reformatting. added tips.

This commit is contained in:
Christoph Haas 2025-09-07 23:49:17 +02:00
parent 3c390fb1e5
commit 61ac1bb2ed
7 changed files with 61 additions and 22 deletions

View file

@ -8,9 +8,9 @@ sidebar:
import { Aside } from "@astrojs/starlight/components"; import { Aside } from "@astrojs/starlight/components";
<Aside type="caution"> <Aside type="tip">
This page is only relevant if you already built a mail server using the ISPmail guide for Debian Bookworm. If you are This page is only relevant if you already built a mail server using the previous ISPmail guide for Debian Bookworm. If
starting from scratch, just skip to the next page. you are starting from scratch, just skip to the next page.
</Aside> </Aside>
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie. Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.

View file

@ -9,7 +9,7 @@ sidebar:
import { Aside } from "@astrojs/starlight/components"; import { Aside } from "@astrojs/starlight/components";
import { FileTree } from "@astrojs/starlight/components"; import { FileTree } from "@astrojs/starlight/components";
<Aside type="caution"> <Aside type="tip">
This page is only relevant if you will install Debian yourself. If your data center has provided you with a ready This page is only relevant if you will install Debian yourself. If your data center has provided you with a ready
Debian Trixie server, just skip this page. Debian Trixie server, just skip this page.
</Aside> </Aside>

View file

@ -55,13 +55,13 @@ In this section you will create the basic database `mailserver` and two users:
| mailserver | read | Used by Postfix/Dovecot | | mailserver | read | Used by Postfix/Dovecot |
| mailadmin | read/write | Used by you <br/> Used by Roundcube (for password changes) | | mailadmin | read/write | Used by you <br/> Used by Roundcube (for password changes) |
Use the _pwgen_ tool to create two random passwords for these users: <Aside type="note" title="About passwords">
```sh For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
pwgen -s1 30 2 are—it will make copying and pasting the upcoming steps much easier. After youve confirmed everything is working
``` correctly, Ill show you how to update the passwords securely with a single command.
Take a note of the passwords or store them somewhere safe. </Aside>
Create the database users: Create the database users:
@ -70,7 +70,7 @@ grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'M
grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'MAILSERVER-PASSWORD-HERE'; grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'MAILSERVER-PASSWORD-HERE';
``` ```
<Aside type="note" title="127.0.0.1 versus localhost"> <Aside type="tip" title="127.0.0.1 versus localhost">
Wait a minute. Why is there “127.0.0.1" instead of “localhost" in the second SQL command? Is that a typo? No, its not. Wait a minute. Why is there “127.0.0.1" instead of “localhost" in the second SQL command? Is that a typo? No, its not.
Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a

View file

@ -7,6 +7,7 @@ sidebar:
--- ---
import StepListReceive from "../../../components/StepListReceive.astro"; import StepListReceive from "../../../components/StepListReceive.astro";
import { Aside } from "@astrojs/starlight/components";
<StepListReceive currentStep={2} /> <StepListReceive currentStep={2} />
@ -31,7 +32,13 @@ So choose an FQDN for your mail server. For example I use `webmail.workaround.or
## Certbot ## Certbot
You already have the `certbot` software and the `apache2` web server installed. Requesting a certificate from Let's You already have the `certbot` software and the `apache2` web server installed. Requesting a certificate from Let's
Encrypt is as simple as running the next command. Please replace `mail.example.org` by the FQDN you chose. Encrypt is as simple as running the next command.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```sh ```sh
certbot --apache --register-unsafely-without-email --agree-tos -d mail.example.org certbot --apache --register-unsafely-without-email --agree-tos -d mail.example.org
@ -96,6 +103,9 @@ In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files no
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_ Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
checks your certificate frequently and triggers a renewal one month before it expires. checks your certificate frequently and triggers a renewal one month before it expires.
<details class="collapsible">
<summary>Click here to learn how the renewal works…</summary>
These commands will show you the definition and status of the timer and the renewal service: These commands will show you the definition and status of the timer and the renewal service:
```sh ```sh
@ -116,3 +126,5 @@ echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot ap
``` ```
Perfect. You won't have to worry about the certificate again. Perfect. You won't have to worry about the certificate again.
</details>

View file

@ -82,8 +82,6 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
### 10-master.conf ### 10-master.conf
TODO: not needed. /var/run/dovecot/auth-userdb is created automatically.
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services. This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
So most settings are sane here and do not have to be changed. However one change is required in the “service auth" So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
@ -108,6 +106,12 @@ between the users and your mail server. You need to tell Dovecot where to find t
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent [ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
that someone sends their password without encryption. that someone sends their password without encryption.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
``` ```
ssl = required ssl = required
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem

View file

@ -38,6 +38,7 @@ service lmtp {
user = postfix user = postfix
group = postfix group = postfix
} }
}
``` ```
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you

View file

@ -64,7 +64,15 @@ HTTPS have been adapted already:
- **000-default-le-ssl.conf**: This is the HTTPS virtual host. - **000-default-le-ssl.conf**: This is the HTTPS virtual host.
So to get Apache to serve the Roundcube application you need to edit the So to get Apache to serve the Roundcube application you need to edit the
`/etc/apache2/sites-available/000-default-le-ssl.conf` file and add/set: `/etc/apache2/sites-available/000-default-le-ssl.conf` file.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
Set this:
``` ```
ServerName mail.example.org ServerName mail.example.org
@ -96,10 +104,16 @@ In case of a problem run “`apache2ctl configtest`" to find the cause.
The main configuration file of Roundcube is located at `/etc/roundcube/config.inc.php`. Feel free to customize the file. The main configuration file of Roundcube is located at `/etc/roundcube/config.inc.php`. Feel free to customize the file.
Fortunately nowadays the basic settings are already as we need them. However these two settings need to be changed by Fortunately nowadays the basic settings are already as we need them. However these two settings need to be changed by
you: you.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
``` ```
$config['imap_host'] = "tls://mail.example.org:143"; $config['imap_host'] = 'tls://mail.example.org:143';
$config['smtp_host'] = 'tls://mail.example.org:587'; $config['smtp_host'] = 'tls://mail.example.org:587';
``` ```
@ -108,6 +122,10 @@ So now when your users enter `https://webmail.example.org/` in their browser the
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
email address as the user name. E.g. `john@example.org` and password `summersun`. email address as the user name. E.g. `john@example.org` and password `summersun`.
TODO: show login dialog
TODO: on errors, check /var/log/roundcube/errors.log
## Plugins ## Plugins
Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password** Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password**
@ -126,7 +144,7 @@ Plugins are configured through files located in the `/etc/roundcube/plugins` dir
password plugin: password plugin:
```sh ```sh
cat > /etc/roundcube/plugins/password/config.inc.php << EOF cat > /etc/roundcube/plugins/password/config.inc.php << 'EOF'
<?php <?php
$config['password_driver'] = 'sql'; $config['password_driver'] = 'sql';
$config['password_minimum_length'] = 12; $config['password_minimum_length'] = 12;
@ -170,4 +188,8 @@ Try it. Log into Roundcube as `john@example.org` with password summersun.
Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new
password. Does it work? Great. password. Does it work? Great.
Before you get overly enthusiastic: you can't send emails from Roundcube yet. <Aside type="tip" title="Important">
Before you get overly enthusiastic: you can't send emails from Roundcube yet. We will fix that now.
</Aside>