Deploying mailcow-dockerized with Coolify + Traefik

This repository ships the upstream mailcow-dockerized stack plus a small override (mailcow-dockerized/docker-compose.coolify.yml) to let Coolify's Traefik proxy front the web UI at mail.karmacoma.dev while leaving mail protocols (SMTP/IMAP/POP3/Sieve) bound directly on the host.

Official docs to keep handy:

mailcow: https://docs.mailcow.email/
Reverse proxy notes (mailcow): https://docs.mailcow.email/post_installation/reverse-proxy/
Coolify: https://docs.coolify.io/

Prerequisites

DNS already points mail.karmacoma.dev A/AAAA and MX to this host; PTR records match.
Host firewall allows TCP 25, 465, 587, 993, 995, 143, 110, 4190 and UDP/TCP 53 for DNS resolver traffic. Ports 80/443 stay open but will be used by Traefik.
Coolify is running with its built-in Traefik proxy. Note the proxy network name (UI: Infrastructure → Networks or docker network ls), typically coolify-proxy.

Prepare configuration

From mailcow-dockerized/, generate the base config if you have not already:
```
cd mailcow-dockerized
./generate_config.sh
```
Edit mailcow.conf:
- MAILCOW_HOSTNAME=mail.karmacoma.dev
- Leave HTTP_PORT=80 and HTTPS_PORT=443 (Traefik attaches via Docker network, not host binds).
- Ensure HTTP_REDIRECT=n so ACME HTTP-01 works through Traefik.
- Keep SKIP_LETS_ENCRYPT=n so mailcow issues its own cert for mail protocols.
- Optionally set TRUSTED_PROXIES=172.16.0.0/12 (defaulted in the override) to trust Coolify's proxy IP range.
Create a small .env (or set in Coolify) for the Traefik network if the default differs:
```
echo "TRAEFIK_NETWORK=coolify-proxy" > .env
```

Coolify deployment steps

Add a new Docker Compose service in Coolify pointing to this repository/branch.
Compose files:
- Primary: mailcow-dockerized/docker-compose.yml
- Override: mailcow-dockerized/docker-compose.coolify.yml
Environment file: point Coolify to mailcow-dockerized/mailcow.conf (and .env if you created one), or copy its contents into the UI env editor.
No additional ports need to be declared for HTTP/HTTPS—Traefik handles routing. Mail ports remain published by the base compose file.
Deploy. First start will pull all mailcow images and generate certificates in mailcow-dockerized/data/assets/ssl.

Routing behavior

Traefik forwards HTTP on entrypoint web to nginx-mailcow port 80 and enforces an HTTPS redirect.
Traefik passes through TLS on entrypoint websecure to nginx-mailcow port 443 so mailcow presents its own certificate (also used by Postfix/Dovecot/SOGo).
Other mail protocols continue to bind to the host as defined in the upstream compose.

Post-deploy checks

Browse https://mail.karmacoma.dev and ensure the UI loads through Traefik.
Verify certificates exist in mailcow-dockerized/data/assets/ssl/ and that Postfix/Dovecot advertise the correct hostname.
Send/receive a test message and confirm DNSBL lookups work (unbound container must resolve outbound DNS).

If you need to adjust anything later, edit mailcow.conf or tweak mailcow-dockerized/docker-compose.coolify.yml and redeploy from Coolify.

3.2 KiB Raw Blame History