coop-cloud/mailu
0
0
Fork 0
Code Issues 4 Pull Requests 1 Releases Wiki Activity

ssl certs are only reloaded on startup. Mailu serves out of date certificates #10

New Issue
Open
opened 2024-04-02 13:36:09 +00:00 by knoflook · 1 comment
knoflook commented 2024-04-02 13:36:09 +00:00
Owner
Copy Link
Copy Source

The certificates mounted in app container in /certs are getting dumped by traefik-certs-dumperproperly but mailu doesn't scan for them changing.

behavior:
If we have a container running for a really long time (2 months+ uptime because that's how long the letsencrypt certs are valid), the smtp/imap servers will serve the certificate that was loaded 2 months ago which will have expired by this time. Even though the file has been rotated by traefik-certs-dumper.

workaround:
restart the app container every 2 months to load the new certificates lol

The certificates mounted in `app` container in `/certs` are getting dumped by `traefik-certs-dumper`properly but mailu doesn't scan for them changing. behavior: If we have a container running for a really long time (2 months+ uptime because that's how long the letsencrypt certs are valid), the smtp/imap servers will serve the certificate that was loaded 2 months ago which will have expired by this time. Even though the file has been rotated by `traefik-certs-dumper`. workaround: restart the `app` container every 2 months to load the new certificates lol
👍 1
3wordchant commented 2024-04-02 20:44:10 +00:00
Owner
Copy Link
Copy Source

Amazing troubleshooting @knoflook, nice one!

Mailu docs recommend running this after certs are regenerated: docker exec mailu_front_1 nginx -s reload

Is it possible that's enough, if the front container is indeed terminating TLS even for IMAP/SMTP connections? Maybe it's something we can add to the traefik-certdumper config? Or a separate service using inotifywatch to detect changes in certs and reload when there are new ones?

Amazing troubleshooting @knoflook, nice one! [Mailu docs recommend](https://mailu.io/master/maintain.html#external-certs) running this after certs are regenerated: `docker exec mailu_front_1 nginx -s reload` Is it possible that's enough, if the `front` container is indeed terminating TLS even for IMAP/SMTP connections? Maybe it's something we can add to the `traefik-certdumper` config? Or a separate service using `inotifywatch` to detect changes in certs and reload when there are new ones?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
3wordchant aadil (Aadil Ayub) abra-bot (Abra Bot) ammaratef45 amras (Sarma) Apfelwurm appletalk arjan basebuilder BornDeleuze Brooke carla cas (Cassowary) codegod100 coopcloud cyrnel decentral1se (d1) dede devydave fauno (fauno) flancian Frando iexos jade (Jade Ambrose) javielico (Javielico) jjsfunhouse jmakdah2 (Jackie Makdah) joe-irving (Joe Irving) kawaiipunk (KawaiiPunk) knoflook kolaente lambdabundesverband linnealovespie (April) marlon (marlon) mayel mirsal moosemower moritz nicksellen (Nick Sellen) notplants oxaliq (sorrel) p4u1 pau pharaohgraphy (Andrew 🐦‍🔥❤️‍🔥✴️) PhiNatalie renovate-bot (Comrade Renovate Bot) ripclap rix rscmbbng sef (sef) simon sixsmith (Sixsmith) stevensting tobias trav (Trav Fryer) val (val (he/him)) vaznasty virtualboys wolcen (Chris Thompson) wykwit xynosis yksflip
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/mailu#10