My issue with my emails being reporting an issue with the private key was caused by a bug in an old nightly image that meant that the same keys generated encrypted data that could only be decrypted from the same container image. This information was mentioned to me in the Telegram channel.
The container image I was running before updating/migrating to stable was mailcow/dovecot:nightly-20231016
The recommendation I was given in the mailcow telegram following the failed update/migration was to backup and then roll back the upgrade to the previous version I was coming from, decrypt the mail in all mailboxes, and then update back to stable and re-encrypt all the mail in all the mailboxes.
I had previously had an override defined in the docker-compose.overrides.yml for the dovecot container image, so rather than perform a full rollback I started a temporary container with the older container image, using bind mounts to point to the crypt and vmail volumes (which allowed me to keep my production mail system up and running)
docker run --rm -it --entrypoint /bin/bash -v /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data:/var/vmail:rw -v /var/lib/docker/volumes/mailcowdockerized_crypt-vol-1/_data:/mail_crypt:ro mailcow/dovecot:nightly-20231016
Once this temporary container was running I used the documentation to decrypt mail inside the temporary container using the old image. This worked cleanly (I had to make a minor adjestment to the find command which didn’t support the -regextype egrep flag), and this left me with unencrypted mails in each account.
I then activated a bash prompt inside the production dovecot container (as per the documentation linked above) and used a variation on the command included there to re-compress and re-encrypt the mail files.
find /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do
if [[ $(head -c7 "$file") != "CRYPTED" ]]; then
doveadm fs put compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \
"$file" "$file"
chmod 600 "$file"
chown 5000:5000 "$file"
fi
done
After logging into SoGo I was able to read emails that had been delivered before the update procedure was initiated, and refreshing my Android email client showed emails again.
I hope this provides useful information for people struggling in future!