Mailcow + Nginx reverse proxy: no response via 127.0.0.1:8080/8443

Simi83

Hello everyone,
We have a Mailcow installation running in Docker on Ubuntu 24.04 ARM64, inside a VM on Oracle Cloud Infrastructure.

The Mailcow instance works perfectly when the external NGINX is turned off and we access it directly via IP or exposed Docker ports, using our own SAN certificates generated via Let’s Encrypt.

However, we would like to use our external reverse proxy NGINX, which is outside Docker but inside the same VM and already serves a website.
The goal is to centralize TLS termination on the reverse proxy.

Below you’ll find our Mailcow configuration and the tests we performed:
mailcow.conf configuration
HTTP_PORT=8080
HTTP_BIND=127.0.0.1
HTTPS_PORT=8443
HTTPS_BIND=127.0.0.1

ADDITIONAL_SAN=imap.,smtp.,autoconfig.,autodiscover.
AUTODISCOVER_SAN=y
ADDITIONAL_SERVER_NAMES=
SKIP_LETS_ENCRYPT=y
ENABLE_SSL_SNI=n

Proxy
TRUSTED_PROXIES=10.x.x.x We have no VLAN or custom networks: which IP should be trusted? loopback? or the local IP of the reverse proxy? NAT is managed directly by OCI.
NGINX (Docker) configuration

/opt/mailcow-dockerized/data/conf/nginx/listen_plain.active
listen 8080;

/opt/mailcow-dockerized/data/conf/nginx/listen_ssl.active
listen 8443;
http2 on;

/opt/mailcow-dockerized/data/conf/nginx/server_name.active
server_name mail.example.tld autodiscover.* autoconfig.*;

Tests performed
curl -v http://127.0.0.1:8080

→ Connects, but hangs. No HTTP response.
curl -vk https://127.0.0.1:8443

→ TLS handshake successful, but no content is served.
curl -vk https://mail.example.tld

→ TLS handshake ok, correct certificate, but blank page or infinite loading.
container nginx-mailcow checks
docker exec -it mailcowdockerized-nginx-mailcow-1 nginx -t

Config OK (just a warning about deprecated http2 directive)
docker exec -it mailcowdockerized-nginx-mailcow-1 netstat -tulpn

NGINX is listening on ports 8080, 8443, 8081, 9081, 9082
Docker host networking
ss -tulpn | grep 8080

tcp LISTEN 127.0.0.1:8080 …
ss -tulpn | grep 8443

tcp LISTEN 127.0.0.1:8443 …
We are looking for support to understand what might be missing or misconfigured to make our external NGINX reverse proxy work properly with Mailcow.
Any technical suggestions or shared experience are very welcome!

Thanks in advance 🙏

esackbauer

Are you running firewalld or ufw? It is recommended to not use them.

Simi83

esackbauer

We are not using ufw or firewalld.

The system uses a custom iptables configuration directly. Below is a summarized version of iptables -S to clarify:

INPUT is DROP by default, but we explicitly allow:

loopback (lo)

connections from trusted internal IPs

required service ports: 80, 443, 8080, 8443, etc.

Docker-related chains like DOCKER, DOCKER-USER, and MAILCOW are in place and accept the necessary internal traffic.

There is no blocking rule affecting 127.0.0.1 or the mailcow internal ports (8080/8443).

So, firewalls are not interfering with local connections or reverse proxy forwarding.

Thanks again for checking this out.

[unknown]
Yes, we already went through all the checks listed here:
👉 https://docs.mailcow.email/getstarted/prerequisite-system/

Our OS (Ubuntu 24.04) and architecture (ARM64 on KVM/OCI) fully meet the official requirements.

Thanks for asking and for your support!

[unknown]
Yes, we already went through all the checks listed here:
👉 https://docs.mailcow.email/getstarted/prerequisite-system/

Our OS (Ubuntu 24.04) and architecture (ARM64 on KVM/OCI) fully meet the official requirements.

Thanks for asking and for your support!

[unknown]

Yes, we already went through all the checks listed here:
👉 https://docs.mailcow.email/getstarted/prerequisite-system/

Our OS (Ubuntu 24.04) and architecture (ARM64 on KVM/OCI) fully meet the official requirements.

Thanks for asking and for your support!

[unknown]

Yes, we already went through all the checks listed here:
👉 https://docs.mailcow.email/getstarted/prerequisite-system/

Our OS (Ubuntu 24.04) and architecture (ARM64 on KVM/OCI) fully meet the official requirements.

Thanks for asking and for your support!

[unknown]

Yes, I’m using an official Oracle-provided Ubuntu ARM64 image.
Here’s the system info:

Distributor ID: Ubuntu
Description: Ubuntu 24.04.2 LTS
Release: 24.04
Codename: noble
Architecture: ARM64
It’s a standard Ubuntu image from Oracle Cloud Infrastructure, not a custom or modified build.
Mailcow works perfectly when accessed directly, without any external reverse proxy
he problems only appear when we try to configure our external Nginx reverse proxy (running on the same VM). At that point, Mailcow’s internal Nginx (listening on 127.0.0.1:8080 and 8443) stops responding to HTTP requests (hanging or no output).

We’ve double-checked all prerequisites as listed here:
🔗 https://docs.mailcow.email/getstarted/prerequisite-system/

Thanks again for your support

[unknown]

Yes, I’m using an official Oracle-provided Ubuntu ARM64 image.
Here’s the system info:

We’ve double-checked all prerequisites as listed here:
🔗 https://docs.mailcow.email/getstarted/prerequisite-system/

Thanks again for your support

Ganzjahresgriller

Is this installed on a suported OS? See here: https://docs.mailcow.email/getstarted/prerequisite-system/#supported-os

esackbauer

Yes he is, he wrote above.
However Oracle Cloud is something different… If this is not a self installed Ubuntu installation, but some of Oracle’s customized Ubuntu images, it might break mailcow.

Simi83

Hi all,
This is the configuration I see inside the internal Nginx running in the Mailcow Docker container:

nginx

cat listen_plain.active

listen 8080;

cat listen_ssl.active

listen 8443;
http2 on;

cat server_name.active

server_name webmail.*****.es autodiscover. autoconfig.*;
We are using an external reverse proxy (not Mailcow’s Nginx), so Mailcow’s internal Nginx is only bound to 127.0.0.1.
We’ve set ENABLE_SSL_SNI=n, SKIP_LETS_ENCRYPT=y, and we’re forwarding requests from the reverse proxy to 127.0.0.1:8080 and 127.0.0.1:8443.

Is this Nginx configuration inside the container expected in such setup?

Thanks in advance!