Running Stalwart behind Caddy

[RonnyLam]

I have managed to get Stalwart to run behind Caddy. There are only a couple of things you have to do.

This is my Caddyfile, yours might differ of course:

www.domain.tld {
	redir https://domain.tld{uri}
	}

domain.tld {
	# Set this path to your site's directory.
	root * /usr/share/caddy

	# Enable the static file server.
	file_server
	}

mail.domain.tld {
	reverse_proxy 127.0.0.1:8080
	}

After succesfully starting Caddy you can copy the certificate files to your Stalwart dir:

mkdir -p /opt/stalwart-mail/cert/
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/domain.tld/domain.tld.crt /opt/stalwart-mail/cert/domain.tld.pem
cp /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/domain.tld/domain.tld.key /opt/stalwart-mail/cert/domain.tld.priv.pem
chown -R stalwart-mail:stalwart-mail /opt/stalwart-mail/cert/

Put the following in root's crontab,it needs to be root because of ownership of different files...

0 3 * * * cat /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/domain.tld/domain.tld.crt > /opt/stalwart-mail/cert/domain.tld.pem
0 3 * * * cat /var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/domain.tld/domain.tld.key > /opt/stalwart-mail/cert/domain.tld.priv.pem

add the following to your config.toml:

##remove https
##change http from [::]:8080 to 127.0.0.1:8080
server.tls.certificate = "default"
certificate.default.cert = "%{file:/opt/stalwart-mail/cert/domain.tld.pem}%"
certificate.default.default = true
certificate.default.private-key = "%{file:/opt/stalwart-mail/cert/domain.tld.priv.pem}%"

Now you can safely (re)start Stalwart and finish configuration in Webmin.

[RonnyLam]

The reason I created this setup is that in this way you can have both mail and http running at the root-domain. www is redirected to the root and webmin is running behind mail.domain.tld. Now you can start a small VM for every venture or cool idea that you think of.

[theweekendgeek]

Thank you! I finally got it running with this config

[rajalah71]

Could you also tell to which ports your router/firewall points to? 443 for caddy and the rest for stalwart? Or all to caddy? I am still a little confused.

[RonnyLam]

80 and 443 are going to Caddy,
Caddy reverse proxies to 8080,
25, 143, 465, 587, 993 and 995 to Stalwart

[rajalah71]

Thanks!

[jjj333-p]

TL;DR I kept doing stupid things

Basically if you change connection/ports config even through the web console you have to restart stalwart. Also if you're already logged into Thunderbird you'll need to log out and back in again.

---

heya, following this just made it go from complaining about self signed certs to just refusing to connect now

when i go to the cert page of stalwart i see that it just verbatim put in the file path, not what was in it. is this what is supposed to happen?

i just copied over mail.pain.agency which is the mail domain of my server. should i have copied over the cert from the normal domain (pain.agency)?

[jjj333-p]

oh im stupid i didnt replace the placeholder

[jjj333-p]

now it seems to alternate between displaying this and saying my cert is for the wrong domain. should i have done for pain.agency (vanity domain) instead of mail.pain.agency?

[jjj333-p]

disabling implicit tls on smtp seems to have fixed that however it still cant fetch emails over imap. thunderturd just says connection refused, and the stalwart admin console will start just throwing 502s and if i reload it wont load until after thunderbird stops trying to connect. is this an internal bug?

[jjj333-p]

thunderbird seems to indicate it cant find tls for imap, whether or not i set imap to have implicit tls. but it sees it for smtp, im so confused

[jjj333-p]

turns out i had set it back to listen to imap on port 993 but you have to restart stalwart for that to work.

[jjj333-p]

Is there any good way to get caddy to foward the real ip to stalwart to log?

[mdecimus]

Yes, by enabling the proxy protocol but unfortunately I don't have experience with Caddy to help you with that.

[jjj333-p]

is that a setting in stalwart or in caddy? ive attempted setting

        header_up X-Forwarded-For {remote_host}
        header_up X-Real-IP {remote_host}

and neither of these seemed to get picked up by stalwart, even with this option selected under server > http

[mdecimus]

You need to configure the soruce IP address(es) of your reverse proxy here.