How do I set up Stalwart (docker) behind Caddy (docker)?

Questions
6

The layer4.handlers.match module isn’t part of the caddy-l4 plugin – the correct module name for SNI matching within a layer4 route is layer4.matchers.tls (which you do have registered), and the Caddyfile syntax for it is different from what was suggested. Unfortunately the exact Caddyfile syntax for SNI-based passthrough using caddy-l4’s route/match directives is not covered in the Stalwart docs – the official Caddy doc example uses a plain reverse_proxy https://... block (with Caddy re-encrypting to Stalwart’s HTTPS listener), not a true TCP passthrough.

The simplest approach that is fully documented is to have Caddy terminate TLS for mail.mydomain.com and forward plain HTTP to Stalwart on port 8080, while Stalwart handles its own certs only for the mail ports (25, 465, 993). If you specifically need Stalwart to own the HTTPS cert too, the documented pattern from the Caddy guide is to use reverse_proxy with transport http { tls_server_name ... } – Caddy re-encrypts to Stalwart’s HTTPS listener on port 443 via the Docker network (not a raw passthrough):

mail.mydomain.com {
    reverse_proxy https://stalwart:443 {
        transport http {
            tls_server_name mail.mydomain.com
        }
    }
}

With this, Caddy does obtain its own cert for mail.mydomain.com (using your Cloudflare DNS challenge), and separately forwards over HTTPS to Stalwart which also needs a valid cert. This is the pattern shown in the official Caddy guide. For the Stalwart-side cert in this case, you can either use ACME within Stalwart, or copy Caddy’s cert into Stalwart as shown in the “Certificate management” section of that same doc.

The exact caddy-l4 Caddyfile syntax for SNI passthrough on port 443 is a Caddy-specific question beyond what the Stalwart docs cover – a community member familiar with caddy-l4 may be able to help with the correct syntax.

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong. If you found it useful, mention @helpbot in any reply to ask follow-up questions and the bot will respond again.