Hello, Can the following be applied without running in trouble with Acme validations?: https://mailcow.github.io/mailcow-dockerized-docs/u_e-80_to_443/ What with the part in docs with "HTTP_BIND=0.0.0.0" this can not be set due to the newest update: https://github.com/mailcow/mailcow-dockerized/commit/64c12d50bc99a4d00e2603e9155ebd93f2c08f03 All of the tutorial in the docs can be applied the same excepted the http bind? Thanks for any suggestion.

HTTP to HTTPS - Redirect

omexlu

Hello,

Can the following be applied without running in trouble with Acme validations?:
https://mailcow.github.io/mailcow-dockerized-docs/u_e-80_to_443/

What with the part in docs with “HTTP_BIND=0.0.0.0” this can not be set due to the newest update:
mailcow/mailcow-dockerized64c12d5

All of the tutorial in the docs can be applied the same excepted the http bind?

Thanks for any suggestion.

diekuh

Fixed https://github.com/mailcow/mailcow-dockerized-docs/blob/master/docs/u_e-80_to_443.md, thanks! 🙂

0.0.0.0 does not break anything, it just ONLY binds on IPv4 and skips IPv6 bindings. That’s a new change in Docker 20.x I guess.

omexlu

Ok thank you, so this can be applied without breaking anthing? Specially ACME-Validation? 🙂

But 0.0.0.0 breaks the ACME Validation if IPv6 is set (AAAA-Records) in ACME .

omexlu

Dont know why but in standart config without the change in docs my mailcow domain redirect to https?:

curl -s -D - -o /dev/null http://mx.domain.tld/SOGo/
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 08 Jan 2021 04:29:26 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://mx.domain.tld/SOGo/

curl -s -D - -o /dev/null http://mx.domain.tld
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Fri, 08 Jan 2021 04:29:34 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://mx.domain.tld/

omexlu

@diekuh

I have tried to set it up as described here:
https://github.com/mailcow/mailcow-dockerized-docs/blob/master/docs/u_e-80_to_443.md

HTTP_BIND= is as described.

After I created the file data/conf/nginx/redirect.conf with the mentioned content and restarted nginx, the panel is not reachable anymore.

So something seems to be wrong here.

diekuh

Works fine here.

Perhaps someone can help when you post logs. 🙂

diekuh

The default config does NOT forward to SOGo nor does it redirect to HTTPS. There was probably another change in your system.

omexlu

2021/01/08 07:44:03 [emerg] 18#18: a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2
nginx-mailcow_1      | nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2

I have make all as described in the docs for https forward.

Maybe this option will redirect, even if the DNS record for MailCow is not proxied here:

So the change would also be superfluous but actually it should work ever with the custom change (redirect.conf).

omexlu

Or maybe tue to this:
strict-transport-security: max-age=15768000;

No matter how it redirects even without the redirect.conf, maybe as mentioned by the Cloudflare setting, which makes me wonder why by the redirect.conf the panel is no longer accessible.

This should still work :/

omexlu

@diekuh

Even if Cloudflare should forward here with DNS only, the configuration in redirect.conf should still work.

But if you restart nginx the panel is not accessible, so I rather assume an error in the redirect.conf especially since this error message points to some error in the nginx configurations:
2021/01/08 07:44:03 [emerg] 18#18: a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2 nginx-mailcow_1 | nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2

Also i asked in cloudflare forum and thats not the reason because non-proxied records don’t get touched:
https://community.cloudflare.com/t/always-https/234870

diekuh

I cannot help you. I set it up like this on various systems yesterday. Everything works as expected. There is no redirect to HTTPS by default.

omexlu

Yes i see that no redirect by default, but something strange is also happend with redirect.conf, something is wrong here with default_server (duplicate) because of that the panel don’t run because ERROR:

2021/01/08 07:44:03 [emerg] 18#18: a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2
nginx-mailcow_1 | nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2

Nothing has been changed inside of mailcow all is default. Only thing is cloudflare and as mentioned non-proxied domains don’t get touched.

Nginx makes a error when redirect.conf are included, so there is a miskake/error somewhere inside of it (see error above)

Duplicate of default_server is the problem here. Once in the standart nginx and once in redirect.

omexlu

@diekuh

Apparently HSTS is the reason for redirecting to https and thus is set by mailcow:
https://github.com/mailcow/mailcow-dockerized/blob/master/data/conf/nginx/includes/site-defaults.conf#L14

That still doesn’t explain the nginx error with the redirect.conf which is another problem with the config you gived.

diekuh

I use the redirect.conf myself and I simply don’t understand what’s the matter right now. It works fine here.

Can you please create a post with information, logs etc.?

omexlu

This is why by DEFAULT mailcow get redirected to https:
https://github.com/mailcow/mailcow-dockerized/blob/master/data/conf/nginx/includes/site-defaults.conf#L14

And the error from nginx log about the redirect.conf is this:
2021/01/08 07:44:03 [emerg] 18#18: a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2 nginx-mailcow_1 | nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2

Or which other logs you need?

As mentioned all is defaults on my installation, copy/paste redirect, reload nginx, byebye panel 🙂
Remove redirect.conf, reload nginx, hello panel 🙂

omexlu

This are the only errors i found after redirect.conf was implemented an nginx reloaded:
2021/01/08 07:44:03 [emerg] 18#18: a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2 nginx-mailcow_1 | nginx: [emerg] a duplicate default server for 0.0.0.0:80 in /etc/nginx/conf.d/site.conf:2 nginx-mailcow_1 | nginx: configuration file /etc/nginx/nginx.conf test failed

So there must be a error with redirect.conf. I have done all the same as i docs and http gets redirected also by DEFAULT by mailcow because of the HSTS setting.

omexlu

here we go:
https://community.mailcow.email/d/571-http-recirect-some-trouble