mailu + nginx reverse proxy: 502 error (tls invalid response)

[ghost]

Environment & Version

Environment

• docker compose
• kubernetes
• docker swarm

Version

• Version: 1.9

Description

i set up mailu using the mailu setup utility and configured nginx to act as a reverse proxy with an ssl certificate provided by certbot. however, attempting to access webmail gives me a 502 error

Replication Steps

docker-compose.yml:

# This file is auto-generated by the Mailu configuration wizard.
# Please read the documentation before attempting any change.
# Generated for compose flavor

version: '2.2'

services:
  ...
  front:
   ...
    ports:
      - "8080:80"
      - "8443:443"
      - "25:25"
      - "465:465"
      - "587:587"
      - "110:110"
      - "995:995"
      - "143:143"
      - "993:993"
   ...

mailu.env:

TLS_FLAVOR=letsencrypt

/etc/nginx/sites-enabled/mailu:

server {
  server_name mail.my.domain;

  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://localhost:8443;
  }


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/mail.my.domain/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mail.my.domain/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = mail.my.domain) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

  server_name mail.my.domain;
    listen 80;
    return 404; # managed by Certbot

}

Observed behaviour

i am unable to access the webmail ui via mail.my.domain/webmail; it returns a 502 error

Expected behaviour

i should be able to access the webmail ui

Logs

mailu-front-1  | Requesting a certificate for mail.my.domain
mailu-front-1  | 
mailu-front-1  | Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
mailu-front-1  |   Domain: mail.my.domain
mailu-front-1  |   Type:   unauthorized
mailu-front-1  |   Detail: 185.112.144.89: Invalid response from https://mail.my.domain/.well-known/acme-challenge/Mnpq3gJjlbP0tjSz5N1GWNVnTG3KM2PdNTM9tEQ9PgA: 502
mailu-front-1  | 
mailu-front-1  | Hint: The Certificate Authority couldn't exterally verify that the standalone plugin completed the required http-01 challenges. Ensure the plugin is configured correctly and that the changes it makes are accessible from the internet.
mailu-front-1  |

[nextgens]

certbot uses port 80 in standalone mode to get the certificate; your reverse-proxy configuration is breaking it by redirecting to the HTTPS handler. Reverse-proxy both to Mailu and it will work.

It is arguable whether

Mailu/core/nginx/conf/nginx.conf

Line 156 in 1b7de12

{% if TLS_FLAVOR == 'mail-letsencrypt' %}

should be also catering for "letsencrypt" too. @Diman0 thoughts?

[nextgens]

Update to 2.0.5, that will fix it without any configuration change.