Help With Traefik-Certs-Dumper #526

ShubashBiswas · 2024-10-04T03:16:57Z

ShubashBiswas
Oct 4, 2024

I am trying to get the cert. Pem and key.pem from Dokploy Traefik which is needed for the Stalwart Mail Server configuration. Any suggestions or alternatives will work.

Stalwart Compose

services:
  mailserver:
    image: stalwartlabs/mail-server:latest
    restart: unless-stopped
    hostname: mail.example.com
    networks:
      - dokploy-network
    ports:
      - "25:25"     # SMTP  (explicit TLS)
      - "465:465"   # ESMTP (implicit TLS)
      - "993:993"   # IMAP4 (implicit TLS)
      - "995:995"   # POP3  (implicit TLS)
    labels:
      - traefik.enable=true

      - traefik.http.routers.mailserver.rule=Host(`mail.example.com`) || Host(`autodiscover.example.com`) || Host(`autoconfig.example.com`) || Host(`mta-sts.example.com`)
      - traefik.http.routers.mailserver.entrypoints=websecure
      - traefik.http.routers.mailserver.service=mailserver
      - traefik.http.services.mailserver.loadbalancer.server.port=8080

      - traefik.tcp.routers.jmap.rule=HostSNI(`*`)
      - traefik.tcp.routers.jmap.tls.passthrough=true
      - traefik.tcp.routers.jmap.entrypoints=websecure
      - traefik.tcp.routers.jmap.service=jmap
      - traefik.tcp.services.jmap.loadbalancer.server.port=443
      - traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtp.entrypoints=smtp
      - traefik.tcp.routers.smtp.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=25
      - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.smtps.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtps.tls.passthrough=true
      - traefik.tcp.routers.smtps.entrypoints=smtps
      - traefik.tcp.routers.smtps.service=smtps
      - traefik.tcp.services.smtps.loadbalancer.server.port=465
      - traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.imaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.imaps.tls.passthrough=true
      - traefik.tcp.routers.imaps.entrypoints=imaps
      - traefik.tcp.routers.imaps.service=imaps
      - traefik.tcp.services.imaps.loadbalancer.server.port=993
      - traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.pop3s.rule=HostSNI(`*`)
      - traefik.tcp.routers.pop3s.tls.passthrough=true
      - traefik.tcp.routers.pop3s.entrypoints=pop3s
      - traefik.tcp.routers.pop3s.service=pop3s
      - traefik.tcp.services.pop3s.loadbalancer.server.port=995
      - traefik.tcp.services.pop3s.loadbalancer.proxyProtocol.version=2

    volumes:
      - /etc/localtime:/etc/localtime:ro
      - data:/opt/stalwart-mail
      - /etc/dokploy/traefik/dynamic/acme.json:/data/certs:ro
      
volumes:
  data:

networks:
  dokploy-network:
    external: true

Traefik-certs-dumper

services:
  certdumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "/etc/dokploy/traefik:/dynamic:ro"  # Ensure this points to the correct directory
      - "/etc/dokploy/traefik/dynamic/acme.json:/dynamic/acme.json:ro"  # Mount acme.json
      - "certs:/output:rw"
    environment:
      - DOMAIN=mail.example.com
    networks:
      - dokploy-network
      
networks:
  dokploy-network:
    external: true
volumes:
  certs:

Traefik Configuration

smtp:
    address: ':25'
    proxyProtocol:
      trustedIPs:
        - 172.19.0.2
        - 172.19.0.5

  smtps:
    address: ':465'
    proxyProtocol:
      trustedIPs:
        - 172.19.0.2
        - 172.19.0.5

  imaps:
    address: ':993'
    proxyProtocol:
      trustedIPs:
        - 172.19.0.2
        - 172.19.0.5  
  web:
    address: ':80'
    http3: {}
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https

Only this part of Stalwart configuration is left:

certificate.default.cert = "%{file:/data/certs/mail.example.com/cert.pem}%"
certificate.default.default = true
certificate.default.private-key = "%{file:/data/certs/mail.example.com/key.pem}%"

SashaGoncharov19 · 2024-10-04T11:03:57Z

SashaGoncharov19
Oct 4, 2024

Hi @ShubashBiswas! You must get something like this.

  traefik-certs-dumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    container_name: traefik-certs-dumper
    restart: unless-stopped
    depends_on:
      - traefik
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /config/certs/:/traefik:ro
      - /config/certs-dumped/:/output

services:
  mailserver:
    image: stalwartlabs/mail-server:latest
    container_name: stalwart-mailserver
    restart: unless-stopped
    hostname: mail.domain.com
    networks:
      proxy:
        ipv4_address: 172.26.0.128
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - data:/opt/stalwart-mail
      - /config/certs-dumped/:/data/certs:ro
    labels:
      - traefik.enable=true

      - traefik.http.routers.mailserver.rule=Host(`mail.domain.com`)
      - traefik.http.routers.mailserver.entrypoints=websecure
      - traefik.http.routers.mailserver.service=mailserver
      - traefik.http.routers.mailserver.tls.certresolver=production
      - traefik.http.services.mailserver.loadbalancer.server.port=8080

      - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtp.entrypoints=mail-smtp
      - traefik.tcp.routers.smtp.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=25
      - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=2

      # - traefik.tcp.routers.jmap.rule=HostSNI(`*`)
      # - traefik.tcp.routers.jmap.tls.passthrough=true
      # - traefik.tcp.routers.jmap.entrypoints=websecure
      # - traefik.tcp.routers.jmap.service=jmap
      # - traefik.tcp.services.jmap.loadbalancer.server.port=443
      # - traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.smtps.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtps.tls.passthrough=true
      - traefik.tcp.routers.smtps.entrypoints=mail-submissions
      - traefik.tcp.routers.smtps.service=smtps
      - traefik.tcp.services.smtps.loadbalancer.server.port=465
      - traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.submission.rule=HostSNI(`*`)
      - traefik.tcp.routers.submission.tls.passthrough=true
      - traefik.tcp.routers.submission.entrypoints=mail-submission
      - traefik.tcp.routers.submission.service=submission
      - traefik.tcp.services.submission.loadbalancer.server.port=587
      - traefik.tcp.services.submission.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.imaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.imaps.tls.passthrough=true
      - traefik.tcp.routers.imaps.entrypoints=mail-imaps
      - traefik.tcp.routers.imaps.service=imaps
      - traefik.tcp.services.imaps.loadbalancer.server.port=993
      - traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version=2
      
volumes:
  data:

networks:
  proxy:
    name: traefik
    external: true

certificate.default.default = true
certificate.default.cert = "%{file:/data/certs/mail.domain.com/cert.pem}%"
certificate.default.private-key = "%{file:/data/certs/mail.domain.com/key.pem}%"

0 replies

ShubashBiswas · 2024-10-04T13:02:19Z

ShubashBiswas
Oct 4, 2024
Author

@SashaGoncharov19 Thank you for your advice.
There are a few issues, I faced during your suggestion.

Error response from daemon: invalid config for network x34ot36f3rwyfa16s07qhpt72: invalid endpoint settings: no configured subnet or ip-range contain the IP address 172.26.0.128
service "traefik-certs-dumper" depends on undefined service "traefik": invalid compose project

2024-10-04T12:56:32Z ERR error="service \"dokploy-traefik\" error: port is missing" container=dokploy-traefik-j786hladjjmwilutitvqw3psm providerName=swarm
2024-10-04T12:56:33Z ERR EntryPoint doesn't exist entryPointName=mail-submission routerName=submission@docker
2024-10-04T12:56:33Z ERR No valid entryPoint for this router routerName=submission@docker
2024-10-04T12:56:33Z ERR EntryPoint doesn't exist entryPointName=mail-imaps routerName=imaps@docker
2024-10-04T12:56:33Z ERR No valid entryPoint for this router routerName=imaps@docker
2024-10-04T12:56:33Z ERR EntryPoint doesn't exist entryPointName=mail-smtp routerName=smtp@docker
2024-10-04T12:56:33Z ERR No valid entryPoint for this router routerName=smtp@docker
2024-10-04T12:56:33Z ERR EntryPoint doesn't exist entryPointName=mail-submissions routerName=smtps@docker
2024-10-04T12:56:33Z ERR No valid entryPoint for this router routerName=smtps@docker
2024-10-04T12:56:33Z ERR Router uses a non-existent certificate resolver certificateResolver=production routerName=mailserver@docker`
```

0 replies

nathan-de-pachtere · 2024-10-26T15:14:51Z

nathan-de-pachtere
Oct 26, 2024

@ShubashBiswas Did you find a way to make it works ?

1 reply

ShubashBiswas Oct 26, 2024
Author

I didn't use Proxy for the email port's. For SSL and TLS I went to the DNS proxy inside the mail server.

services:
mailserver:
image: stalwartlabs/mail-server:latest
container_name: stalwart-mailserver
restart: unless-stopped
hostname: mail.domain.com
networks:
- proxy
volumes:
- /etc/localtime:/etc/localtime:ro
- data:/opt/stalwart-mail
labels:
- traefik.enable=true

  - traefik.http.routers.mailserver.rule=Host(`mail.domain.com`)
  - traefik.http.routers.mailserver.entrypoints=websecure
  - traefik.http.routers.mailserver.service=mailserver
  - traefik.http.routers.mailserver.tls.certresolver=production
  - traefik.http.services.mailserver.loadbalancer.server.port=8080

volumes:
data:

networks:
proxy:
name: traefik
external: true

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Help With Traefik-Certs-Dumper #526

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 1 reply

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

Help With Traefik-Certs-Dumper #526

ShubashBiswas Oct 4, 2024

Replies: 3 comments · 1 reply

SashaGoncharov19 Oct 4, 2024

ShubashBiswas Oct 4, 2024 Author

nathan-de-pachtere Oct 26, 2024

ShubashBiswas Oct 26, 2024 Author

ShubashBiswas
Oct 4, 2024

Replies: 3 comments 1 reply

SashaGoncharov19
Oct 4, 2024

ShubashBiswas
Oct 4, 2024
Author

nathan-de-pachtere
Oct 26, 2024

ShubashBiswas Oct 26, 2024
Author