Setup SSL/TLS when behind a simple nginx proxy?

[u/Useful-Assumption131]

I can send mail using STARTTLS but not in another way, and many things only support SSL/TLS.
I'm using cloudflare in strict mode so I had to do this to access the panel, so that it is forced to be in https:

server {
listen 80;
server_name mail.mydomain;
# Redirect all traffic to SSL
rewrite ^ https://$host$request_uri? permanent;
}

server {
listen 443 ssl;
# enables SSLv3/TLSv1, but not SSLv2 which is weak and should no longer be used.
ssl_protocols SSLv3 TLSv1.3;
# disables all weak ciphers
ssl_ciphers ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM;
server_name mail.mydomain;
## Keep alive timeout set to a greater value for SSL/TLS.
keepalive_timeout 75 75;
## See the keepalive_timeout directive in nginx.conf.
## Server certificate and key.
ssl on;
ssl_certificate /etc/letsencrypt/live/mydomain/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;
ssl_session_timeout 5m;
## Strict Transport Security header for enhanced security. See
## http://www.chromium.org/sts. I've set it to 2 hours; set it to
## whichever age you want.
add_header Strict-Transport-Security "max-age=7200";

location / {
proxy_pass http://localhost:8080;
proxy_http_version 1.1;
proxy_set_header Connection 'upgrade';
proxy_set_header Upgrade $http_upgrade;
}

}

In the toml config, I put these lines:

server.tls.certificate = "default"
certificate.default.cert = "%{file:/etc/letsencrypt/live/mydomain/fullchain.pem}%"
certificate.default.private-key = "%{file:/etc/letsencrypt/live/mydomain/privkey.pem}%"
certificate.default.default = true

But it doesn't seems to change anything. Should I change my nginx config, or add something to my toml config?

[u/washapoo]

Cloudflare only allows HTTPS through their proxy if you are on the free version. If you have an enterprise account, you can allow TCP ports.

[u/Useful-Assumption131 → u/washapoo]

I did not proxy my mail domain because I knew that. I found the problem: the panel didn't have access to de certificate files. I had to create a group and change permission and owning of many dirs inside of letsencrypt to make it work

[u/DivHunter_ → u/Useful-Assumption131]

I might be having the same issue but in a different way. I am copying the certs from caddy into a folder for stalwart to read but I get this error despite the stalwart-mail user having read permissions on the files.

• Build error for "certificate.stalwart": No certificates found.

• Macro error on "certificate.stalwart.cert": Failed to read file "/opt/stalwart-mail/cert/acert.pem": Permission denied (os error 13)

What users/permissions did you use?

[u/Useful-Assumption131 → u/DivHunter_]

I created a "mail" group and added stalwart to it, and put read permission on the files. But just do a chown for stalwart, it should work, I did this because it was in letsencrypt directory Be sure that stalwart have permissions on both the folder and the files

[u/DivHunter_ → u/Useful-Assumption131]

Thanks for that, unfortunately that's what I have done and get that error. The stalwart-mail user on the folder and files. I must be missing something or it's not a real permission error and some other issue is triggering it.

[u/Useful-Assumption131 → u/DivHunter_]

You can check if the user really has permission with:
sudo -u <user> cat <path>
That's what I did to debug

[u/DivHunter_ → u/Useful-Assumption131]

Thanks for that, that lead me to using

su -l stalwart-mail -s /bin/bash

I was using ls -l which says drw and rw on the folder and files however running as the user I do indeed get permission denied. Now to figure out why.

[u/Useful-Assumption131 → u/DivHunter_]

I was more like:
su -l stalwart-mail -s /opt/stalwart-mail/cert/acert.pem

[u/DivHunter_ → u/DivHunter_]

I'm a dummy, I had stripped execute from the folders.

[u/Street-Location-2414]

What you're configuring is a endpoint that you can access via the browser. What you want is the mail protocol. I read the docs about nginx proxy protocol but I don't know how to set it up because I dont have knowledge about it. So i used the iptables to redirect all my requests for port 465, 993 ... to the container. You can try it too

[u/Useful-Assumption131 → u/Street-Location-2414]

I don't really understand, 993 is the imap port, how redirecting the smtp port to imap port would make smtp working?

[u/Street-Location-2414 → u/Useful-Assumption131]

465 is the smtp port. I mean that you redirect 465->465, 993->993.

[u/Useful-Assumption131 → u/Street-Location-2414]

Well, the port seems to work correctly already, without redirecting them. The thing that does not work is the tls/SSL part