Issue Description
I am carefully following Docker | Stalwart to install Stalwart on a freshly-provisioned Debian 13 VM [1]. Setup goes smoothly, with me choosing the default options in the wizard of everything except
- host/domain name (page 1)
- My choosing automatic DNS management via Porkbun. I believe that Porkbun is set up correctly, with an API key and with API access enabled for the domain in question
However, when the instructions request me to visit https://my-hostname/admin I receive an error page in Firefox with the complaint that
mailbox.12rocks.io uses an invalid security certificate.
The certificate is not trusted because it is self-signed.
Error code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT
View Certificate
I know that stalwart is up: I can access http://my-hostname:8080/admin/ just fine. However logs are completely uninformative, with docker logs stalwart only reporting logs until the restart I issued as part of the guide (side note: where the hell are the logs???)
mailbox# docker logs stalwart
════════════════════════════════════════════════════════════
🔑 Stalwart bootstrap mode - temporary administrator account
username: admin
password: [REDACTED]
Use these credentials to complete the initial setup at the
/admin web UI. Once setup is done, Stalwart will provision a
permanent administrator and this temporary account will no
longer apply.
This password is shown only once. To pin a credential
instead, set STALWART_RECOVERY_ADMIN=admin:<password> in the
env file.
════════════════════════════════════════════════════════════
2026-06-01T04:02:17Z WARN Server started in bootstrap mode (server.bootstrap-mode) hostname = "e264acdf3a86", details = "No configuration file was found. Port 8080 is open for initial setup.", version = "0.16.7"
2026-06-01T04:02:18Z INFO Application resource updated (resource.application-updated) url = "https://github.com/stalwartlabs/webui/releases/latest/download/webui.zip", details = "Stalwart Web Interface"
2026-06-01T04:02:18Z INFO Network listener started (network.listen-start) listenerId = "http-recovery", localIp = ::, localPort = 8080, tls = false
2026-06-01T04:08:30Z ERROR Authentication error (auth.error) listenerId = "http-recovery", localPort = 8080, remoteIp = 172.17.0.1, remotePort = 38976, details = "Failed to decode token. If you are using an external OIDC provider, make sure it is configured as the default directory under the Authentication object.", causedBy = "crates/common/src/auth/oauth/token.rs:210", reason = "aead::Error", causedBy = "crates/http/src/auth/oauth/token.rs:235", details = "Failed to validate refresh token"
2026-06-01T04:08:36Z INFO Authentication successful (auth.success) listenerId = "http-recovery", localPort = 8080, remoteIp = 172.17.0.1, remotePort = 38976, accountName = "admin"
2026-06-01T04:14:03Z INFO Shutting down Stalwart Server (server.shutdown) causedBy = "SIGTERM"
Obviously TLS is broken: at a total guess, I suspect that it might have something to do with Porkbun integration being broken: I don’t see any records created for the relevant domain
Expected Behavior
I should be able to navigate to https://my-domain/admin without error like the guide instructs
Relevant Log Output
As mentioned earlier, docker logs stalwart is useless. From inside the container, nothing in /var/lib/stalwart/LOG appears to be interesting either (though it’s quite noisy so who knows?)
Stalwart Version
v0.16.x
Installation Method
Docker
Database Backend
RocksDB
Blob Storage
RocksDB
Search Engine
Internal
Directory Backend
Internal
I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
on
I have searched this support forum (open and closed topics) and confirm this is not a duplicate.
on
I understand that topics in this category are triaged by a bot first but a human reply will follow up. If I’d prefer a human-only reply, I’ll add the no-ai tag to my topic.
on