From 680e7d606e9fe2ef325f4b007863e19a7c6b64d2 Mon Sep 17 00:00:00 2001
From: chrisblech <chrisblech@users.noreply.github.com>
Date: Sun, 4 Jan 2026 23:18:46 +0000
Subject: [PATCH] Change starting order/dependencies, add Healthchecks, expose
 only port 25

Upstream documentation tells to start postfix first, then email-, then job-runner container.
We add postgres as dependency to postfix, and add healthchecks
so postfix waits until certificate files are ready, and postfix-dependencies will wait until postfix is started and responding

MTAs only use port 25 to exchange mails. As connecting/authenticating users (via mail-client and ESMTP submission-protocol) is not a use-case for this project, we do not need port 587.
---
 postfix-compose.yaml      | 27 ++++++++++++++++++++-------
 postfix/Dockerfile        |  3 ++-
 simple-login-compose.yaml |  4 ++++
 3 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/postfix-compose.yaml b/postfix-compose.yaml
index fe5531d..3ae540f 100644
--- a/postfix-compose.yaml
+++ b/postfix-compose.yaml
@@ -13,13 +13,20 @@ services:
     env_file: .env
     ports:
       - '25:25'
-      - '587:587'
     volumes:
       - certs:/certs:ro
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "nc -w 3 127.0.0.1 25 </dev/null | grep -q '^220'"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     depends_on:
-      - email
-      - traefik-certificate-exporter
+      postgres:  
+        condition: service_healthy
+      traefik-certificate-exporter:
+        condition: service_healthy
     labels:
       - com.github.ravensorb.traefik-certificate-exporter.domain-restart=${SUBDOMAIN:-app}.${DOMAIN},${DOMAIN}
 
@@ -37,12 +44,18 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock:ro
       - traefik-acme:/data:ro
       - certs:/certs:rw
+    healthcheck:
+      test: ["CMD-SHELL", "[ -f \"/certs/${SUBDOMAIN:-app}.${DOMAIN}.fullchain.pem\" ] || [ -f \"/certs/${DOMAIN}.fullchain.pem\" ]"]
+      interval: 20s
+      timeout: 5s
+      retries: 3
+      start_period: 5m
     depends_on:
       - app
 
 volumes:
   certs:
-  ## Uncomment the next lines, if traefik is running outside this project
-  # traefik-acme:  # <-- do not change this identifier
-  #   name: traefik-acme    # change (only) this to the name of traefik acme storage volume
-  #   external: true
+## Uncomment the next lines, if traefik is running outside this project
+#  traefik-acme:  # <-- do not change this identifier
+#    name: traefik-acme    # change (only) this to the name of traefik acme storage volume
+#    external: true
diff --git a/postfix/Dockerfile b/postfix/Dockerfile
index e42b978..e69ecbd 100644
--- a/postfix/Dockerfile
+++ b/postfix/Dockerfile
@@ -15,7 +15,7 @@ COPY --from=base / /
 FROM alpine AS postfix
 
 # install dependencies
-RUN apk --no-cache add postfix postfix-pgsql openssl bind-tools \
+RUN apk --no-cache add postfix postfix-pgsql openssl bind-tools netcat-openbsd \
   && mkdir -p /templates /etc/postfix/conf.d
 
 COPY docker-entrypoint.sh /docker-entrypoint.sh
@@ -24,5 +24,6 @@ COPY conf.d /etc/postfix/conf.d/
 
 ENV MAIL_CONFIG=/etc/postfix/conf.d
 
+EXPOSE 25
 ENTRYPOINT ["/docker-entrypoint.sh"]
 CMD ["/usr/sbin/postfix", "start-fg"]
diff --git a/simple-login-compose.yaml b/simple-login-compose.yaml
index f62c85c..5da7ac8 100644
--- a/simple-login-compose.yaml
+++ b/simple-login-compose.yaml
@@ -90,6 +90,8 @@ services:
     depends_on:
       init:
         condition: service_completed_successfully
+      postfix:
+        condition: service_healthy
 
   job-runner:
     <<: *sl-defaults
@@ -99,3 +101,5 @@ services:
     depends_on:
       init:
         condition: service_completed_successfully
+      email:
+        condition: service_started