Verifying Stalwart with Traefik template

[shoutmarble]

Traefik Dashboard on port 9090
https://dashboard.example.com:9090/

Stalwart Email Server admin interface
https://mail.example.com/

---

Verify Stalwart Email Server
https://www.mail-tester.com/
https://internet.nl/

---

Use Lego ACME DNS-01 to validate and save PEM, KEY, and CRT certificates locally on your VPS

# STEP 1: 
# Generate local ACME certificates on VPS
# ./lego -a --pem --email "xxxxxxxxx@gmail.com" --domains "example.com" --domains "*.example.com" --dns manual run

# STEP 2:
# OPEN URL https://toolbox.googleapps.com/apps/dig/#TXT/
# and enter
# _acme-challenge.example.com.
#
# verify TXT value matches what was entered in the DNS from LEGO "sOQf--------UnKbcE"

# STEP 3:
# COPY the "certifcates" folder  from the ".lego" directory to a new "certs" directory
# cp -fr .lego/certificates/ certs

# ├── certs
# │   ├── example.com.crt
# │   ├── example.com.issuer.crt
# │   ├── example.com.json
# │   ├── example.com.key
# │   └── example.com.pem

#### NOTE: Not shown is the manual process of entering the TXT records from the LEGO challenge response into the VPS DNS records

---

Create Docker Network

network.sh

docker network create --driver bridge --subnet=172.19.0.0/16 traefik

---

traefik.yml

networks:
    traefik:
        external: true

services:
    traefik:
        image: traefik:v3.5
        ports:
            - "80:80"
            - "443:443" # PASSTHROUGH, PROXY PROTOCOL
            # TRAEFIK DASHBOARD
            - "9090:9090"
            # STALWART
            - "25:25"   # SMTP, PROXY PROTOCOL
            - "465:465" # SMTPS SUBMISSION, PASSTHROUGH, PROXY PROTOCOL
            - "993:993" # IMAPTLS, PASSTHROUGH, PROXY PROTOCOL
        networks:
            traefik:
                ipv4_address: 172.19.0.2
        volumes:
            - "/var/run/docker.sock:/var/run/docker.sock"
            - "./certs:/certs"
            - "./dynamic_traefik.yml:/dynamic_traefik.yml"
        command:
            - "--api=true"
            - "--api.dashboard=true"
            - "--api.insecure=false"

            - "--providers.docker.network=traefik"
            - "--providers.docker.exposedByDefault=false"
            - "--providers.file.filename=/dynamic_traefik.yml"

            - "--log.level=DEBUG"
            - "--accesslog=true"


            # Entrypoints for TCP services
            - "--entrypoints.dashboard.address=:9090"
            - "--entrypoints.web.address=:80"
            - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
            - "--entrypoints.web.http.redirections.entryPoint.scheme=https"

            - "--entrypoints.websecure.address=:443"

            - "--entrypoints.smtp.address=:25"
            - "--entrypoints.smtps.address=:465"
            - "--entrypoints.imaps.address=:993"
        labels:
            - "traefik.enable=true"
            - "traefik.http.routers.dashboard.rule=Host(`dashboard.example.com`)"
            - "traefik.http.routers.dashboard.entrypoints=dashboard"
            - "traefik.http.routers.dashboard.service=api@internal"
            - "traefik.http.routers.dashboard.middlewares=myauth"
            - "traefik.http.routers.dashboard.tls=true"
            - "traefik.http.middlewares.myauth.basicauth.users=test:$$apr1$$K-----------------"

---

dynamic_traefik.yml

tls:
  certificates:
    - certFile: /certs/example.com.pem
      keyFile: /certs/example.com.key
      stores:
        - default

global:
  checkNewVersion: true
  sendAnonymousUsage: false  # true by default

---

stalwart.yml

volumes:
    data:

networks:
    traefik:
        external: true

services:
    mailserver:
        image: stalwartlabs/stalwart:latest
        container_name: mailserver
        # hostname: mail.example.comexample.com
        hostname: mail # subdomain
        domainname: example.com  # FQDN mail.example.com
        restart: unless-stopped
        ports:
            - "587:587"
            - "143:143"
            - "4190:4190"
            - "110:110"
            - "995:995"
        networks:
            traefik:
                ipv4_address: 172.19.0.5
        volumes:
            - /etc/localtime:/etc/localtime:ro
            - data:/opt/stalwart
            - ./certs:/data/certs:ro
        labels:
            - traefik.enable=true

            # HTTP router for webmail/admin
            - traefik.http.routers.mailserver.rule=Host(`mail.example.com`) || Host(`autodiscover.example.com`) || Host(`autoconfig.example.com`) || Host(`mta-sts.example.com`)
            - traefik.http.routers.mailserver.entrypoints=websecure
            - traefik.http.routers.mailserver.service=mailserver
            - traefik.http.services.mailserver.loadbalancer.server.port=8080

            # JMAP
            - traefik.tcp.routers.jmap.rule=HostSNI(`*`)
            - traefik.tcp.routers.jmap.tls.passthrough=true
            - traefik.tcp.routers.jmap.entrypoints=websecure
            - traefik.tcp.routers.jmap.service=jmap
            - traefik.tcp.services.jmap.loadbalancer.server.port=443
            - traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version=2


            # SMTP (STARTTLS)
            - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
            - traefik.tcp.routers.smtp.entrypoints=smtp
            - traefik.tcp.routers.smtp.service=smtp
            - traefik.tcp.services.smtp.loadbalancer.server.port=25
            - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=2

            # SMTPS (Implicit TLS)
            - traefik.tcp.routers.smtps.rule=HostSNI(`*`)
            - traefik.tcp.routers.smtps.tls.passthrough=true
            - traefik.tcp.routers.smtps.entrypoints=smtps
            - traefik.tcp.routers.smtps.service=smtps
            - traefik.tcp.services.smtps.loadbalancer.server.port=465
            - traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version=2

            # IMAPS (Implicit TLS)
            - traefik.tcp.routers.imaps.rule=HostSNI(`*`)
            - traefik.tcp.routers.imaps.tls.passthrough=true
            - traefik.tcp.routers.imaps.entrypoints=imaps
            - traefik.tcp.routers.imaps.service=imaps
            - traefik.tcp.services.imaps.loadbalancer.server.port=993
            - traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version=2

---

config.toml

docker exec -it mailserver /bin/bash

 UPDATED  /opt/stalwart/etc/config.toml                                                                 ORIGINAL  /opt/stalwart/etc/config.toml

+-------------------------------------------------------------------------------------------------+    +------------------------------------------------------------------------+
|                                                                                                 |    |  authentication.fallback|admin.secret = "$6$7rSf+----------------+xZ"  |
|  certificate.default.cert = "%{file:/data/certs/example.com.pem}%"          <------+            |    |  authentication.fallback-admin.user = "admin"                          |
|  certificate.default.default = true                                            <------|         |    |  directory.internal.store = "rocksdb"                                  |
|  certificate.default.private-key = "%{file:/data/certs/example.com.key}%"   <------+            |    |  directory.internal.type = "internal"                                  |
|                                                                                                 |    |  server.hostname = "mail.example.com"                               |
|  authentication.fallback-admin.secret = "$6$7rS+----------------------"                         |    |  server.listener.http.bind = "[::]:8080"                               |
|  authentication.fallback-admin.user = "admin"                                                   |    |  server.listener.http.protocol = "http"                                |
|  directory.internal.store = "rocksdb"                                                           |    |  server.listener.https.bind = "[::]:443"                               |
|  directory.internal.type = "internal"                                                           |    |  server.listener.https.protocol = "http"                               |
|  server.hostname = "mail.example.com"                                                        |    |  server.listener.https.tls.implicit = true                             |
|  server.listener.http.bind = "[::]:8080"                                                        |    |  server.listener.imap.bind = "[::]:143"                                |
|  server.listener.http.protocol = "http"                                                         |    |  server.listener.imap.protocol = "imap"                                |
|  server.listener.https.bind = "[::]:443"                                                        |    |  server.listener.imaptls.bind = "[::]:993"                             |
|  server.listener.https.protocol = "http"                                                        |    |  server.listener.imaptls.protocol = "imap"                             |
|  server.listener.https.tls.implicit = true                                                      |    |  server.listener.imaptls.tls.implicit = true                           |
|  server.listener.imap.bind = "[::]:143"                                                         |    |  server.listener.pop3.bind = "[::]:110"                                |
|  server.listener.imap.protocol = "imap"                                                         |    |  server.listener.pop3.protocol = "pop3"                                |
|  server.listener.imaptls.bind = "[::]:993"                                                      |    |  server.listener.pop3s.bind = "[::]:995"                               |
|  server.listener.imaptls.protocol = "imap"                                                      |    |  server.listener.pop3s.protocol = "pop3"                               |
|  server.listener.imaptls.tls.implicit = true                                                    |    |  server.listener.pop3s.tls.implicit = true                             |
|  server.listener.imaptls.proxy.override = true                        <------+                  |    |  server.listener.sieve.bind = "[::]:4190"                              |
|  server.listener.imaptls.proxy.trusted-networks.0 = "172.19.0.2"      <------|                  |    |  server.listener.sieve.protocol = "managesieve"                        |
|  server.listener.imaptls.proxy.trusted-networks.1 = "172.19.0.0/16"   <------+                  |    |  server.listener.smtp.bind = "[::]:25"                                 |
|  server.listener.pop3.bind = "[::]:110"                                                         |    |  server.listener.smtp.protocol = "smtp"                                |
|  server.listener.pop3.protocol = "pop3"                                                         |    |  server.listener.submission.bind = "[::]:587"                          |
|  server.listener.pop3s.bind = "[::]:995"                                                        |    |  server.listener.submission.protocol = "smtp"                          |
|  server.listener.pop3s.protocol = "pop3"                                                        |    |  server.listener.submissions.bind = "[::]:465"                         |
|  server.listener.pop3s.tls.implicit = true                                                      |    |  server.listener.submissions.protocol = "smtp"                         |
|  server.listener.sieve.bind = "[::]:4190"                                                       |    |  server.listener.submissions.tls.implicit = true                       |
|  server.listener.sieve.protocol = "managesieve"                                                 |    |  server.max-connections = 8192                                         |
|  server.listener.smtp.bind = "[::]:25"                                                          |    |  server.proxy.trusted-networks = "172.19.0.2"                          |
|  server.listener.smtp.protocol = "smtp"                                                         |    |  server.socket.backlog = 1024                                          |
|  server.listener.smtp.proxy.override = true                            <------+                 |    |  server.socket.nodelay = true                                          |
|  server.listener.smtp.proxy.trusted-networks.0 = "172.19.0.2"          <------|                 |    |  server.socket.reuse-addr = true                                       |
|  server.listener.smtp.proxy.trusted-networks.1 = "172.19.0.0/16"       <------+                 |    |  server.socket.reuse-port = true                                       |
|  server.listener.submission.bind = "[::]:587"                                                   |    |  storage.blob = "rocksdb"                                              |
|  server.listener.submission.protocol = "smtp"                                                   |    |  storage.data = "rocksdb"                                              |
|  server.listener.submissions.bind = "[::]:465"                                                  |    |  storage.directory = "internal"                                        |
|  server.listener.submissions.protocol = "smtp"                                                  |    |  storage.fts = "rocksdb"                                               |
|  server.listener.submissions.tls.implicit = true                                                |    |  storage.lookup = "rocksdb"                                            |
|  server.listener.submissions.proxy.override = true                       <------+               |    |  store.rocksdb.compression = "lz4"                                     |
|  server.listener.submissions.proxy.trusted-networks.0 = "172.19.0.2"     <------|               |    |  store.rocksdb.path = "/opt/stalwart/data"                             |
|  server.listener.submissions.proxy.trusted-networks.1 = "172.19.0.0/16"  <------+               |    |  store.rocksdb.type = "rocksdb"                                        |
|  server.max-connections = 8192                                                                  |    |  tracer.log.ansi = false                                               |
|  server.proxy.trusted-networks = "172.19.0.2"                                                   |    |  tracer.log.enable = true                                              |
|  server.socket.backlog = 1024                                                                   |    |  tracer.log.level = "info"                                             |
|  server.socket.nodelay = true                                                                   |    |  tracer.log.path = "/opt/stalwart/logs"                                |
|  server.socket.reuse-addr = true                                                                |    |  tracer.log.prefix = "stalwart.log"                                    |
|  server.socket.reuse-port = true                                                                |    |  tracer.log.rotate = "daily"                                           |
|  storage.blob = "rocksdb"                                                                       |    |  tracer.log.type = "log"                                               |
|  storage.data = "rocksdb"                                                                       |    |                                                                        |
|  storage.directory = "internal"                                                                 |    +------------------------------------------------------------------------+
|  storage.fts = "rocksdb"                                                                        |
|  storage.lookup = "rocksdb"                                                                     |
|  store.rocksdb.compression = "lz4"                                                              |
|  store.rocksdb.path = "/opt/stalwart/data"                                                      |
|  store.rocksdb.type = "rocksdb"                                                                 |
|  tracer.log.ansi = false                                                                        |
|  tracer.log.enable = true                                                                       |
|  tracer.log.level = "info"                                                                      |
|  tracer.log.path = "/opt/stalwart/logs"                                                         |
|  tracer.log.prefix = "stalwart.log"                                                             |
|  tracer.log.rotate = "daily"                                                                    |
|  tracer.log.type = "log"                                                                        |
|                                                                                                 |
+-------------------------------------------------------------------------------------------------+

---

Verify local PEM and KEY files are stored in stalwart.yml Docker volume

docker exec -it mailserver /bin/bash

root@mail:/data/certs# tree /data/certs/
/data/certs/
|-- example.com.crt
|-- example.com.issuer.crt
|-- example.com.json
|-- example.com.key
`-- example.com.pem

1 directory, 5 files
root@mail:/data/certs #
 

root@mail:/opt/stalwart# tree /opt/stalwart/etc/
/opt/stalwart/etc/
`-- config.toml

1 directory, 1 file

---

VERIFY ALL PORTS WORK

SMTP 25
openssl s_client -quiet -crlf -starttls smtp -connect mail.example.com:25

SMTP 587
openssl s_client -starttls smtp -quiet -crlf -connect mail.example.com:587

SMTP 465
openssl s_client -quiet -crlf -connect mail.example.com:465

IMAP 143
openssl s_client -crlf -connect mail.example.com:143 -starttls imap -servername mail.example.com

IMAP 993
openssl s_client -quiet -crlf -connect mail.example.com:993

SIEVE 4190
openssl s_client -starttls sieve -showcerts -servername mail.example.com -connect mail.example.com:4190

JMAP 443
curl -L -v -u admin:'password' https://mail.example.com/.well-known/jmap