Mailcow with Nginx reverse proxy

Mailcow with Nginx reverse proxy (updated)

2025-04-19

Using other web services with Mailcow

This is roughly what I did to have an Nginx web server on the same machine as dockerized +Mailcow

Note: mail.xxxxx.com is your mail server (MX), yourdomain.com is whatever domain you wish to use.

Change the default http and https ports (for example 8480 and 8443)
+and set SKIP_LETS_ENCRYPT=y in /opt/mailcow-dockerized/mailcow.conf
Restart Mailcow by executing
+cd /opt/mailcow-dockerized;docker compose restart
Make sure the DNS entry mail.xxxxx.com points to the server
mkdir -p /var/www/html/letsencrypt/.well-known/acme-challenge

Create /etc/nginx/letsencrypt_path. This can be re-used in your other domains. +

# url for letsencrypt
+location ^~ /.well-known/acme-challenge/ {
+  allow all;
+  default_type "text/plain";
+  # Path can be used for cert-validation on all domains
+  root /var/www/html/letsencrypt;
+  break;
+}
+

Stop the nginx server systemctl stop nginx
Run certbot certonly -d mail.xxxxx.com (select 2 standalone)
Create /etc/nginx/sites-available/mail.xxxxx.com

server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  http2 on;
+
+  server_name mail.xxxxx.com;
+
+  charset UTF-8;  
+  access_log /var/log/nginx/access.mail.xxxxx.com;  
+  error_log /var/log/nginx/error.mail.xxxxx.com;  
+  include snippets/error_pages.conf;
+  ssl_certificate /etc/letsencrypt/live/mail.xxxxx.com/fullchain.pem; 
+  ssl_certificate_key /etc/letsencrypt/live/mail.xxxxx.com/privkey.pem; 
+  include /etc/letsencrypt/options-ssl-nginx.conf;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams-2048.pem;  
+
+  include /etc/nginx/letsencrypt_path;
+
+  location / {
+    proxy_pass      http://127.0.0.1:8480;
+    proxy_buffering off;
+    include /etc/nginx/proxy_params;
+    
+  }
+
+}
+
+server {
+
+    listen 80;
+    listen [::]:80;
+    server_name mail.xxxxx.com;
+    return 301 https://mail.xxxxx.com;
+}
+

ln -s /etc/nginx/sites-available/mail.xxxxx.com
/etc/nginx/sites-enabled/mail.xxxxx.com
Test with nginx -t, if all is well run sudo systemctl start nginx
Pointing your browser to https://mail.xxxxx.com should show you the Mailcow login page.

Problem

The problem is that Mailcow can no longer use port 80 to update it's ssl certificates that +are used by postfix and dovecot. Instead certbot puts them in /etc/letsencrypt/live. +To fix this the following script runs from crontab daily.

#!/usr/bin/env bash
+
+# we are running behind an nginx proxy, where certbot is run  by systemd,
+# so the mail.xxxxx.com certificates are updated, but not copied to the mailcow folder
+# in case the certificate isn't renewed automatically, run this:
+# sudo certbot -n certonly --webroot -w /var/www/html/letsencrypt -d mail.xxxxx.com
+
+t1="/etc/letsencrypt/live/mail.xxxxx.com/fullchain.pem"
+t2="/opt/mailcow-dockerized/data/assets/ssl/mail.xxxxx.com/cert.pem" 
+
+# test if certificate has been updated
+differ=$(cmp -b $t1 $t2 | grep -c "differ")
+
+[[ "$differ" = "0" ]] && exit 0
+
+# these files are required in /data/assets/ssh/mail.xxxxx.com
+cp /etc/letsencrypt/live/mail.xxxxx.com/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/mail.xxxxx.com/cert.pem
+cp /etc/letsencrypt/live/mail.xxxxx.com/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/mail.xxxxx.com/key.pem
+
+# these files are required in /data/assets/ssl/ (turns out sending failed otherwise)
+cp /etc/letsencrypt/live/mail.xxxxx.com/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem
+cp /etc/letsencrypt/live/mail.xxxxx.com/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem
+
+# update postfix & docker
+docker exec $(/usr/bin/docker ps -qaf name=postfix-mailcow) postfix reload
+docker exec $(/usr/bin/docker ps -qaf name=dovecot-mailcow) dovecot reload
+

Inspiration: Felix Moesbauer

Don't forget to check and correct if necessary your DANE and MTA-STS records if you use them

DANE

On your mail server:

apt install hash-slinger -y

Create a TLSA record:

tlsa --create --selector 1 -p 25 --certificate /etc/letsencrypt/live/mail.xxxxx.com/fullchain.pem mail.xxxxx.com
+

The last line or the result will be something like:

_25._tcp.mail.xxxxx.com. IN TLSA 3 1 1 443ac7c5c70fbfbc...

Enter this TLSA line in your mail server's DNS record.

Do the same for the following ports:

_110._tcp.mail.xxxxx.com
+_143._tcp.mail.xxxxx.com
+_465._tcp.mail.xxxxx.com
+_587._tcp.mail.xxxxx.com
+_993._tcp.mail.xxxxx.com
+_995._tcp.mail.xxxxx.com
+

You can check your DANE records at huque.com

dane success

MTA-STS

This is a fallback to DANE, you can run both.

Note: https access to mta-sts.yourdomain.com is obligatory

Create /var/www/html/mta-sts/.well-known/mta-sts.txt with the following content:
+
```
version: STSv1
+mode: enforce
+max_age: 172800
+mx: mail.xxxxx.com
+
```
+
Create the DNS record _mta-sts.mail.xxxxx.com as TXT with "v=STSv1; id=INSERT AN ID, EX. 202511101644"
Create the DNS record _mta-sts.yourdomain.com as CNAME pointing to _mta-sts.mail.xxxxx.com (your mail server)
Create the DNS record mta-sts.yourdomain.com pointing to the ip of the web server
You may need to wait for the DNS records to propagate
Stop Nginx with systemctl stop nginx
Create a letsencrypt certificate with certbot certonly -d mta-sts.yourdomain.com (select 2 standalone)
Create mta-sts.yourdomain.com in Nginx:

/etc/sites-available/mta-sts.yourdomain.com
+

server {
+   listen 443 ssl;
+   listen [::]:443 ssl;
+   http2 on;
+
+   charset UTF-8;  
+   access_log /var/log/nginx/access.mts-sta.yourdomain.com;  
+   error_log /var/log/nginx/error.mts-sta.yourdomain.com;  
+   include snippets/error_pages.conf;     
+   ssl_certificate /etc/letsencrypt/live/mta-sts.yourdomain.com/fullchain.pem;
+   ssl_certificate_key /etc/letsencrypt/live/mta-sts.yourdomain.com/privkey.pem;
+   include /etc/letsencrypt/options-ssl-nginx.conf;
+   ssl_dhparam /etc/letsencrypt/ssl-dhparams-2048.pem;
+
+   include /etc/nginx/letsencrypt_path;
+  
+   root /var/www/html/mta-sts;
+   index index.html index.htm;
+
+   server_name mta-sts.yourdomain.com;
+
+   location / {
+      try_files $uri $uri/ =404;
+   }
+}
+server {
+    listen 80;
+    listen [::]:80;
+    server_name mta-sts.yourdomain.com;
+    return 301 https://mta-sts.yourdomain.com;
+}
+

ln -s /etc/nginx/sites-available/mta-sts.yourdomain.com
/etc/nginx/sites-enabled/mta-sts.yourdomain.com
Test with nginx -t and if all goes well start nginx systemctl start nginx

You can check your domain's MTA-STS at mxtoolbox.com

All this worked for me :-) I hope it does for you!

+ +