reformatting. added tips.

This commit is contained in:
Christoph Haas 2025-09-07 23:49:17 +02:00
parent 3c390fb1e5
commit 61ac1bb2ed
7 changed files with 61 additions and 22 deletions

View file

@ -8,9 +8,9 @@ sidebar:
import { Aside } from "@astrojs/starlight/components";
<Aside type="caution">
This page is only relevant if you already built a mail server using the ISPmail guide for Debian Bookworm. If you are
starting from scratch, just skip to the next page.
<Aside type="tip">
This page is only relevant if you already built a mail server using the previous ISPmail guide for Debian Bookworm. If
you are starting from scratch, just skip to the next page.
</Aside>
Did you follow the ISPmail guide for Debian Bookworm to install your mail server? Then let's take it to Debian Trixie.

View file

@ -9,7 +9,7 @@ sidebar:
import { Aside } from "@astrojs/starlight/components";
import { FileTree } from "@astrojs/starlight/components";
<Aside type="caution">
<Aside type="tip">
This page is only relevant if you will install Debian yourself. If your data center has provided you with a ready
Debian Trixie server, just skip this page.
</Aside>

View file

@ -55,13 +55,13 @@ In this section you will create the basic database `mailserver` and two users:
| mailserver | read | Used by Postfix/Dovecot |
| mailadmin | read/write | Used by you <br/> Used by Roundcube (for password changes) |
Use the _pwgen_ tool to create two random passwords for these users:
<Aside type="note" title="About passwords">
```sh
pwgen -s1 30 2
```
For now, create these database users with a placeholder password such as `MAILADMIN-PASSWORD-HERE`. Leave them as they
are—it will make copying and pasting the upcoming steps much easier. After youve confirmed everything is working
correctly, Ill show you how to update the passwords securely with a single command.
Take a note of the passwords or store them somewhere safe.
</Aside>
Create the database users:
@ -70,7 +70,7 @@ grant all privileges on mailserver.* to 'mailadmin'@'localhost' identified by 'M
grant select on mailserver.* to 'mailserver'@'127.0.0.1' identified by 'MAILSERVER-PASSWORD-HERE';
```
<Aside type="note" title="127.0.0.1 versus localhost">
<Aside type="tip" title="127.0.0.1 versus localhost">
Wait a minute. Why is there “127.0.0.1" instead of “localhost" in the second SQL command? Is that a typo? No, its not.
Well, in network terminology those two are identical. But MariaDB distinguishes between the two. If you initiate a

View file

@ -7,6 +7,7 @@ sidebar:
---
import StepListReceive from "../../../components/StepListReceive.astro";
import { Aside } from "@astrojs/starlight/components";
<StepListReceive currentStep={2} />
@ -31,7 +32,13 @@ So choose an FQDN for your mail server. For example I use `webmail.workaround.or
## Certbot
You already have the `certbot` software and the `apache2` web server installed. Requesting a certificate from Let's
Encrypt is as simple as running the next command. Please replace `mail.example.org` by the FQDN you chose.
Encrypt is as simple as running the next command.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```sh
certbot --apache --register-unsafely-without-email --agree-tos -d mail.example.org
@ -96,6 +103,9 @@ In /etc/letsencrypt/live/**mail.example.org** you will find a couple of files no
Your new certificate is only valid for 3 months. Fortunately the renewal is happening automatically. A _systemd timer_
checks your certificate frequently and triggers a renewal one month before it expires.
<details class="collapsible">
<summary>Click here to learn how the renewal works…</summary>
These commands will show you the definition and status of the timer and the renewal service:
```sh
@ -116,3 +126,5 @@ echo > /etc/letsencrypt/cli.ini "post-hook = systemctl reload postfix dovecot ap
```
Perfect. You won't have to worry about the certificate again.
</details>

View file

@ -82,8 +82,6 @@ This looks more sophisticated than with versions of Dovecot before 2.4. What it
### 10-master.conf
TODO: not needed. /var/run/dovecot/auth-userdb is created automatically.
This configuration file at `/etc/dovecot/conf.d/10-master.conf` deals with Dovecot's services.
So most settings are sane here and do not have to be changed. However one change is required in the “service auth"
@ -108,6 +106,12 @@ between the users and your mail server. You need to tell Dovecot where to find t
[ssl=required](https://doc.dovecot.org/2.4.1/core/config/ssl.html#how-to-specify-when-ssl-tls-is-required) to prevent
that someone sends their password without encryption.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```
ssl = required
ssl_server_cert_file = /etc/letsencrypt/live/mail.example.org/fullchain.pem
@ -224,10 +228,10 @@ doveadm user john@example.org
That should give you:
```
field value
uid vmail
gid vmail
home /var/vmail/example.org/john
field value
uid vmail
gid vmail
home /var/vmail/example.org/john
mail_path /var/vmail/example.org/john/Maildir
```

View file

@ -38,6 +38,7 @@ service lmtp {
user = postfix
group = postfix
}
}
```
The first `unix_listener lmtp` is just used internally by Dovecot and does not concern us. The second part is what you

View file

@ -64,7 +64,15 @@ HTTPS have been adapted already:
- **000-default-le-ssl.conf**: This is the HTTPS virtual host.
So to get Apache to serve the Roundcube application you need to edit the
`/etc/apache2/sites-available/000-default-le-ssl.conf` file and add/set:
`/etc/apache2/sites-available/000-default-le-ssl.conf` file.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
Set this:
```
ServerName mail.example.org
@ -96,10 +104,16 @@ In case of a problem run “`apache2ctl configtest`" to find the cause.
The main configuration file of Roundcube is located at `/etc/roundcube/config.inc.php`. Feel free to customize the file.
Fortunately nowadays the basic settings are already as we need them. However these two settings need to be changed by
you:
you.
<Aside type="danger" title="Important">
Please replace `mail.example.org` by the FQDN you chose.
</Aside>
```
$config['imap_host'] = "tls://mail.example.org:143";
$config['imap_host'] = 'tls://mail.example.org:143';
$config['smtp_host'] = 'tls://mail.example.org:587';
```
@ -108,6 +122,10 @@ So now when your users enter `https://webmail.example.org/` in their browser the
Keep in mind that we are using the email address as the account name of the user. So when logging in please enter the
email address as the user name. E.g. `john@example.org` and password `summersun`.
TODO: show login dialog
TODO: on errors, check /var/log/roundcube/errors.log
## Plugins
Roundcube comes with various plugins that you can offer your users. I suggest that you enable at least the **password**
@ -126,7 +144,7 @@ Plugins are configured through files located in the `/etc/roundcube/plugins` dir
password plugin:
```sh
cat > /etc/roundcube/plugins/password/config.inc.php << EOF
cat > /etc/roundcube/plugins/password/config.inc.php << 'EOF'
<?php
$config['password_driver'] = 'sql';
$config['password_minimum_length'] = 12;
@ -170,4 +188,8 @@ Try it. Log into Roundcube as `john@example.org` with password summersun.
Enter a new password twice. You should get a success message at the bottom right. Now logout and login with the new
password. Does it work? Great.
Before you get overly enthusiastic: you can't send emails from Roundcube yet.
<Aside type="tip" title="Important">
Before you get overly enthusiastic: you can't send emails from Roundcube yet. We will fix that now.
</Aside>