Best way to deploy Postal behind a firewall

[Ascar699]

Makers of Postal, thank you for excellent product.
Please help me with advice on the best deployment approaches. I have so far achieved the following results:

1. I was able to deploy Postal on a virtual machine connected directly to the internet, so the IP address on the network interface is public and I use Caddy. This instance of Postal is 100% functional with tracking working properly. All configuration files are not modified - postal.yml and caddyfile point to all services running on local host address (127.0.0.1). Everything is good except the fact that I don't have peace of mind about this VM being directly exposed to the internet.

2. I deployed Postal in the same VM (using snapshots) behind HAProxy implemented in pFsense firewall. Initially:

a) I was getting error 503 - No server available until I changed the bind address from 127.0.0.1 to the private IP address of the VM and HTTP check method from OPTIONS to GET in the backend settings.

b) I could make it only to the login screen and past that I was getting "The change you wanted was rejected" error page. This got fixed by checking off the "Use forwardfor option" in the Postal frontend in HAProxy. So, now I can do everything to manage Postal - create orgs, add mail servers, domains. Mail flows smoothly.

To be brief - when my Postal VM is behind HAProxy tracking does not work. The tracking URLs are opening with the error and no forwarding to the original link happens. I tried all combinations of changes - changed IP address from localhost to private IP address, protocols from HTTPS to HTTP, ports.
 

Please suggest where I should look and what else to try. Tracking seems to be the only remaining thing that does not work when Postal is behind the firewall.

[willpower232]

If you're seeing that error on tracking, it means you're missing the header mentioned in the documentation #1785

The web server must add the X-Postal-Track-Host: 1 header so the Postal web server knows to treat requests as tracking requests.

[Ascar699]

Thank you for replying. It was not easy, but I finally figured that the header should be added on the backend side and there should not be the (:) after X-Postal-Track-Host header.

Well, you may congratulate me on Postal finally running behind pFsense!