I ran postfix, dovecot apache etc on my server for a long time. This was working excellent. But I always worried about my settings, security, stability etc. I never had an issue, but ... What if .. That is the reason I switched to Mailcow. I read about it on another forum and just gave it a try. I used docker for some time with other services like Home assistant, Pi-Hole, AdGuard, zwavejs2mqtt, etc. So nothing to fear ;-) Now I run Mailcow Dockerised for some time now. It is really stable and always excellent! Thank you guys developers! Mailcow parts are really working well together. I trust your knowledge in this! Besides this Mailcow server, running on a VPS, I have another VPS. Running Apache, Wordpress and a [Vaultwaren](https://github.com/dani-garcia/vaultwarden) docker container. Which is a Bitwarden server clone, written in Rust. I decided to end my apache2 services and try to move this Vaultwaren docker to the Mailcow VPS. To reduce costs. Starting this Vaultwarden container on its own port, like 9056, is going well. Even if I open this port to the internet, I could never reach the Vaultwarden page. Is it possible to add this Vaultwarden docker aside Mailcow? Should I create a reverse proxy? Inside one of the the mailcow docker containers? Should I place apache in front of Mailcow, direct on the VPS, and reverse proxy Mailcow and Vaultwarden? Has anyone done this before? How do I do this, to run both 'services' on the same VPS? Please advise?!

Mailcow and other docker service on the same server

BartraB

I ran postfix, dovecot apache etc on my server for a long time. This was working excellent. But I always worried about my settings, security, stability etc. I never had an issue, but … What if ..
That is the reason I switched to Mailcow. I read about it on another forum and just gave it a try. I used docker for some time with other services like Home assistant, Pi-Hole, AdGuard, zwavejs2mqtt, etc. So nothing to fear ;-)

Now I run Mailcow Dockerised for some time now. It is really stable and always excellent! Thank you guys developers! Mailcow parts are really working well together. I trust your knowledge in this!

Besides this Mailcow server, running on a VPS, I have another VPS. Running Apache, Wordpress and a Vaultwaren docker container. Which is a Bitwarden server clone, written in Rust.

I decided to end my apache2 services and try to move this Vaultwaren docker to the Mailcow VPS. To reduce costs.
Starting this Vaultwarden container on its own port, like 9056, is going well. Even if I open this port to the internet, I could never reach the Vaultwarden page. Is it possible to add this Vaultwarden docker aside Mailcow? Should I create a reverse proxy? Inside one of the the mailcow docker containers? Should I place apache in front of Mailcow, direct on the VPS, and reverse proxy Mailcow and Vaultwarden?
Has anyone done this before? How do I do this, to run both ‘services’ on the same VPS?
Please advise?!

dahe22

Since you want to access both websites without providing a port, in contrast to doing 1.2.3.4:8080 for mailcow-ui and 1.2.3.4:8081 for Vaultwarden, a reverse proxy probably is the best solution.

I am hosting different Websites on the same VPS by using Traefik as reverse proxy. With this setup only Traefik exposes 80/443 and has direct access to the web ports of the containers. Personally the best thing about Traefik is the creation of certificates via labels in docker-compose.
Of course you also could use NGINX, Caddy, etc.

But it can be a pain to make mailcow use the eg. Traefik certificates. When Mailcow is not reachable on Port 80 you cannot issue certs through HTTP-01.
You may need to use SANs for the mailcow-container (to get different domains in a single certificate) and traefik-certs-dumper when disabling mailcow-acme.

TBH: If I’d had the option to split them to separate VPSs, in hindsight i would have done it 😆

BartraB

Accessing Mailcow via port 80 and Vaultwarden-docker on port 9056 would be okay. But when I start it this way I still can not access Vaultwarden. Should it?
So I thought that I would need a reverse proxy.

dahe22

If you are using Docker and expose the Port 9056 and the firewall is configured properly, there should be no problem connecting. Just be sure to use SSL for transmitting passwords.

That pretty much is the same as with Port 25 of mailcow, letting your Postfix receive Mails from outside.

BartraB

I realised that If I would manage to setup Vaultwarden on the same VPS as Mailcow dockerised, I have to create an apache setup to reverse proxy. This because of the ssl certificates.
I like the way these are managed by Mailcow right now. So I found a better solution for my Vaultwarden docker. I placed it on my home server. So this question is not relevant any more.

Ganzjahresgriller

Perhaps is Traefik a Solution for you

aegide

I can highly recommend lucaslorentz/caddy-docker-proxy:ci-alpine .

You run this on your server alongside any other docker services and share the caddy created network within any container that needs to be externally available. Then just add labels for caddy in those containers that will have caddy auto-register them, create certs where needed (and renew them) and proxy any requests to the container.

A simple example might look like this:

caddy-proxy:

version: "3.7"
services:
  caddy:
    image: lucaslorentz/caddy-docker-proxy:ci-alpine
    ports:
      - 80:80
      - 443:443
    environment:
      - CADDY_INGRESS_NETWORKS=caddy
    networks:
      - caddy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - caddy_data:/data
    restart: unless-stopped
networks:
  caddy:
    external: true

volumes:
  caddy_data: {}

Then just add labels to any exposable containers (here n8n for simplicity):

  n8n:
    image: n8nio/n8n:latest-debian
    restart: always
    environment:
      - ...
    ports:
      - 5678:5678
    networks:
      caddy:
      n8n:
    labels:
      caddy: service.server.tld
      caddy.reverse_proxy: "{{upstreams 5678}}"

Caddy-proxy will do the rest for you. Make sure the upstreams directive takes the containers port, not the port you’ve exposed locally via the ports directive (you may even leave out the ports directive completely if you don’t need the localhost port).

Traefik or caddy-proxy? I guess it’s a matter of preference. For me, it’s caddy since I also use more complex configurations that traefik doesn’t handle as well. YMMV.

Hope this is helpful.

tdings

May I suggest to read some information about HaProxy ? I am using this service for many years, besides a few Nginx reverse services, but HaProxy is rock solid and there are many solutions related to your “problem”.

Probably you solved your issue already but in case you need some help … Please let me know and I am more than willing to help you.

Enjoy your weekend!