[SOLVED] At last the smtp ssl/tls issue is now solved

[The-3x]

Hi, i've been suffering from tls problem in postal smtp as only RSA is supported but caddy gives us another type of certificate (ECDSA). So i have a great solution for it.

Steps:

1. make certificates using certbot
2. copy fullchain.pem & privkey.pem to /opt/postal/config directory & chmod 0644 both of them
3. stop the caddy container (find via 'docker ps' & use 'docker stop xxxxxxxx')
4. stop postal
5. edit the postal.yml & add certificate path. remember postal installation can access to /opt/postal/config but postal container have access to /config which is a mount path of /opt/postal/config. so anything you put in /opt/postal/config you gotta declare the fullchain using /config.. see example below

port: 25
tls_enabled: true
tls_certificate_path: /config/fullchain.pem
tls_private_key_path: /config/privkey.pem

6. start the caddy container (docker start xxxxxxxx)
7. start postal

now you should be send mails using ssl/tls enabled :) comment if you face problem.

[willpower232]

Sounds good, as long as you remember to replace the certificates when they expire every 3 months you should be sorted.

[Trapulo]

Thanks: I was not aware of this command, that makes more sense.

however:
Hook 'post-hook' ran with error output:
Container postal-smtp-1 Restarting
Container postal-web-1 Restarting
Container postal-requeuer-1 Restarting
Container postal-cron-1 Restarting
Container postal-worker-1 Restarting
Container postal-smtp-1 Started
Container postal-requeuer-1 Started
Container postal-worker-1 Started
Container postal-web-1 Started
Container postal-cron-1 Started
1 renew failure(s), 0 parse failure(s)

(at least it has not recreated containers)

[willpower232]

Ah I wonder if it failed to renew the certificate or didn't need to maybe?

[Trapulo]

if way a dry-run, but the certificate renewal was completed without problem, the error is only on the post hook

[gazugafan]

I'm running into the same problem. I can workaround it by forcing an exit code 0 from the restart command like so...

postal dc restart 2>&1 || true

... but of course if the restart were to ever fail for some reason, this wouldn't get caught appropriately. I guess I can be reasonably sure it will succeed, since doing a dry run shows all the containers restarting successfully.

Oddly, running the restart command itself seems to give a 0 exit code, so I'm not sure what the problem is running it from the renewal hook...

sudo postal dc restart
Restarting postal_requeuer_1 ... done
Restarting postal_smtp_1     ... done
Restarting postal_worker_1   ... done
Restarting postal_cron_1     ... done
Restarting postal_web_1      ... done
sudo echo $?
0

[Trapulo]

thank you: also in my env with this workaround the dry runs completed without errors.

I only need some months now to see if it will renew certificate as expected :)

[uhlhosting]

Why not use the generation feature of Caddy, I will test that one and provide feedback.

[willpower232]

as discussed in other issues, this only works if you tell Caddy to provide an RSA cert instead of the more modern kind, I'm not sure where Caddy keeps the certificate files off the top of my head

[uhlhosting]

/opt/postal/caddy-data/caddy/certificates/acme-v02.api.letsencrypt.org-directory/ This should be default path for Caddy and the generated SSLs.