Cannot connect to stalwart running behind traefik v2

[JK-Effects]

Hi
I am using Stalwart V0.8.1 and traefik v2 in docker compose.
The mail server is running great and I can log in to the web interface, but I cannot login from any of my mail apps (Thunderbird / K9).
Can anyone help me and tell me what is configured wrong?

Traefik Docker Compose

version: '3'

services:
  reverse-proxy:
    image: traefik:v2.4
    container_name: traefik
    command:
      - --api.insecure=true
      - --api.dashboard=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.myresolver.acme.email=traefik@example.com
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
      - --entrypoints.smtpsecure.address=:465
      - --entrypoints.imapsecure.address=:993
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
      - "465:465/tcp"
      - "993:993/tcp"
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.traefik.rule=Host(`traefik.example.com`)
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=traefik-dashboard-auth
      - traefik.http.middlewares.traefik-dashboard-auth.basicauth.users=<access>
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.tls.certresolver=myresolver
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /root/traefik/acme:/etc/traefik/acme
      - /var/traefik/letsencrypt:/letsencrypt

networks:
  proxy:
    external: true

Stalwart Docker Compose

version: '3'

services:
  mailserver:
    image: stalwartlabs/mail-server:v0.8.1
    container_name: mailserver
    ports:
      - "25:25/tcp" #SMTP Default
      - "587:587/tcp" #SMTP
    volumes:
      - /var/mailserver/stalwart:/opt/stalwart-mail
      - /var/mailserver/blobs:/var/lib/data/blobs
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.mailserver.entrypoints=websecure
      - traefik.http.services.mailserver.loadbalancer.server.port=8080
      - traefik.http.routers.mailserver.rule=Host(`mail.example.com`)
      - traefik.http.routers.mailserver.tls=true
      - traefik.http.routers.mailserver.tls.certresolver=myresolver
      - traefik.tcp.routers.smtpsecure.tls=true
      - traefik.tcp.routers.smtpsecure.tls.certresolver=myresolver
      - traefik.tcp.routers.smtpsecure.entrypoints=smtpsecure
      - traefik.tcp.routers.smtpsecure.rule=HostSNI(`mail.example.com`)
      - traefik.tcp.routers.smtpsecure.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=587
      - traefik.tcp.services.smtp.loadbalancer.proxyprotocol.version=2
      - traefik.tcp.routers.imapsecure.tls=true
      - traefik.tcp.routers.imapsecure.tls.certresolver=myresolver
      - traefik.tcp.routers.imapsecure.entrypoints=imapsecure
      - traefik.tcp.routers.imapsecure.rule=HostSNI(`mail.example.com`)
      - traefik.tcp.routers.imapsecure.service=imap
      - traefik.tcp.services.imap.loadbalancer.server.port=143
      - traefik.tcp.services.imap.loadbalancer.proxyprotocol.version=2
    networks:
      - proxy
      - intern
    depends_on:
      - mailserver-db

  mailserver-db:
    image: postgres:16
    container_name: mailserver_database
    restart: unless-stopped
    environment:
      - POSTGRES_USER=mailserver
      - POSTGRES_PASSWORD=<pw>
      - POSTGRES_DB=stalwart
    volumes:
      - /var/mailserver/db:/var/lib/postgresql/data
    networks:
      - intern

networks:
  proxy:
    external: true
  intern:

Stalwart Config

authentication.fallback-admin.secret = <secret>
authentication.fallback-admin.user = "admin"
cluster.node-id = 1
directory.internal.store = "postgres"
directory.internal.type = "internal"
lookup.default.hostname = "mail.example.com"
server.http.permissive-cors = false
server.http.url = "protocol + '://' + key_get('default', 'hostname') + ':' + local_port"
server.http.use-x-forwarded = true
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.tls.implicit = true
server.max-connections = 8192
server.proxy.trusted-networks.0 = "127.0.0.0/8"
server.proxy.trusted-networks.1 = "::1"
server.proxy.trusted-networks.2 = "10.0.0.0/8"
server.socket.backlog = 1024
server.socket.nodelay = true
server.socket.reuse-addr = true
server.socket.reuse-port = true
storage.blob = "filesystem"
storage.data = "postgres"
storage.directory = "internal"
storage.fts = "postgres"
storage.lookup = "postgres"
store.filesystem.compression = "lz4"
store.filesystem.depth = 2
store.filesystem.path = "/var/lib/data/blobs"
store.filesystem.purge.frequency = "0 3 *"
store.filesystem.type = "fs"
store.postgres.compression = "lz4"
store.postgres.database = "stalwart"
store.postgres.host = "mailserver-db"
store.postgres.password = <pw>
store.postgres.pool.max-connections = 10
store.postgres.port = 5432
store.postgres.purge.frequency = "0 3 *"
store.postgres.query.domains = "SELECT 1 FROM emails WHERE address LIKE '%@' || $1 LIMIT 1"
store.postgres.query.emails = "SELECT address FROM emails WHERE name = $1 AND type != 'list' ORDER BY type DESC, address ASC"
store.postgres.query.expand = "SELECT p.address FROM emails AS p JOIN emails AS l ON p.name = l.name WHERE p.type = 'primary' AND l.address = $1 AND l.type = 'list' ORDER BY p.address LIMIT 50"
store.postgres.query.members = "SELECT member_of FROM group_members WHERE name = $1"
store.postgres.query.name = "SELECT name, type, secret, description, quota FROM accounts WHERE name = $1 AND active = true"
store.postgres.query.recipients = "SELECT name FROM emails WHERE address = $1 ORDER BY name ASC"
store.postgres.query.verify = "SELECT address FROM emails WHERE address LIKE '%' || $1 || '%' AND type = 'primary' ORDER BY address LIMIT 5"
store.postgres.timeout = "15s"
store.postgres.tls.allow-invalid-certs = false
store.postgres.tls.enable = false
store.postgres.type = "postgresql"
store.postgres.user = "mailserver"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "info"
tracer.log.path = "/opt/stalwart-mail/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"

[mdecimus]

Hi,

I'm not familiar with Traefik but what you could try is to take a look at the Stalwart log files. If you don't see any useful information try increasing the logging level to trace.
Also I recommend that you first try to run Stalwart without Traefik and once you are able to connect from your mail apps then you enable Traefik.

[JK-Effects]

Got it solved.
I now use a certdumper to extract the certificates from the acme.json of traefik.
I then import them into the mailserver as default.
The mail server is assigned all ports directly so that only the ui is accessible via traefik.

[tvx-matt]

@JK-Effects Please can you share how you did that, I appear to have the same issue

[JK-Effects]

I'll be happy to tell you how it worked out for me in the end.
In short, I mounted the ports directly at stalwart and gave the cert to the container via dumper.
One thing I noticed was that the cert was not updated automatically when it was passed to the container and the SSL certificate then expired. I then had to restart the container and then everything worked again.

Traefik:

version: '3'

services:
  reverse-proxy:
    image: traefik:v2.4
    container_name: traefik
    restart: unless-stopped
    command:
      - --api.insecure=true
      - --api.dashboard=true
      - --providers.docker=true
      - --entrypoints.web.address=:80
      - --entrypoints.web.http.redirections.entryPoint.to=websecure
      - --entrypoints.web.http.redirections.entryPoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --entrypoints.websecure.address=:443
      - --certificatesresolvers.myresolver.acme.email=traefik@<domain>
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web
    networks:
      - proxy
    ports:
      - "80:80"
      - "443:443"
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.traefik.rule=Host(`<host>`)
      - traefik.http.routers.traefik.priority=1000
      - traefik.http.routers.traefik.service=api@internal
      - traefik.http.routers.traefik.middlewares=traefik-dashboard-auth
      - traefik.http.middlewares.traefik-dashboard-auth.basicauth.users=system:<pw>
      - traefik.http.routers.traefik.entrypoints=websecure
      - traefik.http.routers.traefik.tls=true
      - traefik.http.routers.traefik.tls.certresolver=myresolver
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /var/traefik/letsencrypt:/letsencrypt

  certdumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    container_name: traefik_certdump
    restart: unless-stopped
    volumes:
      - /var/traefik/letsencrypt:/traefik:ro
      - /var/traefik/certdump:/output:rw
    labels:
      - traefik.enable=false

networks:
  proxy:
    external: true

Stalwart (make sure to put the 2 digit port in " as without them it won't be accessable)

version: '3'

services:
  mailserver:
    image: stalwartlabs/mail-server:v0.10.5
    container_name: mailserver
    restart: unless-stopped
    ports:
      - "25:25" # SMTP Default
      - 465:465 # SMTP TLS
      - 587:587 # SMTP STARTLS
      - 143:143 # IMAP
      - 993:993 # IMAP TLS
    volumes:
      - /var/mailserver/stalwart:/opt/stalwart-mail
      - /var/mailserver/blobs:/var/lib/data/blobs
      - /var/traefik/certdump/<domain or subdomain>:/opt/stalwart-mail/certs:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - /var/mailserver/export:/opt/stalwart-mail/export
    labels:
      - traefik.enable=true
      - traefik.docker.network=proxy
      - traefik.http.routers.mailserver.tls=true
      - traefik.http.routers.mailserver.tls.certresolver=myresolver
      - traefik.http.routers.mailserver.entrypoints=websecure
      - traefik.http.routers.mailserver.rule=Host(`<domain or subdomain>`)
      - traefik.http.services.mailserver.loadbalancer.server.port=8080
    networks:
      - proxy
      - intern
    depends_on:
      - mailserver-db

  mailserver-db:
    image: postgres:16
    container_name: mailserver_database
    restart: unless-stopped
    labels:
      - traefik.enable=false
    environment:
      - POSTGRES_USER=mailserver
      - POSTGRES_PASSWORD=<pw>
      - POSTGRES_DB=stalwart
    volumes:
      - /var/mailserver/db:/var/lib/postgresql/data
    networks:
      - intern

networks:
  proxy:
    external: true
  intern:

add following to your config.toml

certificate.default.cert = "%{file:/opt/stalwart-mail/certs/cert.pem}%"
certificate.default.default = true
certificate.default.private-key = "%{file:/opt/stalwart-mail/certs/key.pem}%"

If something still doesn't work, don't hesitate to contact me, if I know what the problem might be, I will help you.

[tvx-matt]

This was tried on numerous occasions, unsure whether or not sending or receiving emails actually worked, because we were unable to connect to ANY email client.

Setup is Docker >Treafik > Stalwart.

Can you provide a way for me to reach out to you to resolve, thanks

[JK-Effects]

You could try to test the server config via https://internet.nl/test-mail.
Maybe the problem is at the dns config.

You can contact me via the mail-address in my profile.