Nginx Proxy Manager + mailcow

mf_bpd

Hi, guys,I have installed mailcow (/opt/mailcow-dockerized), it starts correctly.
Then I installed the Nginx Proxy Manager in a separate directory on the host (/opt/npm), it starts up, installs certificat. I set the Proxy Host (http://127.0.0.1:8080) to the scheme http. I type it in the Proxy Host Advanced section:
location / {
proxy_pass http://127.0.0.1:8080/;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
client_max_body_size 0;
proxy_buffer_size 128k;
proxy_buffers 64 512k;
proxy_busy_buffers_size 512k;
}
Then I make the following changes to mailcow.conf:

HTTP_PORT=8080
HTTP_BIND=127.0.0.1

HTTPS_PORT=8443
HTTPS_BIND=127.0.0.1

and

SKIP_LETS_ENCRYPT=y

At this point I can’t reach the mailcow home page. The error message is in the Nginx Proxy Manager log:
2024/02/14 00:05:55 [error] 313#313: *255 connect() failed (111: Connection refused) while connecting to upstream, client: 4.3.2.1, server: my.server.com, request: “GET / HTTP/2.0”, upstream: “http://127.0.0.1:18080/”, host: “my.server.com”

Please help

esackbauer

mf_bpd “http://127.0.0.1:18080/

Port 18080??

mf_bpd

Sorry, only a typo.
8080 is the correct.

esackbauer

Is NPM in the same docker network as mailcow?
Is port 8080 properly listening on your host and port open on any firewall?

mf_bpd

esackbauer
Thanks esackbauer

But why?

When I turn off NGINX Proxy Manager, I reset it to:
HTTP_PORT=80
HTTP_BIND=

HTTPS_PORT=443
HTTPS_BIND=

I then reach mailcow.
This is how it is described in the documentation. Nothing changes, I just put a reverse proxy in front of it.

P.S.
In the NGINX Proxy Manager docker-compose.yml it says so:

version: ‘3.8’
services:
nginx-proxy-manager:
image: ‘jc21/nginx-proxy-manager:latest’
restart: unless-stopped
ports:
- ‘80:80’
- ‘443:443’
volumes:
- ‘./data:/data’
- ‘./letsencrypt:/etc/letsencrypt’
networks:
default:
external: true
name: mailcowdockerized_mailcow-network

esackbauer

Connection should go through host interfaces, not docker interfaces. Please attach your NPM to a bridge network.

mf_bpd

Thank you esackbauer for your help.

The reason I don’t understand your answer is that when mailcow is running it seems to create a bridge network called “mailcowdockerized_mailcow-network” by default.

I wrote it that way in the NGINX Proxy Manager docker-compose.yml:

networks:
default:
external: true
name: mailcowdockerized_mailcow-network

Alternatively, in mailcow.conf, this is not the reason for the setting:
HTTP_PORT=8080
HTTP_BIND=127.0.0.1

HTTPS_PORT=8443
HTTPS_BIND=127.0.0.1
to pass through the host?
My understanding is that the connection then goes through the host and not the container. Am I wrong?

esackbauer

mf_bpd My understanding is that the connection then goes through the host and not the container.

And my understanding is that you never should use the mailcow-network for something else than mailcow 😉 It would make the encapsulation useless and can collide with the iptable rules inside.
Use the default docker bridge for NPM.

mf_bpd

esackbauer

OK, on the NGINX Proxy Manager netwok I went back to the default settings.

But something in mailcow is not right, because when I tried to connect via telnet ( telnet localhost 8080) the response was:

Trying ::1…
Connection failed: Connection refused
Trying 127.0.0.1…
Connected to localhost.
Escape character is ‘^]’.
^CConnection closed by foreign host.

Maybe in mailcow.conf, IPV6 is the default and instead of HTTP_BIND=127.0.0.1, IPV6 should be set to localhost?

esackbauer

What do you mean? Your log shows successful connection via IPv4, what you need IPv6 for?

mf_bpd

Unfortunately, it does not connect successfully.

When I try with telnet I get a “Connection refused” error message.
The error.log also says:
“…connect() failed (111: Connection refused)…”

What makes me think IPV6 is the first line of the telnet error message:
“Trying ::1…”

esackbauer

mf_bpd
You have in your proxy config 127.0.0.1 which is not IPv6, so please stick to IPv4 when testing: telnet 127.0.0.1 8080

mf_bpd

So far I have only tried IPv4/.

Still using telnet:

Trying ::1…
Connection failed: Connection refused
Trying 127.0.0.1…
Connected to localhost.
Escape character is ‘^]’.

With ss visible that the port is open:
"tcp LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:* users: ((“docker-proxy”,pid=69644,fd=4))"

Why reject the connection?

esackbauer

I guess its because 127.0.0.1 will stay inside the NPM container. The documentation regarding reverse proxy is assuming that nginx is running on the same host where mailcow runs (not in a container), so 127.0.0.1 would work. I guess you need to replace 127.0.0.1 in mailcow.conf and nginx config with the IP address of host system.