Confused by documentation about admin password change (or using CLI at all)

[baterja]

I'm trying to set up the mail-server using docker-compose, behind Traefik proxy (so I opted out of LetsEncrypt setup during the configuration). I got the admin password from logs and wanted to change it. Let's look at the docs.
Starting there: https://stalw.art/docs/install/docker/#take-note-of-the-administrator-password
I have it running in docker so instead of installing the CLI locally I tried inside of the container:

root@465f1fedd606:/# stalwart-cli -u https://127.0.0.1:443 -c admin:<mypass> account list
Failed to send HTTP request: error sending request for url (https://127.0.0.1/admin/principal?&type=individual): error trying to connect: tls handshake eof

Oopsie, probably I cannot connect to a secured endpoint from localhost because I don't have HTTPS set up. Let's try unsecure way then:

root@465f1fedd606:/# stalwart-cli -u http://127.0.0.1 -c admin:<mypass> account list
Failed to send HTTP request: error sending request for url (http://127.0.0.1/admin/principal?&type=individual): error trying to connect: tcp connect error: Connection refused (os error 111)

Nope, also doesn't work. Then let's maybe try to find where is the endpoint CLI is trying to use defined, maybe I could configure it to allow HTTP. Searching the docs I found: https://stalw.art/docs/management/overview#usage. For some reason port 9990 is used there. Tried that: same error.

Yet another approach: looking into the .toml files. Found /etc/common/tls.toml:

[server.tls]
enable = true

Trying to disable it: still CLI connection is not allowed via HTTP.

I'm stuck. I could also try connecting from outside of the container via Traefik so HTTPS should work but possibly there's another easy method I haven't yet tried?

(I use default_directory = "internal", I know it might not work for other setups)

[typomedia]

Get the admin password from logs:

grep password /opt/stalwart-mail/logs/*

Just use the admin password:

stalwart-cli -u https://127.0.0.1:443 -c <PASSWORD> account list

[baterja]

I have the password, it's not the cause of my issue.

[mdecimus]

Based on this error

root@465f1fedd606:/# stalwart-cli -u https://127.0.0.1:443 -c admin:<mypass> account list
Failed to send HTTP request: error sending request for url (https://127.0.0.1/admin/principal?&type=individual): error trying to connect: tls handshake eof

It looks like TLS is not configured for port 443. Some things to check:

• Make sure Stalwart is listening on port 443 and not a different service.
• Check the TLS settings for your listener server.tls.enable is the global default but it can be overridden with server.<id>.tls.enable where <id> is the name of the listener.

[mdecimus]

The Stalwart CLI ignores self-signed certificates for localhost. However, if you have disabled implicit TLS and you are using port 443 (which is TLS by default) then you'll have to use http on port 443:

stalwart-cli -u http://127.0.0.1:443 -c admin:<mypass> account list

[baterja]

So I tried the following setup:

/etc/jmap/listener.toml:

[server.listener."jmap"]
protocol = "jmap"
bind = ["[::]:443"]
url = "https://%{HOST}%" #<-- also tried with http with the same result 

[server.listener."jmap".tls]
implicit = false #<-- changed there

and the result is still unfortunate:

root@4a2ed31d883f:/# stalwart-cli -u http://127.0.0.1:443 -c admin:<mypass> account list
Failed to send HTTP request: error sending request for url (http://127.0.0.1:443/admin/principal?&type=individual): connection closed before message complete

in the logs of the container:

TRACE utils::listener::listen: Failed to accept proxied TCP connection context="io" event="error" instance="jmap" protocol=Jmap reason=invalid proxy header

I have no idea what proxy header is meant by that log. I executed the command directly on the container itself 🤔

[mdecimus]

I have no idea what proxy header is meant by that log. I executed the command directly on the container itself 🤔

It seems that you have enabled the proxy protocol so Stalwart is expecting the proxy headers at the beginning of the connection.
In order to use the CLI you will have to use the URL of your proxy server instead, not the HTTP port on localhost.

[baterja]

Oh, you're right! I didn't expect not-proxied connections will stop working in that case. I'll check if it will solve the issue right away...

[baterja]

Yup, it works 🥳
Commented out (again) in /etc/common/server.toml:

# [server.proxy]
# trusted-networks = {"127.0.0.0/8", "::1", "10.0.0.0/8", "192.168.1.0/24"}

and:

root@986e5cc3113a:/# stalwart-cli -u http://127.0.0.1:443 -c admin:<mypass> account list

+--------------+
| Account Name |
+--------------+
| admin        |
+--------------+
| bill         |
+--------------+
| jane         |
+--------------+
| john         |
+--------------+
| sales        |
+--------------+
| support      |
+--------------+