Ban, Amavis, PostGrey, ClamAV, SpamAssassin, Rspamd & Valkey
   # https://docker-mailserver.github.io/docker-mailserver/edge/faq/#what-about-the-docker-datadmsmail-state-directory
   mail-state:
     volumeName: mail-state
@@ -658,21 +662,15 @@ configMaps:
 ## such as DKIM signing keys.
 ##
 ##  secrets:
-##    rspamd.example.com:
-##      name: rspamd.example.com                      # This is the name of the Secret
+##    rspamd.dkim.example.com:
+##      name: rspamd.dkim.example.com                 # This is the name of the Secret
 ##      create: true                                  # If true, create a new Secret
-##      path: rspamd.dkim.rsa-2048-mail-example.com.private.txt
-##      data: abace                           # If create is true, then you must specify content. Must be base 64 encoded!
-##
-##    rspamd.dkim.rsa-2048-mail-example.com.public:
-##      name: rspamd.dkim.rsa-2048-mail-example.com.public
-##      create: true
-##      path: rspamd/dkim/rsa-2048-mail-example.com.public
+##      path: rspamd/dkim/example.com-mail.private
 ##      data: abace                           # If create is true, then you must specify content. Must be base 64 encoded!
 ##
 ##  If you set the create key to false, then you must manually create the Secrets before deploying the chart.
 ##
-##    kubectl create secret rspamd.example.com --namespace mail --from-file=rspamd.dkim.rsa-2048-mail-example.com.private.txt=<path_to_rspamd.dkim.rsa-2048-mail-example.com.private.txt>
+##    kubectl create secret generic rspamd-dkim-example-com --namespace mail --from-file=rspamd.dkim.example.com=<path_to_example.com-mail.private>
 secrets: {}
 
 ## @param extraDeploy Array of extra objects to deploy with the release