Traefik and Stalwart TCP entrypoint issue.

[cb3inco]

Hi all,
I'm having some problems with Traefik and Stalwart. I've followed the documentation here and here. I'm using a dual stack network - IPv4 and IPv6. My folder structure is as follows:

/srv/docker/
---traefik/
-------docker-compose.yml
--------/data/acme.json
--------/dumped-certs/
--------/logs
---stalwart/
--------docker-compose.yml
---------/data

I have two bridge networks traefik and stalwart.

My traefik docker-compose is as follows:

services:
  traefik:
    image: traefik
    security_opt:
      - no-new-privileges:true
    container_name: traefik
    command:
      - "--experimental.plugins.traefik-real-ip.modulename=github.com/soulbalz/traefik-real-ip"
      - "--experimental.plugins.traefik-real-ip.version=v1.0.3"

      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.http.address=:80"
      - "--entryPoints.http.forwardedHeaders.insecure"
      - "--entryPoints.http.proxyProtocol.insecure"
      - "--entryPoints.https.address=:443"
      - "--entrypoints.https.forwardedHeaders.insecure"
      - "--entryPoints.https.proxyProtocol.insecure"
      - "--entrypoints.http.http.redirections.entryPoint.to=https"
      - "--entrypoints.http.http.redirections.entryPoint.scheme=https"
#     Stalwart entryPoints
#     SMTP
      - "--entrypoints.smtp.address=:25"
      - "--entrypoints.smtp.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#     SMTPS
      - "--entrypoints.smtps.address=:465"
      - "--entrypoints.smtps.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#     IMAPS
      - "--entrypoints.imaps.address=:993"
      - "--entrypoints.imaps.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#
# For now we will use a http challenge
      - "--certificatesresolvers.letls.acme.httpchallenge.entrypoint=http"
      - "--certificatesResolvers.letls.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory" # LetsEncrypt Staging Server - uncomment when testing
      - "[email protected]"
      - "--accessLog=true"
      - "--accesslog.filePath=/traefik_access.log"
      - "--accesslog.bufferingsize=100"
      - "--log.filePath=/traefik.log"
      - "--log.level=WARN"
      - "--api=true"
      - "--api.dashboard=true"
      - "--serverstransport.insecureskipverify=true"
    ports:
      - "80:80"
      - "443:443"
      # Mailserver
      - "25:25" # SMTP
      - "465:465" # ESMTP submission, implicit TLS
      - "993:993" # IMAP4 secure, implicit TLS
 #     - "4190:4190" # Sieve 
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./logs/traefik.log:/traefik.log"
      - "./logs/traefik_access.log:/traefik_access.log"
      - "./data/acme.json:/acme.json"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.entrypoints=https"
      - "traefik.http.routers.dashboard.tls.certresolver=letls"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:password."
    restart: unless-stopped
    networks:
      - traefik
  traefik-certs-dumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    container_name: traefik-cert-dumper
    restart: unless-stopped
    depends_on:
      - traefik
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
      - "./data:/traefik:ro"
      - "./dumped-certs:/output"
    networks:
      - traefik
networks:
  traefik:
    external: true

Stalwart docker-compose.yml

services:
  mailserver:
    image: stalwartlabs/mail-server:latest
    container_name: stalwart-mailserver
    restart: unless-stopped
    hostname: mail.domain.com
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./data:/opt/stalwart-mail
      - /srv/docker/traefik/dumped-certs:/data/certs:ro
    labels:
      - traefik.enable=true
#      - traefik.docker.network=stalwart
      - traefik.http.routers.mailserver.rule=Host(`mail.domain.com`)
      - traefik.http.routers.mailserver.entrypoints=https
      - traefik.http.routers.mailserver.service=mailserver
      - traefik.http.services.mailserver.loadbalancer.server.port=8080

      - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtp.entrypoints=smtp
      - traefik.tcp.routers.smtp.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=25
      - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.jmap.rule=HostSNI(`*`)
      - traefik.tcp.routers.jmap.tls.passthrough=true
      - traefik.tcp.routers.jmap.entrypoints=https
      - traefik.tcp.routers.jmap.service=jmap
      - traefik.tcp.services.jmap.loadbalancer.server.port=443
      - traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.smtps.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtps.tls.passthrough=true
      - traefik.tcp.routers.smtps.entrypoints=smtps
      - traefik.tcp.routers.smtps.service=smtps
      - traefik.tcp.services.smtps.loadbalancer.server.port=465
      - traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.imaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.imaps.tls.passthrough=true
      - traefik.tcp.routers.imaps.entrypoints=imaps
      - traefik.tcp.routers.imaps.service=imaps
      - traefik.tcp.services.imaps.loadbalancer.server.port=993
      - traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version=2
    networks:
      stalwart:
      traefik:
        ipv4_address: 172.18.0.3
        ipv6_address: fd1a:c450:23fd:1::3
networks:
  traefik:
    name: traefik
    external: true
  stalwart:
    name: stalwart
    external: true

and the stalwart config.yml

authentication.fallback-admin.secret = "$SECRET"
authentication.fallback-admin.user = "admin"
certificate.traefik.cert = "%{file:/srv/docker/traefik/dumped-certs/mail.domain.com/cert.pem}%"
certificate.traefik.default = true
certificate.traefik.private-key = "%{file://srv/docker/traefik/dumped-certs/mail.domain.com/key.pem}%"
directory.internal.store = "rocksdb"
directory.internal.type = "internal"
lookup.default.hostname = "mail.domain.com"
server.http.hsts = true
server.http.permissive-cors = false
server.http.url = "protocol + '://' + key_get('default', 'hostname') + ':' + local_port"
server.http.use-x-forwarded = true
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.proxy.override = true
server.listener.imaptls.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.imaptls.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.imaptls.tls.implicit = true
server.listener.pop3.bind = "[::]:110"
server.listener.pop3.protocol = "pop3"
server.listener.pop3s.bind = "[::]:995"
server.listener.pop3s.protocol = "pop3"
server.listener.pop3s.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.proxy.override = true
server.listener.smtp.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.smtp.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.proxy.override = true
server.listener.submission.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.submission.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.proxy.override = true
server.listener.submissions.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.submissions.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.submissions.socket.override = false
server.listener.submissions.tls.implicit = true
server.listener.submissions.tls.override = false
storage.blob = "rocksdb"
storage.data = "rocksdb"
storage.directory = "internal"
storage.fts = "rocksdb"
storage.lookup = "rocksdb"
store.rocksdb.compression = "lz4"
store.rocksdb.path = "/opt/stalwart-mail/data"
store.rocksdb.type = "rocksdb"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "info"
tracer.log.path = "/opt/stalwart-mail/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"

I'm also running Joplin Server and Vikunja Server. They both live in their own directories as well. What I'm noticing is that when I start Stalwart up and look at the Traefik dashboard, the entrypoints for TCP are all pointing to the Joplin server.

I've not done things with TCP entrypoints before, so it's a bit peculiar that they are all being placed in the HTTP Routers and further under the Joplin server. It would seem to me that they should be under the stalwart router. Even if I shut down Joplin, it doesn't change anything.

I feel like I'm missing something here. Any help would be appreciated.

[mdecimus]

This is more a Traefik than a Stalwart question. Unfortunately I don't have experience with Traefik (the documentation was contributed by a user) so if you don't receive any useful responses you might try asking in the Traefik repository.

[cb3inco]

Thanks. I figured out the entrypoint issue. I never defined the appropriate https entrypoint on the Joplin compose, so, that issue was resolved.

I never seemed to get the tcp entrypoints working (aka never could get external telnet to smtp 25 port). After digging into Stalwart, it's way beyond what I need or want to manage. Wanting a simple email 'transaction' type system and there would be a lot to setup and maintain for a few emails I'll send.

If I have a need down the road, I'll for sure consider Stalwart.