Mailu Reverse Proxy

[TizWarp]

1. The problem I’m having:

I am trying to setup a mailu server. I get a blank caddy connection when connecting to the reverse proxy route. I have changed maliu’s front containers ports and it’s tls is set to the setting recommended for reverse proxying

2. Error messages and/or full log output:

Did a pastebin cause the logs are large.

Dec 05 16:14:51 mainframe systemd[1]: Starting Caddy web server...Dec 05 16:14...

3. Caddy version:

v2.8.4

4. How I installed and ran Caddy:

a. System environment:

b. Command:

systemctl start caddy

c. Service/unit/compose file:

# caddy.service
#
# For using Caddy with a config file.
#
# Make sure the ExecStart and ExecReload commands are correct
# for your installation.
#
# See https://caddyserver.com/docs/install for instructions.
#
# WARNING: This service does not use the --resume flag, so if you
# use the API to make changes, they will be overwritten by the
# Caddyfile next time the service is restarted. If you intend to
# use Caddy's API to configure it, add the --resume flag to the
# `caddy run` command or use the caddy-api.service file instead.

[Unit]
Description=Caddy web server
Documentation=https://caddyserver.com/docs/
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=14400
StartLimitBurst=10

[Service]
Type=notify
User=caddy
Group=caddy
Environment=XDG_DATA_HOME=/var/lib
Environment=XDG_CONFIG_HOME=/etc
ExecStartPre=/usr/bin/caddy validate --config /etc/caddy/Caddyfile
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --force
ExecStopPost=/usr/bin/rm -f /run/caddy/admin.socket

# Do not allow the process to be restarted in a tight loop. If the
# process fails to start, something critical needs to be fixed.
Restart=on-abnormal

# Use graceful shutdown with a reasonable timeout
TimeoutStopSec=5s

LimitNOFILE=1048576
LimitNPROC=512

# Hardening options
AmbientCapabilities=CAP_NET_BIND_SERVICE
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
DevicePolicy=closed
LockPersonality=true
MemoryAccounting=true
MemoryDenyWriteExecute=true
NoNewPrivileges=true
PrivateDevices=true
PrivateTmp=true
ProcSubset=pid
ProtectClock=true
ProtectControlGroups=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=true
ReadWritePaths=/var/lib/caddy /var/log/caddy /run/caddy
RestrictNamespaces=true
RestrictRealtime=true
RestrictSUIDSGID=true

[Install]
WantedBy=multi-user.target

d. My complete Caddy config:

# The Caddyfile is an easy way to configure your Caddy web server.
#
# https://caddyserver.com/docs/caddyfile
#
# The configuration below serves a welcome page over HTTP on port 80.
# To use your own domain name (with automatic HTTPS), first make
# sure your domain's A/AAAA DNS records are properly pointed to
# this machine's public IP, then replace the line below with your
# domain name.
#
# https://caddyserver.com/docs/caddyfile/concepts#addresses


	# Restrict the admin interface to a local unix file socket whose directory
	# is restricted to caddy:caddy. By default the TCP socket allows arbitrary
	# modification for any process and user that has access to the loc



{
	debug
}

https://admin.tizwarp.dev {

	reverse_proxy localhost:9090 {
	
		transport http {
		
			tls_insecure_skip_verify
		}

	}

}

https://vault.tizwarp.dev {

	reverse_proxy 192.168.1.107:8030

}

https://mail.aberrant.works {

	reverse_proxy 192.168.1.107:7443
}

# Import additional caddy confg files in /etc/caddy/conf.d/

5. Links to relevant resources:

[togir]

I do have this caddy config for Mailu:

mail.domain, www.mail.domain {
	reverse_proxy {
		to https://localhost:8443
		transport http {
			tls
			tls_insecure_skip_verify
		}
		header_up X-Real-IP {remote_host}
	}
}

The mailu is reachable via https on the port 8443, instead of the default 443.
I fetch the tls certs for mailu externaly via letsencrypt and use mailu with the “cert” option for tls.
This is the section of the mailu.env

# For tls
TLS_FLAVOR=cert
TLS_CERT_FILENAME=fullchain.pem
TLS_KEYPAIR_FILENAME=privkey.pem

#For the rate limiting
# Header to take the real ip from
REAL_IP_HEADER=X-Real-IP

# IPs for nginx set_real_ip_from (CIDR list separated by commas)
REAL_IP_FROM=199.244.192.230/22, 127.0.0.1/24

199.244.192.230/22 is the adress of the server.