Instructions on how to use TLS connection behind reverse proxy

[mispp]

Hi,

it currently is not mentioned in documentation (https://stalw.art/smtp/get-started/linux/) on how to use this behind reverse proxy like traefik. Traefik (and caddy) can be configured with automatic lets encrypt renewals so it is quite convenient.

Would it work fine or the smtp server really needs to have certificates loaded/managed by itself?

Thanks

[mdecimus]

Hi,

Automatic certificate renewals are on the roadmap but not yet implemented. In the time being you need to manually update them.

A reverse proxy could work but it will disable many of the authentication features such as SPF and DMARC which require the remote SMTP server address.

[UkeHa]

running this in a setup with caddy would be incredibly sweet. That way it would be easy to run in docker containers and have it setup in no time.

[rmsthebest]

SSL CERTS

Creating hardlinks from where you want stalwart to look to where caddy creates them should work. It's just crt and key files.
stalwart here refers to the user that needs read permissions

ln /var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.domain.se/mx1.domain.se.crt /etc/stalwart/certs/mail.domain.se.crt
ln /var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mail.domain.se/mail.domain.se.key /etc/stalwart/certs/mail.domain.se.key

sudo setfacl -m u:stalwart:r /var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mx1.domain.se/mx1.domain.se.crt /var/lib/caddy/certificates/acme-v02.api.letsencrypt.org-directory/mx1.domain.se/mx1.domain.se.key

[mispp]

Seems that even behind reverse proxy, there might be a way to pass source IP:

• https://community.traefik.io/t/tcp-proxy-and-original-source-ip/14458
• https://doc.traefik.io/traefik/routing/services/#proxy-protocol

[johndo100]

I run a stalwart server behind a HAProxy that I can set it to layer 4 mode. Caddy run behind HAProxy, other HTTP services behind Caddy. Caddy is layer 7 proxy so it need to handle SSL itself.

[mdecimus]

There are plans to implement the PROXY protocol, which I believe is supported by Caddy as well.

You can use Caddy without this feature anyway but Stalwart will treat the session as plain text.