Mailcow and Webserver on same NGNX

heinzb

Hello, I am new to NGNX and mailcow.

How can I run mailcow and a web server on the same mailcow / ngnx / ACME containers ?

I want the Mailcow UI on https://mail.example.com:8443, so I added:

        HTTP_PORT=8080
        HTTPS_PORT=8443

For the Webserver at https://www.example.com (or if possible https://example.com ?) I added data/conf/nginx/example.conf which contains:

server {
  ssl_certificate /etc/ssl/mail/cert.pem;
  ssl_certificate_key /etc/ssl/mail/key.pem;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;
  ssl_session_cache shared:SSL:50m;
  ssl_session_timeout 1d;
  ssl_session_tickets off;
  index index.php index.html;
  client_max_body_size 0;
  # Location: data/www/example
  root /www/example;
  include /etc/nginx/conf.d/listen_plain.active;
  include /etc/nginx/conf.d/listen_ssl.active;
  server_name www.example.com;
  server_tokens off;
  location ^~ /.well-known/acme-challenge/ {
    default_type "text/plain";
    rewrite /.well-known/acme-challenge/(.*) /$1 break;
    root /web/.well-known/acme-challenge/;
  }
  if ($scheme = http) {
    return 301 https://$server_name$request_uri;
  }
}

The web contents is in www/example and mounted into ngnx with the following docker-compose.override.yml

services:
    nginx-mailcow:
      volumes:
        - ./www:/www:ro,z

Something is missing because ACME does no work.
Not sure whether ADDITIONAL_SAN=example.com is need ?

Any help is welcome 😍

esackbauer

https://docs.mailcow.email/post_installation/reverse-proxy/r_p-nginx/

heinzb

esackbauer
Thanks for the fast reply. I just read the doc you pointed above.

For me it is not clear, whether ( and how ;-) ) this can be added to the existing nginx configuration.
Can You give me a bit more hints what needs to be done ?

[unknown]
I understand Your concerns, but currently I have no option for a second host.
I thought my changes are in only in an extra .conf-file which gets included “by design” into the Mailcow/nginx configuration.
Then “only” thing missing is how ACME works and whether nginx can handle this ?

ETNyx

I would suggest not to mess with inner working of MC, if MC team change something., you are asking for troubles, in future

At least use another ngnix as proxy as @esackbauer suggest, if you must run another website on same host. Preferably make yourself new host and keep MC as separated as you can.

esackbauer

heinzb Can You give me a bit more hints what needs to be done ?

Nginx is nginx, there are enough videos on youtube explaining how to have multiple sites in nginx.

heinzb Then “only” thing missing is how ACME works and whether nginx can handle this ?

If you configure your front end nginx according the documentation ACME will work (for mailcow).
For your other sites you have to have a separate ACME.

heinzb

esackbauer

Sorry for the late reply, but it took some time until I got it to work ;-)
Maybe this is of interest for somebody who wants to make the same thing.
My understanding is that adding a mount via docker-compose.override.yml should not harm the mailcow installation.
Same for adding a config to data/config/nginx.

Here is the summary what worked for me.

Go to the mailcow installation:
cd /opt/mailcow-dockerized
Edit mailcow.conf to include the additional domain into the cert stuff:
ADDITIONAL_SAN=www.example.de,example.de
Add an additional domain to nginx by adding a new config file /opt/mailcow-dockerized/data/conf/nginx/example-de.conf:

server {
    server_name example.de;
    return 301 $scheme://www.example.de$request_uri;
}
server {
  ssl_certificate /etc/ssl/mail/cert.pem;
  ssl_certificate_key /etc/ssl/mail/key.pem;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;
  ssl_session_cache shared:SSL:50m;
  ssl_session_timeout 1d;
  ssl_session_tickets off;
  index index.php index.html;
  client_max_body_size 0;
  root /www/example.de;
  include /etc/nginx/conf.d/listen_plain.active;
  include /etc/nginx/conf.d/listen_ssl.active;
  server_name www.example.de;
  server_tokens off;

  location ^~ /.well-known/acme-challenge/ {
    default_type "text/plain";
    rewrite /.well-known/acme-challenge/(.*) /$1 break;
    root /web/.well-known/acme-challenge/;
  }

  error_page 401 /error/401.html;
  error_page 403 /error/403.html;
  error_page 404 /error/404.html;
  error_page 500 /error/500.html;

  if ($scheme = http) {
    return 301 https://$server_name$request_uri;
  }
}

Add the data for the domain somewhere:

mkdir -p www/example.de
echo "Back soon" > www/example.de/index.html

Add an addtional mount for nginx to access the data with docker-compose.override.yml

services:
    nginx-mailcow:
      volumes:
        - ./www:/www:ro,z

restart

docker compose down
docker compose up -d