Yeah, sorry about that. I definitely should have mentioned the reverse proxy in the original post.
Here’s the relevant nginx server block:
server {
listen 443 ssl;
listen [::]:443 ssl;
ssl_certificate /etc/letsencrypt/live/example/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/example/privkey.pem; # managed by Certbot
server_name mail.example.com;
location / {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_set_header Host $host;
client_max_body_size 2048M;
client_body_buffer_size 128K;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_pass https://10.17.8.11:443;
}
resolver 1.1.1.1;
}
The rest of the ports besides 80/443 are forwarded directly to the mailcow server from the edge router.
In order to get this to work with SOGO I had to make some port changes in the docker-compose.yml. In the dovecot section I changed the IMAP port and the SIEVE port, and in the postfix section I changed the SMTP, SMTPS, and SUBMISSION ports as follows:
services:
dovecot-mailcow:
ports:
- - "${IMAP_PORT:-143}:143"
+ - "${IMAP_PORT:-143}:11143"
- - "${SIEVE_PORT:-4190}:4190"
+ - "${SIEVE_PORT:-4190}:24190"
postfix-mailcow:
ports:
- - "${SMTP_PORT:-25}:25"
+ - "${SMTP_PORT:-25}:10025"
- - "${SMTPS_PORT:-465}:465"
+ - "${SMTPS_PORT:-465}:10465"
- - "${SUBMISSION_PORT:-587}:587"
+ - "${SUBMISSION_PORT:-587}:10587"
I edited data/conf/dovecot/extra.conf to match. Here is the complete extra.conf:
login_trusted_networks = 172.22.1.0/24 127.0.0.1 ::1
haproxy_trusted_networks = 10.17.8.7/32 172.22.1.0/24
service imap-login {
inet_listener imap {
haproxy = no
}
inet_listener imaps {
haproxy = yes
}
inet_listener imap_ext {
port = 11143
haproxy = yes
}
}
service pop3-login {
inet_listener pop3 {
haproxy = yes
}
inet_listener pop3s {
haproxy = yes
}
}
service managesieve-login {
inet_listener sieve {
port = 4190
haproxy = no
}
inet_listener sieve_ext {
port = 24190
haproxy = yes
}
}
I also added SOGoIMAPServer = "imap://dovecot:10143/?tls=no"; to data/conf/sogo/sogo.conf.
Sorry again for not providing that info in the original post.