Hi all,

Ive upgraded today to the march update and was generally problematic. I could not connect to the domain, since it appears my VPN is banned since the upgrade.

In the logs following is visible too:

netfilter-mailcow-1  | Using IPTables backend
netfilter-mailcow-1  | Clearing all bans
netfilter-mailcow-1  | Traceback (most recent call last):
netfilter-mailcow-1  |   File "/app/main.py", line 416, in <module>
netfilter-mailcow-1  |     clear()
netfilter-mailcow-1  |   File "/app/main.py", line 218, in clear
netfilter-mailcow-1  |     tables.clearIPv4Table()
netfilter-mailcow-1  |   File "/app/modules/IPTables.py", line 69, in clearIPv4Table
netfilter-mailcow-1  |     self.clearTable(iptc.Table(iptc.Table.FILTER))
netfilter-mailcow-1  |   File "/app/modules/IPTables.py", line 89, in clearTable
netfilter-mailcow-1  |     filter_table.commit()
netfilter-mailcow-1  |   File "/usr/lib/python3.12/site-packages/iptc/ip4tc.py", line 1612, in commit
netfilter-mailcow-1  |     raise IPTCError("can't commit: %s" % (self.strerror()))
netfilter-mailcow-1  | iptc.ip4tc.IPTCError: can't commit: b'Resource temporarily unavailable'

Information to the setup:

  1. mailcow and using reverse proxy
  2. docker-compose.override.yml for mailcow (please see below)
  3. nginx-proxy auto gen nginx-proxy/nginx-proxy

docker-compose.override.yml:

services:
  nginx-mailcow:
    expose:
      - "8080"
    environment:
      - VIRTUAL_HOST=${MAILCOW_HOSTNAME}
      - LETSENCRYPT_HOST=${MAILCOW_HOSTNAME}
      - LETSENCRYPT_MAIL=${MAILCOW_HOSTNAME}
      - VIRTUAL_PROTO=http
      - VIRTUAL_PORT=8080
    volumes:
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/fullchain.pem:/etc/ssl/mail/cert.pem:ro
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/key.pem:/etc/ssl/mail/key.pem:ro
    networks:
      mailcow-network:
        aliases:
          - nginx
      proxy:
  dovecot-mailcow:
    volumes:
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/fullchain.pem:/etc/ssl/mail/cert.pem:ro
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/key.pem:/etc/ssl/mail/key.pem:ro
  postfix-mailcow:
    volumes:
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/fullchain.pem:/etc/ssl/mail/cert.pem:ro
      - /docker/nginx-proxy/data/certs/${MAILCOW_HOSTNAME}/key.pem:/etc/ssl/mail/key.pem:ro
    networks:
      mailcow-network:
        aliases:
          - postfix
      proxy:
networks:
  mailcow-network:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: br-mailcow
    enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
        - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
  proxy:
    external: true

I see several problems with your setup, which is non-standard. You seem to be tweaking the mailcow network (why? this is not necessary for docs.mailcow.email Icon nginx reverse proxy

docs.mailcow.email Icon docs.mailcow.email
Overview - mailcow: dockerized documentation
None
docs.mailcow.email
) , and you are docker-binding the certs directly into the containers.
You really shoud copy them as indicated here:
docs.mailcow.email Icon Advanced SSL - mailcow: dockerized documentation
docs.mailcow.email Icon docs.mailcow.email
Advanced SSL - mailcow: dockerized documentation
None
docs.mailcow.email

I use Ansible for that.

    Have something to say?

    Join the community by quickly registering to participate in this discussion. We'd like to see you joining our great moo-community!

    esackbauer

    Hi, the setup is very very old (2021) and back to the date this was the best way to get the reverse proxy with serveral other docker containers running.

    There was then around a year ago an issue, that it couldnt bind it anymore to the network after an upgrade and reason I forced the subnet like this.

    Actually the iptables issue above was not present before the recent upgrade. I will check it next weekend and i might find something.

      No one is typing