Traefik and Stalwart TCP entrypoint issue.

[cb3inco]

Hi all,
I'm having some problems with Traefik and Stalwart. I've followed the documentation here and here. I'm using a dual stack network - IPv4 and IPv6. My folder structure is as follows:

/srv/docker/
---traefik/
-------docker-compose.yml
--------/data/acme.json
--------/dumped-certs/
--------/logs
---stalwart/
--------docker-compose.yml
---------/data

I have two bridge networks traefik and stalwart.

My traefik docker-compose is as follows:

services:
  traefik:
    image: traefik
    security_opt:
      - no-new-privileges:true
    container_name: traefik
    command:
      - "--experimental.plugins.traefik-real-ip.modulename=github.com/soulbalz/traefik-real-ip"
      - "--experimental.plugins.traefik-real-ip.version=v1.0.3"

      - "--providers.docker"
      - "--providers.docker.exposedbydefault=false"
      - "--entryPoints.http.address=:80"
      - "--entryPoints.http.forwardedHeaders.insecure"
      - "--entryPoints.http.proxyProtocol.insecure"
      - "--entryPoints.https.address=:443"
      - "--entrypoints.https.forwardedHeaders.insecure"
      - "--entryPoints.https.proxyProtocol.insecure"
      - "--entrypoints.http.http.redirections.entryPoint.to=https"
      - "--entrypoints.http.http.redirections.entryPoint.scheme=https"
#     Stalwart entryPoints
#     SMTP
      - "--entrypoints.smtp.address=:25"
      - "--entrypoints.smtp.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#     SMTPS
      - "--entrypoints.smtps.address=:465"
      - "--entrypoints.smtps.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#     IMAPS
      - "--entrypoints.imaps.address=:993"
      - "--entrypoints.imaps.proxyProtocol.trustedIPs=fd1a:c450:23fd:1::3,172.18.0.3"
#
# For now we will use a http challenge
      - "--certificatesresolvers.letls.acme.httpchallenge.entrypoint=http"
      - "--certificatesResolvers.letls.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory" # LetsEncrypt Staging Server - uncomment when testing
      - "--certificatesresolvers.letls.acme.email=notifications@email.com"
      - "--accessLog=true"
      - "--accesslog.filePath=/traefik_access.log"
      - "--accesslog.bufferingsize=100"
      - "--log.filePath=/traefik.log"
      - "--log.level=WARN"
      - "--api=true"
      - "--api.dashboard=true"
      - "--serverstransport.insecureskipverify=true"
    ports:
      - "80:80"
      - "443:443"
      # Mailserver
      - "25:25" # SMTP
      - "465:465" # ESMTP submission, implicit TLS
      - "993:993" # IMAP4 secure, implicit TLS
 #     - "4190:4190" # Sieve 
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./logs/traefik.log:/traefik.log"
      - "./logs/traefik_access.log:/traefik_access.log"
      - "./data/acme.json:/acme.json"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.domain.com`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.dashboard.tls=true"
      - "traefik.http.routers.dashboard.entrypoints=https"
      - "traefik.http.routers.dashboard.tls.certresolver=letls"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=traefik-auth"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=admin:password."
    restart: unless-stopped
    networks:
      - traefik
  traefik-certs-dumper:
    image: ghcr.io/kereis/traefik-certs-dumper:latest
    container_name: traefik-cert-dumper
    restart: unless-stopped
    depends_on:
      - traefik
    volumes:
      - "/etc/localtime:/etc/localtime:ro"
      - "./data:/traefik:ro"
      - "./dumped-certs:/output"
    networks:
      - traefik
networks:
  traefik:
    external: true

Stalwart docker-compose.yml

services:
  mailserver:
    image: stalwartlabs/mail-server:latest
    container_name: stalwart-mailserver
    restart: unless-stopped
    hostname: mail.domain.com
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./data:/opt/stalwart-mail
      - /srv/docker/traefik/dumped-certs:/data/certs:ro
    labels:
      - traefik.enable=true
#      - traefik.docker.network=stalwart
      - traefik.http.routers.mailserver.rule=Host(`mail.domain.com`)
      - traefik.http.routers.mailserver.entrypoints=https
      - traefik.http.routers.mailserver.service=mailserver
      - traefik.http.services.mailserver.loadbalancer.server.port=8080

      - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtp.entrypoints=smtp
      - traefik.tcp.routers.smtp.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=25
      - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.jmap.rule=HostSNI(`*`)
      - traefik.tcp.routers.jmap.tls.passthrough=true
      - traefik.tcp.routers.jmap.entrypoints=https
      - traefik.tcp.routers.jmap.service=jmap
      - traefik.tcp.services.jmap.loadbalancer.server.port=443
      - traefik.tcp.services.jmap.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.smtps.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtps.tls.passthrough=true
      - traefik.tcp.routers.smtps.entrypoints=smtps
      - traefik.tcp.routers.smtps.service=smtps
      - traefik.tcp.services.smtps.loadbalancer.server.port=465
      - traefik.tcp.services.smtps.loadbalancer.proxyProtocol.version=2

      - traefik.tcp.routers.imaps.rule=HostSNI(`*`)
      - traefik.tcp.routers.imaps.tls.passthrough=true
      - traefik.tcp.routers.imaps.entrypoints=imaps
      - traefik.tcp.routers.imaps.service=imaps
      - traefik.tcp.services.imaps.loadbalancer.server.port=993
      - traefik.tcp.services.imaps.loadbalancer.proxyProtocol.version=2
    networks:
      stalwart:
      traefik:
        ipv4_address: 172.18.0.3
        ipv6_address: fd1a:c450:23fd:1::3
networks:
  traefik:
    name: traefik
    external: true
  stalwart:
    name: stalwart
    external: true

and the stalwart config.yml

authentication.fallback-admin.secret = "$SECRET"
authentication.fallback-admin.user = "admin"
certificate.traefik.cert = "%{file:/srv/docker/traefik/dumped-certs/mail.domain.com/cert.pem}%"
certificate.traefik.default = true
certificate.traefik.private-key = "%{file://srv/docker/traefik/dumped-certs/mail.domain.com/key.pem}%"
directory.internal.store = "rocksdb"
directory.internal.type = "internal"
lookup.default.hostname = "mail.domain.com"
server.http.hsts = true
server.http.permissive-cors = false
server.http.url = "protocol + '://' + key_get('default', 'hostname') + ':' + local_port"
server.http.use-x-forwarded = true
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.proxy.override = true
server.listener.imaptls.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.imaptls.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.imaptls.tls.implicit = true
server.listener.pop3.bind = "[::]:110"
server.listener.pop3.protocol = "pop3"
server.listener.pop3s.bind = "[::]:995"
server.listener.pop3s.protocol = "pop3"
server.listener.pop3s.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.proxy.override = true
server.listener.smtp.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.smtp.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.proxy.override = true
server.listener.submission.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.submission.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.proxy.override = true
server.listener.submissions.proxy.trusted-networks.0 = "fd1a:c450:23fd:1::/64"
server.listener.submissions.proxy.trusted-networks.1 = "172.18.0.0/16"
server.listener.submissions.socket.override = false
server.listener.submissions.tls.implicit = true
server.listener.submissions.tls.override = false
storage.blob = "rocksdb"
storage.data = "rocksdb"
storage.directory = "internal"
storage.fts = "rocksdb"
storage.lookup = "rocksdb"
store.rocksdb.compression = "lz4"
store.rocksdb.path = "/opt/stalwart-mail/data"
store.rocksdb.type = "rocksdb"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "info"
tracer.log.path = "/opt/stalwart-mail/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"

I'm also running Joplin Server and Vikunja Server. They both live in their own directories as well. What I'm noticing is that when I start Stalwart up and look at the Traefik dashboard, the entrypoints for TCP are all pointing to the Joplin server.

I've not done things with TCP entrypoints before, so it's a bit peculiar that they are all being placed in the HTTP Routers and further under the Joplin server. It would seem to me that they should be under the stalwart router. Even if I shut down Joplin, it doesn't change anything.

I feel like I'm missing something here. Any help would be appreciated.