diff --git a/de/getstarted/prerequisite-system/index.html b/de/getstarted/prerequisite-system/index.html index 270201415..98a3d7ab0 100644 --- a/de/getstarted/prerequisite-system/index.html +++ b/de/getstarted/prerequisite-system/index.html @@ -4077,7 +4077,7 @@

Unterstützte BetriebssystemeWichtig

mailcow nutzt Docker als Basis. Aufgrund von diversen technischen Unterschieden innerhalb der einzelnen Systeme unterstützen wir nicht alle Systeme, wo theoretisch Docker drauf läuft!

-

Die folgende Tabelle enthält alle von uns offiziell unterstützten und getesteten Betriebssysteme (Stand December 2024):

+

Die folgende Tabelle enthält alle von uns offiziell unterstützten und getesteten Betriebssysteme (Stand Dezember 2024):

@@ -4408,7 +4408,7 @@

MTU¶< - 2024-12-09 08:31:58 + 2024-12-09 08:32:30 diff --git a/search/search_index.json b/search/search_index.json index 1151dceed..7e85cfbf9 100644 --- a/search/search_index.json +++ b/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en","de"],"separator":"[\\s\\-,:!=\\[\\]()\"/]+|(?!\\b)(?=[A-Z][a-z])|\\.(?!\\d)|&[lg]t;","pipeline":["stemmer","stopWordFilter","trimmer"]},"docs":[{"location":"","title":"Information & Support","text":""},{"location":"#mailcow-dockerized-","title":"mailcow: dockerized - + =","text":"

The mailserver suite with the 'moo'

"},{"location":"#what-is-mailcow-dockerized","title":"What is mailcow: dockerized?","text":"

Question

Mailcow, MailCow or mailcow? What is the exact name of the project?

Correct: mailcow, because mailcow is a registered word mark with a small m

mailcow: dockerized is an open source groupware/email suite based on docker.

mailcow relies on many well known and long used components, which in combination result in an all around carefree email server.

Each container represents a single application, connected in a bridged network:

  • ACME Automatic generation of Let's Encrypt certificates
  • ClamAV Antivirus scanner (optional)
  • Dovecot IMAP/POP server for retrieving e-mails with integrated Full-Text Search Engine \"Flatcurve\"
  • MariaDB Database for storing user information etc.
  • Memcached Cache for the webmailer SOGo
  • Netfilter Fail2ban-like integration of @mkuron
  • Nginx Web server for components of the stack
  • Olefy Analysis of Office documents for viruses, macros, etc.
  • PHP Programming language of most web-based mailcow applications
  • Postfix MTA (Mail Transfer Agent) for e-mail traffic on the Internet
  • Redis Storage for spam information, DKIM key, etc.
  • Rspamd Spam filter with automatic learning of spam mails
  • SOGo Integrated webmailer and Cal-/Carddav interface
  • Solr Full text search for IMAP connections to quickly search emails (Deprecated) (Optional)
  • Unbound Integrated DNS server for verifying DNSSEC etc.
  • Watchdog For basic monitoring of the container status within mailcow

But the heart of mailcow is the graphical web interface, the mailcow UI.

It offers a place for almost all settings and allows the comfortable creation of new domains and email addresses with just a few clicks.

But also other or more tricky tasks can be done in it with ease:

  • DKIM and ARC support/generation.
  • Black and white lists per domain and per user.
  • Spam score management per user (reject spam, flag spam, greylist).
  • Allow mailbox users to create temporary spam aliases
  • Prepend email tags to subject or move emails to subfolders (per user)
  • Allow mailbox users to toggle TLS enforcement for inbound and outbound messages
  • Users can reset caches on SOGo ActiveSync devices
  • imapsync to periodically migrate or retrieve remote mailboxes
  • TFA: Yubikey OTP and WebAuthn USB (Google Chrome and derivatives only), TOTP
  • Add whitelist hosts to forward mail to mailcow
  • Fail2ban-like integration
  • Quarantine system
  • Anti-virus scanning including macro scanning in Office documents
  • Integrated basic monitoring
  • And much more...

The mailcow data (such as emails, user data, etc.) is stored in Docker volumes - take good care of these volumes:

  • clamd-db-vol-1
  • crypt-vol-1
  • mysql-socket-vol-1
  • mysql-vol-1
  • postfix-vol-1
  • redis-vol-1
  • rspamd-vol-1
  • sogo-userdata-backup-vol-1
  • sogo-web-vol-1
  • solr-vol-1
  • vmail-index-vol-1
  • vmail-vol-1

Warning

The mails are compressed and encrypted. The key pair can be found in crypt-vol-1. Please don't forget to backup this and other volumes. #nobackupnopity

"},{"location":"#support-the-mailcow-project","title":"Support the mailcow project","text":"

Please consider a support contract for a small monthly fee at Servercow1 to support further development. We support you while you support us. :)

If you are super awesome and would like to support without a contract, you can get a SAL (Stay-Awesome License) that confirms your awesomeness (a flexible one-time payment) at Servercow.

"},{"location":"#need-help","title":"Need help?","text":"

There are two ways to achieve support for your mailcow installation.

"},{"location":"#commercial-support","title":"Commercial support","text":"

For professional and prioritized commercial support you can sign a basic support subscription at Servercow. For custom inquiries or questions please contact us at info@servercow.de instead.

Furthermore we do also provide a fully featured and managed mailcow here. This way we take care about the technical magic underneath and you can enjoy your whole mail experience in a hassle-free way.

"},{"location":"#community-support-and-chat","title":"Community support and chat","text":"

The other alternative is our free community-support on our various channels below. Please notice, that this support is driven by our awesome community around mailcow. This kind of support is best-effort, voluntary and there is no guarantee for anything.

  • mailcow Community @ community.mailcow.email

  • Telegram (Support) @ t.me/mailcow

  • Telegram (Off-Topic) @ t.me/mailcowOfftopic

Telegram desktop clients are available for multiple platforms. You can search the groups history for keywords.

For bug tracking, feature requests and code contributions only:

  • mailcow/mailcow-dockerized @ GitHub
"},{"location":"#news-and-release-informations","title":"News and release informations","text":"

For announcements and release informations you can find us on:

  • mailcow @ X/Twitter

  • @doncow @ mailcow.social

Or alternatively on our blog:

  • mailcow.email
"},{"location":"#interested-try-it-out-right-away","title":"Interested? Try it out right away!","text":"

Have we got your interest? Get a first overview of the functionalities of mailcow and your mailcow UI in our official mailcow demos!

We\u00b4re providing two seperate Demo instances:

  • demo.mailcow.email is the classic Demo based on the stable releases.
  • nightly-demo.mailcow.email is the new nightly demo based on unreleased testing features. (So especially interesting for those who have no possibility to create a test instance themselves.)

Use these credentials for the demos

  • Administrator: admin / moohoo
  • Domain-Administrator: department / moohoo
  • Mailbox: demo@440044.xyz / moohoo

The login credentials work for both variants.

Always up to date

The demo instances get the latest updates directly after releases from GitHub. Fully automatic, without any downtime!

  1. Servercow is a hosting/support division of The Infrastructure Company GmbH (mailcow maintainer).\u00a0\u21a9

"},{"location":"backup_restore/b_n_r-accidental_deletion/","title":"Recover accidentally deleted data","text":"

So you deleted a mailbox and have no backups, he?

If you noticed your mistake within a few hours, you can probably recover the users data.

"},{"location":"backup_restore/b_n_r-accidental_deletion/#sogo","title":"SOGo","text":"

We automatically create daily backups (24h interval starting from running up -d) in /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/.

Make sure the user you want to restore exists in your mailcow. Re-create them if they are missing.

Copy the file named after the user you want to restore to __MAILCOW_DIRECTORY__/data/conf/sogo.

  1. Copy the backup: cp /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/restoreme@example.org __MAILCOW_DIRECTORY__/data/conf/sogo

  2. Run the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n
    docker-compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n

    Run sogo-tool without parameters to check for possible restore options.

  3. Delete the copied backup by running rm __MAILCOW_DIRECTORY__/data/conf/sogo

  4. Restart SOGo and Memcached:

docker compose (Plugin)docker-compose (Standalone) 
docker compose restart sogo-mailcow memcached-mailcow\n
docker-compose restart sogo-mailcow memcached-mailcow\n
"},{"location":"backup_restore/b_n_r-accidental_deletion/#mail","title":"Mail","text":"

In case of an accidental deletion of a mailbox, you will be able to recover for (by default) 5 days. This depends on the MAILDIR_GC_TIME parameter in mailcow.conf.

A deleted mailbox is copied in its encrypted form to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage.

The folder inside _garbage follows the structure [timestamp]_[domain_sanitized][user_sanitized], for example 1629109708_exampleorgtest in case of test@example.org deleted on 1629109708.

To restore make sure you are actually restoring to the same mailcow it was deleted from or you use the same encryption keys in crypt-vol-1.

Make sure the user you want to restore exists in your mailcow. Re-create them if they are missing.

Copy the folders from /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage/[timestamp]_[domain_sanitized][user_sanitized] back to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/[domain]/[user] and resync the folder and recalc the quota:

docker compose (Plugin)docker-compose (Standalone) 
docker compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
docker-compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker-compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
"},{"location":"backup_restore/b_n_r-backup/","title":"Backup","text":""},{"location":"backup_restore/b_n_r-backup/#backup","title":"Backup","text":""},{"location":"backup_restore/b_n_r-backup/#manual","title":"Manual","text":"

You can use the provided script helper-scripts/backup_and_restore.sh to backup mailcow automatically.

Danger

Please do not copy this script to another location.

To run a backup, write \"backup\" as first parameter and either one or more components to backup as following parameters. You can also use \"all\" as second parameter to backup all components. Append --delete-days n to delete backups older than n days.

# Syntax:\n# ./helper-scripts/backup_and_restore.sh backup (vmail|crypt|redis|rspamd|postfix|mysql|all|--delete-days)\n\n# Backup all, delete backups older than 3 days\n./helper-scripts/backup_and_restore.sh backup all --delete-days 3\n\n# Backup vmail, crypt and mysql data, delete backups older than 30 days\n./helper-scripts/backup_and_restore.sh backup vmail crypt mysql --delete-days 30\n\n# Backup vmail\n./helper-scripts/backup_and_restore.sh backup vmail\n
"},{"location":"backup_restore/b_n_r-backup/#variables-for-backuprestore-script","title":"Variables for backup/restore script","text":""},{"location":"backup_restore/b_n_r-backup/#multithreading","title":"Multithreading","text":"

With the 2022-10 update it is possible to run the script with multithreading support. This can be used for backups as well as for restores.

To start the backup/restore with multithreading you have to add THREADS as an environment variable in front of the command to execute the script.

THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n
The number after the = character indicates the number of threads. Please keep your core count -2 to leave enough CPU power for mailcow itself.

"},{"location":"backup_restore/b_n_r-backup/#backup-path","title":"Backup path","text":"

The script will ask you for a backup location. Inside of this location it will create folders in the format \"mailcow_DATE\". You should not rename those folders to not break the restore process.

To run a backup unattended, define MAILCOW_BACKUP_LOCATION as environment variable before starting the script:

MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

Tip

Both variables mentioned above can also be combined! Ex:\n```\nMAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n```\n
"},{"location":"backup_restore/b_n_r-backup/#cronjob","title":"Cronjob","text":"

You can run the backup script regularly via cronjob. Make sure BACKUP_LOCATION exists:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n5 4 * * * cd /opt/mailcow-dockerized/; MAILCOW_BACKUP_LOCATION=/mnt/mailcow_backups /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n

Per default cron sends the full result of each backup operation by email. If you want cron to only mail on error (non-zero exit code) you may want to use the following snippet. Pathes need to be modified according to your setup (this script is a user contribution).

This following script may be placed in /etc/cron.daily/mailcow-backup - do not forget to mark it as executable via chmod +x:

#!/bin/sh\n\n# Backup mailcow data\n# https://docs.mailcow.email/backup_restore/b_n_r-backup/\n\nset -e\n\nOUT=\"$(mktemp)\"\nexport MAILCOW_BACKUP_LOCATION=\"/opt/backup\"\nSCRIPT=\"/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh\"\nPARAMETERS=\"backup all\"\nOPTIONS=\"--delete-days 30\"\n\n# run command\nset +e\n\"${SCRIPT}\" ${PARAMETERS} ${OPTIONS} 2>&1 > \"$OUT\"\nRESULT=$?\n\nif [ $RESULT -ne 0 ]\n    then\n            echo \"${SCRIPT} ${PARAMETERS} ${OPTIONS} encounters an error:\"\n            echo \"RESULT=$RESULT\"\n            echo \"STDOUT / STDERR:\"\n            cat \"$OUT\"\nfi\n
"},{"location":"backup_restore/b_n_r-backup/#backup-strategy-with-rsync-and-mailcow-backup-script","title":"Backup strategy with rsync and mailcow backup script","text":"

Create the destination directory for mailcows helper script: 

mkdir -p /external_share/backups/backup_script\n

Create cronjobs: 

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n25 1 * * * rsync -aH --delete /opt/mailcow-dockerized /external_share/backups/mailcow-dockerized\n40 2 * * * rsync -aH --delete /var/lib/docker/volumes /external_share/backups/var_lib_docker_volumes\n5 4 * * * cd /opt/mailcow-dockerized/; BACKUP_LOCATION=/external_share/backups/backup_script /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n# If you want to, use the acl util to backup permissions of some/all folders/files: getfacl -Rn /path\n

On the destination (in this case /external_share/backups) you may want to have snapshot capabilities (ZFS, Btrfs etc.). Snapshot daily and keep for n days for a consistent backup. Do not rsync to a Samba share, you need to keep the correct permissions!

To restore you'd simply need to run rsync the other way round and restart Docker to re-read the volumes. Run:

docker compose (Plugin)docker-compose (Standalone) 
docker compose pull\ndocker compose up -d\n
docker-compose pull\ndocker-compose up -d\n

If you are lucky Redis and MariaDB can automatically fix the inconsistent databases (if they are inconsistent). In case of a corrupted database you'd need to use the helper script to restore the inconsistent elements. If a restore fails, try to extract the backups and copy the files back manually. Keep the file permissions!

"},{"location":"backup_restore/b_n_r-backup_restore-maildir/","title":"Maildir","text":""},{"location":"backup_restore/b_n_r-backup_restore-maildir/#backup","title":"Backup","text":"

This line backups the vmail directory to a file backup_vmail.tar.gz in the mailcow root directory:

docker compose (Plugin)docker-compose (Standalone) 
cd /path/to/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n
cd /path/to/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n

You can change the path by adjusting ${PWD} (which equals to the current directory) to any path you have write-access to. Set the filename backup_vmail.tar.gz to any custom name, but leave the path as it is. Example: [...] tar cvfz /backup/my_own_filename_.tar.gz

"},{"location":"backup_restore/b_n_r-backup_restore-maildir/#restore","title":"Restore","text":"docker compose (Plugin)docker-compose (Standalone) 
cd /path/to/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
cd /path/to/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
"},{"location":"backup_restore/b_n_r-backup_restore-mysql/","title":"MySQL (mysqldump)","text":""},{"location":"backup_restore/b_n_r-backup_restore-mysql/#backup","title":"Backup","text":"docker compose (Plugin)docker-compose (Standalone) 
cd /path/to/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
cd /path/to/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker-compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
"},{"location":"backup_restore/b_n_r-backup_restore-mysql/#restore","title":"Restore","text":"

Warning

docker compose (Plugin)docker-compose (Standalone)

You should redirect the SQL dump without docker compose to prevent parsing errors.

You should redirect the SQL dump without docker-compose to prevent parsing errors.

cd /path/to/mailcow-dockerized\nsource mailcow.conf\ndocker exec -i $(docker compose ps -q mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < backup_file.sql\n
"},{"location":"backup_restore/b_n_r-coldstandby/","title":"Cold-standby backup","text":"

mailcow offers an easy way to create a consistent copy of itself to be rsync'ed to a remote location without downtime.

This may also be used to transfer your mailcow to a new server.

"},{"location":"backup_restore/b_n_r-coldstandby/#you-should-know","title":"You should know","text":"

The provided script will work on default installations.

It may break when you use unsupported volume overrides. We don't support that and we will not include hacks to support that. Please run and maintain a fork if you plan to keep your changes.

The script will use the same paths as your default mailcow installation. That is the mailcow base directory - for most users /opt/mailcow-dockerized - as well as the mountpoints.

To find the paths of your source volumes we use docker inspect and read the destination directory of every volume related to your mailcow compose project. This means we will also transfer volumes you may have added in an override file. Local bind mounts may or may not work.

The script uses rsync with the --delete flag. The destination will be an exact copy of the source.

mariabackup is used to create a consistent copy of the SQL data directory.

After rsync'ing the data we will run the command below (depending on your set docker compose type in mailcow.conf) and remove old image tags from the destination:

docker compose (Plugin)docker-compose (Standalone) 
docker compose pull\n
docker-compose pull\n

Your source will not be changed at any time.

You may want to make sure to use the same /etc/docker/daemon.json on the remote target.

You should not run disk snapshots (e.g. via ZFS, LVM etc.) on the target at the very same time as this script is run.

Versioning is not part of this script, we rely on the destination (snapshots or backups). You may also want to use any other tool for that.

"},{"location":"backup_restore/b_n_r-coldstandby/#prepare","title":"Prepare","text":"

You will need an SSH-enabled destination and a keyfile to connect to said destination. The key should not be protected by a password for the script to work unattended.

In your mailcow base directory, e.g. /opt/mailcow-dockerized you will find a file create_cold_standby.sh.

Edit this file and change the exported variables:

export REMOTE_SSH_KEY=/path/to/keyfile\nexport REMOTE_SSH_PORT=22\nexport REMOTE_SSH_HOST=mailcow-backup.host.name\n

The key must be owned and readable by root only.

Both the source and destination require rsync >= v3.1.0. The destination must have Docker and docker compose v2 available.

The script will detect errors automatically and exit.

You may want to test the connection by running ssh mailcow-backup.host.name -p22 -i /path/to/keyfile.

Important for switching to a different architecture

If you plan to use the Cold Standby script to migrate from x86 to ARM64 or vice versa, simply let the script run normally. The script will automatically recognize whether there are differences between the source and the target in terms of architecture and will behave accordingly and omit affected volumes from the sync.

The reason for this is that Rspamd compiles regexp entries from our configurations to the corresponding platform and these cache files cannot be read when changing platforms. Rspamd would then crash and make it impossible to use mailcow in a meaningful way. Therefore the rspamd-vol-1 (Rspamd volume) will be ommited during the usage of the Cold-standby script.

Don't worry! Rspamd will still work correctly after the migration as it generates these cache files automatically for the new platform.

"},{"location":"backup_restore/b_n_r-coldstandby/#backup-and-refresh-the-cold-standby","title":"Backup and refresh the cold-standby","text":"

Run the first backup, this may take a while depending on the connection:

bash /opt/mailcow-dockerized/create_cold_standby.sh\n

That was easy, wasn't it?

Updating your cold-standby is just as easy:

bash /opt/mailcow-dockerized/create_cold_standby.sh\n

It's the same command.

"},{"location":"backup_restore/b_n_r-coldstandby/#automated-backups-with-cron","title":"Automated backups with cron","text":"

First make sure that the cron service is enabled and running:

systemctl enable cron.service && systemctl start cron.service\n

To automate the backups to the cold-standby server you can use a cron job. To edit the cron jobs for the root user run:

crontab -e\n

Add the following lines to synchronize the cold standby server daily at 03:00. In this example errors of the last execution are logged into a file.

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n0 3 * * * bash /opt/mailcow-dockerized/create_cold_standby.sh 2> /var/log/mailcow-coldstandby-sync.log\n

If saved correctly, the cron job should be shown by typing:

crontab -l\n
"},{"location":"backup_restore/b_n_r-restore/","title":"Restore","text":""},{"location":"backup_restore/b_n_r-restore/#restore","title":"Restore","text":""},{"location":"backup_restore/b_n_r-restore/#variables-for-backuprestore-script","title":"Variables for backup/restore script","text":""},{"location":"backup_restore/b_n_r-restore/#multithreading","title":"Multithreading","text":"

With the 2022-10 update it is possible to run the script with multithreading support. This can be used for backups as well as for restores.

To start the backup/restore with multithreading you have to add THREADS as an environment variable in front of the command to execute the script.

THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n
The number after the = character indicates the number of threads. Please keep your core count -2 to leave enough CPU power for mailcow itself.

"},{"location":"backup_restore/b_n_r-restore/#backup-path","title":"Backup path","text":"

The script will ask you for a backup location. Inside of this location it will create folders in the format \"mailcow_DATE\". You should not rename those folders to not break the restore process.

To run a backup unattended, define MAILCOW_BACKUP_LOCATION as environment variable before starting the script:

MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

Tip

Both variables mentioned above can also be combined! Ex: 

MAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

"},{"location":"backup_restore/b_n_r-restore/#restoring-data","title":"Restoring Data","text":"

Danger

Please do not copy this script to another location.

Warning

To restore a backup on a new system, mailcow must be initialized and running! Therefore, reinstall mailcow according to the instructions and wait to proceed with the restoration until mailcow is up and running in an empty state.

Danger for older installations

Before restoring your mailcow system on a new server and a clean mailcow-dockerized folder, please check if the value MAILDIR_SUB is set in your mailcow.conf. If this value is not set, do not set it in your new mailcow or remove it, otherwise NO emails will be displayed. Dovecot loads emails from the mentioned subfolder of the Maildir volume under $DOCKER_VOLUME_PATH/mailcowdockerized_vmail-vol-1 and if there is any change compared to the original state, no emails will be available there.

To run a restore, start mailcow, use the script with \"restore\" as first parameter.

# Syntax:\n# ./helper-scripts/backup_and_restore.sh restore\n

The script will ask you for a backup location containing the mailcow_DATE folders:

Backup location (absolute path, starting with /): /opt/backup\n

All available backups in the specified folder (in our example /opt/backup) are then displayed:

Found project name mailcowdockerized\n[ 1 ] - /opt/backup/mailcow-2023-12-11-13-27-14/\n[ 2 ] - /opt/backup/mailcow-2023-12-11-14-02-06/\n

Now you can enter the number of your backup that you want to restore, in this example the 2nd backup:

Select a restore point: 2\n

The script will now display all the backed up components that you can restore, in our case we have selected all for the backup process, so this will now appear here:

[ 0 ] - all\n[ 1 ] - Crypt data\n[ 2 ] - Rspamd data\n[ 3 ] - Mail directory (/var/vmail)\n[ 4 ] - Redis DB\n[ 5 ] - Postfix data\n[ 6 ] - SQL DB\n

Again, we select the component that we want to restore. Option 0 restores EVERYTHING.

If you want to restore to a different architecture...

If you have made the backup on a different architecture, e.g. x86, and now want to restore this backup to ARM64, the backup of Rspamd is displayed as incompatible and cannot be selected individually. When restoring with the 0 key, the restoration of Rspamd is also skipped.

Example of incompatible Rspamd backup in the selection menu:

[...]\n[ NaN ] - Rspamd data (incompatible Arch, cannot restore it)\n[...]\n

Now mailcow will restore the backups you have selected. Please note that the restoration may take some time, depending on the size of the backups.

"},{"location":"client/client-android/","title":"Android","text":"
  1. Open the Email app.
  2. If this is your first email account, tap Add Account; if not, tap More and Settings and then Add account.
  3. Select Microsoft Exchange ActiveSync.
  4. Enter your email address () and password.
  5. Tap Sign in.
"},{"location":"client/client-apple/","title":"Apple macOS / iOS","text":""},{"location":"client/client-apple/#method-1-configuration-profile","title":"Method 1: Configuration Profile","text":"

Email, contacts and calendars can be configured automatically on Apple devices by installing a configuration profile. To download such a profile you must login to the mailcow UI with the desired email account first.

"},{"location":"client/client-apple/#method-11-imap-and-smtp","title":"Method 1.1: IMAP and SMTP","text":"

This method configures IMAP and SMTP to access an email account.

  1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_emailmailcow.mobileconfig to download a customized configuration profile.
  2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
    • Steps for macOS
    • Steps for iOS
  3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
"},{"location":"client/client-apple/#method-12-imap-smtp-and-calcarddav","title":"Method 1.2: IMAP, SMTP and Cal/CardDAV","text":"

This method configures CardDAV (address book) and CalDAV (calendar) in addition to the email account.

  1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.phpmailcow.mobileconfig to download a customized configuration profile.
  2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
    • Steps for macOS
    • Steps for iOS
  3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
"},{"location":"client/client-apple/#method-13-imap-and-smtp-with-app-password","title":"Method 1.3: IMAP and SMTP with App Password","text":"

This method configures IMAP and SMTP to access an email account. A new app password is generated and added to the profile so that no password needs to be entered when setting up your device. Please do not share the file as it grants full access to your mailbox.

  1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_passwordmailcow.mobileconfig to download a customized configuration profile.
  2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
    • Steps for macOS
    • Steps for iOS
  3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
"},{"location":"client/client-apple/#method-14-imap-smtp-and-calcarddav-with-app-password","title":"Method 1.4: IMAP, SMTP and Cal/CardDAV with App Password","text":"

This method configures CardDAV (address book) and CalDAV (calendar) in addition to the email account. A new app password is generated and added to the profile so that no password needs to be entered when setting up your device. Please do not share the file as it grants full access to your mailbox.

  1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?app_passwordmailcow.mobileconfig to download a customized configuration profile.
  2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
    • Steps for macOS
    • Steps for iOS
  3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
"},{"location":"client/client-apple/#method-2-exchange-activesync-emulation","title":"Method 2: Exchange ActiveSync emulation","text":"

On iOS/iPadOS, Exchange ActiveSync is also supported as an alternative to the procedure above. It has the advantage of supporting push email (i.e. you are immediately notified of incoming messages), but has some limitations, e.g. it does not support more than three email addresses per contact in your address book. Follow the steps below if you decide to use Exchange instead.

  1. Follow Apple's instructions for your version of iOS/iPadOS and select Microsoft Exchange as email service.
  2. Enter your email address () and tap Next.
  3. Select Manual Configuration when asked if your mail address should be sent to Microsoft.
  4. Enter your password, tap Next again. With Two-factor authentication enabled, you have to use an app password instead of your regular password.
  5. Finally, tap Save.
"},{"location":"client/client-emclient/","title":"eM Client","text":"
  1. Launch eM Client.
  2. If this is the first time you launched eM Client, it asks you to set up your account. Proceed to step 4.
  3. Go to Menu at the top, select Tools and Accounts.
  4. Enter your email address () and click Start Now.
  5. Enter your password and click Continue.
  6. Enter your name () and click Next.
  7. Click Finish.
"},{"location":"client/client-kontact/","title":"KDE Kontact","text":"
  1. Launch Kontact.
  2. If this is the first time you launched Kontact or KMail, it asks you to set up your account. Proceed to step 4.
  3. Go to Mail in the sidebar. Go to the Tools menu and select Account Wizard.
  4. Enter your name (), email address () and your password. Click Next.
  5. Click Create Account. If prompted, re-enter your password and click OK.
  6. Close the window by clicking Finish.
  7. Go to Calendar in the sidebar.
  8. Go to the Settings menu and select Configure KOrganizer.
  9. Go to the Calendars tab and click the Add button.
  10. Choose DAV groupware resource and click OK.
  11. Enter your email address () and your password. Click Next.
  12. Select ScalableOGo from the dropdown menu and click Next.
  13. Enter your mailcow hostname into the Host field and click Next.
  14. Click Test Connection and then Finish. Finally, click OK twice.

Once you have set up Kontact, you can also use KMail, KOrganizer and KAddressBook individually.

"},{"location":"client/client-manual/","title":"Manual configuration","text":"

These instructions are valid for unchanged port bindings only!

"},{"location":"client/client-manual/#email","title":"Email","text":"Service Encryption Host Port IMAP STARTTLS mailcow hostname 143 IMAPS SSL mailcow hostname 993 POP3 STARTTLS mailcow hostname 110 POP3S SSL mailcow hostname 995 SMTP STARTTLS mailcow hostname 587 SMTPS SSL mailcow hostname 465

Please use the \"plain\" password setting as the authentication mechanism. Contrary to what the name implies, the password will not be transferred to the server in plain text as no authentication is allowed to take place without TLS.

"},{"location":"client/client-manual/#contacts-and-calendars","title":"Contacts and calendars","text":"

SOGos default calendar (CalDAV) and contacts (CardDAV) URLs:

  1. CalDAV https://mail.example.com/SOGo/dav/user@example.com/Calendar/personal/https:///SOGo/dav//Calendar/personal/

  2. CardDAV https://mail.example.com/SOGo/dav/user@example.com/Contacts/personal/https:///SOGo/dav//Contacts/personal/

Some applications may require you to use https://mail.example.com/SOGo/dav/https:///SOGo/dav/ or the full path to your calendar, which can be found and copied from within SOGo.

"},{"location":"client/client-outlook/","title":"Microsoft Outlook","text":"
  1. Download and install Outlook CalDav Synchronizer.
  2. Launch Outlook.
  3. If this is the first time you launched Outlook, it asks you to set up your account. Proceed to step 5.
  4. Go to the File menu and click Add Account.
  5. Enter your name (), email address () and your password. Click Next.
  6. Click Finish.
  7. Go to the CalDav Synchronizer ribbon and click Synchronization Profiles.
  8. Click the second button at top (Add multiple profiles), select Sogo, click Ok.
  9. Click the Get IMAP/POP3 account settings button.
  10. Click Discover resources and assign to Outlook folders.
  11. In the Select Resource window that pops up, select your main calendar (usually Personal Calendar), click the ... button, assign it to Calendar, and click OK. Go to the Address Books and Tasks tabs and repeat repeat the process accordingly. Do not assign multiple calendars, address books or task lists!
  12. Close all windows with the OK buttons.
"},{"location":"client/client-outlook/#outlook-2016-or-higher-from-office-365-on-windows","title":"Outlook 2016 or higher from Office 365 on Windows","text":"

This is only applicable if your server administrator has not disabled EAS for Outlook. If it is disabled, please follow the guide for Outlook 2007 instead.

Outlook 2016 has an issue with autodiscover. Only Outlook from Office 365 is affected. If you installed Outlook from another source, please follow the guide for Outlook 2013 or higher.

For EAS you must use the old assistant by launching C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OLCFG.EXE. If this application opens, you can go to step 4 of the guide for Outlook 2013 below.

If it does not open, you can completely disable the new account creation wizard and follow the guide for Outlook 2013 below.

"},{"location":"client/client-outlook/#outlook-2007-or-2010-on-windows","title":"Outlook 2007 or 2010 on Windows","text":""},{"location":"client/client-outlook/#outlook-2007-or-higher-on-windows-calendercontacts-via-caldav-synchronizer","title":"Outlook 2007 or higher on Windows (Calender/Contacts via CalDav Synchronizer)","text":""},{"location":"client/client-outlook/#outlook-2013-or-higher-on-windows-active-sync-not-recommended","title":"Outlook 2013 or higher on Windows (Active Sync - not recommended)","text":"

This is only applicable if your server administrator has not disabled EAS for Outlook. If it is disabled, please follow the guide for Outlook 2007 instead.

  1. Launch Outlook.
  2. If this is the first time you launched Outlook, it asks you to set up your account. Proceed to step 4.
  3. Go to the File menu and click Add Account.
  4. Enter your name (), email address () and your password. Click Next.
  5. When prompted, enter your password again, check Remember my credentials and click OK.
  6. Click the Allow button.
  7. Click Finish.
"},{"location":"client/client-outlook/#outlook-2011-or-higher-on-macos","title":"Outlook 2011 or higher on macOS","text":"

The Mac version of Outlook does not synchronize calendars and contacts and therefore is not supported.

"},{"location":"client/client-thunderbird/","title":"Mozilla Thunderbird","text":"
  1. Launch Thunderbird.
  2. If this is the first time you launched Thunderbird, it asks you whether you would like a new email address. Click Skip this and use my existing email and proceed to step 4.
  3. Go to the File menu and select New, Existing Mail Account....
  4. Enter your name (), email address () and your password. Make sure the Remember password checkbox is selected and click Continue.
  5. Once the configuration has been automatically detected, make sure IMAP is selected and click Done.
  6. To use your contacts from the server, click on the arrow next to \"Address Books\" and click the Connect button on each address book you would like to use.
  7. To use your calendars from the server, click on the arrow next to \"Calendars\" and click the Connect button on each calendar you would like to use.
  8. (Optional) If you want Thunderbird to sync all subfolders, go to the Account Settings menu and select Server Settings. In the Server Settings tab, click on the Advanced button. In the Advanced Account Settings window, uncheck the \"Show only subscribed folders\" checkbox. Click OK to save the changes.
  9. Click Finish to close the Account Setup window.
"},{"location":"client/client-windows/","title":"Windows Mail","text":"

Windows 8 and higher support email, contacts and calendar via Exchange ActiveSync.

  1. Open the Mail app.
  2. If you have not previously used Mail, you can click Add Account in the main window. Proceed to step 4.
  3. Click Accounts in the sidebar on the left, then click Add Account on the far right.
  4. Select Exchange.
  5. Enter your email address () and click Next.
  6. Enter your password and click Log in.

Once you have set up the Mail app, you can also use the People and Calendar apps.

"},{"location":"client/client/","title":"Overview","text":"

mailcow supports a variety of email clients, both on desktop computers and on smartphones. Below, you can find a number of configuration guides that explain how to configure your mailcow account.

Tip

If you access this page by logging into your mailcow server and clicking the \"Show configuration guides for email clients and smartphones\" link, all of the guides will be personalized with your email address and server name.

Success

Since you accessed this page after logging into your mailcow server, all of the guides have been personalized with your email address and server name.
  • Android
  • Apple iOS / macOS
  • eM Client
  • KDE Kontact / KMail
  • Microsoft Outlook
  • Mozilla Thunderbird
  • Windows Mail
  • Manual configuration
"},{"location":"getstarted/install/","title":"Install mailcow","text":"

It's the same

The installation is exactly the same on x86 and ARM64 platforms!

"},{"location":"getstarted/install/#docker-and-docker-compose-installation","title":"Docker and Docker Compose Installation","text":"

You need Docker (a version >= 24.0.0 is required) and Docker Compose (a version >= 2.0 is required).

Learn how to install Docker and Docker Compose.

Quick installation for most operation systems:

"},{"location":"getstarted/install/#docker","title":"Docker","text":"
curl -sSL https://get.docker.com/ | CHANNEL=stable sh\n# After the installation process is finished, you may need to enable the service and make sure it is started (e.g. CentOS 7)\nsystemctl enable --now docker\n
"},{"location":"getstarted/install/#docker-compose","title":"docker compose","text":"

Danger

mailcow requires the latest version of docker compose v2. If Docker was installed using the script above, the Docker Compose plugin is already automatically installed in a version >=2.0. Is your mailcow installation older or Docker was installed in a different way, the Compose plugin or the standalone version of Docker must be installed manually.

"},{"location":"getstarted/install/#installation-via-paketmanager-plugin","title":"Installation via Paketmanager (plugin)","text":"

Info

This approach with the package sources is only possible if the Docker repository has been included. This can happen either through the instructions above (see Docker) or through a manually integration.

On Debian/Ubuntu systems: 

apt update\napt install docker-compose-plugin\n

On Centos 7 systems: 

yum update\nyum install docker-compose-plugin\n

Danger

The Docker Compose command syntax is docker compose for the plugin variant of Docker Compose!!!

"},{"location":"getstarted/install/#installation-via-script-standalone","title":"Installation via Script (standalone)","text":"

Info

This installation is the old familiar way. It installs Docker Compose as a standalone program and does not rely on the Docker installation way.

LATEST=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/docker/compose/releases/latest) && LATEST=${LATEST##*/} && curl -L https://github.com/docker/compose/releases/download/$LATEST/docker-compose-$(uname -s)-$(uname -m) > /usr/local/bin/docker-compose\nchmod +x /usr/local/bin/docker-compose\n

Danger

The Docker Compose command syntax is docker-compose for the standalone variant of Docker Compose!!!

Please use the latest Docker engine available and do not use the engine that ships with your distros repository.

"},{"location":"getstarted/install/#check-selinux-specifics","title":"Check SELinux specifics","text":"

On SELinux enabled systems, e.g. CentOS 7:

  • Check if \"container-selinux\" package is present on your system:
rpm -qa | grep container-selinux\n

If the above command returns an empty or no output, you should install it via your package manager.

  • Check if docker has SELinux support enabled:
docker info | grep selinux\n

If the above command returns an empty or no output, create or edit /etc/docker/daemon.json and add \"selinux-enabled\": true. Example file content:

{\n  \"selinux-enabled\": true\n}\n

Restart the docker daemon and verify SELinux is now enabled.

This step is required to make sure mailcows volumes are properly labeled as declared in the compose file. If you are interested in how this works, you can check out the readme of https://github.com/containers/container-selinux which links to a lot of useful information on that topic.

"},{"location":"getstarted/install/#install-mailcow","title":"Install mailcow","text":"

Clone the master branch of the repository, make sure your umask equals 0022. Please clone the repository as root user and also control the stack as root. We will modify attributes - if necessary - while bootstrapping the containers automatically and make sure everything is secured. The update.sh script must therefore also be run as root. It might be necessary to change ownership and other attributes of files you will otherwise not have access to. We drop permissions for every exposed application and will not run an exposed service as root! Controlling the Docker daemon as non-root user does not give you additional security. The unprivileged user will spawn the containers as root likewise. The behaviour of the stack is identical.

$ su\n# umask\n0022 # <- Verify it is 0022\n# cd /opt\n# git clone https://github.com/mailcow/mailcow-dockerized\n# cd mailcow-dockerized\n
"},{"location":"getstarted/install/#initialize-mailcow","title":"Initialize mailcow","text":"

Generate a configuration file. Use a FQDN (host.domain.tld) as hostname when asked. 

./generate_config.sh\n

Change configuration if you want or need to. 

nano mailcow.conf\n
If you plan to use a reverse proxy, you can, for example, bind HTTPS to 127.0.0.1 on port 8443 and HTTP to 127.0.0.1 on port 8080.

You may need to stop an existing pre-installed MTA which blocks port 25/tcp. See this chapter to learn how to reconfigure Postfix to run besides mailcow after a successful installation.

Some updates modify mailcow.conf and add new parameters. It is hard to keep track of them in the documentation. Please check their description and, if unsure, ask at the known channels for advise.

"},{"location":"getstarted/install/#troubleshooting","title":"Troubleshooting","text":""},{"location":"getstarted/install/#users-with-a-mtu-not-equal-to-1500-eg-openstack","title":"Users with a MTU not equal to 1500 (e.g. OpenStack)","text":"

Whenever you run into trouble and strange phenomena, please check your MTU.

Edit docker-compose.yml and change the network settings according to your MTU. Add the new driver_opts parameter like this: 

networks:\n  mailcow-network:\n    ...\n    driver_opts:\n      com.docker.network.driver.mtu: 1450\n    ...\n

"},{"location":"getstarted/install/#users-without-an-ipv6-enabled-network-on-their-host-system","title":"Users without an IPv6 enabled network on their host system","text":"

Please don't turn off IPv6, even if you don't like it. IPv6 is the future and should not be ignored.

If you do not have an IPv6 enabled network on your host and you don't care for a better internet (thehe), it is recommended to disable IPv6 for the mailcow network to prevent unforeseen issues.

"},{"location":"getstarted/install/#start-mailcow","title":"Start mailcow","text":"

Pull the images and run the compose file. The parameter -d will start mailcow: dockerized detached:

docker compose (Plugin)docker-compose (Standalone) 
docker compose pull\ndocker compose up -d\n
docker-compose pull\ndocker-compose up -d\n

Done!

You can now access https://${MAILCOW_HOSTNAME} with the default credentials admin + password moohoo.

Info

If you are not using mailcow behind a reverse proxy, you should redirect all HTTP requests to HTTPS.

The database will be initialized right after a connection to MySQL can be established.

Your data will persist in multiple Docker volumes, that are not deleted when you recreate or delete containers. Run docker volume ls to see a list of all volumes. You can safely run docker compose down without removing persistent data.

"},{"location":"getstarted/prerequisite-dns/","title":"DNS setup","text":"

Below you can find a list of recommended DNS records. While some are mandatory for a mail server (A, MX), others are recommended to build a good reputation score (TXT/SPF) or used for auto-configuration of mail clients (SRV).

"},{"location":"getstarted/prerequisite-dns/#references","title":"References","text":"
  • A good article covering all relevant topics: \"3 DNS Records Every Email Marketer Must Know\"
  • Another great one, but Zimbra as an example platform: \"Best Practices on Email Protection: SPF, DKIM and DMARC\"
  • An in-depth discussion of SPF, DKIM and DMARC: \"How to eliminate spam and protect your name with DMARC\"
  • A thorough guide on understanding DMARC: \"Demystifying DMARC: A guide to preventing email spoofing\"
"},{"location":"getstarted/prerequisite-dns/#reverse-dns-of-your-ip-address","title":"Reverse DNS of your IP address","text":"

Make sure that the PTR record of your IP address matches the FQDN of your mailcow host: ${MAILCOW_HOSTNAME} 1. This record is usually set at the provider you leased the IP address (server) from. Please make sure that you create the record for IPv4 and IPv6 address (if you are using IPv6)!

"},{"location":"getstarted/prerequisite-dns/#the-minimal-dns-configuration","title":"The minimal DNS configuration","text":"

This example shows you a set of records for one domain managed by mailcow. Each domain that is added to mailcow needs at least this set of records to function correctly.

# Name              Type       Value\nmail                IN A       1.2.3.4\nautodiscover        IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})\nautoconfig          IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})\n@                   IN MX 10   mail.example.org. (your ${MAILCOW_HOSTNAME})\n

Note: The mail DNS record which binds the subdomain to the given ip address must only be set for the domain on which mailcow is running and that is used to access the web interface. For every other mailcow managed domain, the MX record will route the traffic.

"},{"location":"getstarted/prerequisite-dns/#dkim-spf-and-dmarc","title":"DKIM, SPF and DMARC","text":"

In the example DNS zone file snippet below, a simple SPF TXT record is used to only allow THIS server (the MX) to send mail for your domain. Every other server is disallowed but able to (\"~all\"). Please refer to SPF Project for further reading.

# Name              Type       Value\n@                   IN TXT     \"v=spf1 mx a -all\"\n

It is highly recommended to create a DKIM TXT record in your mailcow UI and set the corresponding TXT record in your DNS records. Please refer to OpenDKIM for further reading.

# Name              Type       Value\ndkim._domainkey     IN TXT     \"v=DKIM1; k=rsa; t=s; s=email; p=...\"\n

The last step in protecting yourself and others is the implementation of a DMARC TXT record, for example by using the DMARC Assistant (check).

# Name              Type       Value\n_dmarc              IN TXT     \"v=DMARC1; p=reject; rua=mailto:mailauth-reports@example.org\"\n
"},{"location":"getstarted/prerequisite-dns/#the-advanced-dns-configuration","title":"The advanced DNS configuration","text":"

SRV records specify the server(s) for a specific protocol on your domain. If you want to explicitly announce a service as not provided, give \".\" as the target address (instead of \"mail.example.org.\"). Please refer to RFC 2782.

# Name              Type       Priority Weight Port    Value\n_autodiscover._tcp  IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_caldavs._tcp       IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_caldavs._tcp       IN TXT                              \"path=/SOGo/dav/\"\n_carddavs._tcp      IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_carddavs._tcp      IN TXT                              \"path=/SOGo/dav/\"\n_imap._tcp          IN SRV     0        1      143      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_imaps._tcp         IN SRV     0        1      993      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_pop3._tcp          IN SRV     0        1      110      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_pop3s._tcp         IN SRV     0        1      995      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_sieve._tcp         IN SRV     0        1      4190     mail.example.org. (your ${MAILCOW_HOSTNAME})\n_smtps._tcp         IN SRV     0        1      465      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_submission._tcp    IN SRV     0        1      587      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_submissions._tcp   IN SRV     0        1      465      mail.example.org. (your ${MAILCOW_HOSTNAME})\n
"},{"location":"getstarted/prerequisite-dns/#testing","title":"Testing","text":"

Here are some tools you can use to verify your DNS configuration:

  • MX Toolbox (DNS, SMTP, RBL)
  • port25.com (DKIM, SPF)
  • Mail-tester (DKIM, DMARC, SPF)
  • DMARC Analyzer (DMARC, SPF)
  • MultiRBL.valli.org (DNSBL, RBL, FCrDNS)
"},{"location":"getstarted/prerequisite-dns/#misc","title":"Misc","text":""},{"location":"getstarted/prerequisite-dns/#optional-dmarc-statistics","title":"Optional DMARC Statistics","text":"

If you are interested in statistics, you can additionally register with some of the many below DMARC statistic services - or self-host your own.

Tip

It is worth considering that if you request DMARC statistic reports to your mailcow server and your mailcow server is not configured correctly to receive these reports, you may not get accurate and complete results. Please consider using an alternative email domain for receiving DMARC reports.

It is worth mentioning, that the following suggestions are not a comprehensive list of all services and tools available, but only a small few of the many choices.

  • Postmaster Tool
  • parsedmarc (self-hosted)
  • Fraudmarc
  • Postmark
  • Dmarcian

Tip

These services may provide you with a TXT record you need to insert into your DNS records as the provider specifies. Please ensure you read the provider's documentation from the service you choose as this process may vary.

"},{"location":"getstarted/prerequisite-dns/#email-test-for-spf-dkim-and-dmarc","title":"Email test for SPF, DKIM and DMARC:","text":"

To run a rudimentary email authentication check, send a mail to check-auth at verifier.port25.com and wait for a reply. You will find a report similar to the following:

==========================================================\nSummary of Results\n==========================================================\nSPF check:          pass\n\"iprev\" check:      pass\nDKIM check:         pass\nDKIM check:         pass\nSpamAssassin check: ham\n\n==========================================================\nDetails:\n==========================================================\n....\n

The full report will contain more technical details.

"},{"location":"getstarted/prerequisite-dns/#fully-qualified-domain-name-fqdn","title":"Fully Qualified Domain Name (FQDN)","text":"

  1. A Fully Qualified Domain Name (FQDN) is the complete (absolute) domain name for a specific computer or host, on the Internet. The FQDN consists of at least three parts divided by a dot: the hostname, the domain name, and the Top Level Domain (TLD for short). In the example of mx.mailcow.email the hostname would be mx, the domain name mailcow and the TLD email.\u00a0\u21a9

"},{"location":"getstarted/prerequisite-system/","title":"Prepare your system","text":"

Before you run mailcow: dockerized, there are a few requirements that you should check:

Warning

Do not try to install mailcow on a Synology/QNAP device (any NAS), OpenVZ, LXC or other container platforms. KVM, ESX, Hyper-V and other full virtualization platforms are supported.

Info

  • mailcow: dockerized requires some ports to be open for incoming connections, so make sure that your firewall is not blocking these.
  • Make sure that no other application is interfering with mailcow's configuration, such as another mail service
  • A correct DNS setup is crucial to every good mailserver setup, so please make sure you got at least the basics covered before you begin!
  • Make sure that your system has a correct date and time setup. This is crucial for various components like two factor TOTP authentication.
"},{"location":"getstarted/prerequisite-system/#minimum-system-resources","title":"Minimum System Resources","text":"

Please make sure that your system has at least the following resources:

Resource Minimal Requirement CPU 1 GHz RAM Minimum 6 GiB + 1 GiB swap (default config) Disk 20 GiB (without emails) Architecture x86_64, ARM64

Not supported

OpenVZ, Virtuozzo and LXC

ClamAV and Solr can be greedy with RAM. You may disable them in mailcow.conf by settings SKIP_CLAMD=y and SKIP_SOLR=y.

Info

We are aware that a pure MTA can run on 128 MiB RAM. mailcow is a full-grown and ready-to-use groupware with many extras making life easier. mailcow comes with a webserver, webmailer, ActiveSync (MS), antivirus, antispam, indexing (Solr), document scanner (Oletools), SQL (MariaDB), Cache (Redis), MDA, MTA, various web services etc.

A single SOGo worker can acquire ~350 MiB RAM before it gets purged. The more ActiveSync connections you plan to use, the more RAM you will need. A default configuration spawns 20 workers.

"},{"location":"getstarted/prerequisite-system/#ram-usage-examples","title":"RAM usage examples","text":"

A company with 15 phones (EAS enabled) and about 50 concurrent IMAP connections should plan 16 GiB RAM.

6 GiB RAM + 1 GiB swap are fine for most private installations while 8 GiB RAM are recommended for ~5 to 10 users.

We can help to correctly plan your setup as part of our support.

"},{"location":"getstarted/prerequisite-system/#supported-os","title":"Supported OS","text":"

Important

mailcow is using Docker as a base component, due to some technical differences across multiple platforms we do not support all, even if they can run Docker.

The following table contains all operating systems officially supported and tested by us (as of December 2024):

OS Compatibility Alpine since 3.17 \u26a0\ufe0f Debian 11, 12 \u2705 Ubuntu 20.04 - 24.04 \u2705 Alma Linux 8, 9 \u2705 Rocky Linux 9 \u2705

Legend

\u2705 = Works out of the box using the instructions. \u26a0\ufe0f = Requires some manual adjustments otherwise usable. \u274c = In general NOT Compatible. \u2754 = Pending.

Warning

Note: All other operating systems (not mentioned) may also work, but have not been officially tested.

"},{"location":"getstarted/prerequisite-system/#firewall-ports","title":"Firewall & Ports","text":"

Please check if any of mailcow's standard ports are open and not in use by other applications:

ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n# or:\nnetstat -tulpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n

Danger

There are several problems with running mailcow on a firewalld/ufw enabled system. You should disable it (if possible) and move your ruleset to the DOCKER-USER chain, which is not cleared by a Docker service restart, instead. See this (blog.donnex.net) or this (unrouted.io) guide for information about how to use iptables-persistent with the DOCKER-USER chain. As mailcow runs dockerized, INPUT rules have no effect on restricting access to mailcow. Use the FORWARD chain instead.

If this command returns any results please remove or stop the application running on that port. You may also adjust mailcows ports via the mailcow.conf configuration file.

"},{"location":"getstarted/prerequisite-system/#incoming-ports","title":"Incoming Ports","text":"

If you have a firewall in front of mailcow, please ensure that these ports are open for incoming connections:

Service Protocol Port Container Variable Postfix SMTP TCP 25 postfix-mailcow ${SMTP_PORT} Postfix SMTPS TCP 465 postfix-mailcow ${SMTPS_PORT} Postfix Submission TCP 587 postfix-mailcow ${SUBMISSION_PORT} Dovecot IMAP TCP 143 dovecot-mailcow ${IMAP_PORT} Dovecot IMAPS TCP 993 dovecot-mailcow ${IMAPS_PORT} Dovecot POP3 TCP 110 dovecot-mailcow ${POP_PORT} Dovecot POP3S TCP 995 dovecot-mailcow ${POPS_PORT} Dovecot ManageSieve TCP 4190 dovecot-mailcow ${SIEVE_PORT} HTTP(S) TCP 80/443 nginx-mailcow ${HTTP_PORT} / ${HTTPS_PORT}

To bind a service to an IP address, you can prefix the IP address as follows: SMTP_PORT=1.2.3.4:25

Important: You cannot use IP:PORT bindings for HTTP_PORT and HTTPS_PORT. Please use HTTP_PORT=1234 and HTTP_BIND=1.2.3.4 instead.

"},{"location":"getstarted/prerequisite-system/#outgoing-portshosts","title":"Outgoing Ports/Hosts","text":"

Some outgoing connections are required to use mailcow. Ensure that mailcow can communicate with the following hosts or ports:

Service Protocol Port Target Reason Clamd TCP 873 rsync.sanesecurity.net Download ClamAV signatures (prebundled in mailcow) Dovecot TCP 443 spamassassin.heinlein-support.de Download Spamassassin rules processed by Rspamd, downloaded via Dovecot mailcow Processes TCP 80/443 github.com Download mailcow updates (code-based) mailcow Processes TCP 443 hub.docker.com Download Docker images (directly from Docker Hub) mailcow Processes TCP 443 asn-check.mailcow.email API request for BAD ASN checks (for Spamhaus Free Blocklists) mailcow Processes TCP 80 ip4.mailcow.email & ip6.mailcow.email Retrieve public IP address for display in UI (optional) Postfix TCP 25, 465 Any Outgoing connection for MTA Rspamd TCP 80 fuzzy.mailcow.email Download bad subject regex maps (trained by Servercow) Rspamd TCP 443 bazaar.abuse.ch Download malware MD5 checksums for detection by Rspamd Rspamd TCP 443 urlhaus.abuse.ch Download malware download links for detection in Rspamd Rspamd UDP 11445 fuzzy.mailcow.email Connection to global mailcow fuzzy (trained by Servercow + community) Rspamd UDP 11335 fuzzy1.rspamd.com & fuzzy2.rspamd.com Connection to global Rspamd fuzzy (trained by the Rspamd team) Unbound TCP & UDP 53 Any DNS resolution for the mailcow stack (for DNSSEC validation and retrieval of spam list info)"},{"location":"getstarted/prerequisite-system/#important-for-hetzner-firewalls","title":"Important for Hetzner firewalls","text":"

Quoting https://github.com/chermsen via https://github.com/mailcow/mailcow-dockerized/issues/497#issuecomment-469847380 (THANK YOU!):

For all who are struggling with the Hetzner firewall:

Port 53 unimportant for the firewall configuration in this case. According to the documentation unbound uses the port range 1024-65535 for outgoing requests. Since the Hetzner Robot Firewall is a static firewall (each incoming packet is checked isolated) - the following rules must be applied:

For TCP 

SRC-IP:       ---\nDST IP:       ---\nSRC Port:    ---\nDST Port:    1024-65535\nProtocol:    tcp\nTCP flags:   ack\nAction:      Accept\n

For UDP 

SRC-IP:       ---\nDST IP:       ---\nSRC Port:    ---\nDST Port:    1024-65535\nProtocol:    udp\nAction:      Accept\n

If you want to apply a more restrictive port range you have to change the config of unbound first (after installation):

{mailcow-dockerized}/data/conf/unbound/unbound.conf: 

outgoing-port-avoid: 0-32767\n

Now the firewall rules can be adjusted as follows:

[...]\nDST Port:  32768-65535\n[...]\n
"},{"location":"getstarted/prerequisite-system/#date-and-time","title":"Date and Time","text":"

To ensure that you have the correct date and time setup on your system, please check the output of timedatectl status:

$ timedatectl status\n      Local time: Sat 2017-05-06 02:12:33 CEST\n  Universal time: Sat 2017-05-06 00:12:33 UTC\n        RTC time: Sat 2017-05-06 00:12:32\n       Time zone: Europe/Berlin (CEST, +0200)\n     NTP enabled: yes\nNTP synchronized: yes\n RTC in local TZ: no\n      DST active: yes\n Last DST change: DST began at\n                  Sun 2017-03-26 01:59:59 CET\n                  Sun 2017-03-26 03:00:00 CEST\n Next DST change: DST ends (the clock jumps one hour backwards) at\n                  Sun 2017-10-29 02:59:59 CEST\n                  Sun 2017-10-29 02:00:00 CET\n

The lines NTP enabled: yes and NTP synchronized: yes indicate whether you have NTP enabled and if it's synchronized.

To enable NTP you need to run the command timedatectl set-ntp true. You also need to edit your /etc/systemd/timesyncd.conf:

# vim /etc/systemd/timesyncd.conf\n[Time]\nNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org\n
"},{"location":"getstarted/prerequisite-system/#hetzner-cloud-and-probably-others","title":"Hetzner Cloud (and probably others)","text":"

Check /etc/network/interfaces.d/50-cloud-init.cfg and change the IPv6 interface from eth0:0 to eth0:

# Wrong:\nauto eth0:0\niface eth0:0 inet6 static\n# Right:\nauto eth0\niface eth0 inet6 static\n

Reboot or restart the interface. You may want to disable cloud-init network changes.

"},{"location":"getstarted/prerequisite-system/#mtu","title":"MTU","text":"

Especially relevant for OpenStack users: Check your MTU and set it accordingly in docker-compose.yml. See Troubleshooting in our Installation guide.

"},{"location":"maintenance/deinstall/","title":"Deinstallation","text":"

To remove mailcow: dockerized with all it's volumes, images and containers do:

docker compose (Plugin)docker-compose (Standalone) 
docker compose down -v --rmi all --remove-orphans\n
docker-compose down -v --rmi all --remove-orphans\n

Info

  • -v Remove named volumes declared in the volumes section of the Compose file and anonymous volumes attached to containers.
  • --rmi Remove images. Type must be one of: all: Remove all images used by any service. local: Remove only images that don't have a custom tag set by the image field.
  • --remove-orphans Remove containers for services not defined in the compose file.
  • By default docker compose down only removes currently active containers and networks defined in the docker-compose.yml.
    • "},{"location":"maintenance/migration/","title":"Migration","text":"

    Warning

    This guide assumes you intend to migrate an existing mailcow server (source) over to a brand new, empty server (target). It takes no care about preserving any existing data on your target server and will erase anything within /var/lib/docker/volumes and thus any Docker volumes you may have already set up.

    Tip

    Alternatively, you can use the ./helper-scripts/backup_and_restore.sh script to create a full backup on the source machine, then install mailcow on the target machine as usual, copy over your mailcow.conf and use the same script to restore your backup to the target machine.

    1. Follow the installation guide to install Docker and Compose.

    2. Stop Docker and assure Docker has stopped: 

    systemctl stop docker.service\nsystemctl status docker.service\n

    3. Run the following commands on the source machine (take care of adding the trailing slashes in the first path parameter as shown below!) - WARNING: This command will erase anything that may already exist under /var/lib/docker/volumes on the target machine:

    Within the same architectureTo other architecture 
    rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n
    rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete --exclude '*rspamd-vol-1' /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n

    Danger

    Please follow the instructions for the respective use case, as the volume rspamd-vol-1 must be omitted when migrating to a different architecture, as it contains incompatible hyperscan cache files that lead to crashes and subsequent failure to start Rspamd when switching platforms.

    The hyperscan cache files are automatically regenerated when Rspamd is restarted if they do not exist.

    4. Shut down mailcow and stop Docker on the source machine.

    docker compose (Plugin)docker-compose (Standalone) 
    cd /opt/mailcow-dockerized\ndocker compose down\nsystemctl stop docker.service\n
    cd /opt/mailcow-dockerized\ndocker-compose down\nsystemctl stop docker.service\n

    5. Repeat step 3 with the same commands. This will be much quicker than the first time as it now only syncs the diffs.

    6. Switch over to the target machine and start Docker. 

    systemctl start docker.service\n

    7. Now pull the mailcow Docker images on the target machine.

    docker compose (Plugin)docker-compose (Standalone) 
    cd /opt/mailcow-dockerized\ndocker compose pull\n
    cd /opt/mailcow-dockerized\ndocker-compose pull\n

    8. Start the whole mailcow stack and everything should be done!

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    9. Finally, change your DNS settings to point to the target server. Also check the SNAT_TO_SOURCE variable in your mailcow.conf file if you have changed your public IP address, otherwise SOGo may not work.

    "},{"location":"maintenance/update/","title":"Update","text":""},{"location":"maintenance/update/#automatic-update","title":"Automatic update","text":"

    An update script in your mailcow-dockerized directory will take care of updates.

    Run the update script: 

    ./update.sh\n

    If it needs to, it will ask you how you wish to proceed. Merge errors will be reported. Some minor conflicts will be auto-corrected (in favour for the mailcow-dockerized repository code).

    "},{"location":"maintenance/update/#options","title":"Options","text":"
    # Options can be combined\n\n# - Check for updates and show changes\n./update.sh --check\n\n# - Do not start mailcow after applying an update\n./update.sh --skip-start\n\n# - Skip ICMP Check to public DNS resolvers (Use it only if you\u00b4ve blocked any ICMP Connections to your mailcow machine)\n./update.sh --skip-ping-check\n\n# - Switch your mailcow updates to the unstable (nightly) branch.\nFOR TESTING PURPOSES ONLY!!!! NOT READY FOR PRODUCTION!!!\n./update.sh --nightly\n\n# - Switch your mailcow updates to the stable (master) branch. Default unless you changed it with --nightly.\n./update.sh --stable\n\n# - Force update (unattended, but unsupported, use at own risk)\n./update.sh --force\n\n# - Run garbage collector to cleanup old image tags and exit\n./update.sh --gc\n\n# - Update with merge strategy option \"ours\" instead of \"theirs\"\n#   This will **solve conflicts** when merging in favor for your local changes and should be avoided. Local changes will always be kept, unless we changed file XY, too.\n./update.sh --ours\n\n# - Don't update, but prefetch images and exit\n./update.sh --prefetch\n
    "},{"location":"maintenance/update/#i-forgot-what-i-changed-before-running-updatesh","title":"I forgot what I changed before running update.sh","text":"

    See git log --pretty=oneline | grep -i \"before update\", you will have an output similar to this:

    22cd00b5e28893ef9ddef3c2b5436453cc5223ab Before update on 2020-09-28_19_25_45\ndacd4fb9b51e9e1c8a37d84485b92ffaf6c59353 Before update on 2020-08-07_13_31_31\n

    Run git diff 22cd00b5e28893ef9ddef3c2b5436453cc5223ab to see what changed.

    "},{"location":"maintenance/update/#can-i-roll-back","title":"Can I roll back?","text":"

    Yes.

    See the topic above, instead of a diff, you run checkout:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker compose pull\ndocker compose up -d\n
    docker-compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker-compose pull\ndocker-compose up -d\n
    "},{"location":"maintenance/update/#hooks","title":"Hooks","text":"

    You can hook into the update mechanism by adding scripts called pre_commit_hook.sh and post_commit_hook.sh to your mailcows root directory. See this for more details.

    "},{"location":"maintenance/update/#update-cycle","title":"Update Cycle","text":"
    • We schedule a monthly release cycle for a major update.
    • The releases are numbered like this: YYYY-MM (e.g. 2022-05)
    • Fixes for a main Update will be stated as \"Revisions\" like a,b,c (e.g. 2022-05a, 2022-05b etc.)
    "},{"location":"maintenance/update/#update-variants","title":"Update variants","text":"

    stable (stable updates): These updates are suitable for productive usage. They appear in a cycle of at least 1x per month.

    nightly (unstable updates): These updates are NOT suitable for production use and are for testing only. The nightly updates are ahead of the stable updates, since in these updates we test newer and more extensive features before they go live for all users.

    "},{"location":"maintenance/update/#get-nightly-updates","title":"Get Nightly Updates","text":""},{"location":"maintenance/update/#info-about-the-nightly-updates","title":"Info about the Nightly Updates","text":"

    Since the 2022-08 update there is the possibility to change the update sources. Until now, the master branch on GitHub served as the only (official) update source. With the August 2022 update, however, there is now the Nightly Branch which contains unstable and major changes for testing and feedback.

    The Nightly Branch always gets new updates when something is finished on the mailcow project that will be included in the new main version.

    Besides the obvious changes that will be included in the next major update anyway, it also contains exclusive features that need a longer testing time (e.g. the UI update to Bootstrap 5).

    "},{"location":"maintenance/update/#how-do-i-get-nightly-updates","title":"How do I get Nightly Updates?","text":"

    The process is relatively simple. With the 2022-08 update (assuming an update to the version) it is possible to run update.sh with the parameter --nightly.

    Danger

    Please make a backup before or follow the Best Practice Nightly Update section before switching to mailcow nightly builds. We are not responsible for any data loss/corruption, so work with caution!

    The script will now change the branch with git checkout nightly, which means it will ask for the IPv6 settings again. But this is normal.

    If everything worked fine (for which we made a backup before) the mailcow UI should now show the current version number and date stamp in the lower right corner:

    "},{"location":"maintenance/update/#best-practice-nightly-update","title":"Best Practice Nightly Update","text":"

    Info

    We recommend using the Nightly Update only if you have another machine or VM and NOT use it productively.

    1. use the cold standby script to copy the machine before the switch to the nightly builds on another system.
    2. run the update.sh script on the new machine with the parameter --nightly and confirm.
    3. experience/test the nightly updates on the secondary machine.
    "},{"location":"manual-guides/u_e-80_to_443/","title":"Redirect HTTP to HTTPS","text":"

    Since February the 28th 2017 mailcow does come with port 80 and 443 enabled.

    Do not use the config below for reverse proxy setups, please see our reverse proxy guide for this, which includes a redirect from HTTP to HTTPS.

    Open mailcow.conf and set HTTP_BIND= - if not already set.

    Create a new file data/conf/nginx/redirect.conf and add the following server config to the file:

    server {\n  root /web;\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  include /etc/nginx/conf.d/server_name.active;\n  if ( $request_uri ~* \"%0A|%0D\" ) { return 403; }\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n  location / {\n    return 301 https://$host$uri$is_args$args;\n  }\n}\n

    In case you changed the HTTP_BIND parameter, recreate the container:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    Otherwise restart Nginx:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart\n
    docker-compose restart\n
    "},{"location":"manual-guides/u_e-autodiscover_config/","title":"Autodiscover / Autoconfig","text":"

    You do not need to change or create this file, autodiscover works out of the box. This guide is only meant for customizations to the autodiscover or autoconfig process.

    Newer Outlook clients (especially those delivered with O365) will not autodiscover mail profiles. Keep in mind, that ActiveSync should NOT be used with a desktop client.

    Open/create data/web/inc/vars.local.inc.php and add your changes to the configuration array.

    Changes will be merged with \"$autodiscover_config\" in data/web/inc/vars.inc.php):

    <?php\n$autodiscover_config = array(\n  // General autodiscover service type: \"activesync\" or \"imap\"\n  // emClient uses autodiscover, but does not support ActiveSync. mailcow excludes emClient from ActiveSync.\n  'autodiscoverType' => 'activesync',\n  // If autodiscoverType => activesync, also use ActiveSync (EAS) for Outlook desktop clients (>= Outlook 2013 on Windows)\n  // Outlook for Mac does not support ActiveSync\n  'useEASforOutlook' => 'yes',\n  // Please don't use STARTTLS-enabled service ports in the \"port\" variable.\n  // The autodiscover service will always point to SMTPS and IMAPS (TLS-wrapped services).\n  // The autoconfig service will additionally announce the STARTTLS-enabled ports, specified in the \"tlsport\" variable.\n  'imap' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('IMAPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('IMAP_PORT'))),\n  ),\n  'pop3' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('POPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('POP_PORT'))),\n  ),\n  'smtp' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('SMTPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('SUBMISSION_PORT'))),\n  ),\n  'activesync' => array(\n    'url' => 'https://'.$mailcow_hostname.($https_port == 443 ? '' : ':'.$https_port).'/Microsoft-Server-ActiveSync',\n  ),\n  'caldav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n  'carddav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n);\n

    To always use IMAP and SMTP instead of EAS, set 'autodiscoverType' => 'imap'.

    Disable ActiveSync for Outlook desktop clients by setting \"useEASforOutlook\" to \"no\".

    "},{"location":"manual-guides/u_e-reeanble-weak-protocols/","title":"Re-enable TLS 1.0 and TLS 1.1","text":"

    On February 12th, 2020, we disabled the deprecated protocols TLS 1.0 and 1.1 in Dovecot (POP3, POP3S, IMAP, IMAPS) and Postfix (SMTPS, SUBMISSION).

    With the June 2024 Patch (2024-06), TLS 1.0 and TLS 1.1 were also disabled for unauthenticated mail via SMTP on port 25/tcp, as most modern and well-configured email servers on the internet now use better encryptions than TLS 1.0/1.1.

    How to re-enable weak protocols if necessary?

    Edit data/conf/postfix/extra.cf:

    # For SMTPS/Submission\nsubmission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\nsmtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\n\n# For SMTP (via STARTTLS)\nsmtp_tls_protocols = !SSLv2, !SSLv3\nsmtpd_tls_protocols = !SSLv2, !SSLv3\n

    Edit data/conf/dovecot/extra.conf:

    ssl_min_protocol = TLSv1\n

    Restart the affected services:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart postfix-mailcow dovecot-mailcow\n
    docker-compose restart postfix-mailcow dovecot-mailcow\n

    Hint: You can enable TLS 1.2 in Windows 7.

    "},{"location":"manual-guides/u_e-update-hooks/","title":"Run scripts before and after updates","text":"

    It is possible to add pre- and post-update-hooks to the update.sh script that upgrades your whole mailcow installation.

    To do so, just add the corresponding bash script into your mailcow root directory:

    • pre_update_hook.sh for commands that should run before the update
    • post_update_hook.sh for commands that should run after the update is completed

    Keep in mind that pre_update_hook.sh runs every time you call update.sh and post_update_hook.sh will only run if the update was successful and the script doesn't have to be re-run.

    The scripts will be run by bash, an interpreter (e.g. #!/bin/bash) as well as an execute permission flag (\"+x\") are not required.

    "},{"location":"manual-guides/u_e-why_unbound/","title":"Why unbound?","text":"

    For DNS blacklist lookups and DNSSEC.

    Most systems use either a public or a local caching DNS resolver. That's a very bad idea when it comes to filter spam using DNS-based black hole lists (DNSBL) or similar technics. Most if not all providers apply a rate limit based on the DNS resolver that is used to query their service. Using a public resolver like Googles 4x8, OpenDNS or any other shared DNS resolver like your ISPs will hit that limit very soon.

    "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/","title":"Additional Databases","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#additional-databases-for-clamav","title":"Additional Databases for ClamAV","text":"

    Default ClamAV databases do not have great detection levels, but it can be enhanced with free or paid signature databases.

    "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#list-of-known-free-databases-as-of-april-2022","title":"List of known free databases | As of April 2022","text":"
    • SecurityInfo - free ClamAV DBs for testing purposes, required registration after which you can use them from 1 IP
    • InterServer - free to use ClamAV DBs, but they do not fit well for email scanning
    "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#enable-securiteinfo-databases","title":"Enable SecuriteInfo databases","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#work-todo-in-clamav","title":"Work todo in ClamAV","text":"
    1. Sign up for a free account at https://www.securiteinfo.com/clients/customers/signup
    2. You will receive an email to activate your account and then a follow-up email with your login name
    3. Login and navigate to your customer account: https://www.securiteinfo.com/clients/customers/account
    4. Click on the Setup tab
    5. You will need to get your_id from one of the download links, they are individual for every user

    6. Add to data/conf/clamav/freshclam.conf with replaced your_id part: 

      DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.ign2\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/javascript.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/spam_marketing.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfohtml.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfoascii.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfopdf.hdb\n

    7. For free SecuriteInfo databases, download speed is limited to 300 kB/s. In data/conf/clamav/freshclam.conf, increase the default ReceiveTimeout 20 value to ReceiveTimeout 90 (time in seconds), otherwise some of the database downloads could fail because of their size.

    8. Adjust data/conf/clamav/clamd.conf to align with next settings: 

      DetectPUA yes\nExcludePUA PUA.Win.Packer\nExcludePUA PUA.Win.Trojan.Packed\nExcludePUA PUA.Win.Trojan.Molebox\nExcludePUA PUA.Win.Packer.Upx\nExcludePUA PUA.Doc.Packed\nMaxScanSize 150M\nMaxFileSize 100M\nMaxRecursion 40\nMaxEmbeddedPE 100M\nMaxHTMLNormalize 50M\nMaxScriptNormalize 50M\nMaxZipTypeRcg 50M\n

    9. Restart ClamAV container:
    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart clamd-mailcow\n
    docker-compose restart clamd-mailcow\n

    Please note:

    • You can't use ExcludePUA and IncludePUA in clamd.conf simultaneously, so please comment any IncludePUA if you uncommented them before.
    • List of databases provided in this example fit most use-cases, but SecuriteInfo also provides other databases. Please check SecuriteInfo FAQ for additional information.
    • With the current DB set (including default DBs) ClamAV will consume about 1.3Gb of RAM on your server.
    • If you modified message_size_limit in Postfix you need to adapt MaxSize settings in ClamAV as well.
    "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#work-todo-in-rspamd","title":"Work todo in Rspamd","text":"

    Danger

    mailcow with Version >= 2023-07 is needed for this following guide to work, as it includes the predefined scores for SecuriteInfo Signatures!

    Now you have added the ClamAV signatures, but you will notice that Rspamd does not use them correctly or mercilessly labels EVERYTHING as VIRUS.

    However, we can tame Rspamd with a little bit of manual work so that it doesn't get completely out of hand.

    For this we proceed as follows:

    1. Add the following inside data/conf/rspamd/local.d/antivirus.conf:
    patterns {\n  # Extra Signatures (Securite) Not shipped with mailcow.\n  CLAM_SECI_SPAM = \"^SecuriteInfo\\.com\\.Spam.*\";\n  CLAM_SECI_JPG = \"^SecuriteInfo\\.com\\.JPG.*\";\n  CLAM_SECI_PDF = \"^SecuriteInfo\\.com\\.PDF.*\";\n  CLAM_SECI_HTML = \"^SecuriteInfo\\.com\\.HTML.*\";\n  CLAM_SECI_JS = \"^SecuriteInfo\\.com\\.JS.*\";\n}\n
    1. Restart Rspamd afterwards:
    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Now Rspamd will apply the weighting we specified to each signature instead of marking everything with a value of 2000 as VIRUS and thus rejecting it.

    Info

    You can change the weights at any time:

    data/conf/rspamd/local.d/composites.conf.

    You can also manually set/adjust the strings of the ClamAV to be registered.

    Just use the scheme given in the antivirus.conf of Rspamd.

    Warning

    Please note that the files antivirus.conf and composites.conf can be overwritten by a mailcow update.

    "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#enable-interserver-databases","title":"Enable InterServer databases","text":"
    1. Add to data/conf/clamav/freshclam.conf: 
      DatabaseCustomURL http://sigs.interserver.net/interserver256.hdb\nDatabaseCustomURL http://sigs.interserver.net/interservertopline.db\nDatabaseCustomURL http://sigs.interserver.net/shell.ldb\nDatabaseCustomURL http://sigs.interserver.net/whitelist.fp\n
    2. Restart ClamAV container:
    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart clamd-mailcow\n
    docker-compose restart clamd-mailcow\n
    "},{"location":"manual-guides/ClamAV/u_e-clamav-whitelist/","title":"Whitelist","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-whitelist/#whitelist-specific-clamav-signatures","title":"Whitelist specific ClamAV signatures","text":"

    You may find that legitimate (clean) mail is being blocked by ClamAV (Rspamd will flag the mail with VIRUS_FOUND). For instance, interactive PDF form attachments are blocked by default because the embedded Javascript code may be used for nefarious purposes. Confirm by looking at the clamd logs, e.g.:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs clamd-mailcow | grep \"FOUND\"\n
    docker-compose logs clamd-mailcow | grep \"FOUND\"\n

    This line confirms that such was identified:

    clamd-mailcow_1      | Sat Sep 28 07:43:24 2019 -> instream(local): PUA.Pdf.Trojan.EmbeddedJavaScript-1(e887d2ac324ce90750768b86b63d0749:363325) FOUND\n

    To whitelist this particular signature (and enable sending this type of file attached), add it to the ClamAV signature whitelist file:

    echo 'PUA.Pdf.Trojan.EmbeddedJavaScript-1' >> data/conf/clamav/whitelist.ign2\n

    Then restart the clamd-mailcow service container in the mailcow UI or using docker compose:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart clamd-mailcow\n
    docker-compose restart clamd-mailcow\n

    Cleanup cached ClamAV results in Redis:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
    docker-compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
    "},{"location":"manual-guides/Docker/u_e-docker-cust_dockerfiles/","title":"Customize Dockerfiles","text":"

    You need to copy the override file with corresponding build tags to the mailcow: dockerized root folder (i.e. /opt/mailcow-dockerized):

    cp helper-scripts/docker-compose.override.yml.d/BUILD_FLAGS/docker-compose.override.yml docker-compose.override.yml\n

    Customize data/Dockerfiles/$service and build the image locally: 

    docker build data/Dockerfiles/$service -t mailcow/$service:$tag\n
    (without a personalized :$tag docker will use :latest automatically)

    Now the created image has to be activated in docker-compose.override.yml, e.g.: 

    $service-mailcow:\n    build: ./data/Dockerfiles/$service\n    image: mailcow/$service:$tag\n

    Now auto-recreate modified containers:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-any_acl/","title":"Enable \"any\" ACL settings","text":"

    On August the 17th, we disabled the possibility to share with \"any\" or \"all authenticated users\" by default.

    This function can be re-enabled by setting ACL_ANYONE to allow in mailcow.conf:

    ACL_ANYONE=allow\n

    Apply the changes by restarting the stack:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-catchall_vacation/","title":"Vacation replies for catchall addresses","text":"

    The Dovecot parameter sieve_vacation_dont_check_recipient - which was by default set to yes in mailcow configurations pre 21st July 2021 - allows for vacation replies even when a mail is sent to non-existent mailboxes like a catch-all addresses.

    We decided to switch this parameter back to no and allow a user to specify which recipient address triggers a vacation reply. The triggering recipients can also be configured in SOGos autoresponder feature.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/","title":"Expunge a Users mails","text":"

    If you want to delete old mails out of the .Junk or .Trash folders or maybe delete all read mails that are older than a certain amount of time you may use dovecot's tool doveadm man doveadm-expunge.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#the-manual-way","title":"The manual way","text":"

    That said, let's dive in:

    Delete a user's mails inside the junk folder that are read and older than 4 hours

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n
    docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n

    Delete all user's mails in the junk folder that are older than 7 days

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n
    docker-compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n

    Delete all mails (of all users) in all folders that are older than 52 weeks (internal date of the mail, not the date it was saved on the system => before instead of savedbefore). Useful for deleting very old mails on all users and folders (thus especially useful for GDPR-compliance).

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n
    docker-compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n

    Delete mails inside a custom folder inside a user's inbox that are not flagged and older than 2 weeks

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n
    docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n

    Info

    For possible time spans or search keys have a look at man doveadm-search-query

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#job-scheduler","title":"Job scheduler","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#via-the-host-system-cron","title":"via the host system cron","text":"

    If you want to automate such a task you can create a cron job on your host that calls a script like the one below:

    docker compose (Plugin)docker-compose (Standalone) 
    #!/bin/bash\n# Path to mailcow-dockerized, for example: /opt/mailcow-dockerized\ncd /path/to/your/mailcow-dockerized\n\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n
    #!/bin/bash\n# Path to mailcow-dockerized, for example: /opt/mailcow-dockerized\ncd /path/to/your/mailcow-dockerized\n\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n

    To create a cron job you may execute crontab -e and insert something like the following to execute a script:

    # Execute everyday at 04:00 A.M.\n0 4 * * * /path/to/your/expunge_mailboxes.sh\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#via-docker-job-scheduler","title":"via Docker job scheduler","text":"

    To archive this with a docker job scheduler use this docker-compose.override.yml with your mailcow: 

    services:\n\n  dovecot-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.dovecot-expunge-trash.schedule: \"0 0 4 * * *\"\n      ofelia.job-exec.dovecot-expunge-trash.command: \"doveadm expunge -A mailbox 'Junk' savedbefore 2w\"\n      ofelia.job-exec.dovecot-expunge-trash.tty: \"false\"\n

    We add a few label to our dovecot-container to activate the job scheduler and tell him in a cron compatible scheduling format when to run. Note: Ofelia uses the scheduling format of the Go cron implementation which starts with a field for seconds instead of minutes.

    This docker-compose.override.yml deletes all mails older then 2 weeks from the \"Junk\" folder every day at 4 am. To see if things ran proper, you can not only see in your mailbox but also check Ofelia's docker log if it looks something like this:

    common.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Started - doveadm expunge -A mailbox 'Junk' savedbefore 2w,\ncommon.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Finished in \"285.032291ms\", failed: false, skipped: false, error: none,\n

    If it failed it will say so and give you the output of the doveadm in the log to make it easy on you to debug.

    In case you want to add more jobs, ensure you change the \"dovecot-expunge-trash\" part after \"ofelia.job-exec.\" to something else, it defines the name of the job. Syntax of the labels you find at mcuadros/ofelia.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-extra_conf/","title":"Customize/Expand dovecot.conf","text":"

    Create a file data/conf/dovecot/extra.conf - if missing - and add your additional content here.

    Restart dovecot-mailcow to apply your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart dovecot-mailcow\n
    docker-compose restart dovecot-mailcow\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/","title":"Full-Text Search","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-solr-deprecated","title":"FTS Solr (Deprecated)","text":"

    Warning

    Solr will only be supported until December 2024 and will then be removed from mailcow and replaced with Flatcurve.

    Solr is used for setups with memory >= 3.5 GiB to enable full-text search in Dovecot.

    Please note that applications like Solr may need to be maintained from time to time.

    Additionally, Solr consumes a lot of RAM, depending on your server's usage. Please avoid using it on machines with less than 3 GiB RAM.

    The default heap size (1024 M) is defined in mailcow.conf.

    Since we run in Docker and create our containers with the \"restart: always\" flag, an OOM situation will at least only trigger a container restart.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-flatcurve-experimental-since-2024-06","title":"FTS Flatcurve (Experimental since 2024-06)","text":"

    Flatcurve will soon replace the current FTS engine Solr to allow full-text search to function better on lower-performance systems.

    Starting with the June 2024 update, experimental support for Flatcurve as a full-text search has been implemented, which can only be activated via a mailcow.conf variable during the experimental phase.

    Note

    During the transition period, mailcow will specify the configuration for the FTS engine within Dovecot and overwrite any custom changes (unless explicitly defined in the extra.conf). This will no longer be the case with the full release of the engine within mailcow.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#activating-the-experimental-flatcurve-usage","title":"Activating the Experimental Flatcurve Usage","text":"

    Activation is simple and requires only two small steps:

    1. Edit mailcow.conf and add the following value:

      FLATCURVE_EXPERIMENTAL=y\n

    2. Restart mailcow:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

    mailcow will now use Flatcurve as the FTS backend.

    Unlike Solr, Flatcurve does not require an additional Docker volume. Flatcurve stores its FTS databases in the vmail-index volume and results in a similar folder structure as:

    /var/vmail_index/tester@develcow.de/.INBOX/\n\u251c\u2500\u2500 dovecot.index\n\u251c\u2500\u2500 dovecot.index.cache\n\u251c\u2500\u2500 dovecot.index.log\n\u2514\u2500\u2500 fts-flatcurve\n    \u2514\u2500\u2500 index.814\n        \u251c\u2500\u2500 flintlock\n        \u251c\u2500\u2500 iamglass\n        \u251c\u2500\u2500 postlist.glass\n        \u2514\u2500\u2500 termlist.glass\n

    Each subfolder on the IMAP server thus receives its own fts-flatcurve folder with the respective indices of the mails in the folder.

    Note

    The Solr container will still remain during the transition period (expected until December 2024) to allow for a smooth transition.

    Warning

    If you decide to switch the FTS engine, a complete reindexing is necessary, as the two systems are not compatible with each other. Learn below how to initiate a reindexing.

    However, we recommend performing this reindexing only under supervision, as excessive system load cannot be ruled out despite low system requirements!

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-related-dovecot-commands","title":"FTS-Related Dovecot Commands","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#check-fts-database-for-errors-and-repair-if-necessary","title":"Check FTS Database for Errors and Repair if Necessary","text":"docker compose (Plugin)docker-compose (Standalone) 
    # Single user\ndocker compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# All users\ndocker compose exec dovecot-mailcow doveadm fts rescan -A\n
    # Single user\ndocker-compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# All users\ndocker-compose exec dovecot-mailcow doveadm fts rescan -A\n

    Dovecot Wiki: \"Scans which mails are present in the full-text search index and compares them with the mails actually present in the mailboxes. This removes mails from the index that have already been deleted and ensures that the next doveadm index indexes all missing mails (if any).\"

    This does not reindex a mailbox. It essentially repairs a given index.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#reindex-fts-database","title":"Reindex FTS Database","text":"

    If you want to reindex the data immediately, you can run the following command, where * can also be a mailbox mask like 'Sent'. You do not have to run these commands, but it will speed things up a bit:

    docker compose (Plugin)docker-compose (Standalone) 
    # Single user\ndocker compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# All users, but obviously slower and more dangerous\ndocker compose exec dovecot-mailcow doveadm index -A '*'\n
    # Single user\ndocker-compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# All users, but obviously slower and more dangerous\ndocker-compose exec dovecot-mailcow doveadm index -A '*'\n

    Note

    The indexing will take some time.

    Depending on the FTS engine, there is a possibility of excessive system usage, even leading to system crashes in rare cases. So, monitor the indexing process and your system load closely!

    Since reindexing can be somewhat fragile and particularly sensitive to system resources, we have not integrated it into the mailcow UI.

    You must manually handle any errors when reindexing a mailbox via CLI.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#delete-fts-database","title":"Delete FTS Database","text":"

    mailcow will automatically delete a user's index data when the corresponding mailbox is deleted.

    Alternatively, the index for Flatcurve can be manually deleted via CLI:

    docker compose (Plugin)docker-compose (Standalone) 
    # Single user\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# All users\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
    # Single user\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# All users\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-harden_ciphers/","title":"Hardening Ciphers","text":"

    If you want to change the default ciphers and TLS versions accepted in Dovecot as per it's current release to something stronger, you could add following to Dovecot's extra.conf:

    ssl_min_protocol = TLSv1.2\nssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305\n

    If you want to adjust the ciphers for Postfix as well you can find the corresponding tutorial here.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/","title":"Changing the IMAP IDLE interval","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#what-is-the-idle-interval","title":"What is the IDLE interval?","text":"

    Per default, Dovecot sends a \"I'm still here\" notification to every client that has an open connection with Dovecot to get mails as quickly as possible without manually polling it (IMAP PUSH). This notification is controlled by the setting imap_idle_notify_interval, which defaults to 2 minutes.

    A short interval results in the client getting a lot of messages for this connection, which is bad for mobile devices, because every time the device receives this message, the mailing app has to wake up. This can result in unnecessary battery drain.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#edit-the-value","title":"Edit the value","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#change-configuration","title":"Change configuration","text":"

    Create a new file data/conf/dovecot/extra.conf (or edit it if it already exists). Insert the setting followed by the new value. For example, to set the interval to 5 minutes you could type:

    imap_idle_notify_interval = 5 mins\n

    29 minutes is the maximum value allowed by the corresponding RFC.

    Warning

    This isn't a default setting in mailcow because we don't know how this setting changes the behavior of other clients. Be careful if you change this and monitor different behavior.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#reload-dovecot","title":"Reload Dovecot","text":"

    Now reload Dovecot:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow dovecot reload\n
    docker-compose exec dovecot-mailcow dovecot reload\n

    Info

    You can check the value of this setting with

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n
    docker-compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n

    If you didn't change it, it should be at 2m. If you did change it, you should see your new value.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/","title":"Lazy Expunge (Dovecot Plugin)","text":"

    Danger

    This guide is still a work in progress, and errors may occur! Use this feature with caution!

    Info

    This feature is compatible with mailcow versions starting from 2024-11. Older versions are theoretically capable of using it as well, but due to internal changes, the implementation is more complicated, so it won't be stated here as unsupported.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#introduction","title":"Introduction","text":"

    Dovecot has supported a feature called Lazy Expunge for quite some time, which allows server administrators to temporarily retain deleted emails from a user account even after they have been deleted.

    mailcow also has a similar feature, but it is not easily accessible to users (see Recover accidentally deleted data (Mail)) and serves more as a fallback method for administrators.

    With the Dovecot option, users can view and restore emails that have been marked as deleted before they are automatically purged by the Dovecot server.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#setup","title":"Setup","text":"

    1. Edit the extra.conf file in the Dovecot configuration folder (usually located at MAILCOW_ROOT/data/conf/dovecot) with the following content: 

      plugin {\n    # Copy all deleted emails to the .EXPUNGED mailbox\n    lazy_expunge = .EXPUNGED\n\n    # Exclude marked-as-deleted emails from the quota\n    quota_rule = .EXPUNGED:ignore\n}\n\n# Define the .EXPUNGED mailbox\nnamespace inbox {\n    mailbox .EXPUNGED {\n        # Define how long emails will stay in this folder before they are deleted. Time is defined according to: https://doc.dovecot.org/2.3/settings/types/#time\n        autoexpunge = 7days\n        # Define how many emails can be kept in the EXPUNGED folder before it is cleared\n        autoexpunge_max_mails = 100000\n    }\n}\n

    2. Restart the Dovecot container:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart dovecot-mailcow\n
      docker-compose restart dovecot-mailcow\n

    3. Once the trash is emptied, a new folder named .EXPUNGED should appear. This folder will contain emails that, according to the rules defined in step 1, will be automatically deleted from the server after a certain period.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-mail-crypt/","title":"Mail crypt","text":"

    Warning

    Mails are stored compressed (lz4) and encrypted. The key pair can be found in crypt-vol-1.

    If you want to decode/encode existing maildir files, you can use the following script at your own risk:

    Enter Dovecot by running the following command in the mailcow-dockerized location:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow /bin/bash\n
    docker-compose exec dovecot-mailcow /bin/bash\n
    # Decrypt /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") == \"CRYPTED\" ]]; then\ndoveadm fs get compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" > \"/tmp/$(basename \"$file\")\"\n  if [[ -s \"/tmp/$(basename \"$file\")\" ]]; then\n    chmod 600 \"/tmp/$(basename \"$file\")\"\n    chown 5000:5000 \"/tmp/$(basename \"$file\")\"\n    mv \"/tmp/$(basename \"$file\")\" \"$file\"\n  else\n    rm \"/tmp/$(basename \"$file\")\"\n  fi\nfi\ndone\n\n# Encrypt /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") != \"CRYPTED\" ]]; then\ndoveadm fs put crypt private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" \"$file\"\n  chmod 600 \"$file\"\n  chown 5000:5000 \"$file\"\nfi\ndone\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/","title":"More Examples with DOVEADM","text":"

    Here is just an unsorted list of useful doveadm commands that could be useful.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/#doveadm-quota","title":"doveadm quota","text":"

    The quota get and quota recalc1 commands are used to display or recalculate the current user's quota usage. The reported values are in kilobytes.

    To list the current quota status for a user / mailbox, do:

    doveadm quota get -u 'mailbox@example.org'\n

    To list the quota storage value for all users, do:

    doveadm quota get -A |grep \"STORAGE\"\n

    Recalculate a single user's quota usage:

    doveadm quota recalc -u 'mailbox@example.org'\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/#doveadm-search","title":"doveadm search","text":"

    The doveadm search2 command is used to find messages matching your query. It can return the username, mailbox-GUID / -UID and message-GUIDs / -UIDs.

    To view the number of messages, by user, in their .Trash folder:

    doveadm search -A mailbox 'Trash' | awk '{print $1}' | sort | uniq -c\n

    Show all messages in a user's inbox older then 90 days:

    doveadm search -u 'mailbox@example.org' mailbox 'INBOX' savedbefore 90d\n

    Show all messages in any folder that are older then 30 days for mailbox@example.org:

    doveadm search -u 'mailbox@example.org' mailbox \"*\" savedbefore 30d\n

    1. https://wiki.dovecot.org/Tools/Doveadm/Quota \u21a9

    2. https://wiki.dovecot.org/Tools/Doveadm/Search \u21a9

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-performance/","title":"Performance Optimizations","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-performance/#maildir_very_dirty_syncs","title":"maildir_very_dirty_syncs","text":"

    Dovecot's maildir_very_dirty_syncs option is enabled by default since mailcow Release 2023-05. This option can significantly improve the performance of mailboxes that contain very large folders (over 100,000 emails).

    What this option does is it avoids rescanning the entire cur directory whenever loading an email. With this option disabled, Dovecot takes it safe and scans the entire cur directory (comparable with running an ls) to check if that particular email was touched (renamed, etc), by looking for all files whose names contain the correct ID. This is very slow if the directory is large, even on filesystems optimized for such use cases (such as ext4 with dir_index enabled) on fast SSD drives.

    This option is safe to use as long as you do not manually touch files under cur (as then Dovecot may not notice the changes). Even with this option enabled, Dovecot will still notice changes if the file's mtime (last modified time) is changed, but otherwise it will not scan the directory and just assumes the index is up-to-date. This is essentially the same as what sdbox/mdbox do, and with this option you can get some of the performance increase that would come with sdbox/mdbox while still using maildir.

    This option is safe to use on a standard Mailcow installation. However, if you use any third-party tools that manually modify files directly in the maildir (rather than via IMAP), you may wish to disable it. To disable this option, create a data/conf/dovecot/extra.conf file and add this setting to it:

    maildir_very_dirty_syncs=no\n

    Warning

    Please ALWAYS use the above mentioned extra.conf for your own customizations, as changes made in the normal dovecot.conf might be overwritten after an update from GitHub source code.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-public_folder/","title":"Public folders","text":"

    Create a new public namespace \"Public\" and a mailbox \"Develcow\" inside that namespace:

    Edit or create data/conf/dovecot/extra.conf, add:

    namespace {\n  type = public\n  separator = /\n  prefix = Public/\n  location = maildir:/var/vmail/public:INDEXPVT=~/public\n  subscriptions = yes\n  mailbox \"Develcow\" {\n    auto = subscribe\n  }\n}\n

    :INDEXPVT=~/public can be omitted if per-user seen flags are not wanted.

    The new mailbox in the public namespace will be auto-subscribed by users.

    To allow all authenticated users access full to that new mailbox (not the whole namespace), run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n
    docker-compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n

    Adjust the command to your needs if you like to assign more granular rights per user (use -u user@domain instead of -A for example).

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-public_folder/#allow-authenticated-users-access-to-the-whole-public-namespace","title":"Allow authenticated users access to the whole public namespace","text":"

    To allow all authenticated users access full access to the whole public namespace and its subfolders, create a new dovecot-acl file in the namespace root directory:

    Open/edit/create /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/public/dovecot-acl (adjust the path accordingly) to create the global ACL file with the following content:

    authenticated kxeilprwts\n

    kxeilprwts equals to lookup read write write-seen write-deleted insert post delete expunge create.

    You can use doveadm acl set -u user@domain \"Public/Develcow\" user=user@domain lookup read to limit access for a single user. You may also turn it around to limit access for all users to \"lr\" and grant only some users full access.

    See Dovecot ACL for further information about ACL.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-static_master/","title":"Static master user","text":"

    Random master usernames and passwords are automatically created on every restart of dovecot-mailcow.

    That's recommended and should not be changed.

    If you need the user to be static anyway, please specify two variables in mailcow.conf.

    Both parameters must not be empty!

    DOVECOT_MASTER_USER=mymasteruser\nDOVECOT_MASTER_PASS=mysecretpass\n

    Run the command below to apply your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    The static master username will be expanded to DOVECOT_MASTER_USER@mailcow.local.

    To login as test@example.org this would equal to test@example.org*mymasteruser@mailcow.local with the specified password above.

    A login to SOGo is not possible with this username. A click-to-login function for SOGo is available for admins as described here No master user is required.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/","title":"Move Maildir (vmail)","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#the-new-way","title":"The \"new\" way","text":"

    Warning

    Newer Docker versions seem to complain about existing volumes. You can fix this temporarily by removing the existing volume and start mailcow with the override file. But it seems to be problematic after a reboot (needs to be confirmed).

    An easy, dirty, yet stable workaround is to stop mailcow, remove /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data and create a new link to your remote filesystem location, for example:

    mv /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data_backup\nln -s /mnt/volume-xy/vmail_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\n

    Start mailcow afterwards.

    "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#the-old-way","title":"The \"old\" way","text":"

    If you want to use another folder for the vmail-volume, you can create a docker-compose.override.yml file and add the following content:

    volumes:\n  vmail-vol-1:\n    driver_opts:\n      type: none\n      device: /data/mailcow/vmail   \n      o: bind\n
    "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#moving-an-existing-vmail-folder","title":"Moving an existing vmail folder:","text":"
    • Locate the current vmail folder by its \"Mountpoint\" attribute: docker volume inspect mailcowdockerized_vmail-vol-1
    [\n    {\n        \"CreatedAt\": \"2019-06-16T22:08:34+02:00\",\n        \"Driver\": \"local\",\n        \"Labels\": {\n            \"com.docker.compose.project\": \"mailcowdockerized\",\n            \"com.docker.compose.version\": \"1.23.2\",\n            \"com.docker.compose.volume\": \"vmail-vol-1\"\n        },\n        \"Mountpoint\": \"/var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\",\n        \"Name\": \"mailcowdockerized_vmail-vol-1\",\n        \"Options\": null,\n        \"Scope\": \"local\"\n    }\n]\n
    • Copy the content of the Mountpoint folder to the new location (e.g. /data/mailcow/vmail) using cp -a, rsync -a or a similar non strcuture breaking copy command
    • Stop mailcow by executing the following command from within your mailcow root folder (e.g. /opt/mailcow-dockerized):
    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\n
    docker-compose down    \n
    • Create the file docker-compose.override.yml, edit the device path accordingly
    • Delete the current vmail folder: docker volume rm mailcowdockerized_vmail-vol-1
    • Start mailcow by executing the following command from within your mailcow root folder (e.g. /opt/mailcow-dockerized):
    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"manual-guides/Nginx/u_e-nginx_custom/","title":"Custom sites","text":""},{"location":"manual-guides/Nginx/u_e-nginx_custom/#ssl","title":"SSL","text":"

    Please see Advanced SSL and explicitly check ADDITIONAL_SERVER_NAMES for SSL configuration.

    Please do not add ADDITIONAL_SERVER_NAMES when you plan to use a different web root.

    "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#new-site","title":"New site","text":"

    To create persistent (over updates) sites hosted by mailcow: dockerized, a new site configuration must be placed inside data/conf/nginx/:

    A good template to begin with:

    nano data/conf/nginx/my_custom_site.conf\n
    server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  # Location: data/web\n  root /web;\n  # Location: data/web/mysite.com\n  #root /web/mysite.com\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name mysite.example.org;\n  server_tokens off;\n\n  # This allows acme to be validated even with a different web root\n  location ^~ /.well-known/acme-challenge/ {\n    default_type \"text/plain\";\n    rewrite /.well-known/acme-challenge/(.*) /$1 break;\n    root /web/.well-known/acme-challenge/;\n  }\n\n  if ($scheme = http) {\n    return 301 https://$server_name$request_uri;\n  }\n}\n
    "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#new-site-with-proxy-to-a-remote-location","title":"New site with proxy to a remote location","text":"

    Another example with a reverse proxy configuration:

    nano data/conf/nginx/my_custom_site.conf\n
    server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name example.domain.tld;\n  server_tokens off;\n\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  if ($scheme = http) {\n    return 301 https://$host$request_uri;\n  }\n\n  location / {\n    proxy_pass http://service:3000/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  }\n}\n
    "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#config-expansion-in-mailcows-nginx","title":"Config expansion in mailcows Nginx","text":"

    The filename used for a new site is not important, as long as the filename carries a .conf extension.

    It is also possible to extend the configuration of the default file site.conf file:

    nano data/conf/nginx/site.my_content.custom\n

    This filename does not need to have a \".conf\" extension but follows the pattern site.*.custom, where * is a custom name.

    If PHP is to be included in a custom site, please use the PHP-FPM listener on phpfpm:9002 or create a new listener in data/conf/phpfpm/php-fpm.d/pools.conf.

    Restart Nginx (and PHP-FPM, if a new listener was created):

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart nginx-mailcow\ndocker compose restart php-fpm-mailcow\n
    docker-compose restart nginx-mailcow\ndocker-compose restart php-fpm-mailcow\n
    "},{"location":"manual-guides/Nginx/u_e-nginx_webmail-site/","title":"Create subdomain webmail.example.org","text":"

    IMPORTANT: This guide only applies to non SNI enabled configurations. The certificate path needs to be adjusted if SNI is enabled. Something like ssl_certificate,key /etc/ssl/mail/webmail.example.org/cert.pem,key.pem; will do. But: The certificate should be acquired first and only after the certificate exists a site config should be created. Nginx will fail to start if it cannot find the certificate and key.

    To create a subdomain webmail.example.org and redirect it to SOGo, you need to create a new Nginx site. Take care of \"CHANGE_TO_MAILCOW_HOSTNAME\"!

    nano data/conf/nginx/webmail.conf

    server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name webmail.example.org;\n  server_tokens off;\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  location / {\n    return 301 https://CHANGE_TO_MAILCOW_HOSTNAME/SOGo;\n  }\n}\n

    Save and restart Nginx:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart nginx-mailcow\n
    docker-compose restart nginx-mailcow\n

    Now open mailcow.conf and find ADDITIONAL_SAN. Add webmail.example.org to this array, don't use quotes!

    ADDITIONAL_SAN=webmail.example.org\n

    Run the command to apply the changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    See \"acme-mailcow\" and \"nginx-mailcow\" logs if anything fails.

    "},{"location":"manual-guides/Postfix/u_e-postfix-attachment_size/","title":"Max. message size (attachment size)","text":"

    Open data/conf/postfix/extra.cf and set the message_size_limit accordingly in bytes. See main.cf for the default value.

    You will also need to adjust message size in Rspamd and Clamav configurations:

    • in data/conf/rspamd/local.d/options.inc add max_message parameter, check Rspamd Docs for defaults
    • in data/conf/rspamd/local.d/external_services.conf adjust max_size parameter for oletools
    • in data/conf/rspamd/local.d/antivirus.conf adjust max_size parameter for clamav
    • in data/conf/clamav/clamd.conf adjust MaxScanSize and MaxFileSize

    Restart Postfix, Rspamd and Clamav:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
    docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
    "},{"location":"manual-guides/Postfix/u_e-postfix-custom_transport/","title":"Custom transport maps","text":"

    For transport maps other than those to be configured in mailcow UI, please use data/conf/postfix/custom_transport.pcre to prevent existing maps or settings from being overwritten by updates.

    In most cases using this file is not necessary. Please make sure mailcow UI is not able to route your desired traffic properly before using that file.

    The file needs valid PCRE content and can break Postfix, if configured incorrectly.

    "},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/","title":"Disable Sender Addresses Verification","text":""},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/#new-guide","title":"New guide","text":"

    Edit a mailbox and select \"Allow to send as *\".

    For historical reasons we kept the old and deprecated guide below:

    "},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/#deprecated-guide-do-not-use-on-newer-mailcows","title":"Deprecated guide (DO NOT USE ON NEWER MAILCOWS!)","text":"

    This option is not best-practice and should only be implemented when there is no other option available to achieve whatever you are trying to do.

    Simply create a file data/conf/postfix/check_sasl_access and enter the following content. This user must exist in your installation and needs to authenticate before sending mail. 

    user-to-allow-everything@example.com OK\n

    Open data/conf/postfix/main.cf and find smtpd_sender_restrictions. Prepend check_sasl_access hash:/opt/postfix/conf/check_sasl_access like this: 

    smtpd_sender_restrictions = check_sasl_access hash:/opt/postfix/conf/check_sasl_access reject_authenticated_sender_login_mismatch [...]\n

    Run postmap on check_sasl_access:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n
    docker-compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n

    Restart the Postfix container.

    "},{"location":"manual-guides/Postfix/u_e-postfix-extra_cf/","title":"Customize/Expand main.cf","text":"

    Please create a new file data/conf/postfix/extra.cf for overrides or additional content to main.cf.

    Postfix will complain about duplicate values once after starting postfix-mailcow, this is intended.

    Syslog-ng was configured to hide those warnings while Postfix is running, to not spam the log files with unnecessary information every time a service is used.

    Restart postfix-mailcow to apply your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart postfix-mailcow\n
    docker-compose restart postfix-mailcow\n
    "},{"location":"manual-guides/Postfix/u_e-postfix-harden_ciphers/","title":"Hardening Ciphers","text":"

    If you want to change the default ciphers and TLS versions accepted in postfix as per it's current release to something stronger, you could add following inside Postfix extra.cf:

    tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\ntls_preempt_cipherlist = yes\n\nsmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtp_tls_ciphers = high\nsmtp_tls_mandatory_ciphers = high\n\nsmtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtpd_tls_ciphers = high\nsmtpd_tls_mandatory_ciphers = high\n

    Such a configuration will pass current (2024-10-21) configuration checks against services like Internet.nl.

    If you want to adjust the ciphers for Dovecot as well you can find the corresponding tutorial here.

    "},{"location":"manual-guides/Postfix/u_e-postfix-pflogsumm/","title":"Statistics with pflogsumm","text":"

    To use pflogsumm with the default logging driver, we need to query postfix-mailcow via docker logs and direct the output to pflogsumm:

    docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | pflogsumm\n

    The above log output is limited to the last 24 hours.

    It is also possible to create a daily pflogsumm report via cron. Create the /etc/cron.d/pflogsumm file with the following content:

    SHELL=/bin/bash\n59 23 * * * root docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | /usr/sbin/pflogsumm -d today | mail -s \"Postfix Report of $(date)\" postmaster@example.net\n

    To work, a local postfix must be installed on the server, which relays to the mailcow postfix.

    Question

    More detailed information can be found in section Post installation tasks -> Local MTA on Dockerhost.

    Based on the postfix logs of the last 24 hours, this example then sends a pflogsumm report to postmaster@example.net every day at 23:59:00.

    "},{"location":"manual-guides/Postfix/u_e-postfix-postscreen_whitelist/","title":"Whitelist IP in Postscreen","text":"

    IPs can be removed from Postscreen and therefore also from RBL checks in data/conf/postfix/custom_postscreen_whitelist.cidr.

    Postscreen does multiple checks to identify malicious senders. In most cases you want to whitelist an IP to exclude it from blacklist lookups.

    The format of the file is as follows:

    CIDR ACTION

    Where CIDR is a single IP address or IP range in CIDR notation, and action is either \"permit\" or \"reject\".

    Example:

    # Rules are evaluated in the order as specified.\n# Blacklist 192.168.* except 192.168.0.1.\n192.168.0.1          permit\n192.168.0.0/16       reject\n

    The file is reloaded on the fly, postfix restart is not required.

    "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/","title":"Relayhosts","text":"

    As of September 12, 2018 you can setup relayhosts as admin by using the mailcow UI.

    This is useful if you want to relay outgoing emails for a specific domain to a third-party spam filter or a service like Mailgun or Sendgrid. This is also known as a smarthost.

    "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#add-a-new-relayhost","title":"Add a new relayhost","text":"

    Go to the Routing tab of the Configuration and Details section of the admin UI. Here you will see a list of relayhosts currently setup.

    Scroll to the Add sender-dependent transport section.

    Under Host, add the host you want to relay to. Example: if you want to use Mailgun to send emails instead of your server IP, enter smtp.mailgun.org

    If the relay host requires a username and password to authenticate, enter them in the respective fields. Keep in mind the credentials will be stored in plain text.

    "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#test-a-relayhost","title":"Test a relayhost","text":"

    To test that connectivity to the host works, click on Test from the list of relayhosts and enter a From: address. Then, run the test.

    You will then see the results of the SMTP transmission. If all went well, you should see SERVER -> CLIENT: 250 2.0.0 Ok: queued as A093B401D4 as one of the last lines.

    If not, review the error provided and resolve it.

    Note: Some hosts, especially those who do not require authentication, will deny connections from servers that have not been added to their system beforehand. Make sure you read the documentation of the relayhost to make sure you've added your domain and/or the server IP to their system.

    Tip: You can change the default test To: address the test uses from null@mailcow.email to any email address you choose by modifying the $RELAY_TO variable on the vars.inc.php file under /opt/mailcow-dockerized/data/web/inc This way you can check that the relay worked by checking the destination mailbox.

    "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#set-the-relayhost-for-a-domain","title":"Set the relayhost for a domain","text":"

    Go to the Domains tab of the Mail setup section of the admin UI.

    Edit the desired domain.

    Select the newly added host on the Sender-dependent transports dropdown and save changes.

    Send an email from a mailbox on that domain and you should see postfix handing the message over to the relayhost in the logs.

    "},{"location":"manual-guides/Postfix/u_e-postfix-unauthenticated-relaying/","title":"Unauthenticated Relaying","text":"

    By default, mailcow's postfix considers all networks untrusted except its own IPV4_NETWORK and IPV6_NETWORK ranges, which are specified in mailcow.conf. Although this is reasonable in most cases, there may be circumstances where you want to add a host or subnet as an unauthenticated relayer.

    By default, mailcow uses mynetworks_style = subnet to specify internal subnets and leaves mynetworks unconfigured.

    If you decide to set mynetworks independently in Postfix's extra.conf, Postfix will ignore the mynetworks_style setting. This means that you will have to add the IPv4 and IPv6 addresses used internally by mailcow (specified in mailcow.conf as IPV4_NETWORK and IPV6_NETWORK respectively), as well as the loopback subnets manually!

    Explanation

    The setting mynetworks allows registered hosts or subnets to send e-mails to the Postfix MTA WITHOUT authentication. This is especially useful if monitoring e-mails are to be sent from Linux servers in the same network without extra authentication.

    Danger

    A wrong setting of mynetworks allows your server to be used as an open relay. If this is abused, it will impair your ability to send email and it may take some time for this to subside.

    Example

    As an example, let's take the subnet 192.168.2.0/24, which we want to relay unauthenticated.

    Edit data/conf/postfix/extra.cf:

    mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 [fe80::]/10 172.22.1.0/24 [fd4d:6169:6c63:6f77::]/64 192.168.2.0/24\n

    Edit data/conf/rspamd/local.d/options.inc aswell:

    local_addrs = [127.0.0.0/8, ::ffff:127.0.0.0/104, ::1/128, fe80::/10, 172.22.1.0/24, fd4d:6169:6c63:6f77::/64, 192.168.2.0/24];\n

    Warning

    The subnets before our attached example subnet MUST exists before or after your entered values. Otherwise some mailcow components such as Watchdog or some Sieve Filters (such as Absence Agents) will not work and errors will occur during operation.

    Run the following command to apply your new settings:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart postfix-mailcow rspamd-mailcow\n
    docker-compose restart postfix-mailcow rspamd-mailcow\n

    Good to know!

    IPv6 addresses MUST be entered with [] (square brackets) as mynetworks parameters in this case. Otherwise they cannot be processed.

    Info

    More information about mynetworks can be found in the Postfix documentation.

    "},{"location":"manual-guides/Redis/u_e-redis/","title":"Redis","text":"

    Redis is used as a key-value store for rspamd's and (some of) mailcow's settings and data. If you are unfamiliar with redis please read the introduction to redis and maybe visit this wonderful guide on how to use it.

    "},{"location":"manual-guides/Redis/u_e-redis/#client","title":"Client","text":"

    To connect to the redis cli execute:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow redis-cli\n
    docker-compose exec redis-mailcow redis-cli\n
    "},{"location":"manual-guides/Redis/u_e-redis/#debugging","title":"Debugging","text":"

    Here are some useful commands for the redis-cli for debugging:

    "},{"location":"manual-guides/Redis/u_e-redis/#monitor","title":"MONITOR","text":"

    Listens for all requests received by the server in real time:

    docker compose (Plugin)docker-compose (Standalone) 
    #docker compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
    #docker-compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
    "},{"location":"manual-guides/Redis/u_e-redis/#keys","title":"KEYS","text":"

    Get all keys matching your pattern:

    KEYS *\n
    "},{"location":"manual-guides/Redis/u_e-redis/#ping","title":"PING","text":"

    Test a connection:

    127.0.0.1:6379> PING\nPONG\n

    If you want to know more, here is a cheat sheet.

    "},{"location":"manual-guides/Rspamd/u-e-rspamd-add-additional-modules/","title":"Add Additional Modules","text":"

    Download the module and save it in the following path: data/conf/rspamd/plugins.d/.

    Next, add any necessary configuration for your module to data/conf/rspamd/rspamd.conf.local. \\ If you have a module named my_plugin.lua, configuration might look like the following:

    # rspamd.conf.local\nmy_plugin {\n    some_setting = \"some value\";\n}\n

    If your module does not require any additional configuration, simply add an empty configuration block, for example:

    # rspamd.conf.local\nmy_plugin { }\n

    If you do not add a configuration block, the module will be automatically disabled, and the rspamd-mailcow container log will contain a message such as:

    mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: lua module my_plugin is enabled but has not been configured\nmailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: my_plugin disabling unconfigured lua module\n

    If you have successfully configured your module, the rspamd-mailcow container logs should show:

    mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:04:50 #1(main) <8ayxpf>; cfg; rspamd_init_lua_filters: init lua module my_plugin from /etc/rspamd/plugins.d//my_plugin.lua; digest: 5cb88961e5\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/","title":"Tweaks","text":""},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#spam-filter-thresholds-global","title":"Spam filter thresholds (global)","text":"

    Each user is able to change their spam rating individually. To define a new server-wide limit, edit data/conf/rspamd/local.d/actions.conf:

    reject = 15;\nadd_header = 8;\ngreylist = 7;\n

    Save the file and restart \"rspamd-mailcow\":

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Warning

    Existing settings of users will not be overwritten!

    To reset custom defined thresholds, run:

    docker compose (Plugin)docker-compose (Standalone) 
    source mailcow.conf\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# or:\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
    source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# or:\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#custom-reject-messages","title":"Custom reject messages","text":"

    The default spam reject message can be changed by adding a new file data/conf/rspamd/override.d/worker-proxy.custom.inc with the following content:

    reject_message = \"My custom reject message\";\n

    Save the file and restart Rspamd:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    While the above works for rejected mails with a high spam score, prefilter reject actions will ignore this setting. For these maps, the multimap module in Rspamd needs to be adjusted:

    1. Find prefilet reject symbol for which you want change message, to do it run: grep -R \"SYMBOL_YOU_WANT_TO_ADJUST\" /opt/mailcow-dockerized/data/conf/rspamd/

    2. Add your custom message as new line:

      GLOBAL_RCPT_BL {\ntype = \"rcpt\";\nmap = \"${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map\";\nregexp = true;\nprefilter = true;\naction = \"reject\";\nmessage = \"Sending mail to this recipient is prohibited by postmaster@your.domain\";\n}\n

    3. Save the file and restart Rspamd:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#discard-instead-of-reject","title":"Discard instead of reject","text":"

    If you want to silently drop a message, create or edit the file data/conf/rspamd/override.d/worker-proxy.custom.inc and add the following content:

    discard_on_reject = true;\n

    Restart Rspamd:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/","title":"Work with Spam Data","text":""},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#learn-spam-ham","title":"Learn Spam & Ham","text":"

    Rspamd learns mail as spam or ham when you move a message in or out of the junk folder to any mailbox besides trash. This is achieved by using the Sieve plugin \"sieve_imapsieve\" and parser scripts.

    Rspamd also auto-learns mail when a high or low score is detected (see https://rspamd.com/doc/configuration/statistic.html#autolearning). We configured the plugin to keep a sane ratio between spam and ham learns.

    The bayes statistics are written to Redis as keys BAYES_HAM and BAYES_SPAM.

    Besides bayes, a local fuzzy storage is used to learn recurring patterns in text or images that indicate ham or spam.

    You can also use Rspamd's web UI to learn ham and / or spam or to adjust certain settings of Rspamd.

    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#learn-spam-or-ham-from-existing-directory","title":"Learn Spam or Ham from existing directory","text":"

    You can use a one-liner to learn mail in plain-text (uncompressed) format:

    docker compose (Plugin)docker-compose (Standalone) 
    # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n
    # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n

    Consider attaching a local folder as new volume to rspamd-mailcow in docker-compose.yml and learn given files inside the container. This can be used as workaround to parse compressed data with zcat. Example:

    for file in /data/old_mail/.Junk/cur/*; do rspamc learn_spam < zcat $file; done\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-learned-data-bayes-neural","title":"Reset learned data (Bayes, Neural)","text":"

    You need to delete keys in Redis to reset learned data, so create a copy of your Redis database now:

    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#copy-of-redis-database","title":"Copy of Redis database","text":"
    # It is better to stop Redis before you copy the file.\ncp /var/lib/docker/volumes/mailcowdockerized_redis-vol-1/_data/dump.rdb /root/\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-bayes-data","title":"Reset Bayes data","text":"docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
    docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-neural-data","title":"Reset Neural data","text":"docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
    docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
    "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-fuzzy-data","title":"Reset Fuzzy data","text":"docker compose (Plugin)docker-compose (Standalone) 
    # We need to enter the redis-cli first:\ndocker compose exec redis-mailcow redis-cli\n# In redis-cli:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n
    # We need to enter the redis-cli first:\ndocker-compose exec redis-mailcow redis-cli\n# In redis-cli:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n

    Info

    If redis-cli complains about... 

    (error) ERR wrong number of arguments for 'del' command\n
    ...the key pattern was not found and thus no data is available to delete - it is fine.

    "},{"location":"manual-guides/Rspamd/u_e-rspamd-disable-greylisting/","title":"Disable Greylisting","text":"

    Info

    In this guide we assume the default mailcow path (/opt/mailcow-dockerized). The path in your installation may vary.

    Only messages with a higher Rspamd score will be considered to be greylisted (soft rejected).

    We do NOT recommend deactivating greylisting.

    However, if you see a valid reason to disable greylisting, you can disable it server-wide by editing the greylist.conf:

    /opt/mailcow-dockerized/data/conf/rspamd/local.d/greylist.conf

    Add the line:

    enabled = false;\n

    Save the file and restart \"rspamd-mailcow\":

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Greylisting is now deactivated serverwide!

    "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/","title":"General Settings","text":"

    Rspamd is used for AV handling, DKIM signing and SPAM handling. It's a powerful and fast filter system. For a more in-depth documentation on Rspamd please visit its own documentation.

    "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#ui-access","title":"UI access","text":"

    Rspamd offers a comprehensive WebUI, which is included in every mailcow: dockerized installation.

    The Rspamd UI is provided with a login, which is set to a random password during the initial installation to deny third party access.

    To be able to log in to the Rspamd UI, you must first set your own password for the Rspamd interface.

    You do this as follows:

    1. Log in to your mailcow UI as administrator.
    2. Switch to the tab (top left) System Configuration and there the sub-tab: Access Rspamd UI.
    3. Change the Rspamd UI password here, or set one.
    4. Go to https://${MAILCOW_HOSTNAME}/rspamd in a browser and log in!

    Further configuration options and documentation for the WebUI can be found here: https://rspamd.com/webui/

    "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#cli-tools","title":"CLI tools","text":"

    Rspamd offers a variety of commands that can be used via CLI.

    Enter the following commands to get an overview of these:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow rspamc --help\ndocker compose exec rspamd-mailcow rspamadm --help\n
    docker-compose exec rspamd-mailcow rspamc --help\ndocker-compose exec rspamd-mailcow rspamadm --help\n
    "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#increase-history-retention","title":"Increase history retention","text":"

    By default Rspamd keeps 1000 elements in the history.

    The history is stored compressed.

    It is recommended not to use a disproportionate high value here, try something along 5000 or 10000 and see how your server handles it:

    Edit data/conf/rspamd/local.d/history_redis.conf:

    nrows = 1000; # change this value\n

    Restart Rspamd afterwards:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n
    "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#wipe-all-ratelimit-keys","title":"Wipe all ratelimit keys","text":"

    If you don't want to use the UI and instead wipe all keys in the Redis database, you can use redis-cli for that task:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow sh\n# Unlink (available in Redis >=4.) will delete in the backgronud\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n
    docker-compose exec redis-mailcow sh\n# Unlink (available in Redis >=4.) will delete in the backgronud\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n

    Restart Rspamd:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/","title":"SOGo","text":"

    SOGo is used for accessing your mails via a webbrowser, adding and sharing your contacts or calendars. For a more in-depth documentation on SOGo please visit its own documentation.

    "},{"location":"manual-guides/SOGo/u_e-sogo/#apply-custom-sogo-theme","title":"Apply custom SOGo theme","text":"

    mailcow builds after 28 January 2021 can change SOGo's theme by editing data/conf/sogo/custom-theme.js. Please check the AngularJS Material intro and documentation as well as the material style guideline to learn how this works.

    You can use the provided custom-theme.js as an example starting point by removing the comments. After you modified data/conf/sogo/custom-theme.js and made changes to your new SOGo theme you need to

    1. edit data/conf/sogo/sogo.conf and append/set SOGoUIxDebugEnabled = YES;

    2. restart SOGo and Memcached containers by executing the command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow sogo-mailcow\n
    docker-compose restart memcached-mailcow sogo-mailcow\n

    3. open SOGo in browser

    4. open browser developer console, usually shortcut is F12

    5. only if you use Firefox: write by hands in dev console allow pasting and press enter

    6. paste java script snippet in dev console: 

    copy([].slice.call(document.styleSheets)\n  .map(e => e.ownerNode)\n  .filter(e => e.hasAttribute('md-theme-style'))\n  .map(e => e.textContent)\n  .join('\\n')\n)\n

    7. open text editor and paste data from clipboard (Ctrl+V), you should get minified CSS, save it

    8. copy CSS file to mailcow server data/conf/sogo/custom-theme.css

    9. edit data/conf/sogo/sogo.conf and set SOGoUIxDebugEnabled = NO;

    10. append/create docker-compose.override.yml with: 

    services:\n  sogo-mailcow:\n    volumes:\n      - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n

    11. Run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    12. Run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow\n
    docker-compose restart memcached-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#reset-to-sogo-default-theme","title":"Reset to SOGo default theme","text":"

    1. checkout data/conf/sogo/custom-theme.js by executing git fetch ; git checkout origin/master data/conf/sogo/custom-theme.js data/conf/sogo/custom-theme.js

    2. find in data/conf/sogo/custom-theme.js: 

    // Apply new palettes to the default theme, remap some of the hues\n    $mdThemingProvider.theme('default')\n      .primaryPalette('green-cow', {\n        'default': '400',  // background color of top toolbars\n        'hue-1': '400',\n        'hue-2': '600',    // background color of sidebar toolbar\n        'hue-3': 'A700'\n      })\n      .accentPalette('green', {\n        'default': '600',  // background color of fab buttons and login screen\n        'hue-1': '300',    // background color of center list toolbar\n        'hue-2': '300',    // highlight color for selected mail and current day calendar\n        'hue-3': 'A700'\n      })\n      .backgroundPalette('frost-grey');\n
    and replace it with: 
        $mdThemingProvider.theme('default');\n

    3. remove from docker-compose.override.yml volume mount in sogo-mailcow: 

    - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n

    4. Run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    5. Run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow\n
    docker-compose restart memcached-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#change-favicon","title":"Change favicon","text":"

    mailcow builds after 31 January 2021 can change SOGo's favicon by replacing data/conf/sogo/custom-favicon.ico for SOGo and data/web/favicon.png for mailcow UI. Note: You can use .png favicons for SOGo by renaming them to custom-favicon.ico. For both SOGo and mailcow UI favicons you need use one of the standard dimensions: 16x16, 32x32, 64x64, 128x128 and 256x256. After you replaced said file you need to restart SOGo and Memcached containers by executing:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow sogo-mailcow\n
    docker-compose restart memcached-mailcow sogo-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#change-logo","title":"Change logo","text":"

    mailcow builds after 21 December 2018 can change SOGo's logo by replacing or creating (if missing) data/conf/sogo/sogo-full.svg. After you replaced said file you need to restart SOGo and Memcached containers by executing:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow sogo-mailcow\n
    docker-compose restart memcached-mailcow sogo-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#connect-domains","title":"Connect domains","text":"

    Domains are usually isolated from eachother.

    You can change that by modifying data/conf/sogo/sogo.conf:

    Search... 

       // SOGoDomainsVisibility = (\n    //  (domain1.tld, domain5.tld),\n    //  (domain3.tld, domain2.tld)\n    // );\n
    ...and replace it by - for example:

        SOGoDomainsVisibility = (\n      (example.org, example.com, example.net)\n    );\n

    Restart SOGo:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart sogo-mailcow\n
    docker-compose restart sogo-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#enable-password-changing","title":"Enable password changing","text":"

    The password change option in SOGo is disabled by default because it:

    • doesn't take into account the password policy set in the mailcow UI
    • doesn't work when the user is logged in into SOGo using the Login to Webmail function in the mailcow UI (Auth Proxy)

    If you still want enable this option edit data/conf/sogo/sogo.conf and change SOGoPasswordChangeEnabled to YES. Please do not add a new parameter.

    Run this command to activate the changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart memcached-mailcow sogo-mailcow\n
    docker-compose restart memcached-mailcow sogo-mailcow\n
    "},{"location":"manual-guides/SOGo/u_e-sogo/#reset-totp-disable-totp","title":"Reset TOTP / Disable TOTP","text":"

    Run the following command from within the mailcow directory:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
    docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
    "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/","title":"Using an external DNS service","text":"

    If you want or have to use an external DNS service, you can either set a forwarder in Unbound or copy an override file to define external DNS servers:

    Warning

    Please do not use a public resolver like we did in the example above. Many - if not all - blacklist lookups will fail with public resolvers, because blacklist server has limits on how much requests can be done from one IP and public resolvers usually reach this limits. Important: Only DNSSEC validating DNS services will work.

    "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/#method-a-unbound","title":"Method A, Unbound","text":"

    Edit data/conf/unbound/unbound.conf and append the following parameters:

    forward-zone:\n  name: \".\"\n  forward-addr: 8.8.8.8 # DO NOT USE PUBLIC DNS SERVERS - JUST AN EXAMPLE\n  forward-addr: 8.8.4.4 # DO NOT USE PUBLIC DNS SERVERS - JUST AN EXAMPLE\n

    Restart Unbound:

    docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart unbound-mailcow\n
      docker-compose restart unbound-mailcow\n
    "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/#method-b-override-file","title":"Method B, Override file","text":"
    cd /opt/mailcow-dockerized\ncp helper-scripts/docker-compose.override.yml.d/EXTERNAL_DNS/docker-compose.override.yml .\n

    Edit docker-compose.override.yml and adjust the IP.

    Afterwards stop and start the Docker Stack again:

    docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\n  docker compose up -d\n
      docker-compose down\n  docker-compose up -d\n
    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/","title":"Thresholds","text":"

    Watchdog uses default values for all thresholds defined in docker-compose.yml.

    The default values will work for most setups. Example: 

    - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}\n- UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}\n- REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}\n- MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}\n- MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}\n- SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}\n- POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}\n- CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}\n- DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}\n- DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}\n- PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}\n- RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}\n- FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}\n- ACME_THRESHOLD=${ACME_THRESHOLD:-1}\n- RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}\n- OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}\n- MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}\n- MAILQ_CRIT=${MAILQ_CRIT:-30}\n

    To adjust them just add necessary threshold variables (e.g. MAILQ_THRESHOLD=10) to mailcow.conf and run the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#thresholds-descriptions","title":"Thresholds descriptions","text":""},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#nginx_threshold","title":"NGINX_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to Nginx on port 8081 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#unbound_threshold","title":"UNBOUND_THRESHOLD","text":"

    Notifies administrators if Unbound can not resolve/valide external domains/DNSSEC and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#redis_threshold","title":"REDIS_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to Redis on port 6379 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_threshold","title":"MYSQL_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to MySQL or can not query a table and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_replication_threshold","title":"MYSQL_REPLICATION_THRESHOLD","text":"

    Notifies administrators if the MySQL replication fails.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#sogo_threshold","title":"SOGO_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to SOGo on port 20000 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#postfix_threshold","title":"POSTFIX_THRESHOLD","text":"

    Notifies administrators if watchdog can not sent a test mail via port 589 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#clamd_threshold","title":"CLAMD_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to Clamd and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_threshold","title":"DOVECOT_THRESHOLD","text":"

    Notifies administrators if watchdog fails with various tests with Dovecot container and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_repl_threshold","title":"DOVECOT_REPL_THRESHOLD","text":"

    Notifies administrators if the Dovecot replication fails.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#phpfpm_threshold","title":"PHPFPM_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to PHP-FPM on port 9001/9002 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#ratelimit_threshold","title":"RATELIMIT_THRESHOLD","text":"

    Notifies administrators if a ratelimit got hit.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#fail2ban_threshold","title":"FAIL2BAN_THRESHOLD","text":"

    Notifies administrators if a fail2ban banned an IP.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#acme_threshold","title":"ACME_THRESHOLD","text":"

    Notifies administrators if something is wrong with the acme-mailcow container. You may check its logs.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#rspamd_threshold","title":"RSPAMD_THRESHOLD","text":"

    Notifies administrators if watchdog fails with various tests with Rspamd container and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#olefy_threshold","title":"OLEFY_THRESHOLD","text":"

    Notifies administrators if watchdog can not establish a connection to olefy on port 10005 and it will restart the container automatically when issues were found and the threshold has been reached.

    "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mailq_crit-and-mailq_threshold","title":"MAILQ_CRIT and MAILQ_THRESHOLD","text":"

    Notifies administrators if number of emails in the postfix queue is greater then MAILQ_CRIT for period of MAILQ_THRESHOLD * (60\u00b130) seconds.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/","title":"Blacklist / Whitelist","text":"

    To add or edit an entry to your domain-wide filter table, log in to your mailcow UI as (domain) administrator and go to: Configuration > Email Setup > Domains > Edit Domain > Spam Filter.

    Info

    Be aware that a user can override this setting by setting their own blacklist and whitelist!

    There is also a global filter table in Configuration > Configuration & Details > Global filter maps to configure a server wide filter for multiple regex maps (todo: screenshots).

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-config/","title":"Configuration","text":"

    Several configuration parameters of the mailcow UI can be changed by creating a file data/web/inc/vars.local.inc.php which overrides defaults settings found in data/web/inc/vars.inc.php.

    The local configuration file is persistent over updates of mailcow. Try not to change values inside data/web/inc/vars.inc.php, but use them as template for the local override.

    mailcow UI configuration parameters can be used to...

    • ...change the default language1
    • ...change the default bootstrap theme
    • ...set a password complexity regex
    • ...enable DKIM private key visibility
    • ...set a pagination trigger size
    • ...set default mailbox attributes
    • ...change session lifetimes
    • ...create fixed app menus (which cannot be changed in mailcow UI)
    • ...set a default \"To\" field for relayhost tests
    • ...set a timeout for Docker API requests
    • ...toggle IP anonymization

    1. To change SOGos default language, you will need to edit data/conf/sogo/sogo.conf and replace \"English\" by your preferred language.\u00a0\u21a9

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-css/","title":"CSS overrides","text":"

    For custom overrides of specific elements via CSS, use data/web/css/build/0081-custom-mailcow.css.

    The file is excluded from tracking and persists over updates.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/","title":"WebAuthn / FIDO2","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#how-is-uv-handled-in-mailcow","title":"How is UV handled in mailcow?","text":"

    The UV flag (as in \"user verification\") enforces WebAuthn to verify the user before it allows access to the key (think of a PIN). We don't enforce UV to allow logins via iOS and NFC (YubiKey).

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#login-and-key-processing","title":"Login and key processing","text":"

    mailcow uses client-side key processing. We ask the authenticator (i.e. YubiKey) to save the registration in its memory.

    A user does not need to enter a username. The available credentials - if any - will be shown to the user when selecting the \"key login\" via mailcow UI login.

    When calling the login process, the authenticator is not given any credential IDs. This will force it to lookup credentials in its own memory.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#who-can-use-webauthn-to-login-to-mailcow","title":"Who can use WebAuthn to login to mailcow?","text":"

    As of today, only administrators and domain administrators are able to setup WebAuthn/FIDO2.

    You want to use WebAuthn/Fido as 2FA? Check it out here: Two-Factor Authentication

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/","title":"Forgot Password Feature","text":"

    Note

    This feature requires a mailcow installation at 2024-08!

    The currently installed patch level can be viewed in the mailcow versions since 2022 within the UI.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#preface","title":"Preface","text":"

    Thank You!

    This functionality was integrated into mailcow due to the Youth Foundation Baden-W\u00fcrttemberg (Germany) as part of a sponsored development in August 2024.

    Thank you for sponsoring this feature!

    With the \"Forgot Password\" function, mailbox users can request a link to reset their password by providing a backup email address and then reset their password.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#requirements","title":"Requirements","text":"

    To activate and use this feature for a user, the following must be noted:

    1. The mailcow administrator must have configured a sender email and a subject (see below). The sender email does not need to exist as a mailbox; however, the domain must be fully set up in mailcow to ensure that sending and especially delivery of emails is guaranteed.
    2. The mailbox user must have a backup email address set in their options. This can be done by the user themselves (if the corresponding ACL is not disabled) or by the administrator.
    3. The backup email should be different from the email address of the account for which the password is to be reset.
    4. The backup email must also be able to receive external emails and should, if possible, be from a different provider and not directly on the mailcow server (this point is optional and serves only as a recommendation).
    5. The user must have access to the backup email's mailbox since the links are only valid for a limited time.
    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#configuration-options-in-the-mailcow-ui","title":"Configuration Options in the mailcow UI","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#mailbox-settings","title":"Mailbox Settings","text":"

    This feature adds a new field to the mailbox options:

    Attention

    Reminder: This field MUST be filled in for the user to reset their password! If it is not set, they will not be able to reset their password!

    For administrators, there is a new ACL that can be set either per mailbox afterwards or as a template for mailboxes: Allow management of the password recovery email:

    Note

    If a user has already set a backup email but the admin removes this ACL from them, they can still reset their password since the backup email remains in the system. The ACL does not automatically forbid the possibility of resetting the password if there is an email!

    To achieve this, the backup email for the user must also be removed by an administrator.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#server-settings","title":"Server Settings","text":"

    The mailcow administrator can also edit the template for the \"Forgot Password\" emails, similar to the quota and quarantine emails, to customize how the emails are sent. By default, the template is always in English.

    This can be accessed under the tab: System -> Configuration -> Options -> Password Settings:

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#hidden-settings-not-in-the-mailcow-ui","title":"Hidden Settings (not in the mailcow UI)","text":"

    By default, each user can request a maximum of 3 password reset tokens, which are valid for 15 minutes.

    Server administrators can configure the expiration time and the maximum tokens per user.

    For this, a file named vars.local.inc.php must be created in the folder MAILCOW_ROOT/data/web/inc if it does not already exist.

    This file must contain at least the following:

    <?php\n\n// Maximum number of password reset tokens that can be generated at once per user\n$PW_RESET_TOKEN_LIMIT = 3; // Change this number to another value\n\n// Maximum time in minutes a password reset token is valid\n$PW_RESET_TOKEN_LIFETIME = 15; // Change this number to another value. Value in minutes\n

    The file is automatically loaded, no restart of mailcow or any of the containers is required!

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/","title":"Netfilter","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#change-netfilter-ban-settings","title":"Change Netfilter Ban Settings","text":"

    To change the Netfilter settings in general please navigate to: Configuration -> Configuration & Details -> Configuration -> Fail2ban parameters.

    You should now see a familar interface:

    Here you can set several options regarding the bans itself. For example the max. Ban time or the max. attempts before a ban is executed.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#change-netfilter-regex","title":"Change Netfilter Regex","text":"

    Danger

    The following area requires at least basic regex knowledge. If you are not sure what you are doing there, we can only advise you not to attempt a reconfiguration.

    In addition to the ban settings, you can also define what exactly should be used from the mailcow container logs to ban a possible attacker.

    To do this, you must first expand the regex field, which will look something like this:

    There you can now create various new filter rules.

    Info

    As updates progress, it is possible that new Netfilter regex rules will be added or removed. If this is the case, it is recommended to reset the Netfilter regex rules by clicking on Reset to default.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#provide-netfilter-decisions-via-url-as-source-for-firewall-block-rules","title":"Provide Netfilter decisions via URL as source for firewall block rules","text":"

    Info

    However, the option is deactivated by default and must first be activated by you.

    Since the 2023-12 update, mailcow offers the possibility to export the netfilter decisions as an external endpoint in order to be able to integrate the data from it into an external firewall system, quasi as a blocklist source.

    What does this function do for me?

    With this functionality, you can forward the IPs marked as blocked by Netfilter to an endpoint, which can then process these IPs. For example, an OPNsense firewall can dynamically load this list.

    Let's take a look at these settings:

    To activate the general function, the checkbox Manage Fail2Ban externally must be checked.

    As soon as this is done, the URL (point 2) can be copied and pasted into the respective endpoint.

    Important

    The URL can be regenerated if required. To do this, click on the symbol next to Copy Reload symbol.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/","title":"Notification templates","text":"

    mailcow uses the template engine Jinja for the notification mails. Placeholders can be used to create dynamic content with these templates by replacing them with passed variables during execution. A documentation about the development of Jinja templates can be found here.

    The following variables can be used for the notification email templates:

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quarantine-template","title":"Quarantine template","text":"

    The provided variables can also be obtained on GitHub from the script dovecot/quarantine_notify.py.

    Info

    As an administrator, you can edit the template for the quarantine mails in the mailcow user interface in the global quarantine settings and restore the default template there as well. Code examples can be found in the default template. It can also be viewed on GitHub.

    Name Content username E-mail address of the mailbox user counter Number of messages in the quarantine, about which this e-mail informs hostname Name of the mailcow instance (See also the environment variable MAILCOW_HOSTNAME) quarantine_acl Quarantine ACL setting of the mailbox user (Permission to process the mails in the quarantine) meta Array/list of all messages in the quarantine about which this e-mail informs meta.qhash Hash value of the quarantine entry (e.g. for direct link to the message in the quarantine) meta.id ID of the quarantine entry meta.subject Title of the quarantine entry meta.score Spam score of the quarantine entry meta.sender Sender address of the quarantine entry meta.created Creation date of the quarantine entry / receipt of the e-mail meta.action Action of the spam filter (moved to spam folder or quarantine)."},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quota-template","title":"Quota template","text":"

    The provided variables can also be obtained on GitHub from the script dovecot/quota_notify.py.

    Info

    The template for the quota mails can be edited as an administrator in the mailcow user interface in the quota settings and there also restore the default template. Code examples can be found in the default template. It can also be viewed on GitHub.

    Name Content username E-mail address of the mailbox user percent Percentage of the occupied space of the mailbox"},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-pushover/","title":"Pushover","text":"

    Info

    Pushover makes it easy to get real-time notifications on your Android, iPhone, iPad, and Desktop

    You can use Pushover to get a push notification on every mail you receive for each mailbox where you enabled this feature.

    1. As admin open your mailbox' settings and scroll down to the Pushover settings

    2. Register yourself on Pushover

    3. Put your 'User Key' in the 'User/Group Key' field in your mailbox settings

    4. Create an Applications to get the API Token/Key which you also need to put in your mailbox settings

    5. Optional you can edit the notification title/text and define certain sender email addresses where a push notification is triggered

    6. Save everything and then you can verify your credentials

    If everything is done you can test sending a mail and you will receive a push message on your phone

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-spamalias/","title":"Temporary email aliases","text":"

    These temporary email aliases are mostly used for places where we need to provide an email address but don't want future correspondence with. They are also called spam alias.

    To create, delete or extend a temporary email aliases you need to login to mailcow's UI as a mailbox user and navigate to the tab Temporary email aliases:

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-spamfilter/","title":"Spamfilter","text":"

    A mailbox user may adjust the spam filter and black- / whitelist settings for his mailbox individually by navigating to the Spam filter tab in the users mailcow UI.

    Info

    For global adjustments on your spam filter please check our section on Rspamd. For a domain wide black- and whitelist please check our guide on Black / Whitelist

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/","title":"Sub-addressing","text":"

    Mailbox users can tag their mail address like in me+facebook@example.org. They can control the tag handling in the users mailcow UI panel under Mailbox > Settings.

    sub-addressing (RFC 5233) or plus addressing also known as tagging (do not mix with Tags)

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/#available-actions","title":"Available Actions","text":"

    1. Move this message to a sub folder \"facebook\" (will be created lower case if not existing)

    2. Prepend the tag to the subject: \"[facebook] Subject\"

    Please note: Uppercase tags are converted to lowercase except for the first letter. If you want to keep the tag as it is, please apply the following diff and restart mailcow: 

    diff --git a/data/conf/dovecot/global_sieve_after b/data/conf/dovecot/global_sieve_after\nindex e047136e..933c4137 100644\n--- a/data/conf/dovecot/global_sieve_after\n+++ b/data/conf/dovecot/global_sieve_after\n@@ -15,7 +15,7 @@ if allof (\n   envelope :detail :matches \"to\" \"*\",\n   header :contains \"X-Moo-Tag\" \"YES\"\n   ) {\n-  set :lower :upperfirst \"tag\" \"${1}\";\n+  set \"tag\" \"${1}\";\n   if mailboxexists \"INBOX/${1}\" {\n     fileinto \"INBOX/${1}\";\n   } else {\n

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/","title":"Tags (for Domains and Mailboxes)","text":"

    Info

    You need the mailcow Version 2022-05 at least for this feature. If you don\u00b4t have the Version installed please consider a update. For more informations about a mailcow update please take a look at the Update section here in the docs.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#what-are-tags-designed-for","title":"What are Tags designed for?","text":"

    With the Tags you can easily sort your Domains and Mailboxes by the tags instead of their name.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#where-are-the-tags-located","title":"Where are the Tags located?","text":"

    The Tags are located in the Domain/Mailbox section of the mailcow UI. To view them simply click on the small plus symbol on the left of your Domain/Mailbox (following picture is showing the domain ribbon menu):

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#how-can-i-addremove-a-tag","title":"How can i add/remove a Tag?","text":"

    You can simply add/remove a Tag during the creation of a new Domain/Mailbox. You also can add/remove them if you edit your desired Domain/Mailbox.

    It looks similar to this (following picture showing the domain edit section):

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#how-can-i-search-for-a-tag","title":"How can i search for a tag?","text":"

    Simply type the Tag Name in the search bar in the Domain/Mailbox Section and wait for it to complete.

    You can even specify if you want to search for tags only.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/","title":"Two-Factor Authentication","text":"

    So far three methods for Two-Factor Authentication are implemented: WebAuthn (replacing U2F since February 2022), Yubi OTP, and TOTP

    • For WebAuthn to work, you need an encrypted connection to the server (HTTPS) as well as a FIDO security key.
    • Both WebAuthn and Yubi OTP work well with the fantastic Yubikey.
    • While Yubi OTP needs an active internet connection and an API ID + key, WebAuthn will work with any Fido Security Key out of the box, but can only be used when mailcow is accessed over HTTPS.
    • WebAuthn and Yubi OTP support multiple keys per user.
    • As the third TFA method mailcow uses TOTP: time-based one-time passwords. Those passwords can be generated with apps like \"Google Authenticator\" after initially scanning a QR code or entering the given secret manually.

    As administrator you are able to temporary disable a domain administrators TFA login until they successfully logged in.

    The key used to login will be displayed in green, while other keys remain grey.

    Information on how to remove 2FA can be found here.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#yubi-otp","title":"Yubi OTP","text":"

    The Yubi API ID and Key will be checked against the Yubico Cloud API. When setting up TFA you will be asked for your personal API account for this key. The API ID, API key and the first 12 characters (your YubiKeys ID in modhex) are stored in the MySQL table as secret.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#example-setup","title":"Example setup","text":"

    First of all, the YubiKey must be configured for use as an OTP Generator. To do this, download the YubiKey Manager from the Yubico website: here

    In the following you configure the YubiKey for OTP. Via the menu item Applications -> OTP and a click on the Configure button. In the following menu select Credential Type -> Yubico OTP and click on Next.

    Set a checkmark in the Use serial checkbox, generate a Private ID and a Secret key via the buttons. So that the YubiKey can be validated later, the checkmark in the Upload checkbox must also be set and then click on Finish.

    Now a new browser window will open in which you have to enter an OTP of your YubiKey at the bottom of the form (click on the field and then tap on your YubiKey). Confirm the captcha and upload the information to the Yubico server by clicking 'Upload'. The processing of the data will take a moment.

    After the generation was successful, you will be shown a Client ID and a Secret key, make a note of this information in a safe place.

    Now you can select Yubico OTP authentication from the dropdown menu in the mailcow UI on the start page under Access -> Two-factor authentication. In the dialog that opened now you can enter a name for this YubiKey and insert the Client ID you noted before as well as the Secret key into the fields provided. Finally, enter your current account password and, after selecting the Touch Yubikey field, touch your YubiKey button.

    Congratulations! You can now log in to the mailcow UI using your YubiKey!

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#webauthn-u2f-replacement","title":"WebAuthn (U2F, replacement)","text":"

    Warning

    Since February 2022 Google Chrome has discarded support for U2F and standardized the use of WebAuthn. The WebAuthn (U2F removal) is part of mailcow since 21th January 2022, so if you want to use the Key past February 2022 please consider a update with the update.sh

    To use WebAuthn, the browser must support this standard.

    The following desktop browsers support this authentication type:

    • Edge (>=18)
    • Firefox (>=60)
    • Chrome (>=67)
    • Safari (>=13)
    • Opera (>=54)

    The following mobile browsers support this authentication type:

    • Safari on iOS (>=14.5)
    • Android Browser (>=97)
    • Opera Mobile (>=64)
    • Chrome for Android (>=97)

    Sources: caniuse.com, blog.mozilla.org

    WebAuthn works without an internet connection.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#what-will-happen-to-my-registered-fido-security-key-after-the-update-from-u2f-to-webauthn","title":"What will happen to my registered Fido Security Key after the Update from U2F to WebAuthn?","text":"

    Warning

    With this new U2F replacement (WebAuthn) you have to re-register your Fido Security Key, thankfully WebAuthn is backwards compatible and supports the U2F protocol.

    Ideally, the next time you log in (with the key), you should get a text box saying that your Fido Security Key has been removed due to the update to WebAuthn and deleted as a 2-factor authenticator.

    But don't worry! You can simply re-register your existing key and use it as usual, you probably won't even notice a difference, except that your browser won't show the U2F deactivation message anymore.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#disable-unofficial-supported-fido-security-keys","title":"Disable unofficial supported Fido Security Keys","text":"

    With WebAuthn there is the possibility to use only official Fido Security Keys (from the big brands like: Yubico, Apple, Nitro, Google, Huawei, Microsoft, etc.).

    This is primarily for security purposes, as it allows administrators to ensure that only official hardware can be used in their environment.

    To enable this feature, change the value WEBAUTHN_ONLY_TRUSTED_VENDORS in mailcow.conf from n to y and restart the affected containers with the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    The mailcow will now use the Vendor Certificates located in your mailcow directory under data/web/inc/lib/WebAuthn/rootCertificates.

    Example

    If you want to limit the official Vendor devices to Apple only you only need the Apple Vendor Certificate inside the data/web/inc/lib/WebAuthn/rootCertificates. After you deleted all other certs you now only can activate WebAuthn 2FA with Apple devices.

    Every vendor (listed there) behaves the same, so choose what you like (if you want to).

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#use-own-certificates-for-webauthn","title":"Use own certificates for WebAuthn","text":"

    If you have a valid certificate from the vendor of your key you can also add it to your mailcow!

    Just copy the certificate into the data/web/inc/lib/WebAuthn/rootCertificates folder and restart your mailcow.

    Now you should be able to register this device as well, even though the verification for the vendor certificates is enabled, since you just added the certificate manually.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#is-it-dangerous-to-keep-the-vendor-check-disabled","title":"Is it dangerous to keep the Vendor Check disabled?","text":"

    No, it isn\u00b4t! These vendor certificates are only used to verify original hardware, not to secure the registration process.

    As you can read in these articles, the deactivation is not software security related:

    • https://developers.yubico.com/U2F/Attestation_and_Metadata/
    • https://medium.com/webauthnworks/webauthn-fido2-demystifying-attestation-and-mds-efc3b3cb3651
    • https://medium.com/webauthnworks/sorting-fido-ctap-webauthn-terminology-7d32067c0b01

    In the end, however, it is of course your decision to leave this check disabled or enabled.

    "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#totp","title":"TOTP","text":"

    The best known TFA method mostly used with a smartphone.

    To setup the TOTP method login to the Admin UI and select Time-based OTP (TOTP) from the list.

    Now a modal will open in which you have to type in a name for your 2FA \"device\" (example: John Deer\u00b4s Smartphone) and the password of the affected Admin account (you are currently logged in with).

    You have two seperate methods to register TOTP to your account: 1. Scan the QR-Code with your Authenticator App on a Smartphone or Tablet. 2. Use the TOTP Code (under the QR Code) in your TOTP Program or App (if you can\u00b4t scan a QR Code).

    After you have registered the QR or TOTP code in the TOTP app/program of your choice you only need to enter the now generated TOTP token (in the app/program) as confirmation in the mailcow UI to finally activate the TOTP 2FA, otherwise it will not be activated even though the TOTP token is already generated in your app/program.

    "},{"location":"models/model-acl/","title":"ACL","text":"

    Editing a domain administrator or a mailbox user allows to set restrictions to that account.

    Important: For overlapping modules like sync jobs, which both domain administrators and mailbox users can be granted access to, the domain administrators permissions are inherited, when logging in as mailbox user.

    Some examples:

    1.

    • A domain administror has not access to sync jobs but can login as mailbox user
    • When logging in as mailbox user, he does not gain access to sync jobs, even if the given mailbox user has access when logging in directly

    2.

    • A domain administror has access to sync jobs and can login as mailbox user
    • The mailbox user he tries to login as has not access to sync jobs
    • The domain administrator, now logged in as mailbox user, inherits its permission to the mailbox user and can access sync jobs

    3.

    • A domain administrator logs in as mailbox user
    • Every permission, that does not exist in a domain administrators ACL, is automatically granted (example: time-limited alias, TLS policy etc.)
    "},{"location":"models/model-passwd/","title":"Password hashing","text":""},{"location":"models/model-passwd/#fully-supported-hashing-methods","title":"Fully supported hashing methods","text":"

    The most current mailcow fully supports the following hashing methods. The default hashing method is written in bold:

    • BLF-CRYPT
    • SSHA
    • SSHA256
    • SSHA512

    The methods above can be used in mailcow.conf as MAILCOW_PASS_SCHEME value.

    "},{"location":"models/model-passwd/#read-only-hashing-methods","title":"Read-only hashing methods","text":"

    The following methods are supported read only. If you plan to use SOGo (as per default), you need a SOGo compatible hashing method. Please see the note at the bottom of this page how to update the view if necessary. With SOGo disabled, all hashing methods below will be able to be read by mailcow and Dovecot.

    • ARGON2I (SOGo compatible)
    • ARGON2ID (SOGo compatible)
    • CLEAR
    • CLEARTEXT
    • CRYPT (SOGo compatible)
    • DES-CRYPT
    • LDAP-MD5 (SOGo compatible)
    • MD5 (SOGo compatible)
    • MD5-CRYPT (SOGo compatible)
    • PBKDF2 (SOGo compatible)
    • PLAIN (SOGo compatible)
    • PLAIN-MD4
    • PLAIN-MD5
    • PLAIN-TRUNC
    • SHA (SOGo compatible)
    • SHA1 (SOGo compatible)
    • SHA256 (SOGo compatible)
    • SHA256-CRYPT (SOGo compatible)
    • SHA512 (SOGo compatible)
    • SHA512-CRYPT (SOGo compatible)
    • SMD5 (SOGo compatible)

    That means mailcow is able to verify users with a hash like {MD5}1a1dc91c907325c69271ddf0c944bc72 from the database.

    The value of MAILCOW_PASS_SCHEME will always be used to encrypt new passwords.

    I changed the password hashes in the \"mailbox\" SQL table and cannot login.

    A \"view\" needs to be updated. You can trigger this by restarting sogo-mailcow:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart sogo-mailcow\n
    docker-compose restart sogo-mailcow\n
    "},{"location":"models/model-sender_rcv/","title":"Sender and receiver model","text":"

    When a mailbox is created, a user is allowed to send mail from and receive mail for his own mailbox address.

    Mailbox me@example.org is created. example.org is a primary domain.\nNote: a mailbox cannot be created in an alias domain.\n\nme@example.org is only known as me@example.org.\nme@example.org is allowed to send as me@example.org.\n

    We can add an alias domain for example.org:

    Alias domain alias.com is added and assigned to primary domain example.org.\nme@example.org is now known as me@example.org and me@alias.com.\nme@example.org is now allowed to send as me@example.org and me@alias.com.\n

    We can add aliases for a mailbox to receive mail for and to send from this new address.

    It is important to know, that you are not able to receive mail for my-alias@my-alias-domain.tld. You would need to create this particular alias.

    me@example.org is assigned the alias alias@example.org\nme@example.org is now known as me@example.org, me@alias.com, alias@example.org\n\nme@example.org is NOT known as alias@alias.com.\n

    Please note that this does not apply to catch-all aliases:

    Alias domain alias.com is added and assigned to primary domain example.org\nme@example.org is assigned the catch-all alias @example.org\nme@example.org is still just known as me@example.org, which is the only available send-as option\n\nAny email send to alias.com will match the catch-all alias for example.org\n

    Administrators and domain administrators can edit mailboxes to allow specific users to send as other mailbox users (\"delegate\" them).

    You can choose between mailbox users or completely disable the sender check for domains.

    "},{"location":"models/model-sender_rcv/#sogo-mail-from-addresses","title":"SOGo \"mail from\" addresses","text":"

    Mailbox users can, obviously, select their own mailbox address, as well as all alias addresses and aliases that exist through alias domains.

    If you want to select another existing mailbox user as your \"mail from\" address, this user has to delegate you access through SOGo (see SOGo documentation). Moreover a mailcow (domain) administrator needs to grant you access as described above.

    "},{"location":"post_installation/firststeps-authorize_watchdog_and_bounces/","title":"Authorize Watchdog and Bounce Mails","text":"

    mailcow uses MAILCOW_HOSTNAME as the sender domain to send watchdog notifications and compose bounce emails.

    1. WATCHDOG_NOTIFY_EMAIL should point to external recipients, managed by another mail server. This is very important because the watchdog notifies you about system outages. If this happens, your instance might not be capable of accepting or displaying this notification.
    2. Since the watchdog is designed to work in any situation, including cases when Postfix, Rspamd, or Redis is not functioning, we send emails directly via the watchdog container to the recipient's MX without any DKIM signing.

    To properly send watchdog notifications and bounces to external mail servers, you need to configure SPF and DMARC for MAILCOW_HOSTNAME (replace mail.example.com and the IPs to reflect your setup):

    _dmarc.mail.example.com IN TXT \"v=DMARC1; p=reject\"\nmail.example.com IN TXT \"v=spf1 ip4:192.0.2.146/32 ip6:2001:db8::1/128 -all\"\n

    Info

    If you want, later you can use this SPF as an include on other domains as: 

    example.com IN TXT \"v=spf1 include:mail.example.com -all\"\n

    "},{"location":"post_installation/firststeps-disable_ipv6/","title":"Disable IPv6","text":"

    Danger

    In installations using a Docker version between 25.0.0 and 25.0.2 (to check, use docker version) the behavior of IPv6 address allocation has changed due to a bug. Simply using enable_ipv6: false is NO LONGER sufficient to completely disable IPv6 in the stack. This was a bug in the Docker Daemon, which has been fixed with version 25.0.3.

    This is ONLY recommended if you do not have an IPv6 enabled network on your host!

    If you really need to, you can disable the usage of IPv6 in the compose file. Additionally, you can also disable the startup of container \"ipv6nat-mailcow\", as it's not needed if you won't use IPv6.

    Instead of editing docker-compose.yml directly, it is preferable to create an override file for it and implement your changes to the service there. Unfortunately, this right now only seems to work for services, not for network settings.

    To disable IPv6 on the mailcow network, open docker-compose.yml with your favourite text editor and search for the network section (it's near the bottom of the file).

    1. Modify docker-compose.yml

    Change enable_ipv6: true to enable_ipv6: false and comment out the IPv6 subnet:

    networks:\n  mailcow-network:\n    [...]\n    enable_ipv6: true # <<< set to false\n    ipam:\n      driver: default\n      config:\n        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24\n        - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} # <<< comment out with #\n    [...]\n

    2. Disable ipv6nat-mailcow

    To disable the ipv6nat-mailcow container as well, go to your mailcow directory and create a new file called \"docker-compose.override.yml\":

    NOTE: If you already have an override file, of course don't recreate it, but merge the lines below into your existing one accordingly!

    # cd /opt/mailcow-dockerized\n# touch docker-compose.override.yml\n

    Open the file in your favourite text editor and fill in the following:

    services:\n\n    ipv6nat-mailcow:\n      image: bash:latest\n      restart: \"no\"\n      entrypoint: [\"echo\", \"ipv6nat disabled in compose.override.yml\"]\n

    For these changes to be effective, you need to fully stop and then restart the stack, so containers and networks are recreated:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n

    3. Disable IPv6 in unbound-mailcow

    Edit data/conf/unbound/unbound.conf and set do-ip6 to \"no\":

    server:\n  [...]\n  do-ip6: no\n  [...]\n

    Restart Unbound:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart unbound-mailcow\n
    docker-compose restart unbound-mailcow\n

    4. Disable IPv6 in postfix-mailcow

    Create data/conf/postfix/extra.cf and set smtp_address_preference to ipv4:

    smtp_address_preference = ipv4\ninet_protocols = ipv4\n

    Restart Postfix:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart postfix-mailcow\n
    docker-compose restart postfix-mailcow\n

    5. If your docker daemon completly disabled IPv6:

    Fix the following NGINX, Dovecot and php-fpm config files

    sed -i '/::/d' data/conf/nginx/templates/listen*\nsed -i '/::/d' data/conf/nginx/dynmaps.conf\nsed -i 's/,\\[::\\]//g' data/conf/dovecot/dovecot.conf\nsed -i 's/\\[::\\]://g' data/conf/phpfpm/php-fpm.d/pools.conf\n
    "},{"location":"post_installation/firststeps-dmarc_reporting/","title":"DMARC Reporting","text":"

    DMARC Reporting done via Rspamd DMARC Module.

    Rspamd documentation can be found here: https://rspamd.com/doc/modules/dmarc.html

    Important:

    1. Change example.com, mail.example.com and Example to reflect your setup

    2. DMARC reporting requires additional attention, especially over the first few days

    3. All receiving domains hosted on mailcow send from one reporting domain. It is recommended to use the parent domain of your MAILCOW_HOSTNAME:

      • If your MAILCOW_HOSTNAME is mail.example.com change the following config to domain = \"example.com\";
      • Set email equally, e.g. email = \"noreply-dmarc@example.com\";

    4. It is optional but recommended to create an email user noreply-dmarc in mailcow to handle bounces.

    "},{"location":"post_installation/firststeps-dmarc_reporting/#enable-dmarc-reporting","title":"Enable DMARC reporting","text":"

    Create the file data/conf/rspamd/local.d/dmarc.conf and set the following content:

    reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    domain = 'example.com';\n    org_name = 'Example';\n    helo = 'rspamd';\n    smtp = 'postfix';\n    smtp_port = 25;\n    from_name = 'Example DMARC Report';\n    msgid_from = 'rspamd.mail.example.com';\n    max_entries = 2k;\n    keys_expire = 2d;\n}\n

    Create or modify docker-compose.override.yml in the mailcow-dockerized base directory:

    services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"@every 24h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

    Start the mailcow stack with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-dmarc_reporting/#send-a-copy-reports-to-yourself","title":"Send a copy reports to yourself","text":"

    To receive a hidden copy of reports generated by Rspamd you can set a bcc_addrs list in the reporting config section of data/conf/rspamd/local.d/dmarc.conf:

    reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    bcc_addrs = [\"noreply-dmarc@example.com\",\"parsedmarc@example.com\"];\n[...]\n

    Rspamd will load changes in real time, so you won't need to restart the container at this point.

    This can be useful if you...

    • ...want to check that your DMARC reports are sent correctly and authenticated.
    • ...want to analyze your own reports to get statistics, i.e. to use with ParseDMARC or other analytic systems.
    "},{"location":"post_installation/firststeps-dmarc_reporting/#troubleshooting","title":"Troubleshooting","text":"

    Check when the report schedule last ran:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n
    docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n

    See the latest report output:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n
    docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n

    Manually trigger a DMARC report:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow rspamadm dmarc_report\n
    docker-compose exec rspamd-mailcow rspamadm dmarc_report\n

    Validate that Rspamd has recorded data in Redis: Change 20220428 to date which you interested in.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n
    docker-compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n

    Take one of the lines from output you interested in and request it, f.e.:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
    docker-compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
    "},{"location":"post_installation/firststeps-dmarc_reporting/#change-dmarc-reporting-frequency","title":"Change DMARC reporting frequency","text":"

    In the example above reports are sent once every 24 hours and send reports for yesterday. This will be okay for most setups.

    If you have a large mail volume and want to run the DMARC reporting more than once a day you need create second schedule and run it with dmarc_report $(date '+%Y%m%d') to process the current day. You have to make sure that the first run on each day also processes the last report from the day before, so it needs to be started twice, one time with $(date --date yesterday '+%Y%m%d') at 0 5 0 * * * (00:05 AM) and then with $(date '+%Y%m%d') with desired interval.

    The Ofelia schedule has the same implementation as cron in Go, supported syntax described at cron Documentation

    To change schedule:

    1. Edit docker-compose.override.yml:
    services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"0 5 0 * * *\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.schedule: \"@every 12h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

    1. Restart the desired containers with:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

    2. Restart the ofelia container only:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart ofelia-mailcow\n
      docker-compose restart ofelia-mailcow\n
    "},{"location":"post_installation/firststeps-dmarc_reporting/#disable-dmarc-reporting","title":"Disable DMARC Reporting","text":"

    To disable reporting:

    1. Set enabled to false in data/conf/rspamd/local.d/dmarc.conf

    2. Revert changes done in docker-compose.override.yml to rspamd-mailcow and ofelia-mailcow

    3. Restart the desired containers with:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ip_bindings/","title":"IP bindings","text":"

    Warning

    Changing the binding does not affect source NAT. See SNAT for required steps.

    "},{"location":"post_installation/firststeps-ip_bindings/#ipv4-binding","title":"IPv4 binding","text":"

    To adjust one or multiple IPv4 bindings, open mailcow.conf and edit one, multiple or all variables as per your needs:

    # For technical reasons, http bindings are a bit different from other service bindings.\n# You will find the following variables, separated by a bind address and its port:\n# Example: HTTP_BIND=1.2.3.4\n\nHTTP_PORT=80\nHTTP_BIND=\nHTTPS_PORT=443\nHTTPS_BIND=\n\n# Other services are bound by using the following format:\n# SMTP_PORT=1.2.3.4:25 will bind SMTP to the IP 1.2.3.4 on port 25\n# Important! Specifying an IPv4 address will skip all IPv6 bindings since Docker 20.x.\n# doveadm, SQL as well as Solr are bound to local ports only, please do not change that, unless you know what you are doing.\n\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nIMAP_PORT=143\nIMAPS_PORT=993\nPOP_PORT=110\nPOPS_PORT=995\nSIEVE_PORT=4190\nDOVEADM_PORT=127.0.0.1:19991\nSQL_PORT=127.0.0.1:13306\nSOLR_PORT=127.0.0.1:18983\n

    To apply your changes, run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n
    "},{"location":"post_installation/firststeps-ip_bindings/#ipv6-binding","title":"IPv6 binding","text":"

    Changing IPv6 bindings is different from IPv4. Again, this has a technical background.

    A docker-compose.override.yml file will be used instead of editing the docker-compose.yml file directly. This is to maintain updatability, as the docker-compose.yml file gets updated regularly and your changes will most likely be overwritten.

    Edit to create a file docker-compose.override.yml with the following content. Its content will be merged with the productive docker-compose.yml file.

    An example IPv6 2001:db8:dead:beef::123 is given. The first suffix :PORT1 defines the external port, while the second suffix :PORT2 routes to the corresponding port inside the container and must not be changed.

    services:\n\n    dovecot-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:143:143'\n        - '[2001:db8:dead:beef::123]:993:993'\n        - '[2001:db8:dead:beef::123]:110:110'\n        - '[2001:db8:dead:beef::123]:995:995'\n        - '[2001:db8:dead:beef::123]:4190:4190'\n\n    postfix-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:25:25'\n        - '[2001:db8:dead:beef::123]:465:465'\n        - '[2001:db8:dead:beef::123]:587:587'\n\n    nginx-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:80:80'\n        - '[2001:db8:dead:beef::123]:443:443'\n

    To apply your changes, run the commands below:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n
    "},{"location":"post_installation/firststeps-local_mta/","title":"Local MTA on Docker host","text":"

    The easiest option would be to disable the listener on port 25/tcp.

    Postfix users disable the listener by commenting the following line (starting with smtp or 25) in /etc/postfix/master.cf: 

    #smtp      inet  n       -       -       -       -       smtpd\n

    Furthermore, to relay over a dockerized mailcow, you may want to add 172.22.1.1 as relayhost and remove the Docker interface from \"inet_interfaces\":

    postconf -e 'relayhost = 172.22.1.1'\npostconf -e \"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128\"\npostconf -e \"inet_interfaces = loopback-only\"\npostconf -e \"relay_transport = relay\"\npostconf -e \"default_transport = smtp\"\n

    Now it is important to not have the same FQDN in myhostname as you use for your dockerized mailcow. Check your local (non-Docker) Postfix' main.cf for myhostname and set it to something different, for example local.my.fqdn.tld.

    \"172.22.1.1\" is the mailcow created network gateway in Docker. Relaying over this interface is necessary (instead of - for example - relaying directly over ${MAILCOW_HOSTNAME}) to relay over a known internal network.

    Restart Postfix after applying your changes.

    "},{"location":"post_installation/firststeps-logging/","title":"Logging","text":"

    Logging in mailcow: dockerized consists of multiple stages, but is, after all, much more flexible and easier to integrate into a logging daemon than before.

    In Docker the containerized application (PID 1) writes its output to stdout. For real one-application containers this works just fine. Run the command below to learn more:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs --help\n
    docker-compose logs --help\n

    Some containers log or stream to multiple destinations.

    No container will keep persistent logs in it. Containers are transient items!

    In the end, every line of logs will reach the Docker daemon - unfiltered.

    The default logging driver is \"json\".

    "},{"location":"post_installation/firststeps-logging/#filtered-logs","title":"Filtered logs","text":"

    Some logs are filtered and written to Redis keys but also streamed to a Redis channel.

    The Redis channel is used to stream logs with failed authentication attempts to be read by netfilter-mailcow.

    The Redis keys are persistent and will keep 10000 lines of logs for the web UI.

    This mechanism makes it possible to use whatever Docker logging driver you want to, without losing the ability to read logs from the UI or ban suspicious clients with netfilter-mailcow.

    Redis keys will only hold logs from applications and filter out system messages (think of cron etc.).

    "},{"location":"post_installation/firststeps-logging/#logging-drivers","title":"Logging drivers","text":""},{"location":"post_installation/firststeps-logging/#via-docker-composeoverrideyml","title":"Via docker-compose.override.yml","text":"

    Here is the good news: Since Docker has some great logging drivers, you can integrate mailcow: dockerized into your existing logging environment with ease.

    Create a docker-compose.override.yml and add, for example, this block to use the \"gelf\" logging plugin for postfix-mailcow:

    services:\n  postfix-mailcow: # or any other\n    logging:\n      driver: \"gelf\"\n      options:\n        gelf-address: \"udp://graylog:12201\"\n

    Another example for Syslog:

    services:\n\n  postfix-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  dovecot-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  rspamd-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n
    "},{"location":"post_installation/firststeps-logging/#for-rsyslog-only","title":"For Rsyslog only:","text":"

    Make sure the following lines aren't commented out in /etc/rsyslog.conf:

    # provides UDP syslog reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n

    To move local3 input to /var/log/mailcow.log and stop processing, create a file /etc/rsyslog.d/docker.conf:

    local3.*        /var/log/mailcow.log\n& stop\n

    Restart rsyslog afterwards.

    "},{"location":"post_installation/firststeps-logging/#via-daemonjson-globally","title":"via daemon.json (globally)","text":"

    If you want to change the logging driver globally, edit Dockers daemon configuration file /etc/docker/daemon.json and restart the Docker service:

    {\n...\n  \"log-driver\": \"gelf\",\n  \"log-opts\": {\n    \"gelf-address\": \"udp://graylog:12201\"\n  }\n...\n}\n

    For Syslog:

    {\n...\n  \"log-driver\": \"syslog\",\n  \"log-opts\": {\n    \"syslog-address\": \"udp://1.2.3.4:514\"\n  }\n...\n}\n

    Restart the Docker daemon and run the commands below to recreate the containers with the new logging driver:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n
    "},{"location":"post_installation/firststeps-logging/#log-rotation","title":"Log rotation","text":"

    As those logs can get quite big, it is a good idea to use logrotate to compress and delete them after a certain time period.

    Create /etc/logrotate.d/mailcow with the following content:

    /var/log/mailcow.log {\n        rotate 7\n        daily\n        compress\n        delaycompress\n        missingok\n        notifempty\n        create 660 root root\n}\n

    With this configuration, logrotate will run daily and keep a maximum of 7 archives.

    To rotate the logfile weekly or monthly replace daily with weekly or monthly respectively.

    To keep more archives, set the desired number of rotate.

    Afterwards, logrotate can be restarted.

    "},{"location":"post_installation/firststeps-snat/","title":"SNAT","text":"

    SNAT is used to change the source address of the packets sent by mailcow. It can be used to change the outgoing IP address on systems with multiple IP addresses.

    Open mailcow.conf, set either or both of the following parameters:

    # Use this IPv4 for outgoing connections (SNAT)\nSNAT_TO_SOURCE=1.2.3.4\n\n# Use this IPv6 for outgoing connections (SNAT)\nSNAT6_TO_SOURCE=dead:beef\n

    Run the command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    The values are read by netfilter-mailcow. netfilter-mailcow will make sure, the post-routing rules are on position 1 in the netfilter table. It does automatically delete and re-create them if they are found on another position than 1.

    Check the output with the following command to ensure the SNAT settings have been applied:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs --tail=200 netfilter-mailcow\n
    docker-compose logs --tail=200 netfilter-mailcow\n
    "},{"location":"post_installation/firststeps-ssl/","title":"Advanced SSL","text":""},{"location":"post_installation/firststeps-ssl/#lets-encrypt-out-of-the-box","title":"Let's Encrypt (out-of-the-box)","text":"

    The \"acme-mailcow\" container will try to obtain a LE certificate for ${MAILCOW_HOSTNAME}, autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN.

    Warning

    mailcow must be available on port 80 for the acme-client to work. Our reverse proxy example configurations do cover that. You can also use any external ACME client (certbot for example) to obtain certificates, but you will need to make sure, that they are copied to the correct location and a post-hook reloads affected containers. See more in the Reverse Proxy documentation.

    By default, which means 0 domains are added to mailcow, it will try to obtain a certificate for ${MAILCOW_HOSTNAME}.

    For each domain you add, it will try to resolve autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN to its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address. If it succeeds, a name will be added as SAN to the certificate request.

    Only names that can be validated, will be added as SAN.

    For every domain you remove, the certificate will be moved and a new certificate will be requested. It is not possible to keep domains in a certificate, when we are not able validate the challenge for those.

    If you want to re-run the ACME client, use the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart acme-mailcow\n
    docker-compose restart acme-mailcow\n

    Monitor its logs with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs --tail=200 -f acme-mailcow\n
    docker-compose logs --tail=200 -f acme-mailcow\n
    "},{"location":"post_installation/firststeps-ssl/#additional-domain-names","title":"Additional domain names","text":"

    Edit \"mailcow.conf\" and add a parameter ADDITIONAL_SAN like this:

    Do not use quotes (\") and do not use spaces between the names!

    ADDITIONAL_SAN=smtp.*,cert1.example.com,cert2.example.org,whatever.*\n

    Each name will be validated against its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address.

    A wildcard name like smtp.* will try to obtain a smtp.DOMAIN_NAME SAN for each domain added to mailcow.

    Run the following command to recreate affected containers automatically:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    Info

    Using names other name MAILCOW_HOSTNAME to access the mailcow UI may need further configuration.

    If you plan to use a server name that is not MAILCOW_HOSTNAME to access the mailcow UI (for example by adding mail.* to ADDITIONAL_SAN make sure to populate that name in mailcow.conf via ADDITIONAL_SERVER_NAMES. Names must be separated by commas and must not contain spaces. If you skip this step, mailcow may respond with an incorrect site.

    ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

    Run the command below to apply:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#force-renewal","title":"Force renewal","text":"

    To force a renewal, you need to create a file named force_renew and restart the acme-mailcow container:

    docker compose (Plugin)docker-compose (Standalone) 
    cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker compose restart acme-mailcow\n# Now check the logs for a renewal\ndocker compose logs --tail=200 -f acme-mailcow\n
    cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker-compose restart acme-mailcow\n# Now check the logs for a renewal\ndocker-compose logs --tail=200 -f acme-mailcow\n

    The file will be deleted automatically.

    "},{"location":"post_installation/firststeps-ssl/#validation-errors-and-how-to-skip-validation","title":"Validation errors and how to skip validation","text":"

    You can skip the IP verification by setting SKIP_IP_CHECK=y in mailcow.conf (no quotes). Be warned that a misconfiguration will get you ratelimited by Let's Encrypt! This is primarily useful for multi-IP setups where the IP check would return the incorrect source IP address. Due to using dynamic IPs for acme-mailcow, source NAT is not consistent over restarts.

    If you encounter problems with \"HTTP validation\", but your IP address confirmation succeeds, you are most likely using firewalld, ufw or any other firewall, that disallows connections from br-mailcow to your external interface. Both firewalld and ufw disallow this by default. It is often not enough to just stop these firewall services. You'd need to stop mailcow, stop the firewall service, flush the chains and restart Docker.

    You can also skip this validation method by setting SKIP_HTTP_VERIFICATION=y in \"mailcow.conf\". Be warned that this is discouraged. In most cases, the HTTP verification is skipped to workaround unknown NAT reflection issues, which are not resolved by ignoring this specific network misconfiguration. If you encounter problems generating TLSA records in the DNS overview within mailcow, you are most likely having issues with NAT reflection you should fix.

    If you changed a SKIP_* parameter, run the command below to apply your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#disable-lets-encrypt","title":"Disable Let's Encrypt","text":""},{"location":"post_installation/firststeps-ssl/#disable-lets-encrypt-completely","title":"Disable Let's Encrypt completely","text":"

    Set SKIP_LETS_ENCRYPT=y in \"mailcow.conf\" and recreate \"acme-mailcow\" with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#skip-all-names-but-mailcow_hostname","title":"Skip all names but ${MAILCOW_HOSTNAME}","text":"

    Add ONLY_MAILCOW_HOSTNAME=y to \"mailcow.conf\" and recreate \"acme-mailcow\" with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#the-lets-encrypt-subjectaltname-limit-of-100-domains","title":"The Let's Encrypt subjectAltName limit of 100 domains","text":"

    Let's Encrypt currently has a limit of 100 Domain Names per Certificate.

    By default, \"acme-mailcow\" will create a single SAN certificate for all validated domains (see the first section and Additional domain names). This provides best compatibility but means the Let's Encrypt limit exceeds if you add too many domains to a single mailcow installation.

    To solve this, you can configure ENABLE_SSL_SNI to generate:

    • A main server certificate with MAILCOW_HOSTNAME and all fully qualified domain names in the ADDITIONAL_SAN config
    • One additional certificate for each domain found in the database with autodiscover., autoconfig. and any other ADDITIONAL_SAN configured in this format (subdomain.*).
    • Limitations: A certificate name ADDITIONAL_SAN=test.example.com will be added as SAN to the main certificate. A separate certificate/key pair will not be generated for this format.

    Postfix, Dovecot and Nginx will then serve these certificates with SNI.

    Set ENABLE_SSL_SNI=y in \"mailcow.conf\" and recreate \"acme-mailcow\" with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    Warning

    Not all clients support SNI, see Dovecot documentation or Wikipedia. You should make sure these clients use the MAILCOW_HOSTNAME for secure connections if you enable this feature.

    Here is an example:

    • MAILCOW_HOSTNAME=server.email.tld
    • ADDITIONAL_SAN=webmail.email.tld,mail.*
    • mailcow email domains: \"domain1.tld\" and \"domain2.tld\"

    The following certificates will be generated:

    • server.email.tld, webmail.email.tld -> this is the default certificate, all clients can connect with these domains
    • mail.domain1.tld, autoconfig.domain1.tld, autodiscover.domain1.tld -> individual certificate for domain1.tld, cannot be used by clients without SNI support
    • mail.domain2.tld, autoconfig.domain2.tld, autodiscover.domain2.tld -> individual certificate for domain2.tld, cannot be used by clients without SNI support
    "},{"location":"post_installation/firststeps-ssl/#how-to-use-your-own-certificate","title":"How to use your own certificate","text":"

    Make sure you disable mailcows internal LE client (see above).

    To use your own certificates, just save the combined certificate (containing the certificate and intermediate CA/CA if any) to data/assets/ssl/cert.pem and the corresponding key to data/assets/ssl/key.pem.

    IMPORTANT: Do not use symbolic links! Make sure you copy the certificates and do not link them to data/assets/ssl.

    Restart affected services afterwards:

    docker restart $(docker ps -qaf name=postfix-mailcow)\ndocker restart $(docker ps -qaf name=nginx-mailcow)\ndocker restart $(docker ps -qaf name=dovecot-mailcow)\n

    See Post-hook script for non-mailcow ACME clients for a full example script.

    "},{"location":"post_installation/firststeps-ssl/#test-against-staging-acme-directory","title":"Test against staging ACME directory","text":"

    Edit mailcow.conf and add LE_STAGING=y.

    Run the command below to activate your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#custom-directory-url","title":"Custom directory URL","text":"

    Edit mailcow.conf and add the corresponding directory URL to the new variable DIRECTORY_URL:

    DIRECTORY_URL=https://acme-custom-v9000.api.letsencrypt.org/directory\n

    You cannot use LE_STAGING with DIRECTORY_URL. If both are set, only LE_STAGING is used.

    Run the command below to activate your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/firststeps-ssl/#use-caa-records-with-the-accounturi-parameter","title":"Use CAA records with the accounturi parameter","text":"

    Let's Encrypt allows restricting certificate issuance to specific account IDs via the accounturi parameter in CAA records. You can use the generate_caa_record.py helper script to generate a CAA record with accounturi, which you can then enter with your DNS provider:

    ./helper-scripts/generate_caa_record.py --account-key data/assets/ssl/acme/account.pem --contact mailto:your_acme_email@example.com\n
    "},{"location":"post_installation/firststeps-ssl/#check-your-configuration","title":"Check your configuration","text":"

    Run the command below to find out why a validation fails:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs --tail=200 acme-mailcow\n
    docker-compose logs --tail=200 acme-mailcow\n

    To check if nginx serves the correct certificate, simply use a browser of your choice and check the displayed certificate.

    To check the certificate served by Postfix, Dovecot and Nginx we will use openssl:

    # Connect via SMTP STARTTLS (587)\nopenssl s_client -starttls smtp -connect MAILCOW_HOSTNAME:587 | openssl x509 -noout -text\n# Connect via SMTP (465)\nopenssl s_client -connect MAILCOW_HOSTNAME:465 | openssl x509 -noout -text\n\n# Connect via IMAP STARTTLS (143)\nopenssl s_client -starttls imap -connect MAILCOW_HOSTNAME:143 | openssl x509 -noout -text\n# Connect via IMAP (993)\nopenssl s_client -connect MAILCOW_HOSTNAME:993 | openssl x509 -noout -text\n\n# Connect via HTTPS (443)\nopenssl s_client -connect MAILCOW_HOSTNAME:443 | openssl x509 -noout -text\n

    To validate the expiry dates as returned by openssl against MAILCOW_HOSTNAME, you are able to use our helper script:

    cd /opt/mailcow-dockerized\nbash helper-scripts/expiry-dates.sh\n
    "},{"location":"post_installation/firststeps-sync_jobs_migration/","title":"Sync job migration","text":"

    Sync jobs are used to copy or move existing emails from an external IMAP server or within mailcow's existing mailboxes.

    Info

    Depending on your mailbox's ACL you may not have the option to add a sync job. Please contact your domain administrator if so.

    "},{"location":"post_installation/firststeps-sync_jobs_migration/#setup-a-sync-job","title":"Setup a Sync Job","text":"

    1. In the \"Configuration > Mail Setup\" or \"User Settings\" interface, create a new sync job.

    2. If you are an administrator, select the username of the downstream mailcow mailbox in the \"Username\" dropdown.

    3. Fill in the \"Host\" and \"Port\" fields with their respective correct values from the upstream IMAP server.

    4. In the \"Username\" and \"Password\" fields, supply the correct access credentials from the upstream IMAP server.

    5. Select the \"Encryption Method\". If the upstream IMAP server uses port 143, it is likely that the encryption method is TLS and SSL for port 993. Nevertheless, you can use PLAIN authentication, but it is stongly discouraged.

    6. For all ther other fields, you can leave them as is or modify them as desired.

    7. Make sure to tick \"Active\" and click \"Add\".

    Info

    Once Completed, log into the mailbox and check if all emails are imported correctly. If all goes well, all your mails shall end up in your new mailbox. And don't forget to delete or deactivate the sync job after it is used.

    "},{"location":"post_installation/reverse-proxy/r_p-apache24/","title":"Apache 2.4","text":"

    Important

    First read the overview.

    Required modules: 

    a2enmod rewrite proxy proxy_http headers ssl\n

    Let's Encrypt will follow our rewrite, certificate requests in mailcow will work fine.

    Take care of highlighted lines.

    <VirtualHost *:80>\n  ServerName CHANGE_TO_MAILCOW_HOSTNAME\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n  RewriteEngine on\n\n  RewriteCond %{HTTPS} off\n  RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]\n\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"http\"\n</VirtualHost>\n<VirtualHost *:443>\n  ServerName CHANGE_TO_MAILCOW_HOSTNAME\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n\n  # You should proxy to a plain HTTP session to offload SSL processing\n  ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000\n  ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"https\"\n\n  SSLCertificateFile MAILCOW_PATH/data/assets/ssl/cert.pem\n  SSLCertificateKeyFile MAILCOW_PATH/data/assets/ssl/key.pem\n\n  # If you plan to proxy to a HTTPS host:\n  #SSLProxyEngine On\n\n  # If you plan to proxy to an untrusted HTTPS host:\n  #SSLProxyVerify none\n  #SSLProxyCheckPeerCN off\n  #SSLProxyCheckPeerName off\n  #SSLProxyCheckPeerExpire off\n</VirtualHost>\n
    "},{"location":"post_installation/reverse-proxy/r_p-caddy2/","title":"Caddy v2 (community supported)","text":"

    Important

    First read the overview.

    Warning

    This is an unsupported community contribution. Feel free to provide fixes.

    The configuration of Caddy with mailcow is very simple.

    In the caddyfile you just have to create a section for the mailserver.

    For example 

    MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {\n        log {\n                output file /var/log/caddy/MAILCOW_HOSTNAME.log {\n                        roll_disabled\n                        roll_size 512M\n                        roll_uncompressed\n                        roll_local_time\n                        roll_keep 3\n                        roll_keep_for 48h\n                }\n        }\n\n        reverse_proxy 127.0.0.1:HTTP_BIND\n}\n

    This allows Caddy to automatically create the certificates and accept traffic for these mentioned domains and forward them to mailcow.

    Important: The ACME client of mailcow must be disabled, otherwise mailcow will fail.

    Since Caddy takes care of the certificates itself, we can use the following script to include the Caddy generated certificates into mailcow:

    #!/bin/bash\nMAILCOW_HOSTNAME=your.domain.tld\nCADDY_CERTS_DIR=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory\nMD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))\nMD5SUM_NEW_CERT=($(md5sum $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt))\n\nif [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/key.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/key.pem\n        postfix_c=$(docker ps -qaf name=postfix-mailcow)\n        dovecot_c=$(docker ps -qaf name=dovecot-mailcow)\n        nginx_c=$(docker ps -qaf name=nginx-mailcow)\n        docker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n\nelse\n        echo \"Certs not copied from Caddy (Not needed)\"\nfi\n

    Attention

    Caddy's certificate path varies depending on the installation type. In this installation example, Caddy was installed using the Caddy repo (more informations here). To find out the Caddy certificate path on your system, just run a find / -name \"certificates\".

    This script could be called as a cronjob every hour:

    0 * * * * /bin/bash /path/to/script/deploy-certs.sh  >/dev/null 2>&1\n
    "},{"location":"post_installation/reverse-proxy/r_p-haproxy/","title":"HAProxy (community supported)","text":"

    Important

    First read the overview.

    Warning

    This is an unsupported community contribution. Feel free to provide fixes.

    This example redirects all HTTP traffic to HTTPS except for mailcow's built-in ACME client. If you do not want to use the built-in ACME client, please modify the configuration yourself.

    frontend https-in\n  bind :::80 v4v6\n  bind :::443 v4v6 ssl crt mailcow.pem\n\n  acl mailcow_acme path -i -m beg /.well-known/\n\n  redirect scheme https unless { ssl_fc || mailcow_acme }\n\n  default_backend mailcow\n\nbackend mailcow\n  option forwardfor\n  http-request set-header X-Forwarded-Proto https if { ssl_fc }\n  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }\n  server mailcow 127.0.0.1:8080 check\n
    "},{"location":"post_installation/reverse-proxy/r_p-nginx/","title":"Nginx","text":"

    Important

    First read the overview.

    Let's Encrypt will follow our rewrite, certificate requests will work fine.

    Take care of highlighted lines.

    server {\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;\n  return 301 https://$host$request_uri;\n}\nserver {\n  listen 443 ssl http2;\n  listen [::]:443 ssl http2;\n  server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;\n\n  ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;\n  ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;\n  ssl_session_timeout 1d;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_tickets off;\n\n  # See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations\n  # An example config is given below\n  ssl_protocols TLSv1.2;\n  ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;\n  ssl_prefer_server_ciphers off;\n\n  location /Microsoft-Server-ActiveSync {\n    proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_connect_timeout 75;\n    proxy_send_timeout 3650;\n    proxy_read_timeout 3650;\n    proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo\n    client_body_buffer_size 512k;\n    client_max_body_size 0;\n  }\n\n  location / {\n    proxy_pass http://127.0.0.1:8080/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  # The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update\n  # Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537\n    proxy_buffer_size 128k;\n    proxy_buffers 64 512k;\n    proxy_busy_buffers_size 512k;\n  }\n}\n
    "},{"location":"post_installation/reverse-proxy/r_p-traefik2/","title":"Traefik v2 (community supported)","text":"

    Important

    First read the overview.

    Warning

    This is an unsupported community contribution. Feel free to provide fixes.

    Important: This config only covers the \"reverseproxing\" of the webpannel (nginx-mailcow) using Traefik v2, if you also want to reverseproxy the mail services such as dovecot, postfix... you'll just need to adapt the following config to each container and create an EntryPoint on your traefik.toml or traefik.yml (depending which config you use) for each port.

    For this section we'll assume you have your Traefik 2 [certificatesresolvers] properly configured on your traefik configuration file, and also using acme, also, the following example uses Lets Encrypt, but feel free to change it to your own cert resolver. You can find a basic Traefik 2 toml config file with all the above implemented which can be used for this example here traefik.toml if you need one, or a hint on how to adapt your config.

    So, first of all, we are going to disable the acme-mailcow container since we'll use the certs that traefik will provide us. For this we'll have to set SKIP_LETS_ENCRYPT=y on our mailcow.conf, and run the following command to apply the changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    Then we'll create a docker-compose.override.yml file in order to override the main docker-compose.yml found in your mailcow root folder. 

    services:\n    nginx-mailcow:\n      networks:\n        # Add Traefik's network\n        web:\n      labels:\n        - traefik.enable=true\n        # Creates a router called \"moo\" for the container, and sets up a rule to link the container to certain rule,\n        #   in this case, a Host rule with our MAILCOW_HOSTNAME var.\n        - traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)\n        # Enables tls over the router we created before.\n        - traefik.http.routers.moo.tls=true\n        # Specifies which kind of cert resolver we'll use, in this case le (Lets Encrypt).\n        - traefik.http.routers.moo.tls.certresolver=le\n        # Creates a service called \"moo\" for the container, and specifies which internal port of the container\n        #   should traefik route the incoming data to.\n        - traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}\n        # Specifies which entrypoint (external port) should traefik listen to, for this container.\n        #   websecure being port 443, check the traefik.toml file liked above.\n        - traefik.http.routers.moo.entrypoints=websecure\n        # Make sure traefik uses the web network, not the mailcowdockerized_mailcow-network\n        - traefik.docker.network=traefik_web\n\n    certdumper:\n        image: ghcr.io/kereis/traefik-certs-dumper\n        command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1\n        network_mode: none\n        volumes:\n          # Mount the volume which contains Traefik's `acme.json' file\n          #   Configure the external name in the volume definition\n          - acme:/traefik:ro\n          # Mount mailcow's SSL folder\n          - ./data/assets/ssl/:/output:rw\n          # Mount docker socket to restart containers\n          - /var/run/docker.sock:/var/run/docker.sock:ro\n        restart: always\n        environment:\n          # only change this, if you're using another domain for mailcow's web frontend compared to the standard config\n          - DOMAIN=${MAILCOW_HOSTNAME}\n\nnetworks:\n  web:\n    external: true\n    # Name of the external network\n    name: traefik_web\n\nvolumes:\n  acme:\n    external: true\n    # Name of the external docker volume which contains Traefik's `acme.json' file\n    name: traefik_acme\n

    Start the new containers with:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    Now, there's only one thing left to do, which is setup the certs so that the mail services can use them as well, since Traefik 2 uses an acme v2 format to save ALL the license from all the domains we have, we'll need to find a way to dump the certs, lucky we have this tiny container which grabs the acme.json file through a volume, and a variable DOMAIN=example.org, and with these, the container will output the cert.pem and key.pem files, for this we'll simply run the traefik-certs-dumper container binding the /traefik volume to the folder where our acme.json is saved, bind the /output volume to our mailcow data/assets/ssl/ folder, and set up the DOMAIN=example.org variable to the domain we want the certs dumped from.

    This container will watch over the acme.json file for any changes, and regenerate the cert.pem and key.pem files directly into data/assets/ssl/ being the path binded to the container's /output path.

    You can use the command line to run it, or use the docker-compose.yml shown here.

    After we have the certs dumped, we'll have to reload the configs from our postfix and dovecot containers, and check the certs, you can see how here.

    Aaand that should be it \ud83d\ude0a, you can check if the Traefik router works fine through Traefik's dashboard / traefik logs / accessing the setted domain through https, or / and check HTTPS, SMTP and IMAP through the commands shown on the page linked before.

    "},{"location":"post_installation/reverse-proxy/r_p/","title":"Overview","text":"

    You don't need to change the Nginx site that comes with mailcow: dockerized. mailcow: dockerized trusts the default gateway IP 172.22.1.1 as proxy.

    Make sure you change HTTP_BIND and HTTPS_BIND in mailcow.conf to a local address and set the ports accordingly, for example: 

    HTTP_BIND=127.0.0.1\nHTTP_PORT=8080\nHTTPS_BIND=127.0.0.1\nHTTPS_PORT=8443\n

    This will also change the bindings inside the Nginx container! This is important, if you decide to use a proxy within Docker.

    IMPORTANT: Do not use port 8081, 9081 or 65510!

    Recreate affected containers by running the command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"post_installation/reverse-proxy/r_p/#important-information-please-read-them-carefully","title":"Important information, please read them carefully!","text":"

    Info

    If you plan to use a reverse proxy and want to use another server name that is not MAILCOW_HOSTNAME, you need to read Adding additional server names for mailcow UI below.

    Warning

    Make sure you run generate_config.sh before you enable any site configuration examples. The script generate_config.sh copies snake-oil certificates to the correct location, so the services will not fail to start due to missing files.

    Warning

    If you enable TLS SNI (ENABLE_SSL_SNI in mailcow.conf), the certificate paths in your reverse proxy must match the correct paths in data/assets/ssl/{hostname}. The certificates will be split into data/assets/ssl/{hostname1,hostname2,etc} and therefore will not work when you copy the examples from below pointing to data/assets/ssl/cert.pem etc.

    Info

    Using the site configuration examples will forward ACME requests to mailcow and let it handle certificates itself. The downside of using mailcow as ACME client behind a reverse proxy is, that you will need to reload your webserver after acme-mailcow changed/renewed/created the certificate. You can either reload your webserver daily or write a script to watch the file for changes. On many servers logrotate will reload the webserver daily anyway.

    If you want to use a local certbot installation, you will need to change the SSL certificate parameters accordingly. Make sure you run a post-hook script when you decide to use external ACME clients. You will find an example below.

    Configure your local webserver as reverse proxy using following configuration examples:

    • Apache 2.4
    • Nginx
    • HAProxy
    • Traefik v2
    • Caddy v2
    "},{"location":"post_installation/reverse-proxy/r_p/#optional-post-hook-script-for-non-mailcow-acme-clients","title":"Optional: Post-hook script for non-mailcow ACME clients","text":"

    Using a local certbot (or any other ACME client) requires to restart some containers, you can do this with a post-hook script. Make sure you change the paths accordingly: 

    #!/bin/bash\ncp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem\ncp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem\npostfix_c=$(docker ps -qaf name=postfix-mailcow)\ndovecot_c=$(docker ps -qaf name=dovecot-mailcow)\nnginx_c=$(docker ps -qaf name=nginx-mailcow)\ndocker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n

    "},{"location":"post_installation/reverse-proxy/r_p/#adding-additional-server-names-for-mailcow-ui","title":"Adding additional server names for mailcow UI","text":"

    If you plan to use a server name that is not MAILCOW_HOSTNAME in your reverse proxy, make sure to populate that name in mailcow.conf via ADDITIONAL_SERVER_NAMES first. Names must be separated by commas and must not contain spaces. If you skip this step, mailcow may respond to your reverse proxy with an incorrect site.

    ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

    Run the following command to apply:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"third_party/borgmatic/third_party-borgmatic/","title":"Borgmatic Backup","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#introduction","title":"Introduction","text":"

    Borgmatic is a great way to run backups on your mailcow setup as it securely encrypts your data and is extremely easy to set up.

    Due to it's deduplication capabilities you can store a great number of backups without wasting large amounts of disk space. This allows you to run backups in very short intervals to ensure minimal data loss when the need arises to recover data from a backup.

    This document guides you through the process to enable continuous backups for mailcow with borgmatic. The borgmatic functionality is provided by the borgmatic Docker image. Check out the README in that repository to find out about the other options (such as push notifications) that are available. This guide only covers the basics.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#setting-up-borgmatic","title":"Setting up borgmatic","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#create-or-amend-docker-composeoverrideyml","title":"Create or amend docker-compose.override.yml","text":"

    In the mailcow-dockerized root folder create or edit docker-compose.override.yml and insert the following configuration:

    services:\n  borgmatic-mailcow:\n    image: ghcr.io/borgmatic-collective/borgmatic\n    hostname: mailcow\n    restart: always\n    dns: ${IPV4_NETWORK:-172.22.1}.254\n    volumes:\n      - vmail-vol-1:/mnt/source/vmail:ro\n      - crypt-vol-1:/mnt/source/crypt:ro\n      - redis-vol-1:/mnt/source/redis:ro\n      - rspamd-vol-1:/mnt/source/rspamd:ro\n      - postfix-vol-1:/mnt/source/postfix:ro\n      - mysql-socket-vol-1:/var/run/mysqld/\n      - borg-config-vol-1:/root/.config/borg\n      - borg-cache-vol-1:/root/.cache/borg\n      - ./data/conf/borgmatic/etc:/etc/borgmatic.d:Z\n      - ./data/conf/borgmatic/ssh:/root/.ssh:Z\n    environment:\n      - TZ=${TZ}\n      - BORG_PASSPHRASE=${BORG_PASSPHRASE}\n      - DBNAME=${DBNAME}\n      - DBUSER=${DBUSER}\n      - DBPASS=${DBPASS}\n    networks:\n      mailcow-network:\n        aliases:\n          - borgmatic\n\nvolumes:\n  borg-cache-vol-1:\n  borg-config-vol-1:\n

    Append BORG_PASSPHRASE=YouBetterPutSomethingRealGoodHere to your mailcow.conf and ensure that you change the BORG_PASSPHRASE to a secure passphrase of your choosing.

    For security reasons we mount the maildir as read-only. If you later want to restore data you will need to remove the ro flag prior to restoring the data. This is described in the section on restoring backups.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#create-dataconfborgmaticetcconfigyaml","title":"Create data/conf/borgmatic/etc/config.yaml","text":"

    Next, we need to create the borgmatic configuration. Borgmatic supports environment variable interpolation, this way we can get the correct MySQL credentials from Docker or more specifically from our mailcow.conf without exposing them in our config.

    Make sure to copy all the following lines!

    cat <<EOF > data/conf/borgmatic/etc/config.yaml\nsource_directories:\n    - /mnt/source/vmail\n    - /mnt/source/crypt\n    - /mnt/source/redis\n    - /mnt/source/rspamd\n    - /mnt/source/postfix\nrepositories:\n    - path: ssh://user@rsync.net:22/./mailcow\n      label: rsync\nexclude_patterns:\n    - '/mnt/source/postfix/public/'\n    - '/mnt/source/postfix/private/'\n    - '/mnt/source/rspamd/rspamd.sock'\n\nkeep_hourly: 24\nkeep_daily: 7\nkeep_weekly: 4\nkeep_monthly: 6\n\nmysql_databases:\n    - name: ${DBNAME}\n      username: ${DBUSER}\n      password: ${DBPASS}\n      options: --default-character-set=utf8mb4\nEOF\n

    Warning

    Starting with borgmatic 1.8.0 (released July 19th, 2023), the configuration file syntax was changed. You can check the Docker logs of the borgmatic container for deprecation warnings to see if you are affected, i.e. if your config file was generated for an older borgmatic version. In this case, you should create a new config.yaml file as described above to avoid problems with future borgmatic releases.

    This file is a minimal example for using borgmatic with an account user on the cloud storage provider rsync.net for a repository called mailcow (see repositories setting). This must be changed accordingly.

    It will backup both the maildir and MySQL database, which is all you should need to restore your mailcow setup after an incident.

    The retention settings will keep one archive for each hour of the past 24 hours, one per day of the week, one per week of the month and one per month of the past half year.

    Check the borgmatic documentation on how to use other types of repositories or configuration options. If you choose to use a local filesystem as a backup destination make sure to mount it into the container. The container defines a volume called /mnt/borg-repository for this purpose.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#create-a-crontab","title":"Create a crontab","text":"

    Create a new text file in data/conf/borgmatic/etc/crontab.txt with the following content:

    14 * * * * PATH=$PATH:/usr/local/bin /usr/local/bin/borgmatic --stats -v 0 2>&1\n

    This file expects crontab syntax. The example shown here will trigger the backup to run every hour at 14 minutes past the hour and log some nice stats at the end.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#place-ssh-keys-in-folder","title":"Place SSH keys in folder","text":"

    Place the SSH keys you intend to use for remote repository connections in data/conf/borgmatic/ssh. OpenSSH expects the usual id_rsa, id_ed25519 or similar to be in this directory. Ensure the file is chmod 600 and not world readable or OpenSSH will refuse to use the SSH key.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#bring-up-the-container","title":"Bring up the container","text":"

    For the next step we need the container to be up and running in a configured state. To do that run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"third_party/borgmatic/third_party-borgmatic/#initialize-the-repository","title":"Initialize the repository","text":"

    By now your borgmatic container is up and running, but the backups will currently fail due to the repository not being initialized.

    To initialize the repository run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n
    docker-compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n

    You will be asked you to authenticate the SSH host key of your remote repository server. See if it matches and confirm the prompt by entering yes. The repository will be initialized with the passphrase you set in the BORG_PASSPHRASE environment variable earlier.

    When using any of the repokey encryption methods the encryption key will be stored in the repository itself and not on the client, so there is no further action required in this regard. If you decide to use a keyfile instead of a repokey make sure you export the key and back it up separately. Check the Exporting Keys section for how to retrieve the key.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#restart-container","title":"Restart container","text":"

    Now that we finished configuring and initializing the repository restart the container to ensure it is in a defined state:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart borgmatic-mailcow\n
    docker-compose restart borgmatic-mailcow\n
    "},{"location":"third_party/borgmatic/third_party-borgmatic/#restoring-from-a-backup","title":"Restoring from a backup","text":"

    Restoring a backup assumes you are starting off with a fresh installation of mailcow, and you currently do not have any custom data in your maildir or your mailcow database.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#restore-maildir","title":"Restore maildir","text":"

    Warning

    Doing this will overwrite files in your maildir! Do not run this unless you actually intend to recover mail files from a backup.

    If you use SELinux in Enforcing mode

    If you are using mailcow on a host with SELinux in Enforcing mode you will have to temporarily disable it during extraction of the archive as the mailcow setup labels the vmail volume as private, belonging to the dovecot container exclusively. SELinux will (rightfully) prevent any other container, such as the borgmatic container, from writing to this volume.

    Before running a restore you must make the vmail volume writeable in docker-compose.override.yml by removing the ro flag from the volume. Then you can use the following command to restore the maildir from a backup:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n
    docker-compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n

    Alternatively you can specify any archive name from the list of archives (see Listing all available archives)

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#restore-mysql","title":"Restore MySQL","text":"

    Warning

    Running this command will delete and recreate the mailcow database! Do not run this unless you actually intend to recover the mailcow database from a backup.

    To restore the MySQL database from the latest archive use this command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borgmatic restore --archive latest\n
    docker-compose exec borgmatic-mailcow borgmatic restore --archive latest\n

    Alternatively you can specify any archive name from the list of archives (see Listing all available archives)

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#after-restoring","title":"After restoring","text":"

    After restoring you need to restart mailcow. If you disabled SELinux enforcing mode now would be a good time to re-enable it.

    To restart mailcow use the follwing command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down && docker compose up -d\n
    docker-compose down && docker-compose up -d\n

    If you use SELinux this will also trigger the re-labeling of all files in your vmail volume. Be patient, as this may take a while if you have lots of files.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#useful-commands","title":"Useful commands","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#manual-archiving-run-with-debugging-output","title":"Manual archiving run (with debugging output)","text":"docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borgmatic -v 2\n
    docker-compose exec borgmatic-mailcow borgmatic -v 2\n
    "},{"location":"third_party/borgmatic/third_party-borgmatic/#listing-all-available-archives","title":"Listing all available archives","text":"docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borgmatic list\n
    docker-compose exec borgmatic-mailcow borgmatic list\n
    "},{"location":"third_party/borgmatic/third_party-borgmatic/#break-lock","title":"Break lock","text":"

    When borg is interrupted during an archiving run it will leave behind a stale lock that needs to be cleared before any new operations can be performed:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borg break-lock\n
    docker-compose exec borgmatic-mailcow borg break-lock\n

    Now would be a good time to do a manual archiving run to ensure it can be successfully performed.

    "},{"location":"third_party/borgmatic/third_party-borgmatic/#exporting-keys","title":"Exporting keys","text":"

    When using any of the keyfile methods for encryption you MUST take care of backing up the key files yourself. The key files are generated when you initialize the repository. The repokey methods store the key file within the repository, so a manual backup isn't as essential.

    Note that in either case you also must have the passphrase to decrypt any archives.

    To fetch the keyfile run:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n
    docker-compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n

    Where user@rsync.net:mailcow is the URI to your repository.

    "},{"location":"third_party/checkmk/u_e-checkmk/","title":"CheckMK","text":"

    mailcow provides the ability to check for updates using its own update script.

    If you want to check for mailcow updates using checkmk, you can create an executable file in the local directory of the checkmk agent (typically /usr/lib/check_mk_agent/local/) with the name mailcow_update and the following content: 

    #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh --check-tags >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No newer tags available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 New tag is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/releases/latest\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

    To check for every updated code, just create the executable with the following content: 

    #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No updates available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

    If the mailcow installation directory is not /opt/, adjust this in the 2nd line.

    After that re-inventory the services for your mailcow host in checmk and a new check named mailcow_update should be selectable.

    This will run the mailcow_update everytime checkmk agent is checked, you can cache the result by placing the script in a subfolder named the number of seconds you wish to cache it. \\ /usr/lib/check_mk_agent/local/3600/ will cache the response for an 3600 seconds (1 hour).

    "},{"location":"third_party/checkmk/u_e-checkmk/#screenshots","title":"Screenshots","text":""},{"location":"third_party/checkmk/u_e-checkmk/#no-updates-available","title":"No updates available","text":"

    If there are no updates / newer tag available, OK is displayed.

    "},{"location":"third_party/checkmk/u_e-checkmk/#new-updates-available","title":"New updates available","text":"

    If updates / newer tags are available, WARN is displayed.

    If CRIT is desired instead, replace the 7th line with the following:

    echo \"2 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\n
    "},{"location":"third_party/checkmk/u_e-checkmk/#detailed-check-output","title":"Detailed check output","text":"
    • This provides a link to mailcow's GitHub commits, if updates are available.
    • Metrics are also displayed ( not only when updates are available):
    • 0 = No updates available
    • 1 = New updates available
    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/","title":"Exchange Hybrid Setup","text":"

    Using Microsoft Exchange in a hybrid setup is possible with mailcow. With this setup you can add mailboxes on your mailcow and still use Exchange Online Protection. All mailboxes setup in Exchange will receive their mails as usual, while with the hybrid approach additional Mailboxes can be setup in mailcow without any further configuration.

    This setup becomes very handy if you have enabled the Office 365 security defaults and third party applications can no longer login into your mailboxes by any of the supported methods.

    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#requirements","title":"Requirements","text":"
    • The mx Record of your domain needs to point at the Exchange mail service. Log into your Admin center and look out for the dns settings of your domain to find your personalized gateway domain. It should look like this contoso-com.mail.protection.outlook.com. Contact your domain registrant to get further information on how to change mx record.
    • The domain you want to have additional mailboxes for must be setup as internal relay domain in Exchange.
      1. Log in to your Exchange Admin Center
      2. Select the mail flow pane and click on accepted domains
      3. Select the domain and switch it from authorative to internal relay
    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#set-up-the-mailcow","title":"Set up the mailcow","text":"

    Your mailcow needs to relay all mails to your personalized Exchange Host. It is the same host address we already looked up for the mx Record.

    1. Add the domain to your mailcow
    2. Add your personalized Exchange Host address as relayhost
    3. Add your personalized Exchange Host address as forwarding host to unconditionally accepted all relayed mails from Exchange. (Admin > Configuration & Details > Configuration Dropdown > Forwarding Hosts)
    4. Go to the domain settings and select the newly added host on the Sender-dependent transports dropdown. Enable relaying by ticking the Relay this domain, Relay all recipients and the Relay non-existing mailboxes only. checkboxes

    Info

    From now on your mailcow will accept all mails relayed from Exchange. The inbound filtering and so the neural learning of your cow will no longer work. Because all mails are routed through Exchange the filtering process is handled there.

    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#set-up-connectors-in-exchange","title":"Set up Connectors in Exchange","text":"

    All mail traffic now goes through Exchange. At this point the Exchange Online Protection already filters all incoming and outgoing mails. Now we need to set up two connectors to relay incoming mails from our Exchange Service to the mailcow and another one to allow mails relayed from the mailcow to our exchange service. You can follow the official guide from Microsoft.

    Warning

    For the connector that handles mails from your mailcow to Exchange Microsoft offers two ways of authenticating it. The recommended way is to use a tls certificate configured with a subject name that matches an accepted domain in Exchange. Otherwise you need to choose authentication with the static ip address of your mailcow.

    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#validating","title":"Validating","text":"

    The easiest way to validate the hybrid setup is by sending a mail from the internet to a mailbox that only exists on the mailcow and vice versa.

    "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#common-issues","title":"Common Issues","text":"
    • The connector validation from Exchange to your mailcow failed with 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient test@contoso.com not found by SMTP address lookup Possible Solution: Your domain is not set up as internal relay. Exchange therefore cannot find the recipient
    • Mails sent from the mailcow to a mailbox in the internet cannot be sent. Non Delivery Report with error 550 5.7.64 TenantAttribution; Relay Access Denied Possible Solution: The authentication method failed. Make sure the certificate subject matches an accepted domain in Exchange. Try authenticating by static ip instead.

    Microsoft Guide for the connector setup and additional requirements: https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#prerequisites-for-your-on-premises-email-environment

    "},{"location":"third_party/gitea/third_party-gitea/","title":"Gitea","text":"

    With Gitea' ability to authenticate over SMTP it is trivial to integrate it with mailcow. Few changes are needed:

    1. In order to create a database for gitea, connect to your shell and execute the following commands: 

    source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gitea;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gitea'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'%';\"\n

    2. Open docker-compose.override.yml and add gitea:

    services:\n\n        gitea-mailcow:\n            image: gitea/gitea:1\n            volumes:\n                - ./data/gitea:/data\n            networks:\n                mailcow-network:\n                    aliases:\n                        - gitea\n            ports:\n                - \"${GITEA_SSH_PORT:-127.0.0.1:4000}:22\"\n

    3. Create data/conf/nginx/site.gitea.custom, add: 

    location /gitea/ {\n        proxy_pass http://gitea:3000/;\n}\n

    4. Open mailcow.conf and define the binding you want gitea to use for SSH. Example:

    GITEA_SSH_PORT=127.0.0.1:4000\n

    5. Run the commands to bring up the gitea container and restart the nginx-mailcow container afterwards:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\ndocker compose restart nginx-mailcow\n
    docker-compose up -d\ndocker-compose restart nginx-mailcow\n

    6. If you forced mailcow to https, execute step 9 and restart gitea with the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart gitea-mailcow\n
    docker-compose restart gitea-mailcow\n

    Go head with step 7 (Remember to use https instead of http, https://mx.example.org/gitea/)

    7. Open http://${MAILCOW_HOSTNAME}/gitea/, for example http://mx.example.org/gitea/. For database details set mysql as database host. Use gitea as database name, gitea as database user and your_strong_password you previously definied at step 1 as database password.

    8. Once the installation is complete, login as admin and set \"settings\" -> \"authorization\" -> \"enable SMTP\". SMTP Host should be postfix with port 587, set Skip TLS Verify as we are using an unlisted SAN (\"postfix\" is most likely not part of your certificate).

    9. Create data/gitea/gitea/conf/app.ini and set following values. You can consult gitea cheat sheet for their meaning and other possible values.

    [server]\nSSH_LISTEN_PORT = 22\n# For GITEA_SSH_PORT=127.0.0.1:4000 in mailcow.conf, set:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# For MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (and default ports for HTTPS), set:\nROOT_URL = https://mx.example.org/gitea/\n

    10. Restart gitea with the following command. Your users should be able to login with mailcow managed accounts.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart gitea-mailcow\n
    docker-compose restart gitea-mailcow\n
    "},{"location":"third_party/gogs/third_party-gogs/","title":"Gogs","text":"

    With Gogs' ability to authenticate over SMTP it is trivial to integrate it with mailcow. Few changes are needed:

    1. In order to create a database for Gogs, connect to your shell and execute the following commands: 

    source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gogs;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gogs'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gogs.* TO 'gogs'@'%';\n

    2. Open docker-compose.override.yml and add Gogs:

    services:\n\n    gogs-mailcow:\n      image: gogs/gogs\n      volumes:\n        - ./data/gogs:/data\n      networks:\n        mailcow-network:\n          aliases:\n            - gogs\n      ports:\n        - \"${GOGS_SSH_PORT:-127.0.0.1:4000}:22\"\n

    3. Create data/conf/nginx/site.gogs.custom, add: 

    location /gogs/ {\n    proxy_pass http://gogs:3000/;\n}\n

    4. Open mailcow.conf and define the binding you want Gogs to use for SSH. Example:

    GOGS_SSH_PORT=127.0.0.1:4000\n

    5. Run the commands to bring up the Gogs container and restart the nginx-mailcow container afterwards:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\ndocker compose restart nginx-mailcow\n
    docker-compose up -d\ndocker-compose restart nginx-mailcow\n

    6. Open http://${MAILCOW_HOSTNAME}/gogs/, for example http://mx.example.org/gogs/. For database details set mysql as database host. Use the value gogs as database name, gogs as database user and your_strong_password you previously definied at step 1 as database password.

    7. Once the installation is complete, login as admin and set \"settings\" -> \"authorization\" -> \"enable SMTP\". SMTP Host should be postfix with port 587, set Skip TLS Verify as we are using an unlisted SAN (\"postfix\" is most likely not part of your certificate).

    8. Create data/gogs/gogs/conf/app.ini and set following values. You can consult Gogs cheat sheet for their meaning and other possible values.

    [server]\nSSH_LISTEN_PORT = 22\n# For GOGS_SSH_PORT=127.0.0.1:4000 in mailcow.conf, set:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# For MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (and default ports for HTTPS), set:\nROOT_URL = https://mx.example.org/gogs/\n

    9. Restart Gogs with the following command. Your users should be able to login with mailcow managed accounts.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart gogs-mailcow\n
    docker-compose restart gogs-mailcow\n
    "},{"location":"third_party/mailman3/third_party-mailman3/","title":"Installing mailcow and Mailman 3 based on dockerized versions","text":"

    Info

    This guide is a copy from dockerized-mailcow-mailman. Please post issues, questions and improvements in the issue tracker there.

    Warning

    mailcow is not responsible for any data loss, hardware damage or broken keyboards. This guide comes without any warranty. Make backups before starting, 'coze: No backup no pity!

    "},{"location":"third_party/mailman3/third_party-mailman3/#introduction","title":"Introduction","text":"

    This guide aims to install and configure mailcow-dockerized with docker-mailman and to provide some useful scripts. An essential condition is, to preserve mailcow and Mailman in their own installations for independent updates.

    There are some guides and projects on the internet, but they are not up to date and/or incomplete in documentation or configuration. This guide is based on the work of:

    • mailcow-mailman3-dockerized by Shadowghost
    • mailman-mailcow-integration

    After finishing this guide, mailcow-dockerized and docker-mailman will run and Apache as a reverse proxy will serve the web frontends.

    The operating system used is an Ubuntu 20.04 LTS.

    "},{"location":"third_party/mailman3/third_party-mailman3/#installation","title":"Installation","text":"

    This guide is based on different steps:

    1. DNS setup
    2. Install Apache as a reverse proxy
    3. Obtain SSL certificates with Let's Encrypt
    4. Install mailcow with Mailman integration
    5. Install Mailman
    6. \ud83c\udfc3 Run
    "},{"location":"third_party/mailman3/third_party-mailman3/#dns-setup","title":"DNS setup","text":"

    Most of the configuration is covered by mailcows DNS setup. After finishing this setup add another subdomain for Mailman, e.g. lists.example.org that points to the same server:

    # Name    Type       Value\nlists     IN A       1.2.3.4\nlists     IN AAAA    dead:beef\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#install-apache-as-a-reverse-proxy","title":"Install Apache as a reverse proxy","text":"

    Install Apache, e.g. with this guide from Digital Ocean: How To Install the Apache Web Server on Ubuntu 20.04.

    Activate certain Apache modules (as root or sudo):

    a2enmod rewrite proxy proxy_http headers ssl wsgi proxy_uwsgi http2\n

    Maybe you have to install further packages to get these modules. This PPA by Ond\u0159ej Sur\u00fd may help you.

    "},{"location":"third_party/mailman3/third_party-mailman3/#vhost-configuration","title":"vHost configuration","text":"

    Copy the mailcow.conf and the mailman.conf in the Apache conf folder sites-available (e.g. under /etc/apache2/sites-available).

    Change in mailcow.conf: - MAILCOW_HOSTNAME to your MAILCOW_HOSTNAME

    Change in mailman.conf: - MAILMAN_DOMAIN to your Mailman domain (e.g. lists.example.org)

    Don't activate the configuration, as the ssl certificates and directories are missing yet.

    "},{"location":"third_party/mailman3/third_party-mailman3/#obtain-ssl-certificates-with-lets-encrypt","title":"Obtain SSL certificates with Let's Encrypt","text":"

    Check if your DNS config is available over the internet and points to the right IP addresses, e.g. with MXToolBox:

    • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILCOW_HOSTNAME
    • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILCOW_HOSTNAME
    • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILMAN_DOMAIN
    • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILMAN_DOMAIN

    Install certbot (as root or sudo):

    apt install certbot\n

    Get the desired certificates (as root or sudo):

    certbot certonly -d MAILCOW_HOSTNAME\ncertbot certonly -d MAILMAN_DOMAIN\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#install-mailcow-with-mailman-integration","title":"Install mailcow with Mailman integration","text":""},{"location":"third_party/mailman3/third_party-mailman3/#install-mailcow","title":"Install mailcow","text":"

    Follow the mailcow installation. Omit step 5 and do not pull and start!

    "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailcow","title":"Configure mailcow","text":"

    This is also Step 4 in the official mailcow installation (nano mailcow.conf). So change to your needs and alter the following variables:

    HTTP_PORT=18080            # don't use 8080 as mailman needs it\nHTTP_BIND=127.0.0.1        #\nHTTPS_PORT=18443           # you may use 8443\nHTTPS_BIND=127.0.0.1       #\n\nSKIP_LETS_ENCRYPT=y        # reverse proxy will do the SSL termination\n\nSNAT_TO_SOURCE=1.2.3.4     # change this to your IPv4\nSNAT6_TO_SOURCE=dead:beef  # change this to your global IPv6\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#add-mailman-integration","title":"Add Mailman integration","text":"

    Create the file /opt/mailcow-dockerized/docker-compose.override.yml (e.g. with nano) and add the following lines:

    services:\n  postfix-mailcow:\n    volumes:\n      - /opt/mailman:/opt/mailman\n    networks:\n      - docker-mailman_mailman\n\nnetworks:\n  docker-mailman_mailman:\n    external: true\n
    The additional volume is used by Mailman to generate additional config files for mailcow postfix. The external network is build and used by Mailman. mailcow needs it to deliver incoming list mails to Mailman.

    Create the file /opt/mailcow-dockerized/data/conf/postfix/extra.cf (e.g. with nano) and add the following lines:

    # mailman\n\nrecipient_delimiter = +\nunknown_local_recipient_reject_code = 550\nowner_request_special = no\n\nlocal_recipient_maps =\n  regexp:/opt/mailman/core/var/data/postfix_lmtp,\n  proxy:unix:passwd.byname,\n  $alias_maps\nvirtual_mailbox_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\ntransport_maps =\n  pcre:/opt/postfix/conf/custom_transport.pcre,\n  pcre:/opt/postfix/conf/local_transport,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\nrelay_domains =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_relay_domain_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_domains\nrelay_recipient_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\n
    As we overwrite mailcow postfix configuration here, this step may break your normal mail transports. Check the original configuration files if anything changed.

    "},{"location":"third_party/mailman3/third_party-mailman3/#ssl-certificates","title":"SSL certificates","text":"

    As we proxying mailcow, we need to copy the SSL certificates into the mailcow file structure. This task will do the script renew-ssl.sh for us:

    • Copy the file to /opt/mailcow-dockerized
    • Change mailcow_HOSTNAME to your mailcow hostname
    • Make it executable (chmod a+x renew-ssl.sh)
    • Do not run it yet, as we first need Mailman

    You have to create a cronjob, so that new certificates will be copied. Execute as root or sudo:

    crontab -e\n

    To run the script every day at 5am, add:

    0   5  *   *   *     /opt/mailcow-dockerized/renew-ssl.sh\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#install-mailman","title":"Install Mailman","text":"

    Basicly follow the instructions at docker-mailman. As they are a lot, here is in a nuthshell what to do:

    As root or sudo:

    cd /opt\nmkdir -p mailman/core\nmkdir -p mailman/web\ngit clone https://github.com/maxking/docker-mailman\ncd docker-mailman\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailman","title":"Configure Mailman","text":"

    Create a long key for Hyperkitty, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this key for a moment as HYPERKITTY_KEY.

    Create a long password for the database, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this password for a moment as DBPASS.

    Create a long key for Django, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this key for a moment as DJANGO_KEY.

    Create the file /opt/docker-mailman/docker compose.override.yaml and replace HYPERKITTY_KEY, DBPASS and DJANGO_KEY with the generated values:

    services:\n  mailman-core:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - MTA=postfix\n    restart: always\n    networks:\n      - mailman\n\n  mailman-web:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - SECRET_KEY=DJANGO_KEY\n    - SERVE_FROM_DOMAIN=MAILMAN_DOMAIN # e.g. lists.example.org\n    - MAILMAN_ADMIN_USER=admin # the admin user\n    - MAILMAN_ADMIN_EMAIL=admin@example.org # the admin mail address\n    - UWSGI_STATIC_MAP=/static=/opt/mailman-web-data/static\n    restart: always\n\n  database:\n    environment:\n    - POSTGRES_PASSWORD=DBPASS\n    restart: always\n

    At mailman-web fill in correct values for SERVE_FROM_DOMAIN (e.g. lists.example.org), MAILMAN_ADMIN_USER and MAILMAN_ADMIN_EMAIL. You need the admin credentials to log into the web interface (Postorius). For setting the password for the first time use the Forgot password function in the web interface.

    About other configuration options read Mailman-web and Mailman-core documentation.

    "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailman-core-and-mailman-web","title":"Configure Mailman core and Mailman web","text":"

    Create the file /opt/mailman/core/mailman-extra.cfg with the following content. mailman@example.org should be pointing to a valid mail box or redirection.

    [mailman]\ndefault_language: de\nsite_owner: mailman@example.org\n

    Create the file /opt/mailman/web/settings_local.py with the following content. mailman@example.org should be pointing to a valid mail box or redirection.

    # locale\nLANGUAGE_CODE = 'de-de'\n\n# disable social authentication\nMAILMAN_WEB_SOCIAL_AUTH = []\n\n# change it\nDEFAULT_FROM_EMAIL = 'mailman@example.org'\n\nDEBUG = False\n
    You can change LANGUAGE_CODE and SOCIALACCOUNT_PROVIDERS to your needs.

    "},{"location":"third_party/mailman3/third_party-mailman3/#run","title":"\ud83c\udfc3 Run","text":"

    Run (as root or sudo)

    docker compose (Plugin)docker-compose (Standalone) 
    a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker compose pull\ndocker compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker compose pull\n./renew-ssl.sh\n
    a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker-compose pull\ndocker-compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker-compose pull\n./renew-ssl.sh\n

    Wait a few minutes! The containers have to create there databases and config files. This can last up to 1 minute and more.

    "},{"location":"third_party/mailman3/third_party-mailman3/#remarks","title":"Remarks","text":""},{"location":"third_party/mailman3/third_party-mailman3/#new-lists-arent-recognized-by-postfix-instantly","title":"New lists aren't recognized by postfix instantly","text":"

    When you create a new list and try to immediately send an e-mail, postfix responses with User doesn't exist, because postfix won't deliver it to Mailman yet. The configuration at /opt/mailman/core/var/data/postfix_lmtp is not instantly updated. If you need the list instantly, restart postifx manually:

    docker compose (Plugin)docker-compose (Standalone) 
    cd /opt/mailcow-dockerized\ndocker compose restart postfix-mailcow\n
    cd /opt/mailcow-dockerized\ndocker-compose restart postfix-mailcow\n
    "},{"location":"third_party/mailman3/third_party-mailman3/#update","title":"Update","text":"

    mailcow has it's own update script in /opt/mailcow-dockerized/update.sh, see the docs.

    For Mailman just fetch the newest version from the github repository.

    "},{"location":"third_party/mailman3/third_party-mailman3/#backup","title":"Backup","text":"

    mailcow has an own backup script. Read the docs for further informations.

    Mailman won't state backup instructions in the README.md. In the gitbucket of pgollor is a script that may be helpful.

    "},{"location":"third_party/mailman3/third_party-mailman3/#todo","title":"ToDo","text":""},{"location":"third_party/mailman3/third_party-mailman3/#install-script","title":"install script","text":"

    Write a script like in mailman-mailcow-integration/mailman-install.sh as many of the steps are automatable.

    1. Ask for all the configuration variables and create passwords and keys.
    2. Do a (semi-)automatic installation.
    3. Have fun!
    "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/","title":"Mailpiler Integration","text":"

    This is a simple integration of mailcow aliases and the mailbox name into mailpiler when using IMAP authentication.

    Disclaimer: This is not officially maintained nor supported by the mailcow project nor its contributors. No warranty or support is being provided, however you're free to open issues on GitHub for filing a bug or provide further ideas. GitHub repo can be found here.

    Info

    Support for domain wildcards were implemented in Piler 1.3.10 which was released on 03.01.2021. Prior versions basically do work, but after logging in you won't see emails sent from or to the domain alias. (e.g. when @example.com is an alias for admin@example.com)

    "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#the-problem-to-solve","title":"The problem to solve","text":"

    mailpiler offers the authentication based on IMAP, for example:

    $config['ENABLE_IMAP_AUTH'] = 1;\n$config['IMAP_HOST'] = 'mail.example.com';\n$config['IMAP_PORT'] =  993;\n$config['IMAP_SSL'] = true;\n
    • So when you log in using patrik@example.com, you will only see delivered emails sent from or to this specific email address.
    • When additional aliases are defined in mailcow, like team@example.com, you won't see emails sent to or from this email address even the fact you're a recipient of mails sent to this alias address.

    By hooking into the authentication process of mailpiler, we are able to get required data via the mailcow API during login. This fires API requests to the mailcow API (requiring read-only API access) to read out the aliases your email address participates and also the \"Name\" of the mailbox specified to display it on the top-right of mailpiler after login.

    Permitted email addresses can be seen in the mailpiler settings top-right after logging in.

    Info

    This is only pulled once during the authentication process. The authorized aliases and the realname are valid for the whole duration of the user session as mailpiler sets them in the session data. If user is removed from specific alias, this will only take effect after next login.

    "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#the-solution","title":"The solution","text":"

    Note: File paths might vary depending on your setup.

    "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#requirements","title":"Requirements","text":"
    • A working mailcow instance
    • A working mailpiler instance (You can find an installation guide here, check supported versions here)
    • An mailcow API key (read-only works just fine): Configuration & Details - Access - Read-Only Access. Don't forget to allow API access from your mailpiler IP.

    Warning

    As mailpiler authenticates against mailcow, our IMAP server, failed logins of users or bots might trigger a block for your mailpiler instance. Therefore you might want to consider whitelisting the IP address of the mailpiler instance within mailcow: Configuration & Details - Configuration - Fail2ban parameters - Whitelisted networks/hosts.

    "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#setup","title":"Setup","text":"

    1. Set the custom query function of mailpiler and append this to /usr/local/etc/piler/config-site.php:

      $config['MAILCOW_API_KEY'] = 'YOUR_READONLY_API_KEY';\n$config['MAILCOW_SET_REALNAME'] = true; // when not specified, then default is false\n$config['CUSTOM_EMAIL_QUERY_FUNCTION'] = 'query_mailcow_for_email_access';\ninclude('auth-mailcow.php');\n

      You can also change the mailcow hostname, if required: 

      $config['MAILCOW_HOST'] = 'mail.domain.tld'; // defaults to $config['IMAP_HOST']\n

    2. Download the PHP file with the functions from the GitHub repo:

      curl -o /usr/local/etc/piler/auth-mailcow.php https://raw.githubusercontent.com/patschi/mailpiler-mailcow-integration/master/auth-mailcow.php\n

    3. Done!

    Make sure to re-login with your IMAP credentials for changes to take effect.

    If it doesn't work, most likely something's wrong with the API query itself. Consider debugging by sending manual API requests to the API. (Tip: Open https://mail.domain.tld/api on your instance)

    "},{"location":"third_party/nextcloud/third_party-nextcloud/","title":"Nextcloud","text":""},{"location":"third_party/nextcloud/third_party-nextcloud/#manage-nextcloud-using-the-helper-script","title":"Manage Nextcloud using the helper script","text":"

    Deprecation notice

    This guide about the mailcow Nextcloud helper-script is deprecated. Until December 2024 this installationscript will be removed from mailcow and no further support will be granted. If you are using a Nextcloud installation based on this script you should migrate all your datas to a standalone Nextcloud instance (either inside Docker or natively) in the near future.

    The Authentication guide (below further) will still be intact after the script removal in December 2024.

    Nextcloud can be set up (parameter -i) and removed (parameter -p) with the helper script included with mailcow. In order to install Nextcloud simply navigate to your mailcow-dockerized root folder and run the helper script as follows:

    ./helper-scripts/nextcloud.sh -i

    In case you have forgotten the password (e.g. for admin) and can't request a new one via the password reset link on the login screen calling the helper script with -r as parameter allows you to set a new password. Only use this option if your Nextcloud isn't configured to use mailcow for authentication as described in the next section.

    In order for mailcow to generate a a certificate for the nextcloud domain you need to add \"nextcloud.domain.tld\" to ADDITIONAL_SAN in mailcow.conf and runthe following to apply:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    For more informaton refer to: Advanced SSL.

    "},{"location":"third_party/nextcloud/third_party-nextcloud/#background-jobs","title":"Background jobs","text":"

    To use the recommended setting (cron) to execute the background jobs following lines need to be added to the docker-compose.override.yml:

    services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.nextcloud-cron.schedule: \"@every 5m\"\n      ofelia.job-exec.nextcloud-cron.command: \"su www-data -s /bin/bash -c \\\"/usr/local/bin/php -f /web/nextcloud/cron.php\\\"\"\n

    In addition, a specific function must be activated for the php-fpm worker. Do this by editing the file data/conf/phpfpm/php-fpm.d/pools.conf and removing shell_exec from all items including the ,.

    After the two steps have been completed, the following command must be executed to provide the Docker image with the corresponding labels and restart the stack.

    After adding these lines the following command must be executed to update the docker image:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n

    And also the docker scheduler image must be restarted to pick up the new job definition by executing:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart ofelia-mailcow\n
    docker-compose restart ofelia-mailcow\n

    To check if the job was successfully picked up by ofelia the command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs ofelia-mailcow\n
    docker-compose logs ofelia-mailcow\n

    It should contain a line similar to New job registered \"nextcloud-cron\" - ....

    By adding these lines the background jobs will be executed every 5 minutes. To verify that the execution works correctly, the only way is to see it in the basic settings when logged in as an admin in Nextcloud. If everything is correct the first scheduled execution will change the background jobs processing setting to (X) Cron and the timestamp after Last job ran will be updated every 5 minutes.

    "},{"location":"third_party/nextcloud/third_party-nextcloud/#configure-nextcloud-to-use-mailcow-for-authentication","title":"Configure Nextcloud to use mailcow for authentication","text":"

    The following describes how set up authentication via mailcow using the OAuth2 protocol. We will only assume that you have already set up Nextcloud at cloud.example.com and that your mailcow is running at mail.example.com. It does not matter if your Nextcloud is running on a different server, you can still use mailcow for authentication.

    1. Log into mailcow as administrator.

    2. Click Configuration in the drop-down menu (top right).

    3. Then, in the \"Access\" tab, select the OAuth2 drop-down item.

    4. Scroll down and click the Add OAuth2 client button. Specify the redirect URI as https://cloud.example.com/index.php/apps/sociallogin/custom_oauth2/mailcow and click Add. Save the client ID and secret for later.

    Info

    Some installations, including those setup using the helper script of mailcow, need to remove index.php/ from the URL to get a successful redirect: https://cloud.example.com/apps/sociallogin/custom_oauth2/mailcow

    5. Log into Nextcloud as administrator.

    6. Click the button in the top right corner and select Apps. Click the search button in the toolbar, search for the Social Login plugin and click Download and enable next to it.

    7. Click the button in the top right corner and select Settings. Scroll down to the Administration section on the left and click Social login.

    8. Uncheck the following items:

    • \"Disable auto create new users\"
    • \"Allow users to connect social logins with their accounts\"
    • \"Do not prune not available user groups on login\"
    • \"Automatically create groups if they do not exists\"
    • \"Restrict login for users without mapped groups\"

    7. Check the following items:

    • \"Prevent creating an account if the email address exists in another account\"
    • \"Update user profile every login\"
    • \"Disable notify admins about new users\"

    Click the Save button.

    8. Scroll down to Custom OAuth2 and click the + button. 9. Configure the parameters as follows:

    • Internal name: mailcow
    • Title: mailcow
    • API Base URL: https://mail.example.com
    • Authorize URL: https://mail.example.com/oauth/authorize
    • Token URL: https://mail.example.com/oauth/token
    • Profile URL: https://mail.example.com/oauth/profile
    • Logout URL: (leave blank)
    • Client ID: (what you obtained in step 1)
    • Client Secret: (what you obtained in step 1)
    • Scope: profile

    Click the Save button at the very bottom of the page.

    If you have previously used Nextcloud with mailcow authentication via user_external/IMAP, you need to perform some additional steps to link your existing user accounts with OAuth2.

    1. Click the button in the top right corner and select Apps. Scroll down to the External user authentication app and click Remove next to it. 2. Run the following queries in your Nextcloud database (if you set up Nextcloud with the script from mailcow, you can use the following command to get into the container):

    docker compose (Plugin)docker-compose (Standalone) 
    source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
    source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
    INSERT INTO oc_users (uid, uid_lower) SELECT DISTINCT uid, LOWER(uid) FROM oc_users_external;\nINSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users_external;\n

    If you have previously used Nextcloud without mailcow authentication, but with the same usernames as mailcow, you can also link your existing user accounts with OAuth2.

    1. Run the following queries in your Nextcloud database (if you set up Nextcloud with the script from mailcow, you can use the following command to get into the container):

    docker compose (Plugin)docker-compose (Standalone) 
    source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
    source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
    INSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users;\n
    "},{"location":"third_party/nextcloud/third_party-nextcloud/#update","title":"Update","text":"

    The Nextcloud instance can be updated easily with the web update mechanism. In the case of larger updates, there may be further changes to be made after the update. After the Nextcloud instance has been checked, problems are shown. This can be e.g. missing indices in the DB or similar. It shows which commands have to be executed, these have to be placed in the php-fpm-mailcow container.

    As an an example run the following command to add the missing indices. docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/occ db:add-missing-indices\"

    The update can also been done by CLI with the following command:

    docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar\"

    This can also been done in an non interactive way (e.g. CRON) with this command:

    Danger

    We do not recommend this! Serios damage can be caused or the update process brakes over time. USE AT OWN RISK!!

    docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar --no-interaction\"

    "},{"location":"third_party/nextcloud/third_party-nextcloud/#debugging-troubleshooting","title":"Debugging & Troubleshooting","text":"

    It may happen that you cannot reach the Nextcloud instance from your network. This may be due to the fact that the entry of your subnet in the array 'trusted_proxies' is missing. You can make changes in the Nextcloud config.php in data/web/nextcloud/config/*.

    'trusted_proxies' =>\n  array (\n    0 => 'fd4d:6169:6c63:6f77::/64',\n    1 => '172.22.1.0/24',\n    2 => 'NewSubnet/24',\n  ),\n

    After the changes have been made, the nginx container must be restarted.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart nginx-mailcow\n
    docker-compose restart nginx-mailcow\n
    "},{"location":"third_party/portainer/third_party-portainer/","title":"Portainer","text":"

    In order to enable Portainer, the docker-compose.yml and site.conf for Nginx must be modified.

    1. Create a new file docker-compose.override.yml in the mailcow-dockerized root folder and insert the following configuration 

    services:\n    portainer-mailcow:\n      image: portainer/portainer-ce\n      volumes:\n        - /var/run/docker.sock:/var/run/docker.sock\n        - ./data/conf/portainer:/data\n      restart: always\n      dns:\n        - 172.22.1.254\n      dns_search: mailcow-network\n      networks:\n        mailcow-network:\n          aliases:\n            - portainer\n
    2a. Create data/conf/nginx/portainer.conf: 
    upstream portainer {\n  server portainer-mailcow:9000;\n}\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  '' close;\n}\n

    2b. Insert a new location to the default mailcow site by creating the file data/conf/nginx/site.portainer.custom: 

      location /portainer/ {\n    proxy_http_version 1.1;\n    proxy_set_header Host              $http_host;   # required for docker client's sake\n    proxy_set_header X-Real-IP         $remote_addr; # pass on real client's IP\n    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_read_timeout                 900;\n\n    proxy_set_header Connection \"\";\n    proxy_buffers 32 4k;\n    proxy_pass http://portainer/;\n  }\n\n  location /portainer/api/websocket/ {\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_pass http://portainer/api/websocket/;\n  }\n

    3. Apply your changes:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d && docker compose restart nginx-mailcow\n
    docker-compose up -d && docker-compose restart nginx-mailcow\n

    Now you can simply navigate to https://${MAILCOW_HOSTNAME}/portainer/ to view your Portainer container monitoring page. You\u2019ll then be prompted to specify a new password for the admin account. After specifying your password, you\u2019ll then be able to connect to the Portainer UI.

    "},{"location":"third_party/portainer/third_party-portainer/#reverse-proxy","title":"Reverse Proxy","text":"

    If you are using a reverse proxy you will have to configure it to properly forward websocket requests.

    This needs to be done for the docker console and other components to work.

    Here is an example for Apache:

    <Location /portainer/api/websocket/>\n  RewriteEngine on\n  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\n  RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\n  RewriteRule /portainer/api/websocket/(.*) ws://127.0.0.1:8080/portainer/api/websocket/$1 [P]\n</Location>\n
    "},{"location":"third_party/roundcube/third_party-roundcube/","title":"Roundcube","text":""},{"location":"third_party/roundcube/third_party-roundcube/#installing-roundcube","title":"Installing Roundcube","text":"

    Note

    Unless otherwise stated, all of the given commands are expected to be executed in the mailcow installation directory, i.e., the directory containing mailcow.conf etc. Please do not blindly execute the commands but understand what they do. None of the commands is supposed to produce an error, so if you encounter an error, fix it if necessary before continuing with the subsequent commands.

    "},{"location":"third_party/roundcube/third_party-roundcube/#note-on-composer-usage","title":"Note on composer usage","text":"

    This guide uses composer to update roundcube dependencies or install / update roundcube plugins.

    The roundcube-plugin-installer composer plugin has a design issue that can lead to composer errors when packages are upgraded or uninstalled in the composer execution.

    The error message will typically tell you that a require in autoload_real.php failed because a file could not be opened. Example:

    In autoload_real.php line 43:\n  require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory\n

    Unfortunately these occur quite frequently, but they can be worked around by updating the autoloader and re-running the failed command:

    docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o\n# Now execute the command that failed again\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#preparation","title":"Preparation","text":"

    First we load mailcow.conf so we have access to the mailcow configuration settings for the following commands.

    source mailcow.conf\n

    Download Roundcube 1.6.x (check for latest release and adapt URL) to the web directory and extract it (here rc/):

    mkdir -m 755 data/web/rc\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#optional-spellchecking","title":"Optional: Spellchecking","text":"

    If you need spell check features, create a file data/hooks/phpfpm/aspell.sh with the following content, then chmod +x data/hooks/phpfpm/aspell.sh. This installs a local spell check engine. Note, most modern web browsers have built in spell check, so you may not want/need this.

    #!/bin/bash\napk update\napk add aspell-en # or any other language\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#install-mime-type-mappings","title":"Install mime type mappings","text":"

    Download the mime.types file as it is not included in the php-fpm container.

    wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#create-roundcube-database","title":"Create roundcube database","text":"

    Create a database for roundcube in the mailcow MySQL container. This creates a new roundcube database user with a random password, which will be echoed to the shell and stored in a shell variable for use by later commands. Note that when you interrupt the process and continue in a new shell, you must set the DBROUNDCUBE shell variable manually to the password output by the following commands.

    DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)\necho Database password for user roundcube is $DBROUNDCUBE\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';\"\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#roundcube-configuration","title":"Roundcube configuration","text":"

    Create a file data/web/rc/config/config.inc.php with the following content. - The des_key option is set to a random value. It is used to temporarily store your IMAP password. - The plugins list can be adapted to your preference. I added a set of standard plugins that I consider of common usefulness and which work well together with mailcow: - The archive plugin adds an archive button that moves selected messages to a user-configurable archive folder. - The managesieve plugin provides a user-friendly interface to manage server-side mail filtering and vacation / out of office notification. - The acl plugin allows to manage access control lists on IMAP folders, including the ability to share IMAP folders to other users. - The markasjunk plugin adds buttons to mark selected messages as junk (or messages in the junk folder not as junk) and moves them to the junk folder or back to the inbox. The sieve filters included with mailcow will take care that action triggers a learn as spam/ham action in rspamd, so no further configuration of the plugin is needed. - The zipdownload plugin allows to download multiple message attachments or messages as a zip file. - If you didn't install spell check in the above step, remove spellcheck_engine parameter.

    cat <<EOCONFIG >data/web/rc/config/config.inc.php\n<?php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\n\\$config['imap_host'] = 'dovecot:143';\n\\$config['smtp_host'] = 'postfix:588';\n\\$config['smtp_user'] = '%u';\n\\$config['smtp_pass'] = '%p';\n\\$config['support_url'] = '';\n\\$config['product_name'] = 'Roundcube Webmail';\n\\$config['cipher_method'] = 'chacha20-poly1305';\n\\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc \"A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\\\]^_{|}~\" 2> /dev/null | head -c 32)';\n\\$config['plugins'] = [\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n];\n\\$config['spellcheck_engine'] = 'aspell';\n\\$config['mime_types'] = '/web/rc/config/mime.types';\n\\$config['enable_installer'] = true;\n\n\\$config['managesieve_host'] = 'dovecot:4190';\n// Enables separate management interface for vacation responses (out-of-office)\n// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section\n\\$config['managesieve_vacation'] = 1;\nEOCONFIG\n\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#initialize-database","title":"Initialize database","text":"

    Point your browser to https://myserver/rc/installer. Check that the website shows no \"NOT OK\" check results on any of the steps, some \"NOT AVAILABLE\" are expected regarding different database extensions of which we only need MySQL. Initialize the database and leave the installer. It is not necessary to update the configuration with the downloaded one, unless you made some settings in the installer you would like to take over.

    "},{"location":"third_party/roundcube/third_party-roundcube/#webserver-configuration","title":"Webserver configuration","text":"

    The roundcube directory includes some locations that we do not want to serve to web users. We add a configuration extension to nginx to only expose the public directory of roundcube.

    cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#disable-and-remove-installer","title":"Disable and remove installer","text":"

    Delete the directory data/web/rc/installer after a successful installation, and set the enable_installer option to false in data/web/rc/config/config.inc.php:

    rm -r data/web/rc/installer\nsed -i -e \"s/\\(\\$config\\['enable_installer'\\].* = \\)true/\\1false/\" data/web/rc/config/config.inc.php\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#update-roundcube-dependencies","title":"Update roundcube dependencies","text":"

    This step is not strictly necessary, but at least at the time of this writing the dependencies shipped with roundcube included versions with security vulnerabilities, so it may be a good idea to update the dependencies to the latest versions. For the same reason, it may be a good idea to run the composer update once in a while.

    cp -n data/web/rc/composer.json-dist data/web/rc/composer.json\ndocker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n

    You can also use composer audit to check for any reported security issues with the installed set of composer packages:

    docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#allow-plaintext-authentication-for-the-php-fpm-container-without-using-tls","title":"Allow plaintext authentication for the php-fpm container without using TLS","text":"

    We need to allow plaintext authentication in dovecot over unencrypted connection (inside the container network), which is per default mailcow installation only possible for the SOGo container for the very same purpose. Afterwards restart the dovecot container so the change becomes effective.

    cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nremote ${IPV4_NETWORK}.0/24 {\n  disable_plaintext_auth = no\n}\nremote ${IPV6_NETWORK} {\n  disable_plaintext_auth = no\n}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#ofelia-job-for-roundcube-housekeeping","title":"Ofelia job for roundcube housekeeping","text":"

    Roundcube needs to clean some stale information from the database every once in a while, for which we will create an ofelia job that runs the roundcube cleandb.sh script.

    To do this, add the following to docker-compose.override.yml (if you already have some adaptations for the php-fpm container, add the labels to the existing section):

    services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.roundcube_cleandb.schedule: \"@every 168h\"\n      ofelia.job-exec.roundcube_cleandb.user: \"www-data\"\n      ofelia.job-exec.roundcube_cleandb.command: \"/bin/bash -c \\\"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\\\"\"\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#optional-extra-functionality","title":"Optional extra functionality","text":""},{"location":"third_party/roundcube/third_party-roundcube/#enable-change-password-function-in-roundcube","title":"Enable change password function in Roundcube","text":"

    Changing the mailcow password from the roundcube UI is supported via the password plugin. We will configure it to use the mailcow API to update the password, which requires to enable the API first and to get the API key (read/write API access required). The API can be enabled in the mailcow admin interface, where you can also find the API key.

    Open data/web/rc/config/config.inc.php and enable the password plugin by adding it to the $config['plugins'] array, for example:

    $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n);\n

    Configure the password plugin (be sure to adapt **API_KEY** to you mailcow read/write API key):

    cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'http://nginx';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n

    Note: If you have changed the mailcow nginx configuration to redirect http requests to https (e.g., as described here), then directly talking to the nginx container via http will not work because nginx is not a hostname contained in the certificate. In such cases, set password_mailcow_api_host in the above configuration to the public URI instead:

    cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#integrate-carddav-addressbooks-in-roundcube","title":"Integrate CardDAV addressbooks in Roundcube","text":"

    Install the latest v5 version (the config below is compatible with v5 releases) using composer. Answer Y when asked if you want to activate the plugin.

    docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"roundcube/carddav:~5\"\n

    Edit the file data/web/rc/plugins/carddav/config.inc.php and insert the following content:

    cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php\n<?php\n\\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';\n\n\\$prefs['SOGo'] = [\n    'accountname'    => 'SOGo',\n    'username'       => '%u',\n    'password'       => '%p',\n    'discovery_url'  => 'http://sogo:20000/SOGo/dav/',\n    'name'           => '%N',\n    'use_categories' => true,\n    'fixed'          => ['username', 'password'],\n];\nEOCONFIG\n

    RCMCardDAV will add all addressbooks of the user on login, including subscribed addressbooks shared to the user by other users.

    If you want to remove the default addressbooks (stored in the Roundcube database), so that only the CardDAV addressbooks are accessible, append $config['address_book_type'] = ''; to the config file data/web/rc/config/config.inc.php.

    Note: RCMCardDAV uses additional database tables. After installing (or upgrading) RCMCardDAV, it is required to log in roundcube (log out first if already logged in) because the database table creation / changes are performed only during the login to roundcube.

    "},{"location":"third_party/roundcube/third_party-roundcube/#forward-the-client-network-address-to-dovecot","title":"Forward the client network address to dovecot","text":"

    Normally, the IMAP server dovecot will see the network address of the php-fpm container when roundcube interacts with the IMAP server. Using an IMAP extension and the dovecot_client_ip roundcube plugin, it is possible for roundcube to tell dovecot the client IP, so it will also show up in the logs as the remote IP. When doing this, login attempts will show in the dovecot logs like any direct client connections to dovecot, and such failed logins into roundcube will be treated in the same manner as failed direct IMAP logins, causing blocking of the client with the netfilter container or other mechanisms that may already be in place to handle bruteforce attacks on the IMAP server.

    For this, the roundcube plugin must be installed.

    docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"foorschtbar/dovecot_client_ip:~2\"\n

    Edit the file data/web/rc/config/config.inc.php and insert the following content:

    cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['dovecot_client_ip_trusted_proxies'] = ['${IPV4_NETWORK}.0/24', '${IPV6_NETWORK}'];\nEOCONFIG\n

    Furthermore, we must configure dovecot to treat the php-fpm container as part of a trusted network so it is allowed to override the client IP in the IMAP session. Note that this also enables plaintext authentication for the listed network ranges, so the explicit overridings of disable_plaintext_auth done above are not necessary when using this.

    cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nlogin_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#add-roundcube-link-to-mailcow-apps-list","title":"Add roundcube link to mailcow Apps list","text":"

    You can add Roundcube's link to the mailcow Apps list. To do this, open or create data/web/inc/vars.local.inc.php and make sure it includes the following configuration block:

    <?php\n\n$MAILCOW_APPS = [\n    [\n        'name' => 'SOGo',\n        'link' => '/SOGo/'\n    ],\n    [\n        'name' => 'Roundcube',\n        'link' => '/rc/'\n    ]\n];\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#let-admins-log-into-roundcube-without-password","title":"Let admins log into Roundcube without password","text":"

    First, install plugin dovecot_impersonate and add Roundcube as an app (see above).

    docker exec -it -w /web/rc/plugins $(docker ps -f name=php-fpm-mailcow -q) git clone https://github.com/corbosman/dovecot_impersonate.git\n

    Open data/web/rc/config/config.inc.php and enable the dovecot_impersonate plugin by adding it to the $config['plugins'] array, for example:

    $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n  'dovecot_impersonate'\n);\n

    Edit mailcow.conf and add the following:

    # Allow admins to log into Roundcube as email user (without any password)\n# Roundcube with plugin dovecot_impersonate must be installed first\n\nALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=y\n

    Edit docker-compose.override.yml and crate/extend the section for php-fpm-mailcow:

    services:\n  php-fpm-mailcow:\n    environment:\n      - ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}\n

    Edit data/web/js/site/mailbox.js and the following code after if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }

    if (ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE) {\n  item.action += '<a href=\"/rc-auth.php?login=' + encodeURIComponent(item.username) + '\" class=\"login_as btn btn-sm btn-xs-half btn-primary\" target=\"_blank\"><i class=\"bi bi-envelope-fill\"></i> Roundcube</a>';\n}\n

    Edit data/web/mailbox.php and add this line to array $template_data:

      'allow_admin_email_login_roundcube' => (preg_match(\"/^(yes|y)+$/i\", $_ENV[\"ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE\"])) ? 'true' : 'false',\n

    Edit data/web/templates/mailbox.twig and add this code to the bottom of the javascript section:

      var ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE = {{ allow_admin_email_login_roundcube }};\n

    Copy the contents of the following files from this Snippet:

    • data/web/inc/lib/RoundcubeAutoLogin.php
    • data/web/rc-auth.php
    "},{"location":"third_party/roundcube/third_party-roundcube/#finish-installation","title":"Finish installation","text":"

    Finally, restart mailcow

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#upgrading-roundcube","title":"Upgrading Roundcube","text":"

    Upgrading Roundcube is rather simple, go to the GitHub releases page for Roundcube and get the link for the \"complete.tar.gz\" file for the wanted release. Then follow the below commands and change the URL and Roundcube folder name if needed.

    # Enter a bash session of the mailcow PHP container\ndocker exec -it mailcowdockerized-php-fpm-mailcow-1 bash\n\n# Install required upgrade dependency, then upgrade Roundcube to wanted release\napk add rsync\ncd /tmp\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar xfvz -\ncd roundcubemail-1.6.9\nbin/installto.sh /web/rc\n\n# Type 'Y' and press enter to upgrade your install of Roundcube\n# Type 'N' to \"Do you want me to fix your local configuration\" if prompted\n\n# If you see \"NOTICE: Update dependencies by running php composer.phar update --no-dev\" run composer:\ncd /web/rc\ncomposer update --no-dev -o\n# If asked \"Do you trust \"roundcube/plugin-installer\" to execute code and wish to enable it now? (writes \"allow-plugins\" to composer.json) [y,n,d,?] \" hit y and continue.\n\n# Remove leftover files\nrm -rf /tmp/roundcube*\n\n# If you're going from 1.5 to 1.6 please run the config file changes below\nsed -i \"s/\\$config\\['default_host'\\].*$/\\$config\\['imap_host'\\]\\ =\\ 'dovecot:143'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['default_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['smtp_server'\\].*$/\\$config\\['smtp_host'\\]\\ =\\ 'postfix:588'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['smtp_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['managesieve_host'\\].*$/\\$config\\['managesieve_host'\\]\\ =\\ 'dovecot:4190'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['managesieve_port'\\].*$/d\" /web/rc/config/config.inc.php\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#upgrade-composer-plugins","title":"Upgrade composer plugins","text":"

    To upgrade roundcube plugins installed using composer and dependencies (e.g. RCMCardDAV plugin), you can simply run composer in the container:

    docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#upgrade-mime-type-mappings","title":"Upgrade mime type mappings","text":"

    To upgrade the mime type mappings, re-download them using the command in the installation instructions.

    "},{"location":"third_party/roundcube/third_party-roundcube/#uninstalling-roundcube","title":"Uninstalling roundcube","text":"

    For the uninstallation, it is also assumed that the commands are executed in the mailcow installation directory and that mailcow.conf has been sourced in the shell, see Preparation above.

    "},{"location":"third_party/roundcube/third_party-roundcube/#remove-the-web-directory","title":"Remove the web directory","text":"

    This deletes the roundcube installation and all plugins and dependencies that you may have installed, including those installed with composer.

    Note: This deletes also any custom configuration that you may have done in roundcube. If you want to preserve it, move it some place else instead of deleting it.

    rm -r data/web/rc\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#remove-the-database","title":"Remove the database","text":"

    Note: This clears all data stored for roundcube. If you want to preserve it, you could use mysqldump before deleting the data, or simply keep the database.

    docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP USER 'roundcube'@'%';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP DATABASE roundcubemail;\"\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#remove-any-custom-configuration-files-we-added-to-mailcow","title":"Remove any custom configuration files we added to mailcow","text":"

    To determine these, please read through the installation steps and revert what you changed there.

    "},{"location":"third_party/roundcube/third_party-roundcube/#migration-from-older-mailcow-roundcube-setup","title":"Migration from older mailcow roundcube setup","text":"

    Older versions of this instruction used the mailcow database also for roundcube, with a configured name prefix mailcow_rc1 on all roundcube tables.

    For the migration, it is also assumed that the commands are executed in the mailcow installation directory and that mailcow.conf has been sourced in the shell, see Preparation above. The commands of the different steps build on each other and must be executed in the same shell. Particularly, some steps set shell variables (most importantly the DBROUNDCUBE variable with the database password of the roundcube database user) used in later steps.

    "},{"location":"third_party/roundcube/third_party-roundcube/#create-new-roundcube-database-user-and-database","title":"Create new roundcube database user and database","text":"

    Follow the steps above to create the roundcube database user and the separate database.

    "},{"location":"third_party/roundcube/third_party-roundcube/#migrate-roundcube-data-from-mailcow-database","title":"Migrate roundcube data from mailcow database","text":"

    Before starting the database migration, we disable roundcube to avoid further changes to the roundcube database tables during the migration.

    cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation ^~ /rc/ {\n  return 503;\n}\nEOCONFIG\ndocker compose exec nginx-mailcow nginx -s reload\n

    Now we copy the roundcube data to the new database. We strip the database table prefix in the process, you may need to adjust mailcow_rc1 in case you used a different prefix. It is also possible to keep the prefix (then also keep the respective db_prefix roundcube setting). Then amend the foreign keys.

    RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"show tables like 'mailcow_rc1%';\" | tr '\\n\\r' ' ')\ndocker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c \"mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail\"\nFOREIGNKEYS=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SELECT CONCAT('ALTER TABLE \\`', TABLE_NAME, '\\` ', 'DROP FOREIGN KEY \\`', CONSTRAINT_NAME, '\\`;', 'ALTER TABLE \\`', TABLE_NAME, '\\` ', 'ADD FOREIGN KEY \\`', CONSTRAINT_NAME, '\\` (', COLUMN_NAME, ') ', 'REFERENCES \\`', REPLACE(REFERENCED_TABLE_NAME, 'mailcow_rc1', ''), '\\` (', REFERENCED_COLUMN_NAME, ');') FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = 'roundcubemail' AND REFERENCED_TABLE_NAME IS NOT NULL;\")\ndocker exec $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} roundcubemail -e \"$FOREIGNKEYS\"\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#update-roundcube-configuration","title":"Update roundcube configuration","text":"

    Run the following to remove the no longer required db_prefix option. We also enable logging of roundcube by removing the settings log_dir and temp_dir that were part of the old setup instructions.

    sed -i \"/\\$config\\['db_prefix'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['log_dir'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['temp_dir'\\].*$/d\" data/web/rc/config/config.inc.php\n

    We need to adapt the nginx configuration for roundcube to not expose the non-public folders of roundcube, specifically those containing temporary files and log files:

    cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n

    We can also update the cipher_method to a more secure one but mind that data previously encrypted by roundcube cannot be decrypted anymore afterwards. This specifically affects stored CardDAV passwords if you use RCMCardDAV and your users added custom addressbooks (the preset will be fixed automatically upon next login of the user). If you want to change the cipher_method, run:

    cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['cipher_method'] = 'chacha20-poly1305';\nEOCONFIG\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#switch-rcmcarddav-plugin-to-composer-installation-method","title":"Switch RCMCardDAV plugin to composer installation method","text":"

    This is optional but will align your installation with these instructions and enable you to upgrade RCMCardDAV using composer. This is simply done by deleting the carddav plugin from the installation and installing it using composer according to the instructions above, which include the creation of a new RCMCardDAV v5 config. In case you modified your RCMCardDAV configuration file, you may want to backup it before deleting the plugin and carry over your changes to the new configuration afterwards as well.

    To delete the carddav plugin run the following command, then re-install according to the instructions above:

    rm -r data/web/rc/plugins/carddav\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#switch-roundcube-to-new-database","title":"Switch roundcube to new database","text":"

    First adapt the roundcube configuration to use the new database. 

    sed -i \"/\\$config\\['db_dsnw'\\].*$/d\" data/web/rc/config/config.inc.php\ncat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\nEOCONFIG\n

    "},{"location":"third_party/roundcube/third_party-roundcube/#re-enable-roundcube-web-access","title":"Re-enable roundcube web access","text":"

    Execute the chown and chmod commands on sensitive roundcube directories listed in Preparation, to make sure the nginx webserver cannot access files it is not supposed to serve.

    Then re-enable web access to roundcube by replacing our temporary roundcube custom config for the one described above, and reload the nginx configuration:

    docker compose exec nginx-mailcow nginx -s reload\n
    "},{"location":"third_party/roundcube/third_party-roundcube/#other-changes","title":"Other changes","text":"

    You must also adapt the configuration of the roundcube password plugin according to this instruction, specifically if you use the password changing functionality, since the old instruction directly changed the password in the database, whereas this version of the instruction uses the mailcow API for the password change.

    Regarding other changes and additions (e.g., dovecot_client_ip plugin), you can go through the current installation instructions and adapt your configuration accordingly or perform the listed installation steps for new additions.

    Specifically, consider the following sections: - Ofelia job for roundcube housekeeping - Allow plaintext authentication in dovecot, if you adapt the roundcube configuration to contact dovecot via non-encrypted IMAP connection. - Forward the client network address to dovecot

    "},{"location":"third_party/roundcube/third_party-roundcube/#removing-roundcube-tables-from-mailcow-database","title":"Removing roundcube tables from mailcow database","text":"

    After you have verified that the migration was successful and roundcube works using the separate database, you can remove the roundcube tables from the mailcow database using the following command:

    docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \\+/,/g');\"\n
    "},{"location":"troubleshooting/debug-admin_login_sogo/","title":"Admin login to SOGo","text":"

    This is an experimental feature that allows admins and domain admins to directly log into SOGo as a mailbox user, without knowing the users password.

    For this, an additional link to SOGo is displayed in the mailbox list (mailcow UI).

    Multiple concurrent admin-logins to different mailboxes are also possible when using this feature.

    "},{"location":"troubleshooting/debug-admin_login_sogo/#enabling-the-feature","title":"Enabling the feature","text":"

    The feature is disabled by default. It can be enabled in the mailcow.conf by setting: 

    ALLOW_ADMIN_EMAIL_LOGIN=y\n
    and recreating the affected containers with

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose up -d\n
    docker-compose up -d\n
    "},{"location":"troubleshooting/debug-admin_login_sogo/#drawbacks-when-enabled","title":"Drawbacks when enabled","text":"
    • Each SOGo page-load and each Active-Sync request will cause an additional execution of an internal PHP script. This might impact load-times of SOGo / EAS. In most cases, this should not be noticeable but should be kept in mind if you face any performance issues.
    • SOGo will not display a logout link for admin-logins, to login normally one has to logout from the mailcow UI so the PHP session is destroyed.
    • Subscribing to another user's calendar or address book while logged in as admin does not work. Neither does inviting other users to calendar events. The page will reload when these things are attempted.
    "},{"location":"troubleshooting/debug-admin_login_sogo/#technical-details","title":"Technical details","text":"

    SOGoTrustProxyAuthentication option is set to YES which makes SOGo trust the x-webobjects-remote-user header.

    Dovecot will receive a random master-password which is valid for all mailboxes when used by the SOGo container.

    Clicking on the SOGo button in the mailbox list will open sogo-auth.php which checks permissions, sets session variables and redirects to the SOGo mailbox.

    Each SOGo, CardDAV, CalDAV and EAS http request will cause an additional, nginx internal auth_request call to sogo-auth.php with the following behavior:

    • If a basic_auth header is present, the script will validate the credentials in place of SOGo and provide the following headers: x-webobjects-remote-user, Authorization and x-webobjects-auth-type.

    • If no basic_auth header is present, the script will check for an active mailcow admin session for the requested email user and provide the same headers but with the dovecot master password used in the Authorization header.

    • If both fails the headers will be set empty, which makes SOGo use its standard authentication methods.

    All of these options / behaviors are disabled if the ALLOW_ADMIN_EMAIL_LOGIN is not enabled in the config.

    "},{"location":"troubleshooting/debug-attach_service/","title":"Attach to a Container","text":""},{"location":"troubleshooting/debug-attach_service/#attaching-a-container-to-your-shell","title":"Attaching a Container to your Shell","text":"

    To attach a container to your shell you can simply run

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec $Dienst_Name /bin/bash\n
    docker-compose exec $Dienst_Name /bin/bash\n
    "},{"location":"troubleshooting/debug-attach_service/#connecting-to-services","title":"Connecting to Services","text":"

    If you want to connect to a service / application directly it is always a good idea to source mailcow.conf to get all relevant variables into your environment.

    "},{"location":"troubleshooting/debug-attach_service/#mysql","title":"MySQL","text":"docker compose (Plugin)docker-compose (Standalone) 
    source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\n
    source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\n
    "},{"location":"troubleshooting/debug-attach_service/#redis","title":"Redis","text":"docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec redis-mailcow redis-cli\n
    docker-compose exec redis-mailcow redis-cli\n
    "},{"location":"troubleshooting/debug-attach_service/#service-descriptions","title":"Service Descriptions","text":"

    Here is a brief overview of what container / service does what:

    Service Name Service Descriptions unbound-mailcow Local (DNSSEC) DNS Resolver mysql-mailcow Stores SOGo's and most of mailcow's settings postfix-mailcow Receives and sends mails dovecot-mailcow User logins and sieve filter redis-mailcow Storage back-end for DKIM keys and Rspamd rspamd-mailcow Mail filtering system. Used for av handling, dkim signing, spam handling clamd-mailcow Scans attachments for viruses olefy-mailcow Scans attached office documents for macro-viruses solr-mailcow Provides full-text search in Dovecot sogo-mailcow Webmail client that handles Microsoft ActiveSync and Cal- / CardDav nginx-mailcow Nginx remote proxy that handles all mailcow related HTTP / HTTPS requests acme-mailcow Automates HTTPS (SSL/TLS) certificate deployment memcached-mailcow Internal caching system for mailcow services watchdog-mailcow Allows the monitoring of docker containers / services php-fpm-mailcow Powers the mailcow web UI netfilter-mailcow Fail2Ban like integration"},{"location":"troubleshooting/debug-common_problems/","title":"Common Problems","text":"

    Here we list common problems and possible solutions:

    "},{"location":"troubleshooting/debug-common_problems/#mail-loops-back-to-myself","title":"Mail loops back to myself","text":"

    Please check in your mailcow UI if you made the domain a backup MX:

    "},{"location":"troubleshooting/debug-common_problems/#i-can-receive-but-not-send-mails","title":"I can receive but not send mails","text":"

    There are a lot of things that could prevent you from sending mail:

    • Check if your IP address is on any blacklists. You could use dnsbl.info or any other similar service to check for your IP address.
    • There are some consumer ISP routers out there, that block mail ports for non whitelisted domains. Please check if you can reach your server on the ports 465 or 587:
    # telnet 74.125.133.27 465\nTrying 74.125.133.27...\nConnected to 74.125.133.27.\nEscape character is '^]'.\n
    "},{"location":"troubleshooting/debug-common_problems/#my-mails-are-identified-as-spam","title":"My mails are identified as Spam","text":"

    Please read our guide on DNS configuration.

    "},{"location":"troubleshooting/debug-common_problems/#docker-compose-throws-weird-errors","title":"docker compose throws weird errors","text":"

    ... like:

    • ERROR: Invalid interpolation format ...
    • AttributeError: 'NoneType' object has no attribute 'keys'.
    • ERROR: In file './docker-compose.yml' service 'version' doesn't have any configuration options.

    When you encounter one or similar messages while trying to run mailcow: dockerized please check if you have the latest version of Docker and docker compose

    "},{"location":"troubleshooting/debug-common_problems/#container-xy-is-unhealthy","title":"Container XY is unhealthy","text":"

    This error tries to tell you that one of the (health) conditions for a certain container are not met. Therefore it can't be started. This can have several reasons, the most common one is an updated git clone but old docker image or vice versa.

    A wrong configured firewall could also cause such a failure. The containers need to be able to talk to each other over the network 172.22.1.1/24.

    It might also be wrongly linked file (i.e. SSL certificate) that prevents a crucial container (nginx) from starting, so always check your logs to get an idea where your problem is coming from.

    "},{"location":"troubleshooting/debug-common_problems/#address-already-in-use","title":"Address already in use","text":"

    If you get an error message like:

    ERROR: for postfix-mailcow  Cannot start service postfix-mailcow: driver failed programming external     connectivity on endpoint mailcowdockerized_postfix-mailcow_1: Error starting userland proxy: listen tcp 0.0.0.0:25: bind: address already in use\n

    while trying to start / install mailcow: dockerized, make sure you've followed our section on the prerequisites.

    "},{"location":"troubleshooting/debug-common_problems/#xyz-cant-connect-to","title":"XYZ can't connect to ...","text":"

    Please check your local firewall! Docker and iptables-based firewalls sometimes create conflicting rules, so disable the firewall on your host to determine whether your connection issues are caused by such conflicts. If they are, you need to manually create appropriate rules in your host firewall to permit the necessary connections.

    If you experience connection problems from home, please check your ISP router's firewall too, some of them block mail traffic on the SMTP (587) or SMTPS (465) ports. It could also be, that your ISP is blocking the ports for SUBMISSION (25).

    While Linux users can chose from a variety of tools1 to check if a port is open, the Windows user has only the PowerShell command Test-NetConnection -ComputerName host -Port port available by default.

    To enable telnet on a Windows after Vista please check this guide or enter the following command in an terminal with administrator privileges:

    dism /online /Enable-Feature /FeatureName:TelnetClient\n
    "},{"location":"troubleshooting/debug-common_problems/#inotify-instance-limit-for-user-5000-uid-vmail-exceeded-see-453","title":"Inotify instance limit for user 5000 (UID vmail) exceeded (see #453)","text":"

    Docker containers use the Docker hosts inotify limits. Setting them on your Docker host will pass them to the container.

    "},{"location":"troubleshooting/debug-common_problems/#dovecot-keeps-restarting-see-2672","title":"Dovecot keeps restarting (see #2672)","text":"

    Check that you have at least the following files in data/assets/ssl:

    cert.pem\ndhparams.pem\nkey.pem\n

    If dhparams.pem is missing, you can generate it with

    openssl dhparam -out data/assets/ssl/dhparams.pem 4096\n
    "},{"location":"troubleshooting/debug-common_problems/#rspamd-reports-cannot-open-hyperscan-cache-file-varlibrspamdhs-compiled-for-a-different-platform","title":"Rspamd reports: cannot open hyperscan cache file /var/lib/rspamd/{...}.hs: compiled for a different platform","text":"

    When migrating mailcow to another system (usually with a different CPU), Rspamd may report that it cannot load some (possibly all) .hs files because they were compiled for a different platform (CPU).

    This is related to Hyperscan2, an Intel technique for precompiling regex schemas that Rspamd uses.

    This feature provides a significant performance boost and is therefore heavily embedded in Rspamd.

    To fix this bug, all .hs and .hsmp files must be deleted from the rspamd directory:

    docker compose (Plugin)docker-compose (Standalone) 
    cd MAILCOW_ROOT # Usually /opt/mailcow-dockerized\ndocker compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n
    cd MAILCOW_ROOT # Usually /opt/mailcow-dockerized\ndocker-compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n

    Restart Rspamd afterwards:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Now Rspamd recompiles the said regex maps again with Hyperscan.

    1. netcat, nmap, openssl, telnet, etc.\u00a0\u21a9

    2. Hyperscan \u21a9

    "},{"location":"troubleshooting/debug-logs/","title":"Logs","text":"

    Warning

    This section only applies for Dockers default logging driver (JSON).

    To view the logs of all mailcow: dockerized related containers, you can use the following command inside your mailcow-dockerized folder that contains your mailcow.conf.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs\n
    docker-compose logs\n

    This is usually a bit much, but you could trim the output with --tail=100 to the last 100 lines per container, or add a -f to follow the live output of all your services.

    To view the logs of a specific service you can use the following:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose logs [options] $service_name\n
    docker-compose logs [options] $service_name\n

    Info

    The available options for the previous commands are:

    • --no-color: Produce monochrome output.
    • -f: Follow the log output.
    • -t: Show timestamps.
    • --tail=\"all\": Number of lines to show from the end of the logs for each container.
    "},{"location":"troubleshooting/debug-mysql_aria/","title":"Recover crashed Aria storage engine","text":""},{"location":"troubleshooting/debug-mysql_aria/#mariadb-aria-recovery-after-crash","title":"MariaDB: Aria recovery after crash","text":"

    If your server crashed and MariaDB logs an error similar to [ERROR] mysqld: Aria recovery failed. Please run aria_chk -r on all Aria tables (*.MAI) and delete all aria_log.######## files you may want to try the following to recover the database to a healthy state:

    Start the stack and wait until mysql-mailcow begins to report a restart. Check this with the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose ps\n
    docker-compose ps\n

    Now exec the following commands:

    Stop the stack, don't run \"down\"

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose stop\n
    docker-compose stop\n

    Run a bash in the stopped container as user mysql

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n
    docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n

    cd to the SQL data directory

    cd /var/lib/mysql\n

    Run aria_chk

    aria_chk --check --force */*.MAI\n

    Delete aria log files

    rm aria_log.*\n

    Execute a complete stack restart using the following commands:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down\ndocker compose up -d\n
    docker-compose down\ndocker-compose up -d\n
    "},{"location":"troubleshooting/debug-mysql_upgrade/","title":"Manual MySQL upgrade","text":""},{"location":"troubleshooting/debug-mysql_upgrade/#run-a-manual-mysql_upgrade","title":"Run a manual mysql_upgrade","text":"

    This step is usually not necessary.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose stop mysql-mailcow watchdog-mailcow\ndocker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n
    docker-compose stop mysql-mailcow watchdog-mailcow\ndocker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n

    As soon as the SQL shell spawned, run mysql_upgrade and exit the container:

    mysql_upgrade\nexit\n
    "},{"location":"troubleshooting/debug-resend-quarantine-notifications/","title":"Resend Quarantine Notifications","text":"

    To resend a quarantine notification, enter the following command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n
    docker-compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n

    Info

    We recommend to use this command ONLY for debugging process as the notification is normally triggered automatically based on the settings set for each mailbox.

    "},{"location":"troubleshooting/debug-reset_pw/","title":"Reset Passwords (incl. SQL)","text":""},{"location":"troubleshooting/debug-reset_pw/#mailcow-admin-account","title":"mailcow Admin Account","text":"

    Resets the mailcow admin account to a random password. Older mailcow: dockerized installations may find the mailcow-reset-admin.sh script in their mailcow root directory (mailcow_path).

    cd mailcow_path\n./helper-scripts/mailcow-reset-admin.sh\n
    "},{"location":"troubleshooting/debug-reset_pw/#reset-mysql-passwords","title":"Reset MySQL Passwords","text":"

    Stop the stack by running:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose stop\n
    docker-compose stop\n

    When the containers came to a stop, run this command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
    docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
    "},{"location":"troubleshooting/debug-reset_pw/#1-find-database-name","title":"1. Find database name","text":"
    # source mailcow.conf\n# docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| mailcow_database   | <=====\n| mysql              |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
    "},{"location":"troubleshooting/debug-reset_pw/#2-reset-one-or-more-users","title":"2. Reset one or more users","text":""},{"location":"troubleshooting/debug-reset_pw/#21-maria-db-104-older-mailcow-installations","title":"2.1 Maria DB < 10.4 (older mailcow installations)","text":"

    Both \"password\" and \"authentication_string\" exist. Currently \"password\" is used, but better set both.

    MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user         |\n+--------------+\n| mailcow      | <=====\n| root         |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('gotr00t'), password = PASSWORD('gotr00t') WHERE User = 'root';\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('mookuh'), password = PASSWORD('mookuh') WHERE User = 'mailcow' AND Host = '%';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
    "},{"location":"troubleshooting/debug-reset_pw/#22-maria-db-104-current-mailcows","title":"2.2 Maria DB >= 10.4 (current mailcows)","text":"
    MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user         |\n+--------------+\n| mailcow      | <=====\n| root         |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> ALTER USER 'mailcow'@'%' IDENTIFIED BY 'mookuh';\nMariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
    "},{"location":"troubleshooting/debug-reset_pw/#remove-two-factor-authentication","title":"Remove Two-Factor Authentication","text":""},{"location":"troubleshooting/debug-reset_pw/#for-mailcow-webui","title":"For mailcow WebUI:","text":"

    This works similar to resetting a MySQL password, now we do it from the host without connecting to the MySQL CLI:

    source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
    "},{"location":"troubleshooting/debug-reset_pw/#for-sogo","title":"For SOGo:","text":"
    docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
    "},{"location":"troubleshooting/debug-reset_tls/","title":"Reset TLS certificates","text":"

    In case you encounter problems with your certificate, key or Let's Encrypt account, please try to reset the TLS assets:

    source mailcow.conf\ndocker compose down\nrm -rf data/assets/ssl\nmkdir data/assets/ssl\nopenssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl-example/key.pem -out data/assets/ssl-example/cert.pem -days 365 -subj \"/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${MAILCOW_HOSTNAME}\" -sha256 -nodes\ncp -n -d data/assets/ssl-example/*.pem data/assets/ssl/\ndocker compose up -d\n

    This will stop mailcow, source the variables we need, create a self-signed certificate and start mailcow.

    If you use Let's Encrypt you should be careful as you will create a new account and a new set of certificates. You will run into a ratelimit sooner or later.

    Please also note that previous TLSA records will be invalid.

    "},{"location":"troubleshooting/debug-rm_volumes/","title":"Remove Persistent Data","text":"

    You may want to remove a set of persistent data to resolve a conflict or to start over.

    mailcowdockerized can vary and depends on your compose project name (if it's unchanged, mailcowdockerized is the correct value). If you are unsure about volume names, run docker volume ls for a full list.

    Delete a single volume:

    docker volume rm mailcowdockerized_${VOLUME_NAME}\n
    • Remove volume mysql-vol-1 to remove all MySQL data.
    • Remove volume redis-vol-1 to remove all Redis data.
    • Remove volume vmail-vol-1 to remove all contents of /var/vmail mounted to dovecot-mailcow.
    • Remove volume rspamd-vol-1 to remove all Rspamd data.
    • Remove volume crypt-vol-1 to remove all crypto data. This will render all mails unreadable.

    Alternatively, running the following command will destroy all mailcow: dockerized volumes and delete any related containers and networks:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down -v\n
    docker-compose down -v\n
    "},{"location":"troubleshooting/debug-rspamd_memory_leaks/","title":"Advanced: Find memory leaks in Rspamd","text":"

    A quick guide to deeply analyze a malfunctioning Rspamd.

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# Add this in front of \"exec \"$@\"\":\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n
    docker-compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# Add this in front of \"exec \"$@\"\":\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n

    Restart Rspamd:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Your memory consumption will increase by a lot, it will also steadily grow, which is not related to a possible memory leak you are looking for.

    Leave the container running for a few minutes, hours or days (it should match the time you usually wait for the leak to \"happen\") and restart it:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose restart rspamd-mailcow\n
    docker-compose restart rspamd-mailcow\n

    Now enter the container by running the command:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec rspamd-mailcow bash\n
    docker-compose exec rspamd-mailcow bash\n

    Change the directory to /tmp and copy the asan Files to your desired location or upload them via termbin.com (cat /tmp/rspamd-asan.* | nc termbin.com 9999).

    "},{"location":"troubleshooting/debug/","title":"Introduction","text":"

    When a problem occurs, then always for a reason! What you want to do in such a case is:

    1. Read your logs; follow them to see what the reason for your problem is.
    2. Follow the leads given to you in your logfiles and start investigating.
    3. Restarting the troubled service or the whole stack to see if the problem persists.
    4. Read the documentation of the troubled service and search it's bugtracker for your problem.
    5. Search our issues for your problem.
    6. Create an issue over at our GitHub repository if you think your problem might be a bug or a missing feature you badly need. But please make sure, that you include all the logs and a full description to your problem. Please do not ask for support on Git.
    7. Join our Telegram community or find the official support packages at Servercow.Alternatively ask Twitter and tag us with @mailcow_email
    "},{"location":"de/","title":"Informationen & Support","text":""},{"location":"de/#mailcow-dockerized-","title":"mailcow: dockerized - + =","text":"

    Die Mailserver-Suite mit dem 'moo'

    "},{"location":"de/#was-ist-mailcow-dockerized","title":"Was ist mailcow: dockerized?","text":"

    Frage

    Mailcow, MailCow oder doch mailcow? Wie hei\u00dft das Projekt nun genau?

    Richtig: mailcow, denn mailcow ist eine eingetragene Wortmarke mit kleinem m

    mailcow: dockerized ist eine Open-Source Groupware/E-Mail Suite auf Docker Basis.

    Dabei setzt mailcow auf viele bekannte und lang bewertete Komponenten, welche im Zusammenspiel einen Rund um Sorglosen E-Mail Server ergeben.

    Jeder Container repr\u00e4sentiert eine einzelne Anwendung, die in einem \u00fcberbr\u00fcckten (Bridged) Netzwerk verbunden sind:

    • ACME Automatische Generation von Let's Encrypt Zertifikaten
    • ClamAV Antiviren Scanner (optional)
    • Dovecot IMAP/POP Server zum Abrufen der E-Mails mit integrierter Full-Text Search Engine \"Flatcurve\"
    • MariaDB Datenbank zum Speichern der Nutzer Informationen u.w.
    • Memcached Cache f\u00fcr den Webmailer SOGo
    • Netfilter Fail2ban-\u00e4hnliche Integration von @mkuron
    • Nginx Webserver f\u00fcr Komponenten des Stacks
    • Olefy Analyse von Office Dokumenten nach Viren, Makros etc.
    • PHP Programmiersprache der meisten Webbasierten mailcow Applikationen
    • Postfix MTA (Mail Transfer Agent) f\u00fcr den E-Mail-Verkehr im Internet
    • Redis Speicher f\u00fcr Spaminformationen, DKIM Schl\u00fcssel u.w.
    • Rspamd Spamfilter mit automatischem Lernen von Spammails
    • SOGo Integrierter Webmailer und Cal-/Carddav Schnittstelle
    • Solr Voll-Text-Suche f\u00fcr IMAP Verbindungen zum schnellen durchsuchen von E-Mails (Deprecated) (Optional)
    • Unbound Integrierter DNS-Server zum Verifizieren von DNSSEC u.w
    • Watchdog F\u00fcr die grundlegende \u00dcberwachung der Containerstatus innerhalb von mailcow

    Doch das Herzst\u00fcck bzw. das, was mailcow besonders macht, ist die grafische Weboberfl\u00e4che, die mailcow UI.

    Diese bietet f\u00fcr so gut wie alle Einstellungen einen Platz und erlaubt das bequeme Anlegen von neuen Domains und E-Mail-Adressen mit wenigen Klicks.

    Aber auch andere bzw. kniffligere Themen k\u00f6nnen in ihr problemlos erledigt werden:

    • DKIM und ARC Unterst\u00fctzung bzw. Generation.
    • Black- und Whitelists pro Domain und pro Benutzer
    • Spam-Score-Verwaltung pro Benutzer (Spam ablehnen, Spam markieren, Greylist)
    • Erlauben Sie Mailbox-Benutzern, tempor\u00e4re Spam-Aliase zu erstellen
    • Voranstellen von E-Mail-Tags an den Betreff oder Verschieben von E-Mails in Unterordner (pro Benutzer)
    • Mailbox-Benutzer k\u00f6nnen die TLS-Durchsetzung f\u00fcr eingehende und ausgehende Nachrichten umschalten
    • Benutzer k\u00f6nnen die Caches von SOGo ActiveSync-Ger\u00e4ten zur\u00fccksetzen
    • imapsync, um entfernte Postf\u00e4cher regelm\u00e4\u00dfig zu migrieren oder abzurufen
    • TFA: Yubikey OTP und WebAuthn USB (nur Google Chrome und Derivate), TOTP
    • Hinzuf\u00fcgen von Whitelist-Hosts zur Weiterleitung von Mails an mailcow
    • Fail2ban-\u00e4hnliche Integration
    • Quarant\u00e4ne-System
    • Antivirus-Scanning inkl. Makro-Scanning in Office-Dokumenten
    • Integrierte Basis\u00fcberwachung
    • Und weitere...

    Die mailcow Daten (wie bspw. E-Mails, Userdaten etc.) werden in Docker-Volumes aufbewahrt - geben Sie gut auf diese Volumes acht:

    • clamd-db-vol-1
    • crypt-vol-1
    • mysql-socket-vol-1
    • mysql-vol-1
    • postfix-vol-1
    • redis-vol-1
    • rspamd-vol-1
    • sogo-userdata-backup-vol-1
    • sogo-web-vol-1
    • solr-vol-1
    • vmail-index-vol-1
    • vmail-vol-1

    Achtung

    Die Mails werden komprimiert und verschl\u00fcsselt gespeichert. Das Schl\u00fcsselpaar ist in crypt-vol-1 zu finden. Bitte vergessen Sie nicht, dieses und andere Volumes zu sichern. #KeinBackupkeinMitleid

    "},{"location":"de/#unterstutzen-sie-das-mailcow-projekt","title":"Unterst\u00fctzen Sie das mailcow Projekt","text":"

    Bitte erw\u00e4gen Sie einen Supportvertrag gegen eine geringe monatliche Geb\u00fchr unter Servercow1, um die weitere Entwicklung zu unterst\u00fctzen. Wir unterst\u00fctzen Sie, w\u00e4hrend Sie uns unterst\u00fctzen. :)

    Wenn Sie super toll sind und uns ohne Vertrag unterst\u00fctzen m\u00f6chten, k\u00f6nnen Sie eine SAL (Stay-Awesome License) erhalten, die Ihre Unterst\u00fctzung best\u00e4tigt (kaufbar als flexible Einmalzahlung) bei Servercow.

    "},{"location":"de/#hilfe-gefallig","title":"Hilfe gef\u00e4llig?","text":"

    Es gibt zwei M\u00f6glichkeiten, Support f\u00fcr Ihre mailcow-Installation zu erhalten.

    "},{"location":"de/#kommerzieller-support","title":"Kommerzieller Support","text":"

    F\u00fcr professionellen und priorisierten kommerziellen Support k\u00f6nnen Sie ein Basis-Support-Abonnement unter Servercow abschlie\u00dfen. F\u00fcr kundenspezifische Anfragen oder Fragen kontaktieren Sie uns stattdessen bitte unter info@servercow.de.

    Dar\u00fcber hinaus bieten wir auch eine voll ausgestattete und verwaltete managed mailcow an. Auf diese Weise k\u00fcmmern wir uns um alles technische und Sie k\u00f6nnen Ihr ganzes Mail-Erlebnis auf eine problemlose Weise genie\u00dfen.

    "},{"location":"de/#community-support-und-chat","title":"Community Support und Chat","text":"

    Die Alternative ist unser kostenloser Community-Support auf unseren verschiedenen Kan\u00e4len unten. Bitte beachten Sie, dass dieser Support von unserer gro\u00dfartigen Community rund um mailcow betrieben wird. Diese Art von Support ist best-effort, freiwillig und es gibt keine Garantie f\u00fcr irgendetwas.

    • mailcow Community @ community.mailcow.email

    • Telegram (Support) @ t.me/mailcow

    • Telegram (Off-Topic) @ t.me/mailcowOfftopic

    Telegram Desktop-Clients sind f\u00fcr mehrere Plattformen verf\u00fcgbar. Sie k\u00f6nnen den Gruppenverlauf nach Stichworten durchsuchen.

    Nur f\u00fcr Bug Tracking, Feature Requests und Codebeitr\u00e4ge:

    • mailcow/mailcow-dockerized @ GitHub
    "},{"location":"de/#neuigkeiten-und-release-informationen","title":"Neuigkeiten und Release Informationen:","text":"

    F\u00fcr Ank\u00fcndigungen oder Release Informationen sind wir auf folgenden Plattformen vertreten:

    • mailcow @ X/Twitter

    • @doncow @ mailcow.social

    Oder alternativ auf unserem Blog:

    • mailcow.email
    "},{"location":"de/#neugierig-gleich-ausprobieren","title":"Neugierig? Gleich ausprobieren!","text":"

    Haben wir Ihr Interesse geweckt? Verschaffen Sie sich in unseren offiziellen mailcow Demos einen ersten \u00dcberblick \u00fcber die Funktionalit\u00e4ten von mailcow und Ihrer mailcow UI!

    Wir stellen zwei verschiedene Demos bereit:

    • demo.mailcow.email ist die altbekannte Demo, welche sich am Stabilen Stand der mailcow orrientiert (master Branch auf GitHub).
    • nightly-demo.mailcow.email ist die neue Nightly Demo, welche Testfunktionen beherbergt. (Also insbesondere f\u00fcr alle interessant, die keine M\u00f6glichkeit haben sich eine Testinstanz selbst zu erstellen.) (nightly Branch auf GitHub)

    Nutzen Sie diese Anmeldedaten f\u00fcr die Demos

    • Administrator: admin / moohoo
    • Dom\u00e4nen-Administrator: department / moohoo
    • Mailbox: demo@440044.xyz / moohoo

    Die Anmeldedaten f\u00fcr die Logins funktionieren bei beiden Varianten

    Immer auf dem neusten Stand

    Die Demo Instanzen erhalten die neusten Updates direkt nach Release von GitHub. Vollautomatisch, ohne Downtime!

    1. Servercow ist eine Hosting/Support Sparte der The Infrastructure Company GmbH (mailcow Maintainer)\u00a0\u21a9

    "},{"location":"de/backup_restore/b_n_r-accidental_deletion/","title":"Versehentlich gel\u00f6schte Daten wiederherstellen","text":"

    Sie haben also ein Postfach gel\u00f6scht und haben keine Sicherungskopien?

    Wenn Sie Ihren Fehler innerhalb von ein paar Stunden bemerken, k\u00f6nnen Sie die Daten des Benutzers wahrscheinlich wiederherstellen.

    "},{"location":"de/backup_restore/b_n_r-accidental_deletion/#sogo","title":"SOGo","text":"

    Wir erstellen automatisch t\u00e4gliche Backups (24 Stunden Intervall ab dem ausf\u00fchren von up -d) in /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/.

    Stellen Sie sicher, dass der Benutzer, den Sie wiederherstellen wollen, in Ihrem mailcow-Backend existiert. Legen Sie diesen neu an, falls nicht mehr existent.

    Kopieren Sie die Datei mit dem Namen des Benutzers, den Sie wiederherstellen wollen, nach __MAILCOW_DIRECTORY__/data/conf/sogo.

    1. Kopieren Sie die Sicherung: cp /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/restoreme@example.org __MAILCOW_DIRECTORY__/data/conf/sogo

    2. F\u00fchren Sie folgenden Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n
      docker-compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n

      F\u00fchren Sie sogo-tool ohne Parameter aus, um nach m\u00f6glichen Wiederherstellungsoptionen zu suchen.

    3. L\u00f6schen Sie die kopierte Sicherung, indem Sie rm __MAILCOW_DIRECTORY__/data/conf/sogo ausf\u00fchren

    4. Starten Sie SOGo und Memcached neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart sogo-mailcow memcached-mailcow\n
      docker-compose restart sogo-mailcow memcached-mailcow\n
    "},{"location":"de/backup_restore/b_n_r-accidental_deletion/#mail","title":"Mail","text":"

    Im Falle einer versehentlichen L\u00f6schung einer Mailbox, k\u00f6nnen Sie diese (standardm\u00e4\u00dfig) 5 Tage lang wiederherstellen. Dies h\u00e4ngt von dem MAILDIR_GC_TIME Parameter in mailcow.conf ab.

    Eine gel\u00f6schte Mailbox wird in ihrer verschl\u00fcsselten Form nach /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage kopiert.

    Der Ordner innerhalb von _garbage folgt der Struktur [timestamp]_[domain_sanitized][user_sanitized], zum Beispiel 1629109708_exampleorgtest im Falle von test@example.org, das am 1629109708 gel\u00f6scht wurde.

    Um die Mailbox wiederherzustellen, stellen Sie sicher, dass Sie tats\u00e4chlich auf die gleiche mailcow wiederherstellen, von der sie gel\u00f6scht wurde, oder Sie die gleichen Verschl\u00fcsselungsschl\u00fcssel in crypt-vol-1 verwenden.

    Stellen Sie sicher, dass der Benutzer, den Sie wiederherstellen wollen, in Ihrer mailcow existiert. Legen Sie diesen neu an, wenn der Benutzer fehlt.

    Kopieren Sie die Ordner von /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage/[timestamp]_[domain_sanitized][user_sanitized] zur\u00fcck nach /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/[domain]/[user] und synchronisieren Sie die Ordner neu und berechnen Sie die Quota (Speicherplatz) neu:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
    docker-compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker-compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
    "},{"location":"de/backup_restore/b_n_r-backup/","title":"Sicherung","text":""},{"location":"de/backup_restore/b_n_r-backup/#sicherung","title":"Sicherung","text":""},{"location":"de/backup_restore/b_n_r-backup/#anleitung","title":"Anleitung","text":"

    Sie k\u00f6nnen das mitgelieferte Skript helper-scripts/backup_and_restore.sh verwenden, um mailcow automatisch zu sichern.

    Achtung

    Bitte kopieren Sie dieses Skript nicht an einen anderen Ort.

    Um ein Backup zu starten, geben Sie \"backup\" als ersten Parameter an und entweder eine oder mehrere zu sichernde Komponenten als folgende Parameter. Sie k\u00f6nnen auch \"all\" als zweiten Parameter verwenden, um alle Komponenten zu sichern. F\u00fcgen Sie --delete-days n an, um Sicherungen zu l\u00f6schen, die \u00e4lter als n Tage sind.

    # Syntax:\n# ./helper-scripts/backup_and_restore.sh backup (vmail|crypt|redis|rspamd|postfix|mysql|all|--delete-days)\n\n# Alles sichern, Sicherungen \u00e4lter als 3 Tage l\u00f6schen\n./helper-scripts/backup_and_restore.sh backup all --delete-days 3\n\n# vmail-, crypt- und mysql-Daten sichern, Sicherungen l\u00f6schen, die \u00e4lter als 30 Tage sind\n./helper-scripts/backup_and_restore.sh backup vmail crypt mysql --delete-days 30\n\n# vmail sichern\n./helper-scripts/backup_and_restore.sh backup vmail\n
    "},{"location":"de/backup_restore/b_n_r-backup/#variablen-fur-backuprestore-skript","title":"Variablen f\u00fcr Backup/Restore Skript","text":""},{"location":"de/backup_restore/b_n_r-backup/#multithreading","title":"Multithreading","text":"

    Seit dem 2022-10 Update ist es m\u00f6glich das Skript mit Multithreading Support laufen zu lassen. Dies l\u00e4sst sich sowohl f\u00fcr Backups aber auch f\u00fcr Restores nutzen.

    Um das Backup/den Restore mit Multithreading zu starten muss THREADS als Umgebungsvariable vor dem Befehl zum starten hinzugef\u00fcgt werden.

    THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n
    Die Anzahl hinter dem = Zeichen gibt dabei dann die Thread Anzahl an. Nehmen Sie bitte immer ihre Kernanzahl -2 um mailcow selber noch genug CPU Leistung zu lassen.

    "},{"location":"de/backup_restore/b_n_r-backup/#backup-pfad","title":"Backup Pfad","text":"

    Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung fragen. Innerhalb dieses Speicherortes wird es Ordner im Format \"mailcow_DATE\" erstellen. Sie sollten diese Ordner nicht umbenennen, um den Wiederherstellungsprozess nicht zu st\u00f6ren.

    Um ein Backup unbeaufsichtigt durchzuf\u00fchren, definieren Sie MAILCOW_BACKUP_LOCATION als Umgebungsvariable, bevor Sie das Skript starten:

    MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

    Tipp

    Beide oben genannten Variablen k\u00f6nnen auch kombiniert werden! Bsp:\n```\nMAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n```\n
    "},{"location":"de/backup_restore/b_n_r-backup/#cronjob","title":"Cronjob","text":"

    Sie k\u00f6nnen das Backup-Skript regelm\u00e4\u00dfig \u00fcber einen Cronjob laufen lassen. Stellen Sie sicher, dass BACKUP_LOCATION existiert:

    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n5 4 * * * cd /opt/mailcow-dockerized/; MAILCOW_BACKUP_LOCATION=/mnt/mailcow_backups /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n

    Standardm\u00e4\u00dfig sendet Cron das komplette Ergebnis jeder Backup-Operation per E-Mail. Wenn Sie m\u00f6chten, dass cron nur im Fehlerfall (Exit-Code ungleich Null) eine E-Mail sendet, k\u00f6nnen Sie den folgenden Ausschnitt verwenden. Die Pfade m\u00fcssen entsprechend Ihrer Einrichtung angepasst werden (dieses Skript ist ein Beitrag eines Benutzers).

    Das folgende Skript kann in /etc/cron.daily/mailcow-backup platziert werden - vergessen Sie nicht, es mit chmod +x als ausf\u00fchrbar zu markieren:

    #!/bin/sh\n\n# Backup mailcow data\n# https://docs.mailcow.email/b_n_r_backup/\n\nset -e\n\nOUT=\"$(mktemp)\"\nexport MAILCOW_BACKUP_LOCATION=\"/opt/backup\"\nSCRIPT=\"/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh\"\nPARAMETERS=\"backup all\"\nOPTIONS=\"--delete-days 30\"\n\n# run command\nset +e\n\"${SCRIPT}\" ${PARAMETERS} ${OPTIONS} 2>&1 > \"$OUT\"\nRESULT=$?\n\nif [ $RESULT -ne 0 ]\n    then\n            echo \"${SCRIPT} ${PARAMETERS} ${OPTIONS} encounters an error:\"\n            echo \"RESULT=$RESULT\"\n            echo \"STDOUT / STDERR:\"\n            cat \"$OUT\"\nfi\n
    "},{"location":"de/backup_restore/b_n_r-backup/#backup-strategie-mit-rsync-und-mailcow-backup-skript","title":"Backup-Strategie mit rsync und mailcow Backup-Skript","text":"

    Erstellen Sie das Zielverzeichnis f\u00fcr mailcows Hilfsskript: 

    mkdir -p /external_share/backups/backup_script\n

    Cronjobs erstellen: 

    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n25 1 * * * rsync -aH --delete /opt/mailcow-dockerized /external_share/backups/mailcow-dockerized\n40 2 * * * rsync -aH --delete /var/lib/docker/volumes /external_share/backups/var_lib_docker_volumes\n5 4 * * * cd /opt/mailcow-dockerized/; BACKUP_LOCATION=/external_share/backups/backup_script /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n# Wenn Sie wollen, benutzen Sie das Werkzeug acl, um die Berechtigungen einiger/aller Ordner/Dateien zu sichern: getfacl -Rn /path\n

    Am Zielort (in diesem Fall /external_share/backups) m\u00f6chten Sie vielleicht Snapshot-M\u00f6glichkeiten haben (ZFS, Btrfs usw.). Machen Sie t\u00e4glich einen Snapshot und bewahren Sie ihn f\u00fcr n Tage auf, um ein konsistentes Backup zu erhalten. F\u00fchren Sie kein rsync auf eine Samba-Freigabe durch, Sie m\u00fcssen die richtigen Berechtigungen behalten!

    Zum Wiederherstellen m\u00fcssen Sie rsync einfach in umgekehrter Richtung ausf\u00fchren und Docker neu starten, um die Volumes erneut zu lesen. F\u00fchren Sie folgende Befehle aus:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose pull\ndocker compose up -d\n
    docker-compose pull\ndocker-compose up -d\n

    Wenn Sie Gl\u00fcck haben, k\u00f6nnen Redis und MariaDB die inkonsistenten Datenbanken automatisch reparieren (wenn sie inkonsistent sind). Im Falle einer besch\u00e4digten Datenbank m\u00fcssen Sie das Hilfsskript verwenden, um die inkonsistenten Elemente wiederherzustellen. Wenn die Wiederherstellung fehlschl\u00e4gt, versuchen Sie, die Sicherungen zu extrahieren und die Dateien manuell zur\u00fcck zu kopieren. Behalten Sie die Dateiberechtigungen bei!

    "},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/","title":"Mail-Verzeichnis","text":""},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/#sicherung","title":"Sicherung","text":"

    Diese Zeile sichert das vmail-Verzeichnis in eine Datei backup_vmail.tar.gz im mailcow-Root-Verzeichnis:

    docker compose (Plugin)docker-compose (Standalone) 
    cd /pfad/zu/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n
    cd /pfad/zu/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n

    Sie k\u00f6nnen den Pfad \u00e4ndern, indem Sie ${PWD} (das dem aktuellen Verzeichnis entspricht) zu einem beliebigen Pfad \u00e4ndern, auf den Sie Schreibzugriff haben. Setzen Sie den Dateinamen backup_vmail.tar.gz auf einen beliebigen Namen, aber lassen Sie den Pfad so wie er ist. Beispiel: [...] tar cvfz /backup/mein_eigener_dateiname_.tar.gz

    "},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/#wiederherstellen","title":"Wiederherstellen","text":"docker compose (Plugin)docker-compose (Standalone) 
    cd /pfad/zu/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
    cd /pfad/zu/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
    "},{"location":"de/backup_restore/b_n_r-backup_restore-mysql/#sicherung","title":"Sicherung","text":"docker compose (Plugin)docker-compose (Standalone) 
    cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
    cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker-compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
    "},{"location":"de/backup_restore/b_n_r-backup_restore-mysql/#wiederherstellen","title":"Wiederherstellen","text":"

    Warnung

    docker compose (Plugin)docker-compose (Standalone)

    Sie sollten den SQL-Dump ohne docker compose umleiten, um Parsing-Fehler zu vermeiden.

    Sie sollten den SQL-Dump ohne docker-compose umleiten, um Parsing-Fehler zu vermeiden.

    cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\ndocker exec -i $(docker compose ps -q mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < backup_file.sql\n
    "},{"location":"de/backup_restore/b_n_r-coldstandby/","title":"Cold-standby-Backup","text":"

    mailcow bietet eine einfache M\u00f6glichkeit, eine konsistente Kopie von sich selbst zu erstellen, die per rsync an einen entfernten Ort ohne Ausfallzeit \u00fcbertragen werden kann.

    Dies kann auch verwendet werden, um Ihre mailcow auf einen neuen Server zu \u00fcbertragen.

    "},{"location":"de/backup_restore/b_n_r-coldstandby/#das-sollten-sie-wissen","title":"Das sollten Sie wissen","text":"

    Das bereitgestellte Skript funktioniert auf Standardinstallationen.

    Es kann versagen, wenn Sie nicht unterst\u00fctzte Volume Overrides verwenden. Wir unterst\u00fctzen das nicht und wir werden keine Hacks einbauen, die das unterst\u00fctzen. Bitte erstellen und pflegen Sie einen Fork, wenn Sie Ihre \u00c4nderungen beibehalten wollen.

    Das Skript wird die gleichen Pfade wie Ihre Standard-mailcow-Installation verwenden. Das ist das mailcow-Basisverzeichnis - f\u00fcr die meisten Nutzer /opt/mailcow-dockerized - sowie die Mountpoints.

    Um die Pfade Ihrer Quellvolumes zu finden, verwenden wir docker inspect und lesen das Zielverzeichnis jedes Volumes, das mit Ihrem mailcow compose Projekt verbunden ist. Das bedeutet, dass wir auch Volumes \u00fcbertragen, die Sie in einer Override-Datei hinzugef\u00fcgt haben. Lokale Bind-Mounts k\u00f6nnen funktionieren, m\u00fcssen aber nicht.

    Das Skript verwendet rsync mit dem --delete Flag. Das Ziel wird eine exakte Kopie der Quelle sein.

    mariabackup wird verwendet, um eine konsistente Kopie des SQL-Datenverzeichnisses zu erstellen.

    Nach dem Rsync der Daten f\u00fchren wir folgenden Befehl aus (anhand der gesetzten docker compose Version in der mailcow.conf) und entfernen alte Image-Tags aus dem Ziel:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose pull\n
    docker-compose pull\n

    Ihre Quelle wird zu keinem Zeitpunkt ver\u00e4ndert.

    Sie sollten sicherstellen, dass Sie die gleiche /etc/docker/daemon.json auf dem entfernten Ziel verwenden.

    Sie sollten keine Festplatten-Snapshots (z. B. \u00fcber ZFS, LVM usw.) auf dem Ziel ausf\u00fchren, w\u00e4hrend dieses Skript ausgef\u00fchrt wird.

    Die Versionierung ist nicht Teil dieses Skripts, wir verlassen uns auf das Ziel (Snapshots oder Backups). Sie k\u00f6nnen daf\u00fcr auch jedes andere Tool verwenden.

    "},{"location":"de/backup_restore/b_n_r-coldstandby/#vorbereiten","title":"Vorbereiten","text":"

    Sie ben\u00f6tigen ein SSH-f\u00e4higes Ziel und eine Schl\u00fcsseldatei, um sich mit diesem Ziel zu verbinden. Der Schl\u00fcssel sollte nicht durch ein Passwort gesch\u00fctzt sein, damit das Skript unbeaufsichtigt arbeiten kann.

    In Ihrem mailcow-Basisverzeichnis, z.B. /opt/mailcow-dockerized, finden Sie eine Datei create_cold_standby.sh.

    Bearbeiten Sie diese Datei und \u00e4ndern Sie die exportierten Variablen:

    export REMOTE_SSH_KEY=/pfad/zum/keyfile\nexport REMOTE_SSH_PORT=22\nexport REMOTE_SSH_HOST=mailcow-backup.host.name\n

    Der Schl\u00fcssel muss im Besitz von root sein und darf nur von diesem gelesen werden k\u00f6nnen.

    Sowohl die Quelle als auch das Ziel ben\u00f6tigen rsync >= v3.1.0. Das Ziel muss \u00fcber Docker und docker compose v2 verf\u00fcgen.

    Das Skript wird Fehler automatisch erkennen und sich beenden.

    Sie k\u00f6nnen die Verbindung testen, indem Sie ssh mailcow-backup.host.name -p22 -i /path/to/keyfile ausf\u00fchren.

    Wichtig f\u00fcr den Wechsel auf eine andere Architektur

    Wenn Sie planen mit dem Cold Standby Skript eine Migration von x86 auf ARM64 bzw. umgekehrt zu machen, lassen Sie das Skript einfach normal laufen. Das Skript wird automatisch erkennen, ob es unterschiede zwischen der Quelle und dem Ziel im Bezug auf die Architektur gibt und sich dementsprechend verhalten und betroffene Volumes im Sync auslassen.

    Dies hat den Hintergrund, dass Rspamd Regexp Eintr\u00e4ge von unseren Konfigurationen auf die entsprechende Plattform kompiliert und bei einem Plattform Wechsel diese Cache Dateien nicht gelesen werden k\u00f6nnen. Rspamd w\u00fcrde daraufhin abst\u00fcrzen und eine sinnvolle Nutzung mailcow's damit nicht erm\u00f6glichen. Deswegen wird das rspamd-vol-1 (Rspamd Volume) im Cold Standby ausgelassen.

    Keine Sorge! Rspamd wird trotzdem nach der Migration korrekt funktionieren, da diese Cache Dateien selbstst\u00e4ndig f\u00fcr die neue Plattform generiert werden.

    "},{"location":"de/backup_restore/b_n_r-coldstandby/#backup-und-aktualisierung-des-cold-standby","title":"Backup und Aktualisierung des Cold-Standby","text":"

    Starten Sie das erste Backup, dies kann je nach Verbindung eine Weile dauern:

    bash /opt/mailcow-dockerized/create_cold_standby.sh\n

    Das war einfach, nicht wahr?

    Das Aktualisieren des Cold-Standby ist genauso einfach:

    bash /opt/mailcow-dockerized/create_cold_standby.sh\n

    Es ist derselbe Befehl.

    "},{"location":"de/backup_restore/b_n_r-coldstandby/#automatisierte-backups-mit-cron","title":"Automatisierte Backups mit cron","text":"

    Stellen Sie zun\u00e4chst sicher, dass der cron Dienst aktiviert ist und l\u00e4uft:

    systemctl enable cron.service && systemctl start cron.service\n

    Um die Backups auf dem Cold-Standby-Server zu automatisieren, k\u00f6nnen Sie einen Cron-Job verwenden. Um die Cron-Jobs f\u00fcr den Root-Benutzer zu bearbeiten, f\u00fchren Sie aus:

    crontab -e\n

    F\u00fcgen Sie die folgenden Zeilen hinzu, um den Cold-Standby-Server t\u00e4glich um 03:00 Uhr zu synchronisieren. In diesem Beispiel werden Fehler der letzten Ausf\u00fchrung in einer Datei protokolliert.

    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n0 3 * * * bash /opt/mailcow-dockerized/create_cold_standby.sh 2> /var/log/mailcow-coldstandby-sync.log\n

    Wenn korrekt gespeichert, sollte der Cron-Job durch folgende Eingabe angezeigt werden:

    crontab -l\n
    "},{"location":"de/backup_restore/b_n_r-restore/","title":"Wiederherstellung","text":""},{"location":"de/backup_restore/b_n_r-restore/#wiederherstellung","title":"Wiederherstellung","text":""},{"location":"de/backup_restore/b_n_r-restore/#variablen-fur-backuprestore-skript","title":"Variablen f\u00fcr Backup/Restore Skript","text":""},{"location":"de/backup_restore/b_n_r-restore/#multithreading","title":"Multithreading","text":"

    Seit dem 2022-10 Update ist es m\u00f6glich das Skript mit Multithreading Support laufen zu lassen. Dies l\u00e4sst sich sowohl f\u00fcr Backups aber auch f\u00fcr Restores nutzen.

    Um das Backup/den Restore mit Multithreading zu starten muss THREADS als Umgebungsvariable vor dem Befehl zum starten hinzugef\u00fcgt werden.

    THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n
    Die Anzahl hinter dem = Zeichen gibt dabei dann die Thread Anzahl an. Nehmen Sie bitte immer ihre Kernanzahl -2 um mailcow selber noch genug CPU Leistung zu lassen.

    "},{"location":"de/backup_restore/b_n_r-restore/#backup-pfad","title":"Backup Pfad","text":"

    Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung fragen. Innerhalb dieses Speicherortes wird es Ordner im Format \"mailcow_DATE\" erstellen. Sie sollten diese Ordner nicht umbenennen, um den Wiederherstellungsprozess nicht zu st\u00f6ren.

    Um ein Backup unbeaufsichtigt durchzuf\u00fchren, definieren Sie MAILCOW_BACKUP_LOCATION als Umgebungsvariable, bevor Sie das Skript starten:

    MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

    Tipp

    Beide oben genannten Variablen k\u00f6nnen auch kombiniert werden! Bsp: 

    MAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

    "},{"location":"de/backup_restore/b_n_r-restore/#wiederherstellung-der-daten","title":"Wiederherstellung der Daten","text":"

    Achtung

    Bitte kopieren Sie dieses Skript nicht an einen anderen Ort.

    Wichtig

    Um ein Backup auf ein neues System wiederherzustellen muss mailcow initialisiert sein und gestartet sein! Installieren Sie also mailcow nach der Anleitung neu und warten Sie mit der Wiederherstellung so lange, bis mailcow in einem leeren Zustand l\u00e4uft.

    Achtung f\u00fcr \u00e4ltere Installationen

    Bitte schauen Sie VOR der Wiederherstellung Ihres mailcow Systemes auf einen neuen Server und einem sauberen mailcow-dockerized Ordner, ob in Ihrer mailcow.conf der Wert MAILDIR_SUB gesetzt ist. Falls dieser nicht gesetzt ist, so setzen Sie diesen auch bitte in Ihrer neuen mailcow nicht, bzw. entfernen diesen, da sonst KEINE E-Mails angezeigt werden. Dovecot l\u00e4dt E-Mails aus dem besagtem Unterordner des Maildir Volumes unter $DOCKER_VOLUME_PFAD/mailcowdockerized_vmail-vol-1 und bei \u00c4nderung im Vergleich zum Ursprungszustand sind dort keine Mails vorhanden.

    Um eine Wiederherstellung durchzuf\u00fchren, starten Sie mailcow, verwenden Sie das Skript mit \"restore\" als ersten Parameter.

    # Syntax:\n# ./helper-scripts/backup_and_restore.sh restore\n

    Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung der mailcow_DATE-Ordner fragen:

    Backup location (absolute path, starting with /): /opt/backup\n

    Anschlie\u00dfend werden alle verf\u00fcgbaren Backups in dem angegebenen Ordner (in unserem Beispiel /opt/backup) angezeigt:

    Found project name mailcowdockerized\n[ 1 ] - /opt/backup/mailcow-2023-12-11-13-27-14/\n[ 2 ] - /opt/backup/mailcow-2023-12-11-14-02-06/\n

    Nun k\u00f6nnen Sie die Nummer Ihres Backups angeben, welches Sie Wiederherstellen wollen, in diesem Beispiel die 2:

    Select a restore point: 2\n

    Das Skript wird nun alle gesicherten Komponenten Anzeigen, die Sie wiederherstellen k\u00f6nnen, in unserem Fall haben wir beim Backup Prozess all also Alles gew\u00e4hlt, dementsprechend taucht das hier nun auf:

    [ 0 ] - all\n[ 1 ] - Crypt data\n[ 2 ] - Rspamd data\n[ 3 ] - Mail directory (/var/vmail)\n[ 4 ] - Redis DB\n[ 5 ] - Postfix data\n[ 6 ] - SQL DB\n

    Auch hier w\u00e4hlen wir nun wieder die Komponente aus, die wir wiederherstellen wollen. Option 0 stellt ALLES wieder her.

    Wenn Sie auf eine andere Architektur wiederherstellen wollen...

    Sollten Sie das Backup auf einer anderen Architektur bspw. x86 gemacht haben und wollen dieses Backup nun auf ARM64 wiederherstellen, so wird das Backup von Rspamd als inkompatibel angezeigt und ist nicht einzeln anw\u00e4hlbar. Bei der Wiederherstellung mit Aufruf der Taste 0 wird die Wiederherstellung von Rspamd ebenfalls \u00fcbersprungen.

    Beispiel f\u00fcr inkompatibles Rspamd Backup im Auswahl Men\u00fc:

    [...]\n[ NaN ] - Rspamd data (incompatible Arch, cannot restore it)\n[...]\n

    Nun wird mailcow die von Ihnen ausgew\u00e4hlten Sicherungen wiederherstellen. Bitte beachten Sie, dass je nach Gr\u00f6\u00dfe der Sicherungen die Wiederherstellung eine gewisse Zeit in Anspruch nehmen kann.

    "},{"location":"de/client/client-android/","title":"Android","text":"
    1. \u00d6ffnen Sie die App Email.
    2. Wenn dies Ihr erstes E-Mail-Konto ist, tippen Sie auf Konto hinzuf\u00fcgen; wenn nicht, tippen Sie auf Mehr und Einstellungen und dann Konto hinzuf\u00fcgen.
    3. W\u00e4hlen Sie Microsoft Exchange ActiveSync.
    4. Geben Sie Ihre E-Mail Adresse () und Ihr Passwort ein.
    5. Tippen Sie auf Anmelden.
    "},{"location":"de/client/client-apple/#methode-1-konfigurationsprofil","title":"Methode 1: Konfigurationsprofil","text":"

    E-Mail, Kontakte und Kalender k\u00f6nnen auf Apple-Ger\u00e4ten automatisch konfiguriert werden, indem ein Konfigurationsprofil installiert wird. Um ein solches Profil herunterzuladen, m\u00fcssen Sie sich mit dem gew\u00fcnschten E-Mail-Konto in der mailcow UI anmelden.

    "},{"location":"de/client/client-apple/#methode-11-imap-und-smtp","title":"Methode 1.1: IMAP und SMTP","text":"

    Diese Methode konfiguriert IMAP und SMTP f\u00fcr den Zugriff auf ein E-Mail-Konto.

    1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_emailmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
    2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
      • Anleitung f\u00fcr macOS
      • Anleitung f\u00fcr iOS
    3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen. Wenn Sie dazu aufgefordert werden, geben Sie das Passwort Ihres E-Mail-Kontos ein.
    "},{"location":"de/client/client-apple/#methode-12-imap-smtp-und-calcarddav","title":"Methode 1.2: IMAP, SMTP und Cal/CardDAV","text":"

    Diese Methode konfiguriert neben dem E-Mail-Konto zus\u00e4tzlich CardDAV (Adressbuch) und CalDAV (Kalender).

    1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.phpmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
    2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
      • Anleitung f\u00fcr macOS
      • Anleitung f\u00fcr iOS
    3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen. Wenn Sie dazu aufgefordert werden, geben Sie das Passwort Ihres E-Mail-Kontos ein.
    "},{"location":"de/client/client-apple/#methode-13-imap-und-smtp-mit-app-passwort","title":"Methode 1.3: IMAP und SMTP mit App-Passwort","text":"

    Diese Methode konfiguriert IMAP und SMTP f\u00fcr den Zugriff auf ein E-Mail-Konto. Es wird ein neues App-Passwort erzeugt und in das Profil eingef\u00fcgt, damit bei der Einrichtung kein Passwort eingegeben werden muss. Geben Sie das Profil nicht weiter, da es einen vollst\u00e4ndigen Zugriff auf Ihr Postfach erm\u00f6glicht.

    1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_passwordmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
    2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
      • Anleitung f\u00fcr macOS
      • Anleitung f\u00fcr iOS
    3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen.
    "},{"location":"de/client/client-apple/#methode-14-imap-smtp-und-calcarddav-mit-app-passwort","title":"Methode 1.4: IMAP, SMTP und Cal/CardDAV mit App-Passwort","text":"

    Diese Methode konfiguriert neben dem E-Mail-Konto zus\u00e4tzlich CardDAV (Adressbuch) und CalDAV (Kalender). Es wird ein neues App-Passwort erzeugt und in das Profil eingef\u00fcgt, damit bei der Einrichtung kein Passwort eingegeben werden muss. Geben Sie das Profil nicht weiter, da es einen vollst\u00e4ndigen Zugriff auf Ihr Postfach erm\u00f6glicht.

    1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?app_passwordmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
    2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
      • Anleitung f\u00fcr macOS
      • Anleitung f\u00fcr iOS
    3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen.
    "},{"location":"de/client/client-apple/#methode-2-exchange-activesync-emulation","title":"Methode 2: Exchange ActiveSync-Emulation","text":"

    Unter iOS/iPadOS wird auch Exchange ActiveSync als Alternative zum obigen Verfahren unterst\u00fctzt. Es hat den Vorteil, dass es Push-E-Mail unterst\u00fctzt (d. h. Sie werden sofort \u00fcber eingehende Nachrichten benachrichtigt), hat aber einige Einschr\u00e4nkungen, z. B. unterst\u00fctzt es nicht mehr als drei E-Mail-Adressen pro Kontakt in Ihrem Adressbuch. Befolgen Sie die folgenden Schritte, wenn Sie stattdessen Exchange verwenden m\u00f6chten.

    1. Folgen Sie der Anleitung von Apple f\u00fcr Ihre Version von iOS/iPadOS und w\u00e4hlen Sie Microsoft Exchange als E-Mail-Dienst.
    2. Geben Sie Ihre E-Mail Adresse () ein und tippen Sie auf Weiter.
    3. W\u00e4hlen Sie Manuell konfigurieren bei der Frage, ob die E-Mail-Adresse an Microsoft gesendet werden soll.
    4. Geben Sie Ihr Passwort ein und tippen Sie erneut auf Weiter. Wenn die 2-Faktor-Authentifizierung aktiviert ist, m\u00fcssen Sie ein App-Password anstelle Ihres normalen Passwortes benutzen.
    5. Tippen Sie abschlie\u00dfend auf Speichern.
    "},{"location":"de/client/client-emclient/","title":"eM Client","text":"
    1. Starten Sie eM Client.
    2. Wenn Sie eM Client zum ersten Mal starten, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
    3. Gehen Sie oben auf Men\u00fc, w\u00e4hlen Sie Tools und Konten.
    4. Geben Sie Ihre E-Mail Adresse ein () und klicken Sie auf Jetzt starten.
    5. Geben Sie Ihr Passwort ein und klicken Sie auf Weiter.
    6. Geben Sie Ihren Namen ein () und klicken Sie auf Weiter.
    7. Klicken Sie auf Fertigstellen.
    "},{"location":"de/client/client-kontact/","title":"KDE Kontact","text":"
    1. Starten Sie Kontact.
    2. Wenn Sie Kontact oder KMail zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
    3. Gehen Sie zu Mail in der Seitenleiste. Gehen Sie zum Men\u00fc Tools und w\u00e4hlen Sie Account Wizard.
    4. Geben Sie Ihren Namen (), E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
    5. Klicken Sie auf Konto erstellen. Wenn Sie dazu aufgefordert werden, geben Sie Ihr Passwort erneut ein und klicken Sie auf OK.
    6. Schlie\u00dfen Sie das Fenster, indem Sie auf Beenden klicken.
    7. Gehen Sie zu Kalender in der Seitenleiste.
    8. Gehen Sie zum Men\u00fc Einstellungen und w\u00e4hlen Sie Konfigurieren Sie KOrganizer.
    9. Gehen Sie zur Registerkarte Kalender und klicken Sie auf die Schaltfl\u00e4che Hinzuf\u00fcgen.
    10. W\u00e4hlen Sie DAV-Groupware-Ressource und klicken Sie auf OK.
    11. Geben Sie Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
    12. W\u00e4hlen Sie ScalableOGo aus dem Dropdown-Men\u00fc und klicken Sie auf Weiter.
    13. Geben Sie den mailcow Hostname in das Feld Host ein und klicken Sie auf Weiter.
    14. Klicken Sie auf Verbindung testen und dann auf Fertigstellen. Klicken Sie abschlie\u00dfend zweimal auf OK.

    Sobald Sie Kontact eingerichtet haben, k\u00f6nnen Sie KMail, KOrganizer und KAddressBook auch einzeln verwenden.

    "},{"location":"de/client/client-manual/","title":"Manuelle Konfiguration","text":"

    Diese Anweisungen gelten nur f\u00fcr unver\u00e4nderte Portbindungen!

    "},{"location":"de/client/client-manual/#e-mail","title":"E-Mail","text":"Dienst Verschl\u00fcsselung Host Port IMAP STARTTLS mailcow hostname 143 IMAPS SSL mailcow hostname 993 POP3 STARTTLS mailcow hostname 110 POP3S SSL mailcow hostname 995 SMTP STARTTLS mailcow hostname 587 SMTPS SSL mailcow hostname 465

    Bitte verwenden Sie \"plain\" als Authentifizierungsmechanismus. Entgegen der Annahme werden keine Passw\u00f6rter im Klartext \u00fcbertragen, da ohne TLS keine Authentifizierung stattfinden darf.

    "},{"location":"de/client/client-manual/#kontakte-und-kalender","title":"Kontakte und Kalender","text":"

    SOGos Standard-URLs f\u00fcr Kalender (CalDAV) und Kontakte (CardDAV):

    1. CalDAV https://mail.example.com/SOGo/dav/user@example.com/Calendar/personal/https:///SOGo/dav//Calendar/personal/

    2. CardDAV https://mail.example.com/SOGo/dav/user@example.com/Contacts/personal/https:///SOGo/dav//Contacts/personal/

    Einige Anwendungen verlangen m\u00f6glicherweise die Verwendung von https://mail.example.com/SOGo/dav/https:///SOGo/dav/ oder den vollst\u00e4ndigen Pfad zu Ihrem Kalender, der in SOGo gefunden und kopiert werden kann.

    "},{"location":"de/client/client-outlook/","title":"Microsoft Outlook","text":"
    1. Downloaden und installieren Sie Outlook CalDav Synchronizer.
    2. Starten Sie Outlook.
    3. Wenn Sie Outlook zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 5 fort.
    4. Gehen Sie zum Men\u00fc Datei und klicken Sie auf Konto hinzuf\u00fcgen.
    5. Geben Sie Ihren Namen (), Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
    6. Klicken Sie auf Finish.
    7. Gehen Sie zur Multifunktionsleiste CalDav Synchronizer und klicken Sie auf Synchronisationsprofile.
    8. Klicken Sie auf die zweite Schaltfl\u00e4che oben (Mehrere Profile hinzuf\u00fcgen), w\u00e4hlen Sie Sogo und klicken Sie auf Ok.
    9. Klicken Sie auf die Schaltfl\u00e4che IMAP/POP3-Kontoeinstellungen abrufen.
    10. Klicken Sie auf Ressourcen erkennen und Outlook-Ordnern zuweisen.
    11. W\u00e4hlen Sie im Fenster Ressource ausw\u00e4hlen Ihren Hauptkalender (in der Regel Pers\u00f6nlicher Kalender), klicken Sie auf die Schaltfl\u00e4che ..., weisen Sie ihn dem Ordner Kalender zu, und klicken Sie auf OK. Gehen Sie zu den Registerkarten Adressb\u00fccher und Aufgaben und wiederholen Sie den Vorgang entsprechend. Weisen Sie nicht mehreren Kalendern, Adressb\u00fcchern oder Aufgabenlisten zu!
    12. Schlie\u00dfen Sie alle Fenster mit den Tasten OK.
    "},{"location":"de/client/client-outlook/#outlook-2016-oder-hoher-von-office-365-unter-windows","title":"Outlook 2016 oder h\u00f6her von Office 365 unter Windows","text":"

    Dies gilt nur, wenn Ihr Serveradministrator EAS f\u00fcr Outlook nicht deaktiviert hat. Wenn es deaktiviert ist, folgen Sie bitte stattdessen der Anleitung f\u00fcr Outlook 2007.

    Outlook 2016 hat ein Problem mit der automatischen Erkennung. Nur Outlook von Office 365 ist betroffen. Wenn Sie Outlook aus einer anderen Quelle installiert haben, folgen Sie bitte der Anleitung f\u00fcr Outlook 2013 oder h\u00f6her.

    F\u00fcr EAS m\u00fcssen Sie den alten Assistenten verwenden, indem Sie C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OLCFG.EXE starten. Wenn diese Anwendung ge\u00f6ffnet wird, k\u00f6nnen Sie mit Schritt 4 der Anleitung f\u00fcr Outlook 2013 unten fortfahren.

    Wenn die Anwendung nicht ge\u00f6ffnet wird, k\u00f6nnen Sie den Assistenten zum Erstellen eines neuen Kontos vollst\u00e4ndig deaktivieren und die nachstehende Anleitung f\u00fcr Outlook 2013 befolgen.

    "},{"location":"de/client/client-outlook/#outlook-2007-oder-hoher-auf-windows-kalenderkontakte-via-caldav-synchronizer","title":"Outlook 2007 oder h\u00f6her auf Windows (Kalender/Kontakte via CalDav Synchronizer)","text":""},{"location":"de/client/client-outlook/#outlook-2013-oder-hoher-unter-windows-active-sync-nicht-empfohlen","title":"Outlook 2013 oder h\u00f6her unter Windows (Active Sync - nicht empfohlen)","text":"

    Dies gilt nur, wenn Ihr Serveradministrator EAS f\u00fcr Outlook nicht deaktiviert hat. Wenn es deaktiviert ist, folgen Sie bitte stattdessen der Anleitung f\u00fcr Outlook 2007.

    1. Starten Sie Outlook.
    2. Wenn Sie Outlook zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
    3. \u00d6ffnen Sie das Men\u00fc Datei und klicken Sie auf Konto hinzuf\u00fcgen.
    4. Geben Sie Ihren Namen (), Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
    5. Wenn Sie dazu aufgefordert werden, geben Sie Ihr Passwort erneut ein, markieren Sie Meine Anmeldedaten speichern und klicken Sie auf OK.
    6. Klicken Sie auf die Schaltfl\u00e4che Zulassen.
    7. Klicken Sie auf Fertigstellen.
    "},{"location":"de/client/client-outlook/#outlook-2011-oder-hoher-unter-macos","title":"Outlook 2011 oder h\u00f6her unter macOS","text":"

    Die Mac-Version von Outlook synchronisiert keine Kalender und Kontakte und wird daher nicht unterst\u00fctzt.

    "},{"location":"de/client/client-thunderbird/","title":"Mozilla Thunderbird","text":"
    1. \u00d6ffnen Sie Thunderbird.
    2. Wenn Sie Thunderbird zum ersten Mal \u00f6ffnen, werden Sie gefragt, ob Sie eine neue E-Mail-Adresse einrichten m\u00f6chten. Klicken Sie auf \u00dcberspringen und eine bereits vorhandene E-Mail-Adresse verwenden und gehen Sie zum Schritt 4.
    3. Klicken Sie auf das Men\u00fc Datei und w\u00e4hlen Sie Neu, Bestehendes Mail-Konto....
    4. Geben Sie Ihren Namen (), Ihre E-Mail-Adresse () und Ihr Passwort ein. Stellen Sie sicher, dass die Option Passwort merken aktiviert ist und klicken Sie auf Weiter.
    5. Sobald die Konfiguration automatisch erkannt wurde, stellen Sie sicher, dass IMAP ausgew\u00e4hlt ist und klicken Sie auf Fertig.
    6. Um Ihre Kontakte vom Server zu verwenden, klicken Sie auf den Pfeil neben \"Adressb\u00fccher\" und auf die Schaltfl\u00e4che Verbinden f\u00fcr jedes Adressbuch, das Sie verwenden m\u00f6chten.
    7. Um Ihre Kalender vom Server zu verwenden, klicken Sie auf den Pfeil neben \"Kalender\" und dann auf die Schaltfl\u00e4che Verbinden f\u00fcr jeden Kalender, den Sie verwenden m\u00f6chten.
    8. (Optional) Wenn Sie alle Unterordner synchronisieren m\u00f6chten, gehen Sie zum Men\u00fc Kontoeinstellungen und w\u00e4hlen Sie Server-Einstellungen. Klicken Sie im Tab Server-Einstellungen auf die Schaltfl\u00e4che Erweitert. In dem Fenster Erweiterte Kontoeinstellungen deaktivieren Sie das Kontrollk\u00e4stchen \"Nur abonnierte Ordner anzeigen\". Klicken Sie auf OK, um die \u00c4nderungen zu speichern.
    9. Klicken Sie auf Beenden, um das Fenster \"Konto-Einrichtung\" zu schlie\u00dfen.
    "},{"location":"de/client/client-windows/","title":"Windows Mail","text":"

    Windows 8 und h\u00f6her unterst\u00fctzen E-Mail, Kontakte und Kalender \u00fcber Exchange ActiveSync.

    1. \u00d6ffnen Sie die App Mail.
    2. Wenn Sie Mail noch nicht verwendet haben, k\u00f6nnen Sie im Hauptfenster auf Konto hinzuf\u00fcgen klicken. Fahren Sie mit Schritt 4 fort.
    3. Klicken Sie auf Konten in der Seitenleiste links und dann auf Konto hinzuf\u00fcgen ganz rechts.
    4. W\u00e4hlen Sie Exchange.
    5. Geben Sie Ihre E-Mail Adresse () ein und klicken Sie auf Weiter..
    6. Geben Sie Ihr Passwort ein und klicken Sie auf Anmelden.

    Sobald Sie die Mail-App eingerichtet haben, k\u00f6nnen Sie auch die Apps \"Kontakte\" und \"Kalender\" verwenden.

    "},{"location":"de/client/client/","title":"\u00dcbersicht","text":"

    mailcow unterst\u00fctzt eine Vielzahl von E-Mail-Clients, sowohl auf Desktop-Computern als auch auf Smartphones. Im Folgenden finden Sie eine Reihe von Konfigurationsanleitungen, die erkl\u00e4ren, wie Sie Ihr mailcow-Konto konfigurieren k\u00f6nnen.

    Tipp

    Wenn Sie auf diese Seite zugreifen, indem Sie sich bei Ihrem mailcow-Server anmelden und auf den Link \"Konfigurationsanleitungen f\u00fcr E-Mail-Clients und Smartphones anzeigen\" klicken, werden alle Anleitungen mit Ihrer E-Mail-Adresse und Ihrem Servernamen personalisiert.

    Erfolgreich

    Da Sie diese Seite aufgerufen haben, nachdem Sie sich in Ihren mailcow-Server eingeloggt haben, wurden alle Anleitungen mit Ihrer E-Mail-Adresse und Ihrem Servernamen personalisiert.
    • Android
    • Apple iOS / macOS
    • eM Client
    • KDE Kontact / KMail
    • Microsoft Outlook
    • Mozilla Thunderbird
    • Windows Mail
    • Manual configuration
    "},{"location":"de/getstarted/install/","title":"mailcow Installieren","text":"

    \u00dcberall gleich

    Die Installation ist auf x86 und ARM64 exakt identisch!

    "},{"location":"de/getstarted/install/#docker-und-docker-compose-installation","title":"Docker und Docker Compose Installation","text":"

    Sie ben\u00f6tigen Docker (eine Version >= 24.0.0 ist erforderlich) und Docker Compose (eine Version >= 2.0 ist erforderlich).

    Erfahren Sie, wie Sie Docker und Docker Compose installieren.

    Schnelle Installation f\u00fcr die meisten Betriebssysteme:

    "},{"location":"de/getstarted/install/#docker","title":"Docker","text":"

    curl -sSL https://get.docker.com/ | CHANNEL=stable sh\n# Nachdem der Installationsprozess abgeschlossen ist, m\u00fcssen Sie eventuell den Dienst aktivieren und sicherstellen, dass er gestartet ist (z. B. CentOS 7)\nsystemctl enable --now docker\n
    Bitte verwenden Sie die neueste verf\u00fcgbare Docker-Engine und nicht die Engine, die mit Ihrem Distros-Repository ausgeliefert wird.

    "},{"location":"de/getstarted/install/#docker-compose","title":"docker compose","text":"

    Achtung

    mailcow ben\u00f6tigt eine Version von Docker Compose >= v2. Sollte die Installation von Docker \u00fcber das obenstehende Skript erfolgt sein wird das Docker Compose Plugin bereits automatisch in einer Version >=2.0 installiert. Ist die mailcow Installation \u00e4lter oder Docker wurde auf einem anderen Weg installiert, muss das Compose Plugin bzw. die Standalone Version von Docker manuell installiert werden.

    "},{"location":"de/getstarted/install/#installation-via-paketmanager-plugin","title":"Installation via Paketmanager (Plugin)","text":"

    Hinweis

    Diese Vorgehensweise mit den Paketquellen ist nur dann m\u00f6glich, wenn das Docker Repository eingebunden wurde. Dies kann entweder durch die Anleitung oben (siehe Docker) oder durch eine manuelle Einbindung passieren.

    Auf Debian/Ubuntu Systemen: 

    apt update\napt install docker-compose-plugin\n

    Auf Centos 7 Systemen: 

    yum update\nyum install docker-compose-plugin\n

    Achtung

    Die Syntax der Docker Compose Befehle lautet docker compose bei der Plugin Variante von Docker Compose!!

    "},{"location":"de/getstarted/install/#installation-via-script-standalone","title":"Installation via Script (Standalone)","text":"

    Hinweis

    Diese Installation ist die alt bekannte Weise. Sie installiert Docker Compose als Standalone Programm und ist nicht auf die Art und weise der Docker Installation angewiesen.

    LATEST=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/docker/compose/releases/latest) && LATEST=${LATEST##*/} && curl -L https://github.com/docker/compose/releases/download/$LATEST/docker-compose-$(uname -s)-$(uname -m) > /usr/local/bin/docker-compose\nchmod +x /usr/local/bin/docker-compose\n

    Achtung

    Die Syntax der Docker Compose Befehle lautet docker-compose bei der Standalone Variante von Docker Compose!!

    "},{"location":"de/getstarted/install/#selinux-besonderheiten-prufen","title":"SELinux Besonderheiten pr\u00fcfen","text":"

    Auf SELinux-aktivierten Systemen, z.B. CentOS 7:

    • Pr\u00fcfen Sie, ob das Paket \"container-selinux\" auf Ihrem System vorhanden ist:
    rpm -qa | grep container-selinux\n

    Wenn der obige Befehl eine leere oder keine Ausgabe liefert, sollten Sie es \u00fcber Ihren Paketmanager installieren.

    • Pr\u00fcfen Sie, ob Docker SELinux-Unterst\u00fctzung aktiviert hat:
    docker info | grep selinux\n

    Wenn der obige Befehl eine leere oder keine Ausgabe liefert, erstellen oder bearbeiten Sie /etc/docker/daemon.json und f\u00fcgen Sie \"selinux-enabled\": true hinzu. Beispielhafter Inhalt der Datei:

    {\n  \"selinux-enabled\": true\n}\n

    Starten Sie den Docker-Daemon neu und \u00fcberpr\u00fcfen Sie, ob SELinux nun aktiviert ist.

    Dieser Schritt ist erforderlich, um sicherzustellen, dass die mailcows-Volumes richtig gekennzeichnet sind, wie in der Compose-Datei angegeben. Wenn Sie daran interessiert sind, wie das funktioniert, k\u00f6nnen Sie sich die Readme-Datei von https://github.com/containers/container-selinux ansehen, die auf viele n\u00fctzliche Informationen zu diesem Thema verweist.

    "},{"location":"de/getstarted/install/#mailcow-installieren","title":"mailcow Installieren","text":"

    Klonen Sie den Master-Zweig des Repositorys und stellen Sie sicher, dass Ihre umask gleich 0022 ist. Bitte klonen Sie das Repository als root-Benutzer und kontrollieren Sie auch den Stack als root. Wir werden die Attribute - wenn n\u00f6tig - \u00e4ndern, w\u00e4hrend wir die Container automatisch bereitstellen und sicherstellen, dass alles gesichert ist. Das update.sh-Skript muss daher ebenfalls als root ausgef\u00fchrt werden. Es kann notwendig sein, den Besitzer und andere Attribute von Dateien zu \u00e4ndern, auf die Sie sonst keinen Zugriff haben. Wir geben die Berechtigungen f\u00fcr jede exponierte Anwendung auf und f\u00fchren einen exponierten Dienst nicht als root aus! Wenn Sie den Docker-Daemon als Nicht-Root-Benutzer steuern, erhalten Sie keine zus\u00e4tzliche Sicherheit. Der unprivilegierte Benutzer wird die Container ebenfalls als root spawnen. Das Verhalten des Stacks ist identisch.

    $ su\n# umask\n0022 # <- \u00dcberpr\u00fcfen, dass es 0022 ist\n# cd /opt\n# git clone https://github.com/mailcow/mailcow-dockerized\n# cd mailcow-dockerized\n
    "},{"location":"de/getstarted/install/#mailcow-initialisieren","title":"mailcow Initialisieren","text":"

    Erzeugen Sie eine Konfigurationsdatei. Verwenden Sie einen FQDN (host.domain.tld) als Hostname, wenn Sie gefragt werden. 

    ./generate_config.sh\n

    \u00c4ndern Sie die Konfiguration, wenn Sie wollen oder m\u00fcssen. 

    nano mailcow.conf\n
    Wenn Sie planen, einen Reverse Proxy zu verwenden, k\u00f6nnen Sie zum Beispiel HTTPS an 127.0.0.1 auf Port 8443 und HTTP an 127.0.0.1 auf Port 8080 binden.

    M\u00f6glicherweise m\u00fcssen Sie einen vorinstallierten MTA stoppen, der Port 25/tcp blockiert. Siehe dieses Kapitel, um zu erfahren, wie man Postfix rekonfiguriert, um nach einer erfolgreichen Installation neben mailcow laufen zu lassen.

    Einige Updates modifizieren mailcow.conf und f\u00fcgen neue Parameter hinzu. Es ist schwer, in der Dokumentation den \u00dcberblick zu behalten. Bitte \u00fcberpr\u00fcfen Sie deren Beschreibung und fragen Sie, wenn Sie unsicher sind, in den bekannten Kan\u00e4len nach Rat.

    "},{"location":"de/getstarted/install/#problembehandlungen","title":"Problembehandlungen","text":""},{"location":"de/getstarted/install/#benutzer-mit-einer-mtu-ungleich-1500-zb-openstack","title":"Benutzer mit einer MTU ungleich 1500 (z.B. OpenStack)","text":"

    Wenn Sie auf Probleme und seltsame Ph\u00e4nomene sto\u00dfen, \u00fcberpr\u00fcfen Sie bitte Ihre MTU.

    Bearbeiten Sie docker-compose.yml und \u00e4ndern Sie die Netzwerkeinstellungen entsprechend Ihrer MTU. F\u00fcgen Sie den neuen Parameter driver_opts wie folgt hinzu: 

    networks:\n  mailcow-network:\n    ...\n    driver_opts:\n      com.docker.network.driver.mtu: 1450\n    ...\n

    "},{"location":"de/getstarted/install/#benutzer-ohne-ein-ipv6-aktiviertes-netzwerk-auf-ihrem-hostsystem","title":"Benutzer ohne ein IPv6-aktiviertes Netzwerk auf ihrem Hostsystem","text":"

    Schalten Sie IPv6 bitte nicht ab, auch wenn es Ihnen nicht gef\u00e4llt. IPv6 ist die Zukunft und sollte nicht ignoriert werden.

    Sollten Sie jedoch kein IPv6-f\u00e4higes Netzwerk auf Ihrem Host haben und Sie sich nicht um ein besseres Internet k\u00fcmmern wollen (hehe), ist es empfehlenswert, IPv6 f\u00fcr das mailcow-Netzwerk zu deaktivieren, um unvorhergesehene Probleme zu vermeiden.

    "},{"location":"de/getstarted/install/#mailcow-starten","title":"mailcow starten","text":"

    Laden Sie die Images herunter und f\u00fchren Sie die Compose-Datei aus. Der Parameter -d wird ihre mailcow dann im Hintergrund starten:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose pull\ndocker compose up -d\n
    docker-compose pull\ndocker-compose up -d\n

    Geschafft!

    Sie k\u00f6nnen nun auf https://${MAILCOW_HOSTNAME} mit den Standard-Zugangsdaten admin + Passwort moohoo zugreifen.

    Info

    Wenn Sie mailcow nicht hinter einem Reverse Proxy verwenden, sollten Sie alle HTTP-Anfragen auf HTTPS umleiten.

    Die Datenbank wird sofort initialisiert, nachdem eine Verbindung zu MySQL hergestellt werden kann.

    Ihre Daten bleiben in mehreren Docker-Volumes erhalten, die nicht gel\u00f6scht werden, wenn Sie Container neu erstellen oder l\u00f6schen. F\u00fchren Sie docker volume ls aus, um eine Liste aller Volumes zu sehen. Sie k\u00f6nnen docker compose down sicher ausf\u00fchren, ohne persistente Daten zu entfernen.

    "},{"location":"de/getstarted/prerequisite-dns/","title":"DNS Einstellungen","text":"

    Nachstehend finden Sie eine Liste von empfohlenen DNS-Eintr\u00e4gen. Einige sind f\u00fcr einen Mailserver obligatorisch (A, MX), andere werden empfohlen, um eine gute Reputation aufzubauen (TXT/SPF) oder f\u00fcr die automatische Konfiguration von Mailclients verwendet (SRV).

    "},{"location":"de/getstarted/prerequisite-dns/#referenzen","title":"Referenzen","text":"
    • Ein guter Artikel, der alle relevanten Themen abdeckt: \"3 DNS Records Every Email Marketer Must Know\"
    • Ein weiterer guter Artikel, aber mit Zimbra als Beispielplattform: \"Best Practices on Email Protection: SPF, DKIM and DMARC\"
    • Eine ausf\u00fchrliche Diskussion \u00fcber SPF, DKIM und DMARC: \"Wie Sie Spam beseitigen und Ihren Namen mit DMARC sch\u00fctzen\"
    • Ein ausf\u00fchrlicher Leitfaden zum Verst\u00e4ndnis von DMARC: \"Entmystifizierung von DMARC: Ein Leitfaden zur Verhinderung von E-Mail-Spoofing\"
    "},{"location":"de/getstarted/prerequisite-dns/#reverse-dns-ihrer-ip-adresse","title":"Reverse DNS Ihrer IP-Adresse","text":"

    Stellen Sie sicher, dass der PTR-Eintrag Ihrer IP-Adresse mit dem FQDN Ihres mailcow-Hosts \u00fcbereinstimmt: ${MAILCOW_HOSTNAME} 1. Dieser Eintrag wird normalerweise bei dem Provider gesetzt, von dem Sie die IP-Adresse (Server) gemietet haben. Bitte beachten Sie, dies sowohl f\u00fcr Ihre IPv4 als auch Ihre IPv6 Adressen (falls verwendet) sicherzustellen!

    "},{"location":"de/getstarted/prerequisite-dns/#die-minimale-dns-konfiguration","title":"Die minimale DNS-Konfiguration","text":"

    Dieses Beispiel zeigt Ihnen eine Reihe von Eintr\u00e4gen f\u00fcr eine von mailcow verwaltete Domain. Jede Domain, die zu mailcow hinzugef\u00fcgt wird, ben\u00f6tigt mindestens diesen Satz an Eintr\u00e4gen, um korrekt zu funktionieren.

    # Name Typ Wert\nmail IN A 1.2.3.4\nautodiscover IN CNAME mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\nautoconfig IN CNAME mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n@ IN MX 10 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n

    Hinweis: Der mail DNS-Eintrag, der die Subdomain an die angegebene IP-Adresse bindet, muss nur f\u00fcr die Domain gesetzt werden, auf der mailcow l\u00e4uft und die f\u00fcr den Zugriff auf das Webinterface verwendet wird. F\u00fcr jede andere von mailcow verwaltete Domain leitet der MX-Eintrag den Datenverkehr entsprechend weiter.

    "},{"location":"de/getstarted/prerequisite-dns/#dkim-spf-und-dmarc","title":"DKIM, SPF und DMARC","text":"

    Im folgenden Beispiel f\u00fcr eine DNS-Zonendatei wird ein einfacher SPF TXT-Eintrag verwendet, um nur DIESEM Server (dem MX) zu erlauben, E-Mails f\u00fcr Ihre Dom\u00e4ne zu senden. Jeder andere Server ist nicht zugelassen, kann es aber tun (\"~all\"). Weitere Informationen finden Sie im SPF-Projekt.

    # Name Typ Wert\n@ IN TXT \"v=spf1 mx a -all\"\n

    Es wird dringend empfohlen, einen DKIM TXT-Eintrag in Ihrer mailcow UI zu erstellen und den entsprechenden TXT-Eintrag in Ihren DNS-Eintr\u00e4gen zu setzen. Bitte lesen Sie OpenDKIM f\u00fcr weitere Informationen.

    # Name Typ Wert\ndkim._domainkey IN TXT \"v=DKIM1; k=rsa; t=s; s=email; p=...\"\n

    Der letzte Schritt, um sich selbst und andere zu sch\u00fctzen, ist die Implementierung eines DMARC TXT-Datensatzes, zum Beispiel mit Hilfe des DMARC-Assistenten (check).

    # Name Typ Wert\n_dmarc IN TXT \"v=DMARC1; p=reject; rua=mailto:mailauth-reports@example.org\"\n
    "},{"location":"de/getstarted/prerequisite-dns/#die-erweiterte-dns-konfiguration","title":"Die erweiterte DNS-Konfiguration","text":"

    SRV-Eintr\u00e4ge geben den/die Server f\u00fcr ein bestimmtes Protokoll in Ihrer Dom\u00e4ne an. Wenn Sie einen Dienst explizit als nicht bereitgestellt ank\u00fcndigen wollen, geben Sie \".\" als Zieladresse an (statt \"mail.example.org.\"). Bitte beachten Sie RFC 2782.

    # Name Typ Priorit\u00e4t Gewicht Port Wert\n_autodiscover._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_caldavs._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_caldavs._tcp IN TXT \"path=/SOGo/dav/\"\n_carddavs._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_carddavs._tcp IN TXT \"path=/SOGo/dav/\"\n_imap._tcp IN SRV 0 1 143 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_imaps._tcp IN SRV 0 1 993 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_pop3._tcp IN SRV 0 1 110 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_pop3s._tcp IN SRV 0 1 995 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_sieve._tcp IN SRV 0 1 4190 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_smtps._tcp IN SRV 0 1 465 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_submission._tcp IN SRV 0 1 587 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_submissions._tcp IN SRV 0 1 465 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n
    "},{"location":"de/getstarted/prerequisite-dns/#testen","title":"Testen","text":"

    Hier finden Sie einige Tools, mit denen Sie Ihre DNS-Konfiguration \u00fcberpr\u00fcfen k\u00f6nnen:

    • MX Toolbox (DNS, SMTP, RBL)
    • port25.com (DKIM, SPF)
    • Mail-Tester (DKIM, DMARC, SPF)
    • DMARC-Analysator (DMARC, SPF)
    • MultiRBL.valli.org (DNSBL, RBL, FCrDNS)
    "},{"location":"de/getstarted/prerequisite-dns/#verschiedenes","title":"Verschiedenes","text":""},{"location":"de/getstarted/prerequisite-dns/#optionale-dmarc-statistiken","title":"Optionale DMARC-Statistiken","text":"

    Wenn Sie an Statistiken interessiert sind, k\u00f6nnen Sie sich zus\u00e4tzlich bei einem der vielen unten aufgef\u00fchrten DMARC-Statistikdienste anmelden - oder Ihre eigene Statistik selbst hosten.

    Tipp

    Es ist zu bedenken, dass wenn Sie DMARC-Statistik-Berichte an Ihren mailcow-Server anfordern und Ihr mailcow-Server nicht korrekt f\u00fcr den Empfang dieser Berichte konfiguriert ist, Sie m\u00f6glicherweise keine genauen und vollst\u00e4ndigen Ergebnisse erhalten. Bitte erw\u00e4gen Sie die Verwendung einer alternativen E-Mail-Domain f\u00fcr den Empfang von DMARC-Berichten.

    Es ist erw\u00e4hnenswert, dass die folgenden Vorschl\u00e4ge keine umfassende Liste aller verf\u00fcgbaren Dienste und Tools sind, sondern nur eine kleine Auswahl der vielen M\u00f6glichkeiten.

    • Postmaster Tool
    • parsedmarc (selbst gehostet)
    • Fraudmarc
    • Postmark
    • Dmarcian

    Tipp

    Diese Dienste stellen Ihnen m\u00f6glicherweise einen TXT-Eintrag zur Verf\u00fcgung, den Sie in Ihre DNS-Eintr\u00e4ge einf\u00fcgen m\u00fcssen, so wie es der Anbieter vorschreibt. Bitte stellen Sie sicher, dass Sie die Dokumentation des Anbieters des von Ihnen gew\u00e4hlten Dienstes lesen, da dieser Prozess variieren kann.

    "},{"location":"de/getstarted/prerequisite-dns/#e-mail-test-fur-spf-dkim-und-dmarc","title":"E-Mail-Test f\u00fcr SPF, DKIM und DMARC:","text":"

    Um eine rudiment\u00e4re E-Mail-Authentifizierungspr\u00fcfung durchzuf\u00fchren, senden Sie eine E-Mail an check-auth at verifier.port25.com und warten Sie auf eine Antwort. Sie werden einen Bericht \u00e4hnlich dem folgenden finden:

    ==========================================================\nZusammenfassung der Ergebnisse\n==========================================================\nSPF-Pr\u00fcfung: bestanden\n\"iprev\"-Pr\u00fcfung: bestanden\nDKIM-Pr\u00fcfung: bestanden\nDKIM-Pr\u00fcfung: bestanden\nSpamAssassin-Pr\u00fcfung: ham\n\n==========================================================\nEinzelheiten:\n==========================================================\n....\n

    Der vollst\u00e4ndige Bericht enth\u00e4lt weitere technische Details.

    "},{"location":"de/getstarted/prerequisite-dns/#fully-qualified-domain-name-fqdn","title":"Fully Qualified Domain Name (FQDN)","text":"

    1. Ein Fully Qualified Domain Name (FQDN) ist der vollst\u00e4ndige (absolute) Dom\u00e4nenname f\u00fcr einen bestimmten Computer oder Host im Internet. Der FQDN besteht aus mindestens drei Teilen, die durch einen Punkt getrennt sind: dem Hostnamen, dem Dom\u00e4nennamen und der Top Level Domain (kurz TLD). Im Beispiel mx.mailcow.email w\u00e4re der Hostname mx, der Domainname mailcow und die TLD email.\u00a0\u21a9

    "},{"location":"de/getstarted/prerequisite-system/","title":"Systemvoraussetzungen","text":"

    Bevor Sie mailcow: dockerized ausf\u00fchren, sollten Sie einige Voraussetzungen \u00fcberpr\u00fcfen:

    Achtung

    Versuchen Sie nicht, mailcow auf einem Synology/QNAP-Ger\u00e4t (jedes NAS), OpenVZ, LXC oder anderen Container-Plattformen zu installieren. KVM, ESX, Hyper-V und andere vollst\u00e4ndige Virtualisierungsplattformen werden unterst\u00fctzt.

    Info

    • mailcow: dockerized erfordert, dass einige Ports f\u00fcr eingehende Verbindungen offen sind, also stellen Sie sicher, dass Ihre Firewall diese nicht blockiert.
    • Stellen Sie sicher, dass keine andere Anwendung die Konfiguration von mailcow st\u00f6rt, wie z.B. ein anderer Maildienst
    • Ein korrektes DNS-Setup ist entscheidend f\u00fcr jedes gute Mailserver-Setup, also stellen Sie bitte sicher, dass Sie zumindest die basics abgedeckt haben, bevor Sie beginnen!
    • Stellen Sie sicher, dass Ihr System ein korrektes Datum und eine korrekte Zeiteinstellung hat. Dies ist entscheidend f\u00fcr verschiedene Komponenten wie die Zwei-Faktor-TOTP-Authentifizierung.
    "},{"location":"de/getstarted/prerequisite-system/#minimale-systemressourcen","title":"Minimale Systemressourcen","text":"

    Bitte stellen Sie sicher, dass Ihr System mindestens \u00fcber die folgenden Ressourcen verf\u00fcgt:

    Ressource Minimale Anforderung CPU 1 GHz RAM Minimum 6 GiB + 1 GiB Swap (Standardkonfiguration) Festplatte 20 GiB (ohne Emails) Architektur x86_64, ARM64

    Nicht unterst\u00fctzt

    OpenVZ, Virtuozzo und LXC

    ClamAV und Solr k\u00f6nnen sehr viel Arbeitspeicher verbrauchen. Sie k\u00f6nnen diese in der mailcow.conf durch die Einstellungen SKIP_CLAMD=y und SKIP_SOLR=y jedoch auch deaktivieren.

    Info

    Wir sind uns bewusst, dass ein reiner MTA auf 128 MiB RAM laufen kann. mailcow ist eine ausgewachsene und gebrauchsfertige Groupware mit vielen Extras, die das Leben einfacher machen. Diese kommt mit einem Webserver, Webmailer, ActiveSync (MS), Antivirus, Antispam, Indexierung (Solr), Dokumentenscanner (Oletools), SQL (MariaDB), Cache (Redis), MDA, MTA, verschiedenen Webdiensten etc.

    Ein einzelner SOGo-Worker kann ~350 MiB RAM belegen, bevor er geleert wird. Je mehr ActiveSync-Verbindungen Sie verwenden m\u00f6chten, desto mehr RAM wird ben\u00f6tigt. In der Standardkonfiguration werden 20 Arbeiter erzeugt.

    "},{"location":"de/getstarted/prerequisite-system/#beispiele-fur-die-ram-planung","title":"Beispiele f\u00fcr die RAM Planung","text":"

    Ein Unternehmen mit 15 Smartphones (EAS aktiviert) und etwa 50 gleichzeitigen IMAP-Verbindungen sollte 16 GiB RAM einplanen.

    6 GiB RAM + 1 GiB Swap sind f\u00fcr die meisten privaten Installationen ausreichend, w\u00e4hrend 8 GiB RAM f\u00fcr ~5 bis 10 Benutzer empfohlen werden.

    Im Rahmen unseres Supports k\u00f6nnen wir Ihnen bei der korrekten Planung Ihres Setups helfen.

    "},{"location":"de/getstarted/prerequisite-system/#unterstutzte-betriebssysteme","title":"Unterst\u00fctzte Betriebssysteme","text":"

    Wichtig

    mailcow nutzt Docker als Basis. Aufgrund von diversen technischen Unterschieden innerhalb der einzelnen Systeme unterst\u00fctzen wir nicht alle Systeme, wo theoretisch Docker drauf l\u00e4uft!

    Die folgende Tabelle enth\u00e4lt alle von uns offiziell unterst\u00fctzten und getesteten Betriebssysteme (Stand December 2024):

    Betriebssystem Kompatibilit\u00e4t Alpine 3.16 und \u00e4lter \u26a0\ufe0f Debian 11, 12 \u2705 Ubuntu 20.04 - 24.04 \u2705 Alma Linux 8, 9 \u2705 Rocky Linux 9 \u2705

    Legende

    \u2705 = Funktioniert out of the box anhand der Anleitung. \u26a0\ufe0f = Erfordert einige manuelle Anpassungen, sonst aber nutzbar. \u274c = Generell NICHT Kompatibel. \u2754 = Ausstehend.

    Achtung

    Andere (nicht genannte Betriebssysteme) k\u00f6nnen auch funktionieren, sind jedoch nicht offiziell getestet worden.

    "},{"location":"de/getstarted/prerequisite-system/#firewall-ports","title":"Firewall & Ports","text":"

    Bitte \u00fcberpr\u00fcfen Sie, ob alle Standard-Ports von mailcow offen sind und nicht von anderen Anwendungen genutzt werden:

    ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n# oder:\nnetstat -tulpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n

    Vorsicht

    Es gibt einige Probleme mit dem Betrieb von mailcow auf einem Firewalld/ufw aktivierten System. Sie sollten es deaktivieren (wenn m\u00f6glich) und stattdessen Ihren Regelsatz in die DOCKER-USER-Kette verschieben, die nicht durch einen Neustart des Docker-Dienstes gel\u00f6scht wird. Siehe diese (blog.donnex.net) oder diese (unrouted.io) Anleitung f\u00fcr Informationen dar\u00fcber, wie man iptables-persistent mit der DOCKER-USER Kette benutzt. Da mailcow im Docker-Modus l\u00e4uft, haben INPUT-Regeln keinen Effekt auf die Beschr\u00e4nkung des Zugriffs auf mailcow. Verwenden Sie stattdessen die FORWARD-Kette.

    Wenn dieser Befehl irgendwelche Ergebnisse liefert, entfernen oder stoppen Sie bitte die Anwendung, die auf diesem Port l\u00e4uft. Sie k\u00f6nnen mailcows Ports auch \u00fcber die Konfigurationsdatei mailcow.conf anpassen.

    "},{"location":"de/getstarted/prerequisite-system/#eingehende-ports","title":"Eingehende Ports","text":"

    Wenn Sie eine Firewall vor mailcow haben, stellen Sie bitte sicher, dass diese Ports f\u00fcr eingehende Verbindungen offen sind:

    Dienst Protokoll Port Container Variable Postfix SMTP TCP 25 postfix-mailcow ${SMTP_PORT} Postfix SMTPS TCP 465 postfix-mailcow ${SMTPS_PORT} Postfix Submission TCP 587 postfix-mailcow ${SUBMISSION_PORT} Dovecot IMAP TCP 143 dovecot-mailcow ${IMAP_PORT} Dovecot IMAPS TCP 993 dovecot-mailcow ${IMAPS_PORT} Dovecot POP3 TCP 110 dovecot-mailcow ${POP_PORT} Dovecot POP3S TCP 995 dovecot-mailcow ${POPS_PORT} Dovecot ManageSieve TCP 4190 dovecot-mailcow ${SIEVE_PORT} HTTP(S) TCP 80/443 nginx-mailcow ${HTTP_PORT} / ${HTTPS_PORT}

    Um einen Dienst an eine IP-Adresse zu binden, k\u00f6nnen Sie die IP-Adresse wie folgt voranstellen: SMTP_PORT=1.2.3.4:25

    Wichtig: Sie k\u00f6nnen keine IP:PORT-Bindungen in HTTP_PORT und HTTPS_PORT verwenden. Bitte verwenden Sie stattdessen HTTP_PORT=1234 und HTTP_BIND=1.2.3.4.

    "},{"location":"de/getstarted/prerequisite-system/#ausgehende-portshosts","title":"Ausgehende Ports/Hosts","text":"

    F\u00fcr die Nutzung von mailcow werden einige ausgehende Verbindungen ben\u00f6tigt. Stellen Sie sicher, dass mailcow mit folgenden Hosts oder auf folgenden Ports nach au\u00dfen kommunizieren kann:

    Dienst Protokoll Port Ziel Grund Clamd TCP 873 rsync.sanesecurity.net Download ClamAV Signaturen (Prebundled in mailcow) Dovecot TCP 443 spamassassin.heinlein-support.de Herunterladen von Spamassasin Regeln, die Rspamd verarbeitet, Download erfolgt \u00fcber Dovecot mailcow Prozesse TCP 80/443 github.com Download von mailcow Updates (Code Basiert) mailcow Prozesse TCP 443 hub.docker.com Download von Docker Images (direkt von Docker Hub) mailcow Prozesse TCP 443 asn-check.mailcow.email API Abfrage auf Pr\u00fcfung BAD ASN (f\u00fcr Spamhaus Free Blocklists) mailcow Prozesse TCP 80 ip4.mailcow.email & ip6.mailcow.email Ermittelung der eigenen \u00f6ffentlichen IP Adresse zur Anzeige in UI (optional) Postfix TCP 25, 465 Beliebig / Any Ausgehende Verbindung MTA Rspamd TCP 80 fuzzy.mailcow.email Download von Bad Subject Regex Maps (Trainiert von Servercow) Rspamd TCP 443 bazaar.abuse.ch Download von Mailware MD5 Pr\u00fcfsummen zur Erkennung von Rspamd Rspamd TCP 443 urlhaus.abuse.ch Download von Malware Downloads Links zur Erkennung in Rspamd Rspamd UDP 11445 fuzzy.mailcow.email Anbindung an Globalen mailcow Fuzzy (Trainiert von Servercow + Community) Rspamd UDP 11335 fuzzy1.rspamd.com & fuzzy2.rspamd.com Anbindung an Globalen Rspamd Fuzzy (Trainiert vom Rspamd Team) Unbound TCP & UDP 53 Beliebig / Any DNS Aufl\u00f6sung f\u00fcr mailcow Stack (Zur Validierung von DNSSEC und Abruf von Spamlistinformationen)"},{"location":"de/getstarted/prerequisite-system/#wichtig-fur-hetzner-firewalls","title":"Wichtig f\u00fcr Hetzner Firewalls","text":"

    Ich zitiere https://github.com/chermsen \u00fcber https://github.com/mailcow/mailcow-dockerized/issues/497#issuecomment-469847380 (DANKE!):

    F\u00fcr alle, die mit der Hetzner-Firewall zu k\u00e4mpfen haben:

    Port 53 ist in diesem Fall f\u00fcr die Firewall-Konfiguration unwichtig. Laut Dokumentation verwendet unbound den Portbereich 1024-65535 f\u00fcr ausgehende Anfragen. Da es sich bei der Hetzner Robot Firewall um eine statische Firewall handelt (jedes eingehende Paket wird isoliert gepr\u00fcft) - m\u00fcssen die folgenden Regeln angewendet werden:

    F\u00fcr TCP 

    SRC-IP: ---\nDST-IP: ---\nSRC-Port: ---\nDST-Port: 1024-65535\nProtokoll: tcp\nTCP-Flags: ack\nAktion:      Akzeptieren\n

    F\u00fcr UDP 

    SRC-IP: ---\nDST-IP: ---\nSRC-Port: ---\nDST-Port: 1024-65535\nProtokoll: udp\nAktion:      Akzeptieren\n

    Wenn man einen restriktiveren Portbereich anwenden will, muss man zuerst die Konfiguration von unbound \u00e4ndern (nach der Installation):

    {mailcow-dockerized}/data/conf/unbound/unbound.conf: 

    outgoing-port-avoid: 0-32767\n

    Nun k\u00f6nnen die Firewall-Regeln wie folgt angepasst werden:

    [...]\nDST Port: 32768-65535\n[...]\n
    "},{"location":"de/getstarted/prerequisite-system/#datum-und-uhrzeit","title":"Datum und Uhrzeit","text":"

    Um sicherzustellen, dass Sie das richtige Datum und die richtige Zeit auf Ihrem System eingestellt haben, \u00fcberpr\u00fcfen Sie bitte die Ausgabe von timedatectl status:

    $ timedatectl status\n      Lokale Zeit: Sat 2017-05-06 02:12:33 CEST\n  Weltzeit: Sa 2017-05-06 00:12:33 UTC\n        RTC-Zeit: Sa 2017-05-06 00:12:32\n       Zeitzone: Europa/Berlin (MESZ, +0200)\n     NTP aktiviert: ja\nNTP synchronisiert: ja\n RTC in lokaler TZ: nein\n      Sommerzeit aktiv: ja\n Letzte DST-\u00c4nderung: Sommerzeit begann am\n                  Sonne 2017-03-26 01:59:59 MEZ\n                  So 2017-03-26 03:00:00 MESZ\n N\u00e4chste Sommerzeit\u00e4nderung: Die Sommerzeit endet (die Uhr springt eine Stunde r\u00fcckw\u00e4rts) am\n                  Sun 2017-10-29 02:59:59 MESZ\n                  Sun 2017-10-29 02:00:00 MEZ\n

    Die Zeilen NTP aktiviert: ja und NTP synchronisiert: ja zeigen an, ob Sie NTP aktiviert haben und ob es synchronisiert ist.

    Um NTP zu aktivieren, m\u00fcssen Sie den Befehl timedatectl set-ntp true ausf\u00fchren. Sie m\u00fcssen auch Ihre /etc/systemd/timesyncd.conf bearbeiten:

    # vim /etc/systemd/timesyncd.conf\n[Zeit]\nNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org\n
    "},{"location":"de/getstarted/prerequisite-system/#hetzner-cloud-und-wahrscheinlich-andere","title":"Hetzner Cloud (und wahrscheinlich andere)","text":"

    Pr\u00fcfen Sie /etc/network/interfaces.d/50-cloud-init.cfg und \u00e4ndern Sie die IPv6-Schnittstelle von eth0:0 auf eth0:

    # Falsch:\nauto eth0:0\niface eth0:0 inet6 static\n# Richtig:\nauto eth0\niface eth0 inet6 static\n

    Starten Sie die Schnittstelle neu, um die Einstellungen zu \u00fcbernehmen. Sie k\u00f6nnen au\u00dferdem die cloud-init Netzwerk\u00e4nderungen deaktivieren.

    "},{"location":"de/getstarted/prerequisite-system/#mtu","title":"MTU","text":"

    Besonders relevant f\u00fcr OpenStack-Benutzer: \u00dcberpr\u00fcfen Sie Ihre MTU und setzen Sie sie entsprechend in docker-compose.yml. Siehe Problebehandlungen in unseren Installationsanleitungen.

    "},{"location":"de/maintenance/deinstall/","title":"Deinstallation","text":"

    Um mailcow: dockerized mit all seinen Volumes, Images und Containern zu entfernen, tun Sie dies:

    docker compose (Plugin)docker-compose (Standalone) 
    docker compose down -v --rmi all --remove-orphans\n
    docker-compose down -v --rmi all --remove-orphans\n

    Info

    • -v Entfernt benannte Volumes, die im Abschnitt volumes der Compose-Datei deklariert sind, und anonyme Volumes, die an Container angeh\u00e4ngt sind.
    • --rmi Images entfernen. Der Typ muss einer der folgenden sein: all: Entfernt alle Images, die von einem beliebigen Dienst verwendet werden. local: Entfernt nur Bilder, die kein benutzerdefiniertes Tag haben, das durch das Feld \"image\" gesetzt wurde.
    • --remove-orphans Entfernt Container f\u00fcr Dienste, die nicht in der Compose-Datei definiert sind.
    • Standardm\u00e4\u00dfig entfernt docker compose down nur derzeit aktive Container und Netzwerke, die in der Datei docker-compose.yml definiert sind.
      • "},{"location":"de/maintenance/migration/","title":"Migration","text":"

      Warnung

      Diese Anleitung geht davon aus, dass Sie beabsichtigen, einen bestehenden mailcow-Server (Quelle) auf einen brandneuen, leeren Server (Ziel) zu migrieren. Sie k\u00fcmmert sich nicht um die Erhaltung bestehender Daten auf dem Zielserver und l\u00f6scht alles innerhalb von /var/lib/docker/volumes und somit alle Docker-Volumes, die Sie bereits eingerichtet haben.

      Tip

      Alternativ k\u00f6nnen Sie das Skript ./helper-scripts/backup_and_restore.sh verwenden, um ein vollst\u00e4ndiges Backup auf der Quellmaschine zu erstellen, dann installieren Sie mailcow auf der Zielmaschine wie gewohnt, kopieren Sie Ihre mailcow.conf und verwenden Sie das gleiche Skript, um Ihr Backup auf der Zielmaschine wiederherzustellen.

      1. Befolgen Sie die Installationsanleitung von Docker und Compose.

      2. Stoppen Sie Docker und stellen Sie sicher, dass Docker gestoppt wurde: 

      systemctl stop docker.service\nsystemctl status docker.service\n

      3. F\u00fchren Sie die folgenden Befehle auf dem Quellcomputer aus (achten Sie darauf, die abschlie\u00dfenden Schr\u00e4gstriche im ersten Pfadparameter wie unten gezeigt hinzuzuf\u00fcgen!) - WARNUNG: Dieser Befehl l\u00f6scht alles, was bereits unter /var/lib/docker/volumes auf dem Zielrechner existiert:

      Innerhalb der selben ArchitekturAuf andere Architektur 
      rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n
      rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete --exclude '*rspamd-vol-1' /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n

      Achtung

      Bitte befolgen Sie die Anweisungen f\u00fcr den jeweiligen Anwendungsfall, da bei einer Migration auf eine andere Architektur das Volume rspamd-vol-1 ausgelassen werden muss, da es inkompatible Hyperscan-Cache-Dateien enth\u00e4lt, die bei einem Plattformwechsel zu Abst\u00fcrzen mit anschlie\u00dfendem Nichtstart von Rspamd f\u00fchren.

      Die Hyperscan-Cache-Dateien werden bei einem Neustart von Rspamd automatisch regeneriert, wenn diese nicht existieren.

      4. Schalten Sie mailcow ab und stoppen Sie Docker auf dem Quellrechner.

      docker compose (Plugin)docker-compose (Standalone) 
      cd /opt/mailcow-dockerized\ndocker compose down\nsystemctl stop docker.service\n
      cd /opt/mailcow-dockerized\ndocker-compose down\nsystemctl stop docker.service\n

      5. Wiederholen Sie Schritt 3 mit denselben Befehlen. Dies wird viel schneller gehen als beim ersten Mal, da nun nur noch die Differenzen \u00fcbertragen werden.

      6. Wechseln Sie auf den Zielrechner und starten Sie Docker. 

      systemctl start docker.service\n

      7. Ziehen Sie nun die mailcow Docker-Images auf den Zielrechner.

      docker compose (Plugin)docker-compose (Standalone) 
      cd /opt/mailcow-dockerized\ndocker compose pull\n
      cd /opt/mailcow-dockerized\ndocker-compose pull\n

      8. Starten Sie den gesamten mailcow-Stack und alles sollte fertig sein!

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      9. Zum Schluss \u00e4ndern Sie Ihre DNS-Einstellungen so, dass sie auf den Zielserver zeigen. Pr\u00fcfen und \u00e4ndern Sie gegebenenfalls die SNAT_TO_SOURCE Variable in der mailcow.conf im mailcow-dockerized Ordner, da andernfalls SOGo nicht richtig funktioniert, wenn die ausgehende IP eine andere ist.

      "},{"location":"de/maintenance/update/#mailcow-automatisch-updaten","title":"mailcow automatisch Updaten","text":"

      Ein Update-Skript in Ihrem mailcow-dockerized Verzeichnis k\u00fcmmert sich um Updates.

      F\u00fchren sie das Update-Skript aus: 

      ./update.sh\n

      Wenn es n\u00f6tig ist, wird es Sie fragen, wie Sie fortfahren m\u00f6chten. Merge-Fehler werden gemeldet. Einige kleinere Konflikte werden automatisch korrigiert (zugunsten des mailcow-dockerized repository code).

      "},{"location":"de/maintenance/update/#optionen","title":"Optionen","text":"
      # Optionen k\u00f6nnen kombiniert werden\n\n# - Pr\u00fcft auf Updates und zeigt \u00c4nderungen an\n./update.sh --check\n\n# - Starten Sie mailcow nicht, nachdem Sie ein Update durchgef\u00fchrt haben\n./update.sh --skip-start\n\n# - \u00dcberspringt den ICMP Check auf die \u00f6ffentlichen DNS Resolver (Bitte nur nutzen, wenn keinerlei ICMP Verbindungen von und zur mailcow erlaubt sind)\n./update.sh --skip-ping-check\n\n# - Wechselt die Update Quellen der mailcow auf nightly (unstabile) Inhalte.\nNUR ZUM TESTEN VERWENDEN!! KEIN PRODUKTIV BETRIEB!!!\n./update.sh --nightly\n\n# - Wechselt die Update Quellen der mailcow auf stable (stabile) Inhalte (standard).\n./update.sh --stable\n\n# - Erzwinge Update (unbeaufsichtigt, aber nicht unterst\u00fctzt, Benutzung auf eigenes Risiko)\n./update.sh --force\n\n# - Garbage Collector ausf\u00fchren, um alte Image-Tags zu bereinigen und beenden\n./update.sh --gc\n\n# - Update mit der Merge-Strategie-Option \"ours\" statt \"theirs\"\n# Dies wird **Konflikte** beim Zusammenf\u00fchren zugunsten Ihrer lokalen \u00c4nderungen l\u00f6sen und sollte vermieden werden. Lokale \u00c4nderungen werden immer beibehalten, es sei denn, wir haben auch die Datei XY ge\u00e4ndert.\n./update.sh --ours\n\n# - Nicht aktualisieren, nur holen von Docker Images\n./update.sh --prefetch\n
      "},{"location":"de/maintenance/update/#ich-habe-vergessen-was-ich-vor-dem-ausfuhren-von-updatesh-geandert-habe","title":"Ich habe vergessen, was ich vor dem Ausf\u00fchren von update.sh ge\u00e4ndert habe.","text":"

      Siehe git log --pretty=oneline | grep -i \"before update\", Sie werden eine Ausgabe \u00e4hnlich dieser haben:

      22cd00b5e28893ef9ddef3c2b5436453cc5223ab Before update on 2020-09-28_19_25_45\ndacd4fb9b51e9e1c8a37d84485b92ffaf6c59353 Before update on 2020-08-07_13_31_31\n

      F\u00fchren Sie git diff 22cd00b5e28893ef9ddef3c2b5436453cc5223ab aus, um zu sehen, was sich ge\u00e4ndert hat.

      "},{"location":"de/maintenance/update/#kann-ich-ein-rollback-durchfuhren","title":"Kann ich ein Rollback durchf\u00fchren?","text":"

      Ja.

      Siehe das obige Thema, anstelle eines Diffs f\u00fchren Sie checkout aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker compose pull\ndocker compose up -d\n
      docker-compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker-compose pull\ndocker-compose up -d\n
      "},{"location":"de/maintenance/update/#hooks","title":"Hooks","text":"

      Sie k\u00f6nnen sich in den Update-Mechanismus einklinken, indem Sie Skripte namens pre_commit_hook.sh und post_commit_hook.sh zu Ihrem mailcows-Root-Verzeichnis hinzuf\u00fcgen. Siehe hier f\u00fcr weitere Details.

      "},{"location":"de/maintenance/update/#update-zyklus","title":"Update-Zyklus","text":"
      • Wir planen in jedem Monat ein neues Hauptupdate zu ver\u00f6ffentlichen.
      • Die Updates sind wie folgt nummeriert: JJJJ-MM (Beispiel: 2022-05).
      • Fehlerkorrekturen eines Hauptupdates werden bei uns als \"Revisionen\" wie a,b,c (Beispiele: 2022-05a, 2022-05b usw.) erscheinen.
      "},{"location":"de/maintenance/update/#update-varianten","title":"Update-Varianten","text":"

      stable (stabile Updates): Diese Updates sind f\u00fcr den Produktivbetrieb geeignet. Sie erscheinen in einem Zyklus von mindest 1x im Monat.

      nightly (instabile Updates): Diese Updates sind NICHT f\u00fcr den Produktivbetrieb geeignet und dienen lediglich dem Testen. Die nightly Updates sind den stabilen Updates vorraus, da in diesen neue und auch umfangreichere Funktionen getestet werden bevor diese f\u00fcr alle User Live gehen.

      "},{"location":"de/maintenance/update/#nightly-updates-beziehen","title":"Nightly Updates beziehen","text":""},{"location":"de/maintenance/update/#infos-zu-den-nightly-updates","title":"Infos zu den Nightly Updates","text":"

      Seit dem 2022-08 Update gibt es die M\u00f6glichkeit die Update quellen zu \u00e4ndern. Bisher diente der master Branch auf GitHub als einzige (offizieller) Update Quelle. Mit dem August 2022 Update gibt es aber nun noch den Nightly Branch welcher instabile und gr\u00f6\u00dfere \u00c4nderungen zum testen und Feedback geben enth\u00e4lt.

      Dabei bekommt der Nightly Branch immer dann neue Updates, wenn irgendetwas am mailcow Projekt fertig gemacht wurde was in die neue Hauptversion reinkommt.

      Neben den offensichtlichen neuerungen welche sowieso im n\u00e4chsten Major Update enthalten sein werden enth\u00e4lt er ebenfalls erstmal exklusive Features welche eine l\u00e4ngere Testzeit brauchen (bspw. das UI Update auf Bootstrap 5).

      "},{"location":"de/maintenance/update/#wie-bekomme-ich-nightly-updates","title":"Wie bekomme ich Nightly Updates?","text":"

      Der Vorgang ist relativ simpel. Mit dem 2022-08 Update (ein Update auf die Version voraussgesetzt) ist es m\u00f6glich die update.sh mit dem Parameter --nightly zu starten.

      Achtung

      Bitte machen Sie vorher ein Backup oder folgen Sie dem Abschnitt Best Practice Nightly Update bevor Sie auf die Nightly Builds von mailcow wechseln. Wir sind f\u00fcr keinerlei Datenverluste/korruptionen verantwortlich, also arbeiten Sie mit bedacht!

      Das Skript wird nun den Branch wechseln mit git checkout nightly d.h. es wird auch wieder nach den IPv6 Einstellungen fragen. Das ist aber normal.

      Sollte alles problemlos geklappt haben (wof\u00fcr wir ja auch vorsichtshalber ein Backup vorher gemacht haben) sollte nun in der mailcow UI unten rechts die aktuelle Versionsnummer samt Datumsstempel abgebildet sein:

      "},{"location":"de/maintenance/update/#best-practice-nightly-update","title":"Best Practice Nightly Update","text":"

      Info

      Wir empfehlen die Benutzung des Nightly Updates nur dann, wenn Ihr eine weitere Maschine oder VM besitzt und diese NICHT Produktiv nutzt.

      1. Das Cold-Standby Skript nutzen um die Maschine vor dem Schwenk auf die Nightly Builds auf ein anderes System zu kopieren.
      2. Das update.sh Skript auf der neuen Maschine mit dem Parameter --nightly ausf\u00fchren und best\u00e4tigen.
      3. Die Nightly Updates auf der sekund\u00e4ren Maschine erleben/testen.
      "},{"location":"de/manual-guides/u_e-80_to_443/","title":"HTTP auf HTTPS umleiten","text":"

      Seit dem 28. Februar 2017 wird mailcow mit aktivierten Ports 80 und 443 geliefert.

      Verwenden Sie die untenstehende Konfiguration nicht f\u00fcr Reverse-Proxy-Setups, bitte lesen Sie dazu unsere Reverse-Proxy-Anleitung, die einen Redirect von HTTP zu HTTPS beinhaltet.

      \u00d6ffne mailcow.conf und setze HTTP_BIND= - falls nicht bereits gesetzt.

      Erstellen Sie eine neue Datei data/conf/nginx/redirect.conf und f\u00fcgen Sie die folgende Serverkonfiguration in die Datei ein:

      server {\n  root /web;\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  include /etc/nginx/conf.d/server_name.active;\n  if ( $request_uri ~* \"%0A|%0D\" ) { return 403; }\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n  location / {\n    return 301 https://$host$uri$is_args$args;\n  }\n}\n

      Falls Sie den Parameter HTTP_BIND ge\u00e4ndert haben, erstellen Sie den Container neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker compose up -d\n

      Andernfalls starten Sie Nginx neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart\n
      docker compose restart\n
      "},{"location":"de/manual-guides/u_e-autodiscover_config/","title":"Autodiscover / Autoconfig","text":"

      Sie brauchen diese Datei nicht zu \u00e4ndern oder zu erstellen, autodiscover funktioniert sofort. Diese Anleitung ist nur f\u00fcr Anpassungen des Autodiscover- oder Autokonfigurationsprozesses gedacht.

      Neuere Outlook-Clients (insbesondere solche, die mit O365 ausgeliefert werden) f\u00fchren keine automatische Erkennung von E-Mail-Profilen durch. Denken Sie daran, dass ActiveSync NICHT mit einem Desktop-Client verwendet werden sollte.

      \u00d6ffnen/erstellen Sie data/web/inc/vars.local.inc.php und f\u00fcgen Sie Ihre \u00c4nderungen in das Konfigurationsfeld ein.

      Die \u00c4nderungen werden mit \"$autodiscover_config\" in data/web/inc/vars.inc.php zusammengef\u00fchrt):

      <?php\n$autodiscover_config = array(\n  // General autodiscover service type: \"activesync\" or \"imap\"\n  // emClient uses autodiscover, but does not support ActiveSync. mailcow excludes emClient from ActiveSync.\n  'autodiscoverType' => 'activesync',\n  // If autodiscoverType => activesync, also use ActiveSync (EAS) for Outlook desktop clients (>= Outlook 2013 on Windows)\n  // Outlook for Mac does not support ActiveSync\n  'useEASforOutlook' => 'yes',\n  // Please don't use STARTTLS-enabled service ports in the \"port\" variable.\n  // The autodiscover service will always point to SMTPS and IMAPS (TLS-wrapped services).\n  // The autoconfig service will additionally announce the STARTTLS-enabled ports, specified in the \"tlsport\" variable.\n  'imap' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('IMAPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('IMAP_PORT'))),\n  ),\n  'pop3' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('POPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('POP_PORT'))),\n  ),\n  'smtp' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('SMTPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('SUBMISSION_PORT'))),\n  ),\n  'activesync' => array(\n    'url' => 'https://'.$mailcow_hostname.($https_port == 443 ? '' : ':'.$https_port).'/Microsoft-Server-ActiveSync',\n  ),\n  'caldav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n  'carddav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n);\n

      Um immer IMAP und SMTP anstelle von EAS zu verwenden, setzen Sie 'autodiscoverType' => 'imap'.

      Deaktivieren Sie ActiveSync f\u00fcr Outlook-Desktop-Clients, indem Sie \"useEASforOutlook\" auf \"no\" setzen.

      "},{"location":"de/manual-guides/u_e-reeanble-weak-protocols/","title":"TLS 1.0 und TLS 1.1 wieder aktivieren","text":"

      Am 12. Februar 2020 haben wir die veralteten Protokolle TLS 1.0 und 1.1 in Dovecot (POP3, POP3S, IMAP, IMAPS) und Postfix (SMTPS, SUBMISSION) deaktiviert.

      Mit dem Juni 2024 Patch (2024-06) wurde auch TLS 1.0 und TLS 1.1 f\u00fcr unauthentifizierte Mails \u00fcber SMTP auf Port 25/tcp deaktiviert, da die meisten modernen und gut konfigurierten E-Mail-Server im Internet mittlerweile bessere Verschl\u00fcsselungen als TLS 1.0/1.1 nutzen.

      Wie kann man schwache Protokolle wieder aktivieren, falls erforderlich?

      Bearbeiten Sie data/conf/postfix/extra.cf:

      # F\u00fcr SMTPS/Submission\nsubmission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\nsmtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\n\n# F\u00fcr SMTP (via STARTTLS)\nsmtp_tls_protocols = !SSLv2, !SSLv3\nsmtpd_tls_protocols = !SSLv2, !SSLv3\n

      Bearbeiten Sie data/conf/dovecot/extra.conf:

      ssl_min_protocol = TLSv1\n

      Starten Sie die betroffenen Dienste neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart postfix-mailcow dovecot-mailcow\n
      docker-compose restart postfix-mailcow dovecot-mailcow\n

      Tipp: Sie k\u00f6nnen TLS 1.2 in Windows 7 aktivieren.

      "},{"location":"de/manual-guides/u_e-update-hooks/","title":"Skripte vor und nach Aktualisierungen ausf\u00fchren","text":"

      Es ist m\u00f6glich, Pre- und Post-Update-Hooks zum update.sh Skript hinzuzuf\u00fcgen, das Ihre gesamte mailcow-Installation aktualisiert.

      Um dies zu tun, f\u00fcgen Sie einfach das entsprechende Bash-Skript in Ihr mailcow-Root-Verzeichnis ein:

      • pre_update_hook.sh f\u00fcr Befehle, die vor dem Update laufen sollen
      • post_update_hook.sh f\u00fcr Befehle, die nach dem Update ausgef\u00fchrt werden sollen

      Beachten Sie, dass pre_update_hook.sh jedes Mal ausgef\u00fchrt wird, wenn Sie update.sh aufrufen, und post_update_hook.sh wird nur ausgef\u00fchrt, wenn die Aktualisierung erfolgreich war und das Skript nicht erneut ausgef\u00fchrt werden muss.

      Die Skripte werden von der Bash ausgef\u00fchrt, ein Interpreter (z.B. #!/bin/bash) sowie ein Execute Permission Flag (\"+x\") sind nicht erforderlich.

      "},{"location":"de/manual-guides/u_e-why_unbound/","title":"Warum unbound?","text":"

      F\u00fcr DNS-Blacklist-Lookups und DNSSEC.

      Die meisten Systeme verwenden entweder einen \u00f6ffentlichen oder einen lokalen DNS-Aufl\u00f6ser mit Zwischenspeicher. Das ist eine sehr schlechte Idee, wenn es darum geht, Spam mit DNS-basierten Blackhole-Listen (DNSBL) oder \u00e4hnlichen Techniken zu filtern. Die meisten, wenn nicht alle Anbieter wenden eine Ratenbegrenzung an, die auf dem DNS-Resolver basiert, der f\u00fcr die Abfrage ihres Dienstes verwendet wird. Wenn Sie einen \u00f6ffentlichen Resolver wie Google 4x8, OpenDNS oder einen anderen gemeinsam genutzten DNS-Resolver wie den Ihres Internetanbieters verwenden, werden Sie diese Grenze sehr bald erreichen.

      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/","title":"Weitere Datenbanken","text":""},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#weitere-datenbanken-fur-clamav","title":"Weitere Datenbanken f\u00fcr ClamAV","text":"

      Die Standard ClamAV Datenbanken haben keine hohe Trefferquote, k\u00f6nnen aber durch kostenlose und kostenpflichtige Datenbanken erweitert werden.

      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#liste-von-bekannten-kostenfreien-datenbanken-stand-april-2022","title":"Liste von bekannten (kostenfreien) Datenbanken | Stand April 2022","text":"
      • SecurityInfo - kostenlose ClamAV DBs f\u00fcr Testzwecke. Registrierung der IP Adresse des Servers erforderlich (dann nutzbar f\u00fcr besagte IP).
      • InterServer - kostenlose ClamAV DBs. F\u00fcr E-Mail Zwecke eher ungeeignet.
      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#securiteinfo-datenbank-aktivieren","title":"SecuriteInfo Datenbank aktivieren","text":""},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#arbeiten-im-clamav","title":"Arbeiten im ClamAV","text":"
      1. Kostenfreien Account auf https://www.securiteinfo.com/clients/customers/signup erstellen.
      2. Sie erhalten eine E-Mail um Ihren Account zu aktivieren gefolgt von einer E-Mail mit Ihrem Login Namen.
      3. Loggen Sie sich ein und navigieren Sie zu Ihrem Account https://www.securiteinfo.com/clients/customers/account
      4. Klicken Sie auf den 'Setup' Reiter.
      5. Sie brauchen your_id von den Downloadlinks. Diese sind pro User individuell.

      6. F\u00fcgen Sie diese wie folgt in die data/conf/clamav/freshclam.conf ein und ersetzen Sie den your_id Teil mit Ihrer ID: 

        DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.ign2\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/javascript.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/spam_marketing.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfohtml.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfoascii.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfopdf.hdb\n

      7. Bei den kostenlosen SecuriteInfo Datenbanken ist die Download-Geschwindigkeit auf 300 kB/s begrenzt. \u00c4ndern Sie in data/conf/clamav/freshclam.conf den Standardwert ReceiveTimeout 20 auf ReceiveTimeout 90 (Zeitangabe in Sekunden), da ansonsten einige der Datenbank-Downloads aufgrund ihrer Gr\u00f6\u00dfe abbrechen k\u00f6nnen.

      8. Passen Sie data/conf/clamav/clamd.conf mit den folgenden Einstellungen an: 

        DetectPUA yes\nExcludePUA PUA.Win.Packer\nExcludePUA PUA.Win.Trojan.Packed\nExcludePUA PUA.Win.Trojan.Molebox\nExcludePUA PUA.Win.Packer.Upx\nExcludePUA PUA.Doc.Packed\nMaxScanSize 150M\nMaxFileSize 100M\nMaxRecursion 40\nMaxEmbeddedPE 100M\nMaxHTMLNormalize 50M\nMaxScriptNormalize 50M\nMaxZipTypeRcg 50M\n

      9. Starten Sie den ClamAV Container neu:
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart clamd-mailcow\n
      docker-compose restart clamd-mailcow\n

      Bitte beachten Sie:

      • Sie k\u00f6nnen ExcludePUA und IncludePUA in der clamd.conf nicht gleichzeitig nutzen! Kommentieren Sie bitte IncludePUA aus, sollte es nicht auskommentiert sein.
      • Die Liste der Datenbanken genutzt in diesem Beispiel sollten f\u00fcr die meisten F\u00e4lle passen. SecuriteInfo bietet jedoch noch andere Datenbanken an. Bitte schauen Sie sich das SecuriteInfo FAQ f\u00fcr weitere Informationen an.
      • Mit den neu eingestellten Datenbanken (und den Standard Datenbanken) ClamAV verbraucht ClamAV etwa 1,3 GB RAM des Servers.
      • Sollten Sie message_size_limit in Postfix ver\u00e4ndert haben m\u00fcssen Sie die MaxSize Einstellung in ClamAV auf den selben Wert eintragen.
      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#arbeiten-im-rspamd","title":"Arbeiten im Rspamd","text":"

      Achtung

      mailcow mit der Version >= 2023-07 wird ben\u00f6tigt, damit die folgende Anleitung funktioniert, da sie die vordefinierten Scores f\u00fcr SecuriteInfo-Signaturen enth\u00e4lt!

      Nun haben Sie zwar die ClamAV-Signaturen hinzugef\u00fcgt, werden aber feststellen, dass Rspamd diese nicht korrekt verwendet bzw. ALLES gnadenlos als VIRUS abstempelt.

      Wir k\u00f6nnen Rspamd aber mit ein wenig Handarbeit z\u00e4hmen, so dass er nicht v\u00f6llig aus dem Ruder l\u00e4uft.

      Dazu gehen wir wie folgt vor:

      1. F\u00fcgen Sie folgendes in data/conf/rspamd/local.d/antivirus.conf ein:
      patterns {\n  # Extra Signatures (Securite) Not shipped with mailcow.\n  CLAM_SECI_SPAM = \"^SecuriteInfo\\.com\\.Spam.*\";\n  CLAM_SECI_JPG = \"^SecuriteInfo\\.com\\.JPG.*\";\n  CLAM_SECI_PDF = \"^SecuriteInfo\\.com\\.PDF.*\";\n  CLAM_SECI_HTML = \"^SecuriteInfo\\.com\\.HTML.*\";\n  CLAM_SECI_JS = \"^SecuriteInfo\\.com\\.JS.*\";\n}\n
      1. Starten Sie den Rspamd neu:
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Nun wird Rspamd die von uns angegebene Gewichtung f\u00fcr die einzelnen Signaturen anwenden, anstatt alles mit einem Wert von 2000 als VIRUS zu markieren und damit abzulehnen.

      Info

      Sie k\u00f6nnen die Gewichtungen jederzeit \u00e4ndern:

      data/conf/rspamd/local.d/composites.conf

      Auch die zu registrierenden Strings des ClamAV k\u00f6nnen Sie manuell einstellen/anpassen.

      Nutzen Sie dazu einfach das gerade eben vorgegebene Schema in der antivirus.conf des Rspamd.

      Achtung

      Bitte beachten Sie, dass die Dateien antivirus.conf und composites.conf durch ein mailcow-Update \u00fcberschrieben werden k\u00f6nnen.

      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#interserver-datenbanken-aktivieren","title":"InterServer Datenbanken aktivieren","text":"
      1. F\u00fcgen Sie folgendes in data/conf/clamav/freshclam.conf ein: 
        DatabaseCustomURL http://sigs.interserver.net/interserver256.hdb\nDatabaseCustomURL http://sigs.interserver.net/interservertopline.db\nDatabaseCustomURL http://sigs.interserver.net/shell.ldb\nDatabaseCustomURL http://sigs.interserver.net/whitelist.fp\n
      2. Starten Sie den ClamAV Container neu:
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart clamd-mailcow\n
      docker-compose restart clamd-mailcow\n
      "},{"location":"de/manual-guides/ClamAV/u_e-clamav-whitelist/#whitelist-fur-bestimmte-clamav-signaturen","title":"Whitelist f\u00fcr bestimmte ClamAV-Signaturen","text":"

      Es kann vorkommen, dass legitime (saubere) Mails von ClamAV blockiert werden (Rspamd markiert die Mail mit VIRUS_FOUND). So werden beispielsweise interaktive PDF-Formularanh\u00e4nge standardm\u00e4\u00dfig blockiert, da der eingebettete Javascript-Code f\u00fcr sch\u00e4dliche Zwecke verwendet werden k\u00f6nnte. \u00dcberpr\u00fcfen Sie dies anhand der clamd-Protokolle, z.B.:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs clamd-mailcow | grep \"FOUND\"\n
      docker-compose logs clamd-mailcow | grep \"FOUND\"\n

      Diese Zeile best\u00e4tigt, dass ein solcher identifiziert wurde:

      clamd-mailcow_1 | Sat Sep 28 07:43:24 2019 -> instream(local): PUA.Pdf.Trojan.EmbeddedJavaScript-1(e887d2ac324ce90750768b86b63d0749:363325) FOUND\n

      Um diese spezielle Signatur auf die Whitelist zu setzen (und den Versand dieses Dateityps im Anhang zu erm\u00f6glichen), f\u00fcgen Sie sie der ClamAV-Signatur-Whitelist-Datei hinzu:

      echo 'PUA.Pdf.Trojan.EmbeddedJavaScript-1' >> data/conf/clamav/whitelist.ign2\n

      Dann starten Sie den clamd-mailcow Service Container in der mailcow UI oder mit docker compose neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart clamd-mailcow\n
      docker-compose restart clamd-mailcow\n

      Bereinigen Sie zwischengespeicherte ClamAV-Ergebnisse in Redis:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
      docker-compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
      "},{"location":"de/manual-guides/Docker/u_e-docker-cust_dockerfiles/","title":"Dockerfiles anpassen","text":"

      Sie m\u00fcssen die Override-Datei mit den entsprechenden Build-Tags in den mailcow: dockerized Root-Ordner (d.h. /opt/mailcow-dockerized) kopieren: 

      cp helper-scripts/docker-compose.override.yml.d/BUILD_FLAGS/docker-compose.override.yml docker-compose.override.yml\n

      Nehmen Sie Ihre \u00c4nderungen in data/Dockerfiles/$service vor und erstellen Sie das Image lokal: 

      docker build data/Dockerfiles/$service -t mailcow/$service:$tag\n
      (Ohne pers\u00f6nlichen :$tag wird automatisch :latest verwendet.)

      Nun muss dieser gerade erstellte Container in docker-compose.override.yml aktiviert werden, z.B.: 

      $service-mailcow:\n    build: ./data/Dockerfiles/$service\n    image: mailcow/$service:$tag\n

      Abschliessend m\u00fcssen die ge\u00e4nderten Container automatisch neu erstellt werden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-any_acl/","title":"Aktivierung von \"any\" ACL-Einstellungen","text":"

      Am 17. August haben wir die M\u00f6glichkeit, mit \"jedem\" oder \"allen authentifizierten Benutzern\" zu teilen, standardm\u00e4\u00dfig deaktiviert.

      Diese Funktion kann wieder aktiviert werden, indem ACL_ANYONE auf allow in mailcow.conf gesetzt wird:

      ACL_ANYONE=allow\n

      Wenden Sie die \u00c4nderungen an, indem Sie den Docker Stack neustarten mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-catchall_vacation/","title":"Urlaubsantworten f\u00fcr Catchall-Adressen","text":"

      Der Dovecot-Parameter sieve_vacation_dont_check_recipient - der in mailcow-Konfigurationen vor dem 21. Juli 2021 standardm\u00e4\u00dfig auf yes gesetzt war - erlaubt Urlaubsantworten auch dann, wenn eine Mail an nicht existierende Mailboxen wie Catch-All-Adressen gesendet wird.

      Wir haben uns entschlossen, diesen Parameter wieder auf no zu setzen und dem Benutzer zu erlauben, die Empf\u00e4ngeradresse zu spezifizieren, die eine Urlaubsantwort ausl\u00f6st. Die ausl\u00f6senden Empf\u00e4nger k\u00f6nnen auch in SOGos Autoresponder-Funktion konfiguriert werden.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/","title":"L\u00f6schen der Mails eines Benutzers","text":"

      Wenn Sie alte Mails aus den Ordnern .Junk oder .Trash l\u00f6schen wollen oder vielleicht alle gelesenen Mails, die \u00e4lter als eine bestimmte Zeitspanne sind, k\u00f6nnen Sie das dovecot-Tool doveadm man doveadm-expunge verwenden.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#der-manuelle-weg","title":"Der manuelle Weg","text":"

      Dann wollen wir mal loslegen:

      L\u00f6schen Sie die Mails eines Benutzers im Junk-Ordner, die gelesen und \u00e4lter als 4 Stunden sind

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n
      docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n

      L\u00f6sche alle Mails des Benutzers im Junk-Ordner, die \u00e4lter als 7 Tage sind

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n
      docker-compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n

      L\u00f6scht alle Mails (aller Benutzer) in allen Ordnern, die \u00e4lter als 52 Wochen sind (internes Datum der Mail, nicht das Datum, an dem sie auf dem System gespeichert wurde => before statt savedbefore). N\u00fctzlich zum L\u00f6schen sehr alter Mails in allen Benutzern und Ordnern (daher besonders n\u00fctzlich f\u00fcr GDPR-Compliance).

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n
      docker-compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n

      L\u00f6schen von Mails in einem benutzerdefinierten Ordner innerhalb des Posteingangs eines Benutzers, die nicht gekennzeichnet und \u00e4lter als 2 Wochen sind

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n
      docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n

      Info

      F\u00fcr m\u00f6gliche Zeitspannen oder SearchQuery schauen Sie bitte in man doveadm-search-query

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#job-scheduler","title":"Job-Scheduler","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#uber-das-host-system-cron","title":"\u00fcber das Host-System cron","text":"

      Wenn Sie eine solche Aufgabe automatisieren wollen, k\u00f6nnen Sie einen Cron-Job auf Ihrem Rechner erstellen, der ein Skript wie das folgende aufruft:

      docker compose (Plugin)docker-compose (Standalone) 
      #!/bin/bash\n# Pfad zu mailcow-dockerized, z.B. /opt/mailcow-dockerized\ncd /pfad/zu/ihrer/mailcow-dockerized\n\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n
      #!/bin/bash\n# Pfad zu mailcow-dockerized, z.B. /opt/mailcow-dockerized\ncd /pfad/zu/ihrer/mailcow-dockerized\n\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n

      Um einen Cronjob zu erstellen, k\u00f6nnen Sie crontab -e ausf\u00fchren und etwas wie das Folgende einf\u00fcgen, um ein Skript auszuf\u00fchren:

      # Jeden Tag um 04:00 Uhr morgens ausf\u00fchren.\n0 4 * * * /pfad/zu/ihr/expunge_mailboxes.sh\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#uber-docker-job-scheduler","title":"\u00fcber Docker Job Scheduler","text":"

      Um dies mit einem Docker-Job-Scheduler zu archivieren, verwenden Sie diese docker-compose.override.yml mit Ihrer mailcow: 

      services:\n\n  dovecot-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.dovecot-expunge-trash.schedule: \"0 0 4 * * *\"\n      ofelia.job-exec.dovecot-expunge-trash.command: \"doveadm expunge -A mailbox 'Junk' savedbefore 2w\"\n      ofelia.job-exec.dovecot-expunge-trash.tty: \"false\"\n

      Wir f\u00fcgen unserem Dovecot-Container ein paar Labels hinzu, um den Job-Scheduler zu aktivieren und ihm in einem Cron-kompatiblen Scheduling-Format mitzuteilen, wann er laufen soll. Hinweis: Ofelia verwendet das Scheduling-Format der Cron-Implementierung von Go, die mit einem Eintrag f\u00fcr Sekunden statt f\u00fcr Minuten beginnt.

      Diese docker-compose.override.yml l\u00f6scht jeden Tag um 4 Uhr morgens alle Mails, die \u00e4lter als 2 Wochen sind, aus dem Ordner \"Junk\". Um zu sehen, ob alles richtig gelaufen ist, k\u00f6nnen Sie nicht nur in Ihrer Mailbox nachsehen, sondern auch im Docker-Log von Ofelia, ob es etwa so aussieht:

      common.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Started - doveadm expunge -A mailbox 'Junk' savedbefore 2w,\ncommon.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Finished in \"285.032291ms\", failed: false, skipped: false, error: none,\n

      Wenn der Vorgang fehlgeschlagen ist, wird dies angegeben und die Ausgabe von doveadm im Protokoll aufgef\u00fchrt, um Ihnen die Fehlersuche zu erleichtern.

      Falls Sie weitere Jobs hinzuf\u00fcgen wollen, stellen Sie sicher, dass Sie den \"dovecot-expunge-trash\"-Teil nach \"ofelia.job-exec.\" in etwas anderes \u00e4ndern, er definiert den Namen des Jobs. Die Syntax der Labels finden Sie unter mcuadros/ofelia.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-extra_conf/","title":"Anpassen/Erweitern von dovecot.conf","text":"

      Erstellen Sie eine Datei data/conf/dovecot/extra.conf - falls nicht vorhanden - und f\u00fcgen Sie Ihren zus\u00e4tzlichen Inhalt hier ein.

      Starten Sie dovecot-mailcow neu, um Ihre \u00c4nderungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart dovecot-mailcow\n
      docker-compose restart dovecot-mailcow\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/","title":"Volltext Suche (FTS)","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-solr-deprecated","title":"FTS Solr (Deprecated)","text":"

      Achtung

      Solr wird nur noch bis Dezember 2024 unterst\u00fctzt und anschlie\u00dfend aus mailcow entfernt und mit Flatcurve ersetzt.

      Solr wird f\u00fcr Setups mit Speicher >= 3,5 GiB verwendet, um eine Volltextsuche in Dovecot zu erm\u00f6glichen.

      Bitte beachten Sie, dass Anwendungen wie Solr vielleicht von Zeit zu Zeit gewartet werden m\u00fcssen.

      Au\u00dferdem verbraucht Solr eine Menge RAM, abh\u00e4ngig von der Nutzung Ihres Servers. Bitte vermeiden Sie es auf Maschinen mit weniger als 3 GiB RAM.

      Die Standard-Heap-Gr\u00f6\u00dfe (1024 M) ist in mailcow.conf definiert.

      Da wir in Docker laufen und unsere Container mit dem \"restart: always\" Flag erstellen, wird eine OOM-Situation zumindest nur einen Neustart des Containers ausl\u00f6sen.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-flatcurve-experimentell-seit-2024-06","title":"FTS Flatcurve (Experimentell seit 2024-06)","text":"

      Flatcurve wird in naher Zukunft die bisherige FTS Engine Solr abl\u00f6sen, damit eine Volltextsuche auch auf leistungsschw\u00e4cheren Systemen besser funktioniert.

      Beginnend mit dem Juni 2024 Update wurde eine experimentelle Unterst\u00fctzung f\u00fcr Flatcurve als Volltextsuche eingebaut, welche sich in der experimentellen Phase ausschlie\u00dflich \u00fcber eine mailcow.conf-Variable aktivieren l\u00e4sst.

      Hinweis

      mailcow gibt in der \u00dcbergangszeit die Konfiguration f\u00fcr die FTS Engine innerhalb Dovecots vor und \u00fcberschreibt etwaige eigene \u00c4nderungen (wenn nicht explizit in der extra.conf definiert). Dies wird aber mit dem Full Release der Engine innerhalb mailcows nicht mehr der Fall sein.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#aktivierung-der-experimentellen-flatcurve-nutzung","title":"Aktivierung der experimentellen Flatcurve-Nutzung","text":"

      Die Aktivierung ist simpel und erfordert nur zwei kleine Handgriffe:

      1. mailcow.conf bearbeiten und folgenden Wert erg\u00e4nzen:

        FLATCURVE_EXPERIMENTAL=y\n

      2. mailcow neu starten:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

      mailcow wird nun Flatcurve als FTS Backend nutzen.

      Anders als bei Solr ist f\u00fcr Flatcurve kein weiteres Docker-Volume notwendig. Flatcurve speichert seine FTS-Datenbanken in dem vmail-index-Volume und f\u00fchrt zu einer \u00e4hnlichen Ordnerstruktur wie:

      /var/vmail_index/tester@develcow.de/.INBOX/\n\u251c\u2500\u2500 dovecot.index\n\u251c\u2500\u2500 dovecot.index.cache\n\u251c\u2500\u2500 dovecot.index.log\n\u2514\u2500\u2500 fts-flatcurve\n    \u2514\u2500\u2500 index.814\n        \u251c\u2500\u2500 flintlock\n        \u251c\u2500\u2500 iamglass\n        \u251c\u2500\u2500 postlist.glass\n        \u2514\u2500\u2500 termlist.glass\n

      Jeder Unterordner im IMAP-Server erh\u00e4lt so analog einen eigenen fts-flatcurve-Ordner mit den jeweiligen Indizes der Mails des Ordners.

      Hinweis

      Der Solr-Container bleibt in der \u00dcbergangszeit (voraussichtlich bis Dezember 2024) noch immer erhalten, um einen flie\u00dfenden \u00dcbergang zu erm\u00f6glichen.

      Achtung

      Sollten Sie sich f\u00fcr den Wechsel der FTS Engine entscheiden, ist eine komplette Reindexierung vonn\u00f6ten, da die beiden Systeme nicht untereinander kompatibel sind. Weiter unten erfahren Sie, wie Sie eine Reindexierung ansto\u00dfen k\u00f6nnen.

      Wir empfehlen allerdings, diese Reindexierung nur unter Aufsicht durchzuf\u00fchren, da trotz niedriger Systemanforderungen eine \u00fcberm\u00e4\u00dfige Systemauslastung nicht ausgeschlossen werden kann!

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-bezogene-dovecot-befehle","title":"FTS-bezogene Dovecot-Befehle","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-auf-fehler-uberprufen-und-ggfs-reparieren","title":"FTS-Datenbank auf Fehler \u00fcberpr\u00fcfen und ggfs. reparieren","text":"docker compose (Plugin)docker-compose (Standalone) 
      # Einzelbenutzer\ndocker compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# alle Benutzer\ndocker compose exec dovecot-mailcow doveadm fts rescan -A\n
      # Einzelbenutzer\ndocker-compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# alle Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts rescan -A\n

      Dovecot Wiki: \"Scannt, welche Mails im Volltextsuchindex vorhanden sind und vergleicht diese mit den tats\u00e4chlich in den Postf\u00e4chern vorhandenen Mails. Dies entfernt Mails aus dem Index, die bereits gel\u00f6scht wurden und stellt sicher, dass der n\u00e4chste doveadm-Index alle fehlenden Mails (falls vorhanden) indiziert.\"

      Dies indiziert nicht eine Mailbox neu. Es repariert im Grunde einen gegebenen Index.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-neu-indizieren-reindex","title":"FTS-Datenbank neu indizieren (Reindex)","text":"

      Wenn Sie die Daten sofort neu indizieren wollen, k\u00f6nnen Sie den folgenden Befehl ausf\u00fchren, wobei * auch eine Postfachmaske wie 'Sent' sein kann. Sie m\u00fcssen diese Befehle nicht ausf\u00fchren, aber es wird die Dinge ein wenig beschleunigen:

      docker compose (Plugin)docker-compose (Standalone) 
      # einzelner Benutzer\ndocker compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# alle Benutzer, aber offensichtlich langsamer und gef\u00e4hrlicher\ndocker compose exec dovecot-mailcow doveadm index -A '*'\n
      # einzelner Benutzer\ndocker-compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# alle Benutzer, aber offensichtlich langsamer und gef\u00e4hrlicher\ndocker-compose exec dovecot-mailcow doveadm index -A '*'\n

      Hinweis

      Die Indizierung wird einige Zeit in Anspruch nehmen.

      Es besteht, je nach FTS Engine, die M\u00f6glichkeit einer \u00fcberm\u00e4\u00dfig starken Systemnutzung, bis hin zu Systemabst\u00fcrzen in seltenen F\u00e4llen. \u00dcberwachen Sie also den Indizierungsprozess und Ihre Systemauslastung wachsam!

      Da die Neuindizierung teilweise etwas fragil und gerade im Bezug auf Systemressourcen sensibel reagieren kann, haben wir sie nicht in die mailcow UI integriert.

      Sie m\u00fcssen sich manuell via CLI um eventuelle Fehler beim Re-Indizieren einer Mailbox k\u00fcmmern.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-loschen","title":"FTS-Datenbank l\u00f6schen","text":"

      mailcow wird die Indexdaten eines Benutzers automatisch l\u00f6schen, wenn die entsprechende Mailbox gel\u00f6scht wird.

      Alternativ kann der Index f\u00fcr Flatcurve via CLI manuell gel\u00f6scht werden:

      docker compose (Plugin)docker-compose (Standalone) 
      # einzelner Benutzer\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# alle Benutzer\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
      # einzelner Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# alle Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-harden_ciphers/","title":"Ciphers verst\u00e4rken","text":"

      Wenn Sie die Standard-Cipher und TLS-Versionen, die in Dovecot akzeptiert werden, entsprechend der aktuellen Version auf st\u00e4rkere Einstellungen \u00e4ndern m\u00f6chten, k\u00f6nnen Sie Folgendes zu Dovecots extra.conf hinzuf\u00fcgen:

      ssl_min_protocol = TLSv1.2\nssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305\n

      Falls Sie auch die Cipher f\u00fcr Postfix anpassen wollen finden Sie hier eine entsprechende Anleitung.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/","title":"\u00c4ndern des IMAP-IDLE-Intervalls","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#was-ist-das-idle-intervall","title":"Was ist das IDLE-Intervall?","text":"

      Standardm\u00e4\u00dfig sendet Dovecot eine \"Ich bin noch da\"-Benachrichtigung an jeden Client, der eine offene Verbindung mit Dovecot hat, um Mails so schnell wie m\u00f6glich zu erhalten, ohne sie manuell abzufragen (IMAP PUSH). Diese Benachrichtigung wird durch die Einstellung imap_idle_notify_interval gesteuert, die standardm\u00e4\u00dfig auf 2 Minuten eingestellt ist.

      Ein kurzes Intervall f\u00fchrt dazu, dass der Client viele Nachrichten f\u00fcr diese Verbindung erh\u00e4lt, was f\u00fcr mobile Ger\u00e4te schlecht ist, da jedes Mal, wenn das Ger\u00e4t diese Nachricht erh\u00e4lt, die Mailing-App aufwachen muss. Dies kann zu einer unn\u00f6tigen Entladung der Batterie f\u00fchren.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#bearbeiten-sie-den-wert","title":"Bearbeiten Sie den Wert","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#konfiguration-andern","title":"Konfiguration \u00e4ndern","text":"

      Erstellen Sie eine neue Datei data/conf/dovecot/extra.conf (oder bearbeiten Sie sie, falls sie bereits existiert). F\u00fcgen Sie die Einstellung ein, gefolgt von dem neuen Wert. Um zum Beispiel das Intervall auf 5 Minuten zu setzen, k\u00f6nnen Sie Folgendes eingeben:

      imap_idle_notify_interval = 5 mins\n

      29 Minuten ist der maximale Wert, den der entsprechende RFC erlaubt.

      Warnung

      Dies ist keine Standardeinstellung in mailcow, da wir nicht wissen, wie diese Einstellung das Verhalten anderer Clients ver\u00e4ndert. Seien Sie vorsichtig, wenn Sie dies \u00e4ndern und ein anderes Verhalten beobachten.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#dovecot-neu-laden","title":"Dovecot neu laden","text":"

      Nun laden Sie Dovecot neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow dovecot reload\n
      docker-compose exec dovecot-mailcow dovecot reload\n

      Info

      Sie k\u00f6nnen den Wert dieser Einstellung \u00fcberpr\u00fcfen mit

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n
      docker-compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n

      Wenn Sie den Wert nicht ge\u00e4ndert haben, sollte er auf 2m stehen. Wenn Sie ihn ge\u00e4ndert haben, sollten Sie den neuen Wert sehen.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/","title":"Verz\u00f6gertes L\u00f6schen (Dovecot Plugin)","text":"

      Vorsicht

      Diese Anleitung befindet sich noch in Arbeit, Fehler k\u00f6nnen passieren! Nutzen Sie diese Funktion mit Bedacht!

      Hinweis

      Diese Funktion ist ab mailcow-Versionen 2024-11 kompatibel. \u00c4ltere Versionen sind theoretisch ebenfalls in der Lage, die Funktion zu nutzen. Aufgrund interner \u00c4nderungen ist die Implementierung jedoch schwieriger und wird hier nicht weiter beschrieben, da nicht unterst\u00fczt.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#vorwort","title":"Vorwort","text":"

      Dovecot unterst\u00fctzt seit geraumer Zeit eine Funktion namens Lazy Expunge, welche es dem Serveradministrator erm\u00f6glicht, gel\u00f6schte E-Mails eines Benutzerkontos nach der eigentlichen L\u00f6schung zur\u00fcckzuhalten.

      mailcow besitzt eine \u00e4hnliche Funktion, die jedoch f\u00fcr Benutzer nicht so leicht zug\u00e4nglich ist (siehe Versehentlich gel\u00f6schte Daten wiederherstellen (Mail)) und eher als Fallback-Methode f\u00fcr Administratoren dient.

      Mit der Dovecot-Option k\u00f6nnen Benutzer selbst als gel\u00f6scht markierte E-Mails einsehen und wiederherstellen, bevor diese dann automatisch vom Dovecot-Server gel\u00f6scht werden.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#einrichtung","title":"Einrichtung","text":"

      1. Bearbeiten Sie die extra.conf im Dovecot-Konfigurationsordner (in der Regel unter MAILCOW_ROOT/data/conf/dovecot) mit folgendem Inhalt: 

        plugin {\n    # Kopiere alle gel\u00f6schten Mails in die .EXPUNGED Mailbox\n    lazy_expunge = .EXPUNGED\n\n    # Als gel\u00f6scht markierte Mails von der Quota ausschlie\u00dfen\n    quota_rule = .EXPUNGED:ignore\n}\n\n# Definiert die .EXPUNGED Mailbox\nnamespace inbox {\n    mailbox .EXPUNGED {\n        # Definiert, wie lange Mails in diesem Ordner bleiben sollen, bevor sie gel\u00f6scht werden. \n        # Zeit wird definiert nach: https://doc.dovecot.org/2.3/settings/types/#time\n        autoexpunge = 7days\n        # Definiert, wie viele Mails maximal in der EXPUNGED Mailbox gehalten werden sollen, bevor diese geleert wird\n        autoexpunge_max_mails = 100000\n    }\n}\n

      2. Starten Sie den Dovecot-Container neu:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart dovecot-mailcow\n
        docker-compose restart dovecot-mailcow\n

      3. Nun sollte, wenn der Papierkorb geleert wird, ein neuer Ordner mit dem Namen .EXPUNGED erscheinen. In diesem Ordner sind die E-Mails enthalten, die gem\u00e4\u00df der in Schritt 1 definierten Regeln nach einer gewissen Zeit automatisch vom Server gel\u00f6scht werden.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-mail-crypt/","title":"Mail crypt","text":"

      Achtung

      Die Mails werden komprimiert (lz4) und verschl\u00fcsselt gespeichert. Das Schl\u00fcsselpaar ist in crypt-vol-1 zu finden.

      Wenn Sie vorhandene maildir-Dateien entschl\u00fcsseln/verschl\u00fcsseln wollen, k\u00f6nnen Sie das folgende Skript auf eigene Gefahr verwenden:

      Wechseln Sie in den Dovecot Container, indem Sie folgenden Befehl im mailcow-dockerized Verzeichnis ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow /bin/bash\n
      docker-compose exec dovecot-mailcow /bin/bash\n
      # Entschl\u00fcsseln Sie /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") == \"CRYPTED\" ]]; then\ndoveadm fs get compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" > \"/tmp/$(basename \"$file\")\"\n  if [[ -s \"/tmp/$(basename \"$file\")\" ]]; then\n    chmod 600 \"/tmp/$(basename \"$file\")\"\n    chown 5000:5000 \"/tmp/$(basename \"$file\")\"\n    mv \"/tmp/$(basename \"$file\")\" \"$file\"\n  else\n    rm \"/tmp/$(basename \"$file\")\"\n  fi\nfi\ndone\n\n\n# Verschl\u00fcsseln von /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") != \"CRYPTED\" ]]; then\ndoveadm fs put crypt private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" \"$file\"\n  chmod 600 \"$file\"\n  chown 5000:5000 \"$file\"\nfi\ndone\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/","title":"Weitere Beispiele mit DOVEADM","text":"

      Hier ist nur eine unsortierte Liste von n\u00fctzlichen doveadm-Befehlen, die n\u00fctzlich sein k\u00f6nnten.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/#doveadm-quota","title":"doveadm quota","text":"

      Die Befehle quota get und quota recalc1 werden verwendet, um die Quota-Nutzung des aktuellen Benutzers anzuzeigen oder neu zu berechnen. Die angezeigten Werte sind in Kilobytes.

      Um den aktuellen Quota-Status f\u00fcr einen Benutzer / eine Mailbox aufzulisten, tun Sie folgendes:

      doveadm quota get -u 'mailbox@example.org'\n

      Um den Quota-Speicherwert f\u00fcr alle Benutzer aufzulisten, tun Sie folgendes:

      doveadm quota get -A |grep \"STORAGE\"\n

      Berechnen Sie die Quota-Nutzung eines einzelnen Benutzers neu:

      doveadm quota recalc -u 'mailbox@example.org'\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/#doveadm-search","title":"doveadm search","text":"

      Der Befehl doveadm search2 wird verwendet, um Nachrichten zu finden, die Ihrer Anfrage entsprechen. Er kann den Benutzernamen, die Mailbox-GUID / -UID und die Nachrichten-GUIDs / -UIDs zur\u00fcckgeben.

      Um die Anzahl der Nachrichten im .Trash Ordner eines Benutzers zu sehen:

      doveadm search -A mailbox 'Trash' | awk '{print $1}' | sort | uniq -c\n

      Alle Nachrichten im Postfach eines Benutzers anzeigen, die \u00e4lter als 90 Tage sind:

      doveadm search -u 'mailbox@example.org' mailbox 'INBOX' savedbefore 90d\n

      Zeige alle Nachrichten in beliebigen Ordnern, die \u00e4lter sind als 30 Tage f\u00fcr mailbox@example.org:

      doveadm search -u 'mailbox@example.org' mailbox \"*\" savedbefore 30d\n

      1. https://wiki.dovecot.org/Tools/Doveadm/Quota \u21a9

      2. https://wiki.dovecot.org/Tools/Doveadm/Search \u21a9

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-performance/","title":"Performance Optimierungen","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-performance/#maildir_very_dirty_syncs","title":"maildir_very_dirty_syncs","text":"

      Dovecot's maildir_very_dirty_syncs Option ist seit mailcow Release 2023-05 standardm\u00e4\u00dfig aktiviert. Diese Option kann die Leistung von Postf\u00e4chern, die sehr gro\u00dfe Ordner (\u00fcber 100.000 E-Mails) enthalten, erheblich verbessern.

      Mit dieser Option wird vermieden, dass beim Laden einer E-Mail das gesamte cur-Verzeichnis erneut durchsucht wird. Wenn diese Option deaktiviert ist, geht Dovecot auf Nummer sicher und durchsucht das gesamte cur-Verzeichnis (vergleichbar mit dem Ausf\u00fchren eines ls), um zu pr\u00fcfen, ob diese bestimmte E-Mail ber\u00fchrt (umbenannt, etc.) wurde, indem es nach allen Dateien sucht, deren Namen die richtige ID enthalten. Dies ist sehr langsam, wenn das Verzeichnis gro\u00df ist, selbst auf Dateisystemen, die f\u00fcr solche Anwendungsf\u00e4lle optimiert sind (wie ext4 mit aktiviertem dir_index) auf schnellen SSD-Laufwerken.

      Diese Option ist sicher, solange Sie Dateien unter cur nicht manuell anfassen (da Dovecot die \u00c4nderungen dann m\u00f6glicherweise nicht bemerkt). Auch wenn diese Option aktiviert ist, wird Dovecot \u00c4nderungen bemerken, wenn die mtime (last modified time) der Datei ge\u00e4ndert wurde, aber ansonsten wird das Verzeichnis nicht gescannt und es wird einfach angenommen, dass der Index aktuell ist. Dies entspricht im Wesentlichen dem, was sdbox/mdbox tun, und mit dieser Option k\u00f6nnen Sie einen Teil der Leistungssteigerung erhalten, die mit sdbox/mdbox einhergehen w\u00fcrde, w\u00e4hrend Sie weiterhin maildir verwenden.

      Diese Option ist bei einer Standard-mailcow-Installation sicher zu verwenden. Wenn Sie jedoch Tools von Drittanbietern verwenden, die manuell Dateien direkt im Maildir modifizieren (anstatt \u00fcber IMAP), m\u00f6chten Sie diese Option vielleicht deaktivieren. Um diese Option zu deaktivieren, erstellen Sie eine data/conf/dovecot/extra.conf Datei und f\u00fcgen Sie diese Einstellung hinzu:

      maildir_very_dirty_syncs=no\n

      Achtung

      Bitte nutzen Sie f\u00fcr eigene Anpassungen IMMER, die oben erw\u00e4hnte extra.conf, da \u00c4nderungen, welche in der normalen dovecot.conf ge\u00e4ndert werden m\u00f6glicherweise nach einem Update vom GitHub Quellcode \u00fcberschrieben werden.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-public_folder/","title":"\u00d6ffentliche Ordner","text":"

      Erstellen Sie einen neuen \u00f6ffentlichen Namespace \"Public\" und eine Mailbox \"Develcow\" innerhalb dieses Namespaces:

      Bearbeiten oder erstellen Sie data/conf/dovecot/extra.conf, f\u00fcgen Sie hinzu:

      namespace {\n  type = public\n  separator = /\n  prefix = Public/\n  location = maildir:/var/vmail/public:INDEXPVT=~/public\n  subscriptions = yes\n  mailbox \"Develcow\" {\n    auto = subscribe\n  }\n}\n

      :INDEXPVT=~/public kann weggelassen werden, wenn die Flags, die pro Benutzer gesehen werden, nicht gew\u00fcnscht sind.

      Die neue Mailbox im \u00f6ffentlichen Namensraum wird von den Benutzern automatisch abonniert.

      Um allen authentifizierten Benutzern vollen Zugriff auf das neue Postfach (nicht auf den gesamten Namespace) zu gew\u00e4hren, f\u00fchren Sie aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n
      docker-compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n

      Passen Sie den Befehl an Ihre Bed\u00fcrfnisse an, wenn Sie detailliertere Rechte pro Benutzer vergeben m\u00f6chten (verwenden Sie z.B. -u user@domain anstelle von -A).

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-public_folder/#erlaube-authentifizierten-benutzern-den-zugriff-auf-den-gesamten-offentlichen-namespace","title":"Erlaube authentifizierten Benutzern den Zugriff auf den gesamten \u00f6ffentlichen Namespace","text":"

      Um allen authentifizierten Benutzern vollen Zugriff auf den gesamten \u00f6ffentlichen Namespace und seine Unterordner zu gew\u00e4hren, erstellen Sie eine neue Datei dovecot-acl im Namespace-Stammverzeichnis:

      \u00d6ffnen/bearbeiten/erstellen Sie /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/public/dovecot-acl (passen Sie den Pfad entsprechend an), um die globale ACL-Datei mit dem folgenden Inhalt zu erstellen:

      authenticated kxeilprwts\n

      kxeilprwts\" ist gleichbedeutend mit \"lookup read write write-seen write-deleted insert post delete expunge create\".

      Sie k\u00f6nnen doveadm acl set -u user@domain \"Public/Develcow\" user=user@domain lookup read verwenden, um den Zugriff f\u00fcr einen einzelnen Benutzer zu beschr\u00e4nken. Sie k\u00f6nnen es auch umdrehen und den Zugriff f\u00fcr alle Benutzer auf \"lr\" beschr\u00e4nken und nur einigen Benutzern vollen Zugriff gew\u00e4hren.

      Siehe Dovecot ACL f\u00fcr weitere Informationen \u00fcber ACL.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-static_master/","title":"Statischer Hauptbenutzer","text":"

      Zuf\u00e4llige Master-Benutzernamen und Passw\u00f6rter werden automatisch bei jedem Neustart von dovecot-mailcow erstellt.

      Das wird empfohlen und sollte nicht ge\u00e4ndert werden.

      Wenn der Benutzer trotzdem statisch sein soll, geben Sie bitte zwei Variablen in mailcow.conf an.

      Beide Parameter d\u00fcrfen nicht leer sein!

      DOVECOT_MASTER_USER=mymasteruser\nDOVECOT_MASTER_PASS=mysecretpass\n

      F\u00fchren Sie folgenden Befehl aus, um Ihre \u00c4nderungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Der statische Master-Benutzername wird zu DOVECOT_MASTER_USER@mailcow.local erweitert.

      Um sich als test@example.org anzumelden, w\u00fcrde dies test@example.org*mymasteruser@mailcow.local mit dem oben angegebenen Passwort entsprechen.

      Eine Anmeldung bei SOGo ist mit diesem Benutzernamen nicht m\u00f6glich. F\u00fcr Admins steht eine Click-to-Login-Funktion f\u00fcr SOGo zur Verf\u00fcgung, wie [hier] beschrieben (https://docs.mailcow.email/debug-admin_login_sogo/) Es wird kein Hauptbenutzer ben\u00f6tigt.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/","title":"Maildir verschieben (vmail)","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#der-neue-weg","title":"Der \"neue\" Weg","text":"

      Warnung

      Neuere Docker-Versionen scheinen sich \u00fcber bestehende Volumes zu beschweren. Man kann dies vor\u00fcbergehend beheben, indem man das bestehende Volume entfernt und mailcow mit der Override-Datei startet. Aber es scheint nach einem Neustart problematisch zu sein (muss best\u00e4tigt werden).

      Ein einfacher, schmutziger, aber stabiler Workaround ist es, mailcow zu stoppen, /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data zu entfernen und einen neuen Link zu Ihrem entfernten Dateisystem zu erstellen, zum Beispiel:

      mv /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data_backup\nln -s /mnt/volume-xy/vmail_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\n

      Starten Sie anschlie\u00dfend mailcow.

      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#der-alte-weg","title":"Der \"alte\" Weg","text":"

      Wenn man einen anderen Ordner f\u00fcr das vmail-Volume verwenden m\u00f6chte, kann man eine docker-compose.override.yml Datei erstellen und den folgenden Inhalt hinzuf\u00fcgen:

      volumes:\n  vmail-vol-1:\n    driver_opts:\n      type: none\n      device: /data/mailcow/vmail   \n      o: bind\n
      "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#verschieben-eines-bestehenden-vmail-ordners","title":"Verschieben eines bestehenden vmail-Ordners:","text":"
      • Finden Sie den aktuellen vmail-Ordner anhand seines \"Mountpoint\"-Attributs: docker volume inspect mailcowdockerized_vmail-vol-1
      [\n    {\n        \"CreatedAt\": \"2019-06-16T22:08:34+02:00\",\n        \"Driver\": \"local\",\n        \"Labels\": {\n            \"com.docker.compose.project\": \"mailcowdockerized\",\n            \"com.docker.compose.version\": \"1.23.2\",\n            \"com.docker.compose.volume\": \"vmail-vol-1\"\n        },\n        \"Mountpoint\": \"/var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\",\n        \"Name\": \"mailcowdockerized_vmail-vol-1\",\n        \"Options\": null,\n        \"Scope\": \"local\"\n    }\n]\n
      • Kopieren Sie den Inhalt des Mountpoint-Ordners an den neuen Speicherort (z.B. /data/mailcow/vmail) mit cp -a, rsync -a oder einem \u00e4hnlichen, nicht strikten Kopierbefehl
      • Stoppen Sie mailcow durch Ausf\u00fchren des kommenden Befehls aus Ihrem mailcow-Stammverzeichnis (z.B. /opt/mailcow-dockerized):
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\n
      docker-compose down    \n
      • Erstellen Sie die Datei docker-compose.override.yml, bearbeiten Sie den Ger\u00e4tepfad entsprechend
      • L\u00f6schen Sie den aktuellen vmail-Ordner: docker volume rm mailcowdockerized_vmail-vol-1
      • Starten Sie mailcow durch Ausf\u00fchren des folgenden Befehls aus Ihrem mailcow-Stammverzeichnis (z.B. /opt/mailcow-dockerized):
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/","title":"Benutzerdefinierte Seiten","text":""},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#ssl","title":"SSL","text":"

      Bitte lesen Sie Erweitertes SSL und \u00fcberpr\u00fcfen Sie explizit ADDITIONAL_SERVER_NAMES f\u00fcr die SSL-Konfiguration.

      Bitte f\u00fcgen Sie ADDITIONAL_SERVER_NAMES nicht hinzu, wenn Sie planen, einen anderen Web-Root zu verwenden.

      "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#neue-website","title":"Neue Website","text":"

      Um persistente (\u00fcber Updates) Sites zu erstellen, die von mailcow: dockerized gehostet werden, muss eine neue Site-Konfiguration in data/conf/nginx/ platziert werden:

      Eine gute Vorlage, um damit zu beginnen:

      nano data/conf/nginx/my_custom_site.conf\n
      server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  # Location: data/web\n  root /web;\n  # Location: data/web/mysite.com\n  #root /web/mysite.com\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name mysite.example.org;\n  server_tokens off;\n\n  # This allows acme to be validated even with a different web root\n  location ^~ /.well-known/acme-challenge/ {\n    default_type \"text/plain\";\n    rewrite /.well-known/acme-challenge/(.*) /$1 break;\n    root /web/.well-known/acme-challenge/;\n  }\n\n  if ($scheme = http) {\n    return 301 https://$server_name$request_uri;\n  }\n}\n
      "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#neue-website-mit-proxy-zu-einem-entfernten-location","title":"Neue Website mit Proxy zu einem entfernten Location","text":"

      Ein weiteres Beispiel mit einer Reverse-Proxy-Konfiguration:

      nano data/conf/nginx/my_custom_site.conf\n
      server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name example.domain.tld;\n  server_tokens off;\n\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  if ($scheme = http) {\n    return 301 https://$host$request_uri;\n  }\n\n  location / {\n    proxy_pass http://service:3000/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  }\n}\n
      "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#konfig-erweiterung-in-mailcows-nginx","title":"Konfig-Erweiterung in mailcows Nginx","text":"

      Der Dateiname, der f\u00fcr eine neue Site verwendet wird, ist nicht wichtig, solange der Dateiname eine .conf-Erweiterung tr\u00e4gt.

      Es ist auch m\u00f6glich, die Konfiguration der Standarddatei site.conf Datei zu erweitern:

      nano data/conf/nginx/site.my_content.custom\n

      Dieser Dateiname muss keine \".conf\"-Erweiterung haben, sondern folgt dem Muster site.*.custom, wobei * ein eigener Name ist.

      Wenn PHP in eine benutzerdefinierte Site eingebunden werden soll, verwenden Sie bitte den PHP-FPM-Listener auf phpfpm:9002 oder erstellen Sie einen neuen Listener in data/conf/phpfpm/php-fpm.d/pools.conf.

      Starten Sie Nginx neu (und PHP-FPM, falls ein neuer Listener erstellt wurde):

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart nginx-mailcow\ndocker compose restart php-fpm-mailcow\n
      docker-compose restart nginx-mailcow\ndocker-compose restart php-fpm-mailcow\n
      "},{"location":"de/manual-guides/Nginx/u_e-nginx_webmail-site/","title":"Subdom\u00e4ne webmail.example.org erstellen","text":"

      WICHTIG: Diese Anleitung gilt nur f\u00fcr Konfigurationen, bei denen SNI nicht aktiviert ist. Wenn SNI aktiviert ist, muss der Zertifikatspfad angepasst werden. Etwas wie ssl_certificate,key /etc/ssl/mail/webmail.example.org/cert.pem,key.pem; wird gen\u00fcgen. Aber: Das Zertifikat sollte zuerst bezogen werden und erst wenn das Zertifikat existiert, sollte eine Site Config erstellt werden. Nginx wird nicht starten, wenn es das Zertifikat und den Schl\u00fcssel nicht finden kann.

      Um eine Subdomain webmail.example.org zu erstellen und sie auf SOGo umzuleiten, m\u00fcssen Sie eine neue Nginx-Site erstellen. Achten Sie dabei auf \"CHANGE_TO_MAILCOW_HOSTNAME\"!

      nano data/conf/nginx/webmail.conf

      server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name webmail.example.org;\n  server_tokens off;\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  location / {\n    return 301 https://CHANGE_TO_MAILCOW_HOSTNAME/SOGo;\n  }\n}\n

      Speichern Sie und starten Sie Nginx neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart nginx-mailcow\n
      docker-compose restart nginx-mailcow\n

      \u00d6ffnen Sie nun mailcow.conf und suchen Sie ADDITIONAL_SAN. F\u00fcgen Sie webmail.example.org zu diesem Array hinzu, verwenden Sie keine Anf\u00fchrungszeichen!

      ADDITIONAL_SAN=webmail.example.org\n

      F\u00fchren Sie den Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Siehe \"acme-mailcow\" und \"nginx-mailcow\" Logs, wenn etwas fehlschl\u00e4gt

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-attachment_size/","title":"Maximale Nachrichtengr\u00f6\u00dfe (Gr\u00f6\u00dfe des Anhangs)","text":"

      \u00d6ffnen Sie data/conf/postfix/extra.cf und setzen Sie das message_size_limit entsprechend in Bytes. Siehe main.cf f\u00fcr den Standardwert.

      Sie m\u00fcssen auch die Nachrichtengr\u00f6\u00dfe in den Konfigurationen von Rspamd und Clamav anpassen:

      • in data/conf/rspamd/local.d/options.inc f\u00fcgen Sie den max_message Parameter entsprechend den im Postfix gesetzten Wert hinzu. Ziehen Sie die Rspamd Docs f\u00fcr den Standardwert zu rate.
      • in data/conf/rspamd/local.d/external_services.conf \u00e4ndern Sie den Wert max_size Parameter f\u00fcr oletools
      • in data/conf/rspamd/local.d/antivirus.conf \u00e4ndern Sie den Wert max_size Parameter f\u00fcr clamav
      • in data/conf/clamav/clamd.conf \u00e4ndern Sie den Wert MaxScanSize und MaxFileSize auf dieselbe Gr\u00f6\u00dfe wie in der Postfix extra.cf

      Starten Sie Postfix, Rspamd and Clamav neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
      docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
      "},{"location":"de/manual-guides/Postfix/u_e-postfix-custom_transport/","title":"Benutzerdefinierte Transportmaps","text":"

      F\u00fcr Transport maps, die nicht in mailcow UI konfiguriert werden, verwenden Sie bitte data/conf/postfix/custom_transport.pcre, um zu verhindern, dass bestehende Maps oder Einstellungen durch Updates \u00fcberschrieben werden.

      In den meisten F\u00e4llen ist die Verwendung dieser Datei nicht notwendig. Bitte vergewissern Sie sich, dass mailcow UI nicht in der Lage ist, den gew\u00fcnschten Datenverkehr richtig zu routen, bevor Sie diese Datei verwenden.

      Die Datei ben\u00f6tigt g\u00fcltigen PCRE-Inhalt und kann Postfix zerst\u00f6ren, wenn sie falsch konfiguriert ist.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/","title":"\u00dcberpr\u00fcfung der Absenderadressen deaktivieren","text":""},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/#neue-anleitung","title":"Neue Anleitung","text":"

      Bearbeiten Sie ein Postfach und w\u00e4hlen Sie \"Senden als * zulassen\".

      Aus historischen Gr\u00fcnden haben wir die alte und veraltete Anleitung unten beibehalten:

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/#veraltete-anleitung-nicht-fur-neuere-mailcows-verwenden","title":"Veraltete Anleitung (NICHT F\u00dcR NEUERE MAILCOWS VERWENDEN!)","text":"

      Diese Option ist keine Best-Practice und sollte nur verwendet werden, wenn es keine andere M\u00f6glichkeit gibt, das zu erreichen, was Sie erreichen wollen.

      Erstellen Sie einfach eine Datei data/conf/postfix/check_sasl_access und tragen Sie den folgenden Inhalt ein. Dieser Benutzer muss in Ihrer Installation existieren und muss sich vor dem Versenden von Mails authentifizieren. 

      user-to-allow-everything@example.com OK\n

      \u00d6ffnen Sie data/conf/postfix/main.cf und suchen Sie smtpd_sender_restrictions. F\u00fcgen Sie check_sasl_access hash:/opt/postfix/conf/check_sasl_access wie folgt ein: 

      smtpd_sender_restrictions = check_sasl_access hash:/opt/postfix/conf/check_sasl_access reject_authenticated_sender_login_mismatch [...]\n

      Postmap auf check_sasl_access ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n
      docker-compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n

      Starten Sie den Postfix-Container neu.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-extra_cf/","title":"main.cf anpassen/erweitern","text":"

      Bitte erstellen Sie eine neue Datei data/conf/postfix/extra.cf f\u00fcr \u00dcberschreibungen oder zus\u00e4tzliche Inhalte zur main.cf.

      Postfix wird sich einmal nach dem Start von postfix-mailcow \u00fcber doppelte Werte beschweren, dies ist beabsichtigt.

      Syslog-ng wurde so konfiguriert, dass es diese Warnungen ausblendet, w\u00e4hrend Postfix l\u00e4uft, um die Log-Dateien nicht jedes Mal mit unn\u00f6tigen Informationen zu spammen, wenn ein Dienst benutzt wird.

      Starten Sie postfix-mailcow neu, um Ihre \u00c4nderungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart postfix-mailcow\n
      docker-compose restart postfix-mailcow\n
      "},{"location":"de/manual-guides/Postfix/u_e-postfix-harden_ciphers/","title":"Ciphers verst\u00e4rken","text":"

      Wenn Sie die Standard-Cipher und TLS-Versionen, die in Postfix akzeptiert werden, entsprechend der aktuellen Version auf st\u00e4rkere Einstellungen \u00e4ndern m\u00f6chten, k\u00f6nnen Sie Folgendes zu Postfix extra.cf hinzuf\u00fcgen:

      tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\ntls_preempt_cipherlist = yes\n\nsmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtp_tls_ciphers = high\nsmtp_tls_mandatory_ciphers = high\n\nsmtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtpd_tls_ciphers = high\nsmtpd_tls_mandatory_ciphers = high\n

      Eine solche Konfiguration wird die aktuellen (2024-10-21) Konfigurationspr\u00fcfungen bei Diensten wie Internet.nl bestehen.

      Falls Sie auch die Cipher f\u00fcr Dovecot anpassen wollen finden Sie hier eine entsprechende Anleitung.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-pflogsumm/","title":"Statistik mit pflogsumm","text":"

      Um pflogsumm mit dem Standard-Logging-Treiber zu verwenden, m\u00fcssen wir postfix-mailcow \u00fcber docker logs abfragen und die Ausgabe zu pflogsumm leiten:

      docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | pflogsumm\n

      Die obige Log-Ausgabe ist auf die letzten 24 Stunden beschr\u00e4nkt.

      Es ist auch m\u00f6glich, einen t\u00e4glichen pflogsumm-Bericht \u00fcber cron zu erstellen. Erstellen Sie die Datei /etc/cron.d/pflogsumm mit dem folgenden Inhalt:

      SHELL=/bin/bash\n59 23 * * * root docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | /usr/sbin/pflogsumm -d today | mail -s \"Postfix Report of $(date)\" postmaster@example.net\n

      Um zu funktionieren muss ein lokaler Postfix auf dem Server installiert werden, welcher an den Postfix der mailcow relayed.

      Frage

      Genauere Informationen lassen sich unter Sektion Post-Installationsaufgaben -> Lokaler MTA auf Dockerhost finden.

      Basierend auf den Postfix-Logs der letzten 24 Stunden sendet dieses Beispiel dann jeden Tag um 23:59:00 Uhr einen pflogsumm-Bericht an postmaster@example.net.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-postscreen_whitelist/","title":"IP in Postscreen auf die Whitelist setzen","text":"

      IPs k\u00f6nnen in der Datei data/conf/postfix/custom_postscreen_whitelist.cidr aus dem Postscreen und damit auch aus den RBL-Pr\u00fcfungen entfernt werden.

      Postscreen f\u00fchrt mehrere Pr\u00fcfungen durch, um b\u00f6sartige Absender zu identifizieren. In den meisten F\u00e4llen m\u00f6chten Sie eine IP-Adresse auf die Whitelist setzen, um sie von der Suche nach einer Blacklist auszuschlie\u00dfen.

      Das Format der Datei ist wie folgt

      CIDR ACTION

      Dabei steht CIDR f\u00fcr eine einzelne IP-Adresse oder einen IP-Bereich in CIDR-Notation und action entweder f\u00fcr \"permit\" oder \"reject\".

      Beispiel:

      # Regeln werden in der angegebenen Reihenfolge ausgewertet.\n# Blacklist 192.168.* au\u00dfer 192.168.0.1.\n192.168.0.1 permit\n192.168.0.0/16 reject\n

      Die Datei wird spontan neu geladen, ein Neustart von Postfix ist nicht erforderlich.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/","title":"Relayhosts","text":"

      Seit dem 12. September 2018 k\u00f6nnen Sie Relayhosts als Admin \u00fcber die mailcow UI einrichten.

      Dies ist n\u00fctzlich, wenn Sie ausgehende E-Mails f\u00fcr eine bestimmte Domain an einen Drittanbieter-Spamfilter oder einen Dienst wie Mailgun oder Sendgrid weiterleiten m\u00f6chten. Dies ist auch bekannt als ein smarthost. Falls nicht, \u00fcberpr\u00fcfen Sie den Fehler und beheben Sie ihn.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#einen-neuen-relayhost-hinzufugen","title":"Einen neuen Relayhost hinzuf\u00fcgen","text":"

      Gehen Sie auf die Registerkarte \"Routing\" im Abschnitt \"Konfiguration und Details\" der mailcow UI. Hier sehen Sie eine Liste der derzeit eingerichteten Relayhosts.

      Bl\u00e4ttern Sie zum Abschnitt \"Absenderabh\u00e4ngigen Transport hinzuf\u00fcgen\".

      F\u00fcgen Sie unter Host den Host hinzu, an den Sie weiterleiten m\u00f6chten. Beispiel: Wenn Sie Mailgun zum Senden von E-Mails anstelle Ihrer Server-IP verwenden m\u00f6chten, geben Sie smtp.mailgun.org ein.

      Wenn der Relay-Host zur Authentifizierung einen Benutzernamen und ein Passwort ben\u00f6tigt, geben Sie diese in die entsprechenden Felder ein. Beachten Sie, dass die Anmeldedaten im Klartext gespeichert werden.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#testen-sie-einen-relayhost","title":"Testen Sie einen Relayhost","text":"

      Um zu testen, ob die Verbindung zum Host funktioniert, klicken Sie in der Liste der Relayhosts auf Test und geben Sie eine Von:-Adresse ein. F\u00fchren Sie dann den Test aus.

      Sie sehen dann die Ergebnisse der SMTP-\u00dcbertragung. Wenn alles klappt, sollten Sie Folgendes sehen: SERVER -> CLIENT: 250 2.0.0 Ok: queued as A093B401D4 als eine der letzten Zeilen.

      Ist dies nicht der Fall, \u00fcberpr\u00fcfen Sie den angegebenen Fehler und beheben Sie ihn.

      Hinweis: Einige Hosts, insbesondere solche, die keine Authentifizierung verlangen, verweigern Verbindungen von Servern, die nicht zuvor in ihr System aufgenommen wurden. Lesen Sie unbedingt die Dokumentation des Relayhosts, um sicherzustellen, dass Sie Ihre Domain und/oder die Server-IP zu ihrem System hinzugef\u00fcgt haben.

      Tipp: Sie k\u00f6nnen die standardm\u00e4\u00dfige Von:-Adresse, die der Test verwendet, von null@mailcow.email auf eine beliebige E-Mail-Adresse \u00e4ndern, indem Sie die Variable $RELAY_TO in der Datei vars.inc.php unter /opt/mailcow-dockerized/data/web/inc \u00e4ndern. Auf diese Weise k\u00f6nnen Sie \u00fcberpr\u00fcfen, ob das Relay funktioniert hat, indem Sie das Zielpostfach \u00fcberpr\u00fcfen.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#relayhost-fur-eine-domain-festlegen","title":"Relayhost f\u00fcr eine Domain festlegen","text":"

      Wechseln Sie auf die Registerkarte \"Domains\" im Abschnitt \"E-Mail-Setup\" der mailcow UI.

      Bearbeiten Sie die gew\u00fcnschte Domain.

      W\u00e4hlen Sie den neu hinzugef\u00fcgten Host in der Dropdown-Liste \"Absenderabh\u00e4ngige Transporte\" aus und speichern Sie die \u00c4nderungen.

      Senden Sie eine E-Mail von einer Mailbox auf dieser Domain und Sie sollten in den Protokollen sehen, dass Postfix die Nachricht an den Relayhost weiterleitet.

      "},{"location":"de/manual-guides/Postfix/u_e-postfix-unauthenticated-relaying/","title":"Unauthentifiziertes Relaying","text":"

      Standardm\u00e4\u00dfig betrachtet mailcow's Postfix alle Netzwerke als nicht vertrauensw\u00fcrdig, ausgenommen seine eigenen IPV4_NETWORK und IPV6_NETWORK Bereiche, die in mailcow.conf festgelegt sind. Obwohl dies in den meisten F\u00e4llen vern\u00fcnftig ist, kann es Umst\u00e4nde geben, unter denen Sie einen Host oder ein Subnetz als unauthentifizierten Relayer hinzuf\u00fcgen m\u00f6chten.

      Standardm\u00e4\u00dfig verwendet mailcow mynetworks_style = subnet um interne Subnetze zu bestimmen und l\u00e4sst mynetworks unkonfiguriert.

      Wenn Sie sich entscheiden, mynetworks selbst\u00e4ndig in der extra.conf von Postfix zu setzen, ignoriert Postfix die mynetworks_style Einstellung. Das bedeutet, dass Sie die von mailcow intern benutzen IPv4- und IPv6-Adressen (in der mailcow.conf angegeben als IPV4_NETWORK bzw. IPV6_NETWORK), sowie die Loopback-Subnetze manuell hinzuf\u00fcgen m\u00fcssen!

      Erl\u00e4uterung

      Die Einstellung mynetworks erlaubt es eingetragenen Hosts bzw. Subnets OHNE Authentifizierung E-Mails an den Postfix MTA zu schicken. Insbesondere dann praktisch, wenn bspw. Monitoring E-Mails von Linux Servern im selben Netzwerk ohne extra Authentifizierung verschickt werden sollen.

      Achtung

      Eine falsche Einstellung von mynetworks erlaubt es Ihrem Server, als offenes Relay verwendet zu werden. Wenn dies missbraucht wird, beeintr\u00e4chtigt dies Ihre F\u00e4higkeit, E-Mails zu versenden, und es kann einige Zeit dauern, bis dies abgeklungen ist.

      Beispiel

      Als Beispiel nehmen wir das Subnetz 192.168.2.0/24, welches wir unauthentifiziert Relayen lassen wollen.

      Bearbeiten Sie data/conf/postfix/extra.cf:

      mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 [fe80::]/10 172.22.1.0/24 [fd4d:6169:6c63:6f77::]/64 192.168.2.0/24\n

      Bearbeiten Sie zus\u00e4tzlich noch data/conf/rspamd/local.d/options.inc:

      local_addrs = [127.0.0.0/8, ::ffff:127.0.0.0/104, ::1/128, fe80::/10, 172.22.1.0/24, fd4d:6169:6c63:6f77::/64, 192.168.2.0/24];\n

      Vorsicht

      Die Subnetze vor unserem angehangenen Beispiel Subnetz M\u00dcSSEN vor oder nach den eigens eingetragenen Werten stehen, da sonst einige mailcow Komponenten wie bspw. der Watchdog oder einige Sieve Filter (wie bspw. Abwesenheitsagenten) nicht funktionieren und Fehler beim Betriebsablauf entstehen.

      F\u00fchren Sie nach Ihren \u00c4nderungen folgenden Befehl aus aus, um Ihre neuen Einstellungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart postfix-mailcow rspamd-mailcow\n
      docker-compose restart postfix-mailcow rspamd-mailcow\n

      Gut zu wissen!

      IPv6 Adressen M\u00dcSSEN in diesem Fall mit [] (Eckigen Klammern) als mynetworks Parameter eingetragen werden, da diese sonst nicht verarbeitet werden k\u00f6nnen.

      Info

      Weitere Informationen \u00fcber mynetworks finden Sie in der Postfix-Dokumentation.

      "},{"location":"de/manual-guides/Redis/u_e-redis/","title":"Redis","text":"

      Redis wird als Key-Value-Speicher f\u00fcr die Einstellungen und Daten von rspamd und (einige von) mailcow verwendet. Wenn Sie mit Redis nicht vertraut sind, lesen Sie bitte die Einf\u00fchrung in Redis und besuchen Sie gegebenenfalls diese wunderbare Anleitung, um zu erfahren, wie man Redis benutzt.

      "},{"location":"de/manual-guides/Redis/u_e-redis/#client","title":"Client","text":"

      Um sich mit dem redis cli zu verbinden, f\u00fchren Sie aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow redis-cli\n
      docker-compose exec redis-mailcow redis-cli\n
      "},{"location":"de/manual-guides/Redis/u_e-redis/#fehlersuche","title":"Fehlersuche","text":"

      Hier sind einige n\u00fctzliche Befehle f\u00fcr den redis-cli zur Fehlersuche:

      "},{"location":"de/manual-guides/Redis/u_e-redis/#monitor","title":"MONITOR","text":"

      \u00dcberwacht alle vom Server empfangenen Anfragen in Echtzeit:

      docker compose (Plugin)docker-compose (Standalone) 
      #docker compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
      #docker-compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
      "},{"location":"de/manual-guides/Redis/u_e-redis/#schlussel-keys","title":"SCHL\u00dcSSEL (Keys)","text":"

      Ermittelt alle Schl\u00fcssel, die dem Muster entsprechen:

      KEYS *\n
      "},{"location":"de/manual-guides/Redis/u_e-redis/#ping","title":"PING","text":"

      Testen Sie eine Verbindung:

      127.0.0.1:6379> PING\nPONG\n

      Wenn Sie mehr wissen wollen, hier ist ein Cheat-Sheet.

      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-add-additional-modules/","title":"Weitere Module hinzuf\u00fcgen","text":"

      Laden Sie das Modul herunter und speichern Sie es in folgenden Pfad ab: data/conf/rspamd/plugins.d/.

      Danach m\u00fcssen Sie die Konfigurationsparameter des Modules in data/conf/rspamd/rspamd.conf.local hinzuf\u00fcgen. Falls das Modul my_plugin.lua hei\u00dft, sollte die Datei wie folgt aussehen:

      # rspamd.conf.local\nmy_plugin {\n    some_setting = \"some value\";\n}\n

      Falls Ihr Modul keine zus\u00e4tzlichen Konfigurationen ben\u00f6tigt, reicht es aus einen leeren Konfigurationsblock hinzuzuf\u00fcgen. Wie im folgenden Beispiel zu sehen:

      # rspamd.conf.local\nmy_plugin { }\n

      Falls Sie keinen Konfigurationsblock hinzuf\u00fcgen, dann wird das Modul automatisch deaktiviert und im Logfile des rspamd-mailcow Containers sehen Sie folgende Nachricht:

      mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: lua module my_plugin is enabled but has not been configured\nmailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: my_plugin disabling unconfigured lua module\n

      Falls Sie das Modul erfolgreich konfiguiert haben, dann sollte das Logfile des rspamd-mailcow Containers wie folgt aussehen:

      mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:04:50 #1(main) <8ayxpf>; cfg; rspamd_init_lua_filters: init lua module my_plugin from /etc/rspamd/plugins.d//my_plugin.lua; digest: 5cb88961e5\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/","title":"Anpassungen","text":""},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#spamfilter-schwellenwerte-global","title":"Spamfilter-Schwellenwerte (global)","text":"

      Jeder Benutzer kann seine Spam-Bewertung individuell \u00e4ndern.

      Um eine neue serverweite Grenze zu definieren, editieren Sie data/conf/rspamd/local.d/actions.conf:

      reject = 15;\nadd_header = 8;\ngreylist = 7;\n

      Speichern Sie die Datei und starten Sie \"rspamd-mailcow\" neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Achtung

      Bestehende Einstellungen der Benutzer werden nicht \u00fcberschrieben!

      Um benutzerdefinierte Schwellenwerte zur\u00fcckzusetzen, f\u00fchren Sie aus:

      docker compose (Plugin)docker-compose (Standalone) 
      source mailcow.conf\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# oder:\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
      source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# oder:\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#benutzerdefinierte-ablehnungsnachrichten","title":"Benutzerdefinierte Ablehnungsnachrichten","text":"

      Die Standard-Spam-Reject-Meldung kann durch Hinzuf\u00fcgen einer neuen Datei data/conf/rspamd/override.d/worker-proxy.custom.inc mit dem folgenden Inhalt ge\u00e4ndert werden:

      reject_message = \"Meine eigene Ablehnungsnachricht\";\n

      Speichern Sie die Datei und starten Sie Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      W\u00e4hrend das oben genannte f\u00fcr abgelehnte Mails mit einem hohen Spam-Score funktioniert, ignorieren Prefilter-Aktionen diese Einstellung. F\u00fcr diese muss das Multimap-Modul in Rspamd angepasst werden:

      1. Finden Sie das Prefilet-Reject-Symbol, f\u00fcr das Sie die Nachricht \u00e4ndern wollen, f\u00fchren Sie dazu aus: grep -R \"SYMBOL_WELCHES_ANGEPASST_WERDEN_SOLL\" /opt/mailcow-dockerized/data/conf/rspamd/

      2. F\u00fcgen Sie Ihre eigene Nachricht als neue Zeile hinzu:

        GLOBAL_RCPT_BL {\nTyp = \"rcpt\";\nmap = \"${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map\";\nregexp = true;\nprefilter = true;\naction = \"reject\";\nmessage = \"Der Versand von E-Mails an diesen Empf\u00e4nger ist durch postmaster@your.domain verboten\";\n}\n

      3. Speichern Sie die Datei und starten Sie Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#e-mails-verwerfen-discard-anstatt-zuruckzuweisen-reject","title":"E-Mails verwerfen (discard) anstatt zur\u00fcckzuweisen (reject)","text":"

      Wenn Sie eine Nachricht stillschweigend verwerfen wollen, erstellen oder bearbeiten Sie die Datei data/conf/rspamd/override.d/worker-proxy.custom.inc und f\u00fcgen Sie den folgenden Inhalt hinzu:

      discard_on_reject = true;\n

      Starten Sie Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/","title":"Mit Spamdaten Arbeiten","text":""},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#spam-ham-lernen","title":"Spam & Ham lernen","text":"

      Rspamd lernt, ob es sich um Spam oder Ham handelt, wenn Sie eine Nachricht in oder aus dem Junk-Ordner in ein anderes Postfach als den Papierkorb verschieben. Dies wird durch die Verwendung des Sieve-Plugins \"sieve_imapsieve\" und Parser-Skripte erreicht.

      Rspamd liest auch automatisch Mails, wenn eine hohe oder niedrige Punktzahl erkannt wird (siehe https://rspamd.com/doc/configuration/statistic.html#autolearning). Wir haben das Plugin so konfiguriert, dass es ein vern\u00fcnftiges Verh\u00e4ltnis zwischen Spam- und Ham-Learnings beibeh\u00e4lt.

      Die Bayes-Statistiken werden in Redis als Schl\u00fcssel BAYES_HAM und BAYES_SPAM gespeichert.

      Neben Bayes wird ein lokaler Fuzzy-Speicher verwendet, um wiederkehrende Muster in Texten oder Bildern zu lernen, die auf Ham oder Spam hinweisen.

      Sie k\u00f6nnen auch die Web-UI von Rspamd verwenden, um Ham und/oder Spam zu lernen oder bestimmte Einstellungen von Rspamd anzupassen.

      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#spam-oder-ham-aus-bestehendem-verzeichnis-lernen","title":"Spam oder Ham aus bestehendem Verzeichnis lernen","text":"

      Sie k\u00f6nnen einen Einzeiler verwenden, um Mails im Klartextformat (unkomprimiert) zu lernen:

      docker compose (Plugin)docker-compose (Standalone) 
      # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n
      # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n

      Erw\u00e4gen Sie, einen lokalen Ordner als neues Volume an rspamd-mailcow in docker-compose.yml anzuh\u00e4ngen und die gegebenen Dateien innerhalb des Containers zu lernen. Dies kann als Workaround verwendet werden, um komprimierte Daten mit zcat zu parsen. Beispiel:

      for file in /data/old_mail/.Junk/cur/*; do rspamc learn_spam < zcat $file; done\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#gelernte-daten-zurucksetzen-bayes-neural","title":"Gelernte Daten zur\u00fccksetzen (Bayes, Neural)","text":"

      Sie m\u00fcssen die Schl\u00fcssel in Redis l\u00f6schen, um die gelernten Daten zur\u00fcckzusetzen, also erstellen Sie zuerst eine Kopie Ihrer Redis-Datenbank:

      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#kopie-der-redis-datenbank","title":"Kopie der Redis Datenbank","text":"
      # Es ist besser, Redis zu stoppen, bevor Sie die Datei kopieren.\ncp /var/lib/docker/volumes/mailcowdockerized_redis-vol-1/_data/dump.rdb /root/\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#bayes-daten-zurucksetzen","title":"Bayes-Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
      docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#neurale-daten-zurucksetzen","title":"Neurale Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
      docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
      "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#fuzzy-daten-zurucksetzen","title":"Fuzzy-Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
      # Wir m\u00fcssen zuerst die redis-cli aufrufen:\ndocker compose exec redis-mailcow redis-cli\n# In redis-cli geben wir nun ein:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n
      # Wir m\u00fcssen zuerst die redis-cli aufrufen:\ndocker-compose exec redis-mailcow redis-cli\n# In redis-cli geben wir nun ein:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n

      Info

      Wenn redis-cli sich dar\u00fcber beschwert... 

      (error) ERR wrong number of arguments for 'del' command\n
      ...,dass das Schl\u00fcsselmuster nicht gefunden wurde und somit keine Daten zum L\u00f6schen vorhanden sind - ist dies in Ordnung.

      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-disable-greylisting/","title":"Greylisting deaktivieren","text":"

      Hinweis

      In dieser Anleitung gehen wir von dem standard mailcow Pfad (/opt/mailcow-dockerized) aus. Der Pfad in Ihrer Installation kann m\u00f6glicherweise variieren!

      Nur Nachrichten mit einem h\u00f6heren Rspamd Score werden Greylisted (soft rejected).

      Wir selbst empfehlen NICHT das Greylisting zu deaktivieren.

      Falls Sie einen validen Grund daf\u00fcr sehen, dass Greylisting zu deaktivieren, k\u00f6nnen Sie dies serverweit durch das Editieren der greylist.conf deaktivieren:

      /opt/mailcow-dockerized/data/conf/rspamd/local.d/greylist.conf

      F\u00fcgen Sie die Zeile hinzu:

      enabled = false;\n

      Speichern Sie die Datei und starten Sie \"rspamd-mailcow\" neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Das Greylisting ist nun serverweit deaktiviert!

      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/","title":"Allgemeine Einstellungen","text":"

      Rspamd wird f\u00fcr die AV-Verarbeitung, DKIM-Signierung und SPAM-Verarbeitung verwendet. Es ist ein leistungsf\u00e4higes und schnelles Filtersystem. F\u00fcr eine ausf\u00fchrlichere Dokumentation \u00fcber Rspamd besuchen Sie bitte die [Rspamd Dokumentation] (https://rspamd.com/doc/index.html).

      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#ui-zugang","title":"UI Zugang","text":"

      Rspamd bietet eine umfangreiche WebUI, welche jeder mailcow: dockerized Installation beiliegt.

      Diese ist mit einem Login versehen, welcher w\u00e4hrend der initialen Installation auf ein zuf\u00e4lliges Passwort gesetzt wird um den Zugang dritter zu verweigern.

      Damit Sie sich in die Rspamd UI einloggen k\u00f6nnen m\u00fcssen Sie zun\u00e4chst ein eigenes Passwort f\u00fcr die Rspamd Oberfl\u00e4che setzen.

      Dies tun Sie wie folgt:

      1. Loggen Sie sich als Administrator in ihrer mailcow UI ein.
      2. Wechseln Sie auf den Reiter (oben links) System Konfiguration und dort den Unterreiter: Zugang Rspamd UI.
      3. \u00c4ndern Sie hier das Rspamd UI Passwort, bzw. legen Sie eines fest.
      4. Gehen Sie in einem Browser zu https://${MAILCOW_HOSTNAME}/rspamd und melden Sie sich an!

      Weitere Konfigurationsoptionen und Dokumentation zur WebUI finden Sie hier: https://rspamd.com/webui/

      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#cli-werkzeuge","title":"CLI-Werkzeuge","text":"

      Rspamd bietet eine vielzahl von Befehlen, welche via CLI benutzt werden k\u00f6nnen.

      Geben Sie folgende Befehle ein, um einen \u00dcberblick auf diese zu erhalten:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow rspamc --help\ndocker compose exec rspamd-mailcow rspamadm --help\n
      docker-compose exec rspamd-mailcow rspamc --help\ndocker-compose exec rspamd-mailcow rspamadm --help\n
      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#speicherung-der-historie-erhohen","title":"Speicherung der Historie erh\u00f6hen","text":"

      Standardm\u00e4\u00dfig speichert Rspamd 1000 Elemente in der Historie.

      Die Historie wird komprimiert gespeichert.

      Es wird empfohlen, hier keinen unverh\u00e4ltnism\u00e4\u00dfig hohen Wert zu verwenden, probieren Sie etwas in der Gr\u00f6\u00dfenordnung von 5000 oder 10000 und sehen Sie, wie Ihr Server damit umgeht:

      Bearbeiten Sie data/conf/rspamd/local.d/history_redis.conf:

      nrows = 1000; # \u00c4ndern Sie diesen Wert\n

      Starten Sie anschlie\u00dfend Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n
      "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#losche-alle-ratelimit-schlussel","title":"L\u00f6sche alle Ratelimit-Schl\u00fcssel","text":"

      Wenn Sie die mailcow UI nicht verwenden wollen und stattdessen alle Schl\u00fcssel in der Redis-Datenbank l\u00f6schen wollen, k\u00f6nnen Sie redis-cli f\u00fcr diese Aufgabe verwenden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow sh\n# Unlink (verf\u00fcgbar in Redis >=4.) l\u00f6scht im Hintergrund\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n
      docker-compose exec redis-mailcow sh\n# Unlink (verf\u00fcgbar in Redis >=4.) l\u00f6scht im Hintergrund\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n

      Starten Sie Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/","title":"SOGo","text":"

      SOGo wird verwendet, um \u00fcber einen Webbrowser auf Ihre Mails zuzugreifen und Ihre Kontakte oder Kalender hinzuzuf\u00fcgen und zu teilen. F\u00fcr eine ausf\u00fchrlichere Dokumentation zu SOGo besuchen Sie bitte die Dokumentation von SOGo.

      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#benutzerdefiniertes-sogo-thema-css-anwenden","title":"Benutzerdefiniertes SOGo-Thema (CSS) anwenden","text":"

      mailcow-Builds nach dem 28. Januar 2021 k\u00f6nnen das CSS-Thema von SOGo \u00e4ndern, indem sie data/conf/sogo/custom-theme.js bearbeiten. Bitte schauen Sie sich die AngularJS Material intro und documentation sowie die material style guideline an, um zu erfahren, wie das funktioniert.

      Sie k\u00f6nnen die mitgelieferte custom-theme.js als Beispiel verwenden, indem Sie die Kommentare entfernen. Nachdem Sie data/conf/sogo/custom-theme.js modifiziert und \u00c4nderungen an Ihrem neuen SOGo-Theme vorgenommen haben, m\u00fcssen Sie

      1. Bearbeiten Sie data/conf/sogo/sogo.conf und f\u00fcgen Sie SOGoUIxDebugEnabled = YES; ein.

      2. SOGo und Memcached Container neu starten, indem man folgenden Befehl ausf\u00fchrt:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow sogo-mailcow\n
      docker-compose restart memcached-mailcow sogo-mailcow\n

      3. SOGo im Browser \u00f6ffnen

      4. \u00f6ffnen Sie die Entwicklerkonsole des Browsers, normalerweise ist die Tastenkombination F12

      5. nur wenn Sie Firefox benutzen: schreiben Sie mit der Hand in die Entwicklerkonsole allow pasting und dr\u00fccken Sie Enter

      6. f\u00fcgen Sie den Java-Script-Schnipsel in die Entwicklungskonsole ein: 

      copy([].slice.call(document.styleSheets)\n  .map(e => e.ownerNode)\n  .filter(e => e.hasAttribute('md-theme-style'))\n  .map(e => e.textInhalt)\n  .join('\\n')\n)\n
      7. \u00d6ffnen Sie den Texteditor und f\u00fcgen Sie die Daten aus der Zwischenablage ein (Strg+V), Sie sollten ein minimiertes CSS erhalten, speichern Sie es

      8. kopieren Sie die CSS-Datei auf den mailcow-Server data/conf/sogo/custom-theme.css

      9. editiere data/conf/sogo/sogo.conf und setze SOGoUIxDebugEnabled = NO;

      10. Anh\u00e4ngen/Erstellen von docker-compose.override.yml mit: 

      services:\n  sogo-mailcow:\n    volumes:\n      - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n
      11. F\u00fchren Sie folgenden Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      12. Neustarten des memcached Containers mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow\n
      docker-compose restart memcached-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#zurucksetzen-auf-das-sogo-standardthema","title":"Zur\u00fccksetzen auf das SOGo Standardthema","text":"
      1. checken Sie data/conf/sogo/custom-theme.js aus, indem Sie git fetch ; git checkout origin/master data/conf/sogo/custom-theme.js data/conf/sogo/custom-theme.js ausf\u00fchren
      2. Suchen Sie in data/conf/sogo/custom-theme.js: 
        // Neue Paletten auf das Standardthema anwenden, einige Farbt\u00f6ne neu zuordnen\n    $mdThemingProvider.theme('default')\n      .primaryPalette('green-cow', {\n        'default': '400', // Hintergrundfarbe der oberen Symbolleisten\n        hue-1': '400',\n        'hue-2': '600', // Hintergrundfarbe der Seitenleiste\n        'hue-3': 'A700'\n      })\n      .accentPalette('green', {\n        'default': '600', // Hintergrundfarbe der Fab-Schaltfl\u00e4chen und des Anmeldebildschirms\n        hue-1': '300', // Hintergrundfarbe der Symbolleiste der mittleren Liste\n        hue-2': '300', // Hervorhebungsfarbe f\u00fcr ausgew\u00e4hlte Nachrichten und den aktuellen Tageskalender\n        hue-3': 'A700'\n      })\n      .backgroundPalette('frost-grey');\n
        und ersetzen Sie es durch: 
            $mdThemingProvider.theme('default');\n
      3. Entfernen Sie aus docker-compose.override.yml Volume Mount in sogo-mailcow: 
        - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n
      4. F\u00fchren Sie folgenden Befehl aus:
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      1. Starten Sie memcached neu mit:
      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow\n
      docker-compose restart memcached-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#favicon-andern","title":"Favicon \u00e4ndern","text":"

      mailcow-Builds nach dem 31. Januar 2021 k\u00f6nnen SOGo's Favicon \u00e4ndern, indem sie data/conf/sogo/custom-favicon.ico f\u00fcr SOGo und data/web/favicon.png f\u00fcr mailcow UI ersetzen.

      Anmerkung: Sie k\u00f6nnen .png Favicons f\u00fcr SOGo verwenden, indem Sie sie in custom-favicon.ico umbenennen. F\u00fcr beide, SOGo und mailcow UI Favicons, m\u00fcssen Sie eine der Standardgr\u00f6\u00dfen verwenden: 16x16, 32x32, 64x64, 128x128 und 256x256. Nachdem Sie diese Datei ersetzt haben, m\u00fcssen Sie SOGo und Memcached Container neu starten, indem Sie folgenden Befehl ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow sogo-mailcow\n
      docker-compose restart memcached-mailcow sogo-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#logo-andern","title":"Logo \u00e4ndern","text":"

      mailcow-Builds nach dem 21. Dezember 2018 k\u00f6nnen das SOGo-Logo \u00e4ndern, indem sie die Datei data/conf/sogo/sogo-full.svg ersetzen oder erstellen (falls sie fehlt). Nachdem Sie diese Datei ersetzt haben, m\u00fcssen Sie SOGo und Memcached Container neu starten, indem Sie folgendes ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow sogo-mailcow\n
      docker-compose restart memcached-mailcow sogo-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#domains-verbinden-untereinander-sichtbar-machen","title":"Domains verbinden (untereinander sichtbar machen)","text":"

      Domains sind normalerweise voneinander isoliert.

      Sie k\u00f6nnen das \u00e4ndern, indem Sie data/conf/sogo/sogo.conf modifizieren:

      Suche... 

         // SOGoDomainsVisibility = (\n    // (domain1.tld, domain5.tld),\n    // (domain3.tld, domain2.tld)\n    // );\n
      ...und ersetzen Sie diese durch - zum Beispiel:

          SOGoDomainsVisibility = (\n      (beispiel.org, beispiel.com, beispiel.net)\n    );\n

      SOGo neu starten:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart sogo-mailcow\n
      docker-compose restart sogo-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#aktivieren-der-passwortanderung-in-sogo","title":"Aktivieren der Passwort\u00e4nderung in SOGo","text":"

      Die M\u00f6glichkeit ihr Passwort in SOGo zu \u00e4ndern wurde standardm\u00e4\u00dfig deaktiviert, da:

      • es nicht die Passwortrichtlinien der mailcow UI beachten kann.
      • es nicht funktioniert, wenn ein User sich direkt in SOGo angemeldet hat (\u00fcber die mailcow UI) In Webmail einloggen (Auth Proxy)

      Sollten Sie diese Funktion dennoch aktiviert haben wollen bearbeiten Sie einfach data/conf/sogo/sogo.conf und \u00e4ndern SOGoPasswordChangeEnabled zu YES. Bitte hier keine anderen Parameter au\u00dfer YES oder NO verwenden.

      Anschlie\u00dfend SOGo neustarten:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart memcached-mailcow sogo-mailcow\n
      docker-compose restart memcached-mailcow sogo-mailcow\n
      "},{"location":"de/manual-guides/SOGo/u_e-sogo/#totp-zurucksetzen-totp-deaktivieren","title":"TOTP zur\u00fccksetzen / TOTP deaktivieren","text":"

      F\u00fchren Sie folgenden Befehl aus dem mailcow Verzeichnis aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
      docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
      "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/","title":"Verwendung eines externen DNS-Dienstes","text":"

      Wenn Sie einen externen DNS-Dienst verwenden wollen oder m\u00fcssen, k\u00f6nnen Sie entweder einen Forwarder in Unbound einstellen oder eine Override-Datei kopieren, um externe DNS-Server zu definieren:

      Warnung

      Bitte verwenden Sie keinen \u00f6ffentlichen Resolver, wie wir es im obigen Beispiel getan haben. Viele - wenn nicht sogar alle - Blacklist-Lookups werden mit \u00f6ffentlichen Resolvern fehlschlagen, da der Blacklist-Server Grenzen hat, wie viele Anfragen von einer IP gestellt werden k\u00f6nnen und \u00f6ffentliche Resolver diese Grenzen normalerweise erreichen. Wichtig: Nur DNSSEC-validierende DNS-Dienste werden funktionieren.

      "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/#methode-a-unbound","title":"Methode A, Unbound","text":"

      Bearbeiten Sie data/conf/unbound/unbound.conf und f\u00fcgen Sie die folgenden Parameter hinzu:

      forward-zone:\n  name: \".\"\n  forward-addr: 8.8.8.8 # VERWENDEN SIE KEINE \u00d6FFENTLICHEN DNS-SERVER - NUR EIN BEISPIEL\n  forward-addr: 8.8.4.4 # VERWENDET KEINE \u00d6FFENTLICHEN DNS-SERVER - NUR EIN BEISPIEL\n

      Unbound neu starten:

      docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart unbound-mailcow\n
        docker-compose restart unbound-mailcow\n
      "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/#methode-b-uberschreiben-der-datei","title":"Methode B, \u00dcberschreiben der Datei","text":"
      cd /opt/mailcow-dockerized\ncp helper-scripts/docker-compose.override.yml.d/EXTERNAL_DNS/docker-compose.override.yml .\n

      Bearbeiten Sie docker-compose.override.yml und passen Sie die IP an.

      Stoppen und starten Sie bitte im Anschluss noch den Docker Stack:

      docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\n  docker compose up -d\n
        docker-compose down\n  docker-compose up -d\n
      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/","title":"Thresholds","text":"

      Watchdog verwendet Standardwerte f\u00fcr alle in docker-compose.yml definierten Thresholde.

      Die Standardwerte sind f\u00fcr die meisten Konfigurationen geeignet. Beispiel: 

      - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}\n- UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}\n- REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}\n- MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}\n- MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}\n- SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}\n- POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}\n- CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}\n- DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}\n- DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}\n- PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}\n- RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}\n- FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}\n- ACME_THRESHOLD=${ACME_THRESHOLD:-1}\n- RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}\n- OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}\n- MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}\n- MAILQ_CRIT=${MAILQ_CRIT:-30}\n

      Um sie anzupassen, f\u00fcgen Sie einfach die notwendigen Threshold Variablen (z.B. MAILQ_THRESHOLD=10) zu mailcow.conf hinzu und f\u00fchren Sie den folgenden Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#threshold-beschreibungen","title":"Threshold Beschreibungen","text":""},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#nginx_threshold","title":"NGINX_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu Nginx auf Port 8081 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#unbound_threshold","title":"UNBOUND_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn Unbound externe Dom\u00e4nen/DNSSEC nicht aufl\u00f6sen/\u00fcberpr\u00fcfen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#redis_threshold","title":"REDIS_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn der Watchdog keine Verbindung zu Redis auf Port 6379 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_threshold","title":"MYSQL_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn watchdog keine Verbindung zu MySQL herstellen kann oder eine Tabelle nicht abfragen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_replication_threshold","title":"MYSQL_REPLICATION_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn die MySQL-Replikation fehlschl\u00e4gt.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#sogo_threshold","title":"SOGO_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn der Watchdog keine Verbindung zu SOGo auf Port 20000 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#postfix_threshold","title":"POSTFIX_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn watchdog keine Testmail \u00fcber Port 589 senden kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#clamd_threshold","title":"CLAMD_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu Clamd herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_threshold","title":"DOVECOT_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn watchdog bei verschiedenen Tests mit dem Dovecot-Container fehlschl\u00e4gt. Der Container wird automatisch neu gestartet, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_repl_threshold","title":"DOVECOT_REPL_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn die Dovecot-Replikation fehlschl\u00e4gt.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#phpfpm_threshold","title":"PHPFPM_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu PHP-FPM auf Port 9001/9002 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#ratelimit_threshold","title":"RATELIMIT_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn ein Ratelimit erreicht wurde.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#fail2ban_threshold","title":"FAIL2BAN_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn ein fail2ban eine IP gesperrt hat.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#acme_threshold","title":"ACME_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn etwas mit dem acme-mailcow-Container nicht in Ordnung ist. Sie k\u00f6nnen dessen Logs \u00fcberpr\u00fcfen.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#rspamd_threshold","title":"RSPAMD_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn Watchdog bei verschiedenen Tests mit dem Rspamd-Container fehlschl\u00e4gt und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#olefy_threshold","title":"OLEFY_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn watchdog keine Verbindung zu olefy auf Port 10005 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

      "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mailq_crit-und-mailq_threshold","title":"MAILQ_CRIT und MAILQ_THRESHOLD","text":"

      Benachrichtigt Administratoren, wenn die Anzahl der E-Mails in der Postfix-Warteschlange gr\u00f6\u00dfer ist als MAILQ_CRIT f\u00fcr einen Zeitraum von MAILQ_THRESHOLD * (60\u00b130) Sekunden.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/","title":"Blacklist / Whitelist","text":"

      Um einen Eintrag zu Ihrer domain-weiten Filtertabelle hinzuzuf\u00fcgen oder zu bearbeiten, loggen Sie sich als (Domain-)Administrator in Ihre mailcow UI ein und wechseln Sie zu: Konfiguration > E-Mail-Setup > Domains > (Domain) Bearbeiten > Spamfilter.

      Info

      Seien Sie sich bewusst, dass ein Benutzer diese Einstellung \u00fcberschreiben kann, indem er seine eigene Black- und Whitelist setzt!

      Es ist auch eine globale Filtertabelle in Konfiguration > Server-Konfiguration > Globale Filter-Maps verf\u00fcgbar, um einen server-weiten (also domain\u00fcbergreifenden) Filter f\u00fcr ein oder mehrere Regex-Maps zu konfigurieren (Todo: Screenshots).

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-config/","title":"Konfiguration","text":"

      Mehrere Konfigurationsparameter der mailcow-Benutzeroberfl\u00e4che k\u00f6nnen ge\u00e4ndert werden, indem eine Datei data/web/inc/vars.local.inc.php erstellt wird, die die Standardeinstellungen in data/web/inc/vars.inc.php \u00fcberschreibt.

      Die lokale Konfigurationsdatei ist \u00fcber Updates von mailcow hinweg best\u00e4ndig. Versuchen Sie nicht, die Werte in data/web/inc/vars.inc.php zu \u00e4ndern, sondern verwenden Sie diese als Vorlage f\u00fcr die lokale \u00dcberschreibung.

      mailcow UI Konfigurationsparameter k\u00f6nnen verwendet werden, um...

      • ...die Standardsprache zu \u00e4ndern1
      • ...das Standard-Bootstrap-Theme zu \u00e4ndern
      • ...eine Passwort-Komplexit\u00e4ts-Regex zu setzen
      • ...die Sichtbarkeit des privaten DKIM-Schl\u00fcssels aktivieren
      • ...eine Gr\u00f6\u00dfe f\u00fcr den Paginierungsausl\u00f6ser festlegen
      • ...Standard-Postfach-Attribute festlegen
      • ...Sitzungs-Lebensdauern \u00e4ndern
      • ...feste App-Men\u00fcs erstellen (die nicht in der mailcow UI ge\u00e4ndert werden k\u00f6nnen)
      • ...ein Standard \"To\"-Feld f\u00fcr Relayhost-Tests einstellen
      • ...ein Timeout f\u00fcr Docker API Anfragen setzen
      • ...IP-Anonymisierung umschalten

      1. Um SOGos Standardsprache zu \u00e4ndern, m\u00fcssen Sie data/conf/sogo/sogo.conf bearbeiten und \"English\" durch Ihre bevorzugte Sprache ersetzen.\u00a0\u21a9

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-css/","title":"CSS-\u00dcberschreibungen","text":"

      F\u00fcr benutzerdefinierte \u00dcberschreibungen bestimmter Elemente \u00fcber CSS, verwenden Sie die data/web/css/build/0081-custom-mailcow.css Datei.

      Die Datei wird von der Verfolgung (via Git) ausgeschlossen und bleibt bei Aktualisierungen erhalten.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#wie-wird-uv-in-mailcow-gehandhabt","title":"Wie wird UV in mailcow gehandhabt?","text":"

      Das UV-Flag (wie in \"user verification\") erzwingt, dass WebAuthn den Benutzer verifiziert, bevor es den Zugriff auf den Schl\u00fcssel erlaubt (denken Sie an eine PIN). Wir erzwingen keine UV, um Logins \u00fcber iOS und NFC (YubiKey) zu erm\u00f6glichen.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#login-und-schlussel-verarbeitung","title":"Login und Schl\u00fcssel-Verarbeitung","text":"

      mailcow verwendet Client-seitige Schl\u00fcsselverarbeitung. Wir bitten den Authentifikator (d.h. YubiKey), die Registrierung in seinem Speicher zu speichern.

      Ein Benutzer muss keinen Benutzernamen eingeben. Die verf\u00fcgbaren Anmeldedaten - falls vorhanden - werden dem Nutzer angezeigt, wenn er den \"Schl\u00fcssel-Login\" \u00fcber das mailcow UI Login ausw\u00e4hlt.

      Beim Aufruf des Login-Prozesses werden dem Authentifikator keine Credential-IDs \u00fcbergeben. Dies wird ihn dazu zwingen, die Anmeldeinformationen in seinem eigenen Speicher zu suchen.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#wer-kann-webauthn-benutzen-um-sich-bei-mailcow-anzumelden","title":"Wer kann WebAuthn benutzen, um sich bei mailcow anzumelden?","text":"

      Ab heute sind nur Administratoren und Domain-Administratoren in der Lage, WebAuthn/FIDO2 einzurichten.

      Sie wollen WebAuthn/Fido als 2FA verwenden? Schauen Sie sich das hier an: Zwei-Faktoren-Authentifizierung

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/","title":"Passwort vergessen Funktion","text":"

      Hinweis

      F\u00fcr dieses Feature ist eine mailcow Installation ab Version 2024-08 erforderlich!

      Der aktuell installierte Patchstand kann in mailcow Versionen seit 2022 innerhalb der UI eingesehen werden.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#vorwort","title":"Vorwort","text":"

      Danke!

      Diese Funktionalit\u00e4t wurde von der Jugendstiftung Baden-W\u00fcrttemberg im Rahmen eines Sponsored Developments im August 2024 in mailcow integriert.

      Vielen Dank f\u00fcr das Sponsoring dieses Features!

      Mit der Passwort-vergessen-Funktion ist es Mailbox-Nutzern m\u00f6glich, durch die Angabe einer Backup-E-Mail-Adresse, sich einen Link zur Zur\u00fccksetzung ihres Passwortes schicken zu lassen und dieses dann zur\u00fcckzusetzen.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#voraussetzungen","title":"Voraussetzungen","text":"

      Damit dieses Feature f\u00fcr einen Benutzer aktiviert und nutzbar ist, sind folgende Dinge zu beachten:

      1. Der mailcow Administrator muss eine Absender E-Mail und einen Betreff (siehe unten) eingestellt haben. Die Absender E-Mail muss nicht als Mailbox existieren, die Domain allerdings muss auf mailcow komplett eingerichtet sein, so dass mit dieser das Senden und vor allem die Zustellung von E-Mails sichergestellt ist.
      2. Der Mailbox-Benutzer muss eine Backup-E-Mail in seinen Optionen hinterlegt haben. Dies kann der User selber tun (wenn die dazugeh\u00f6rige ACL nicht deaktiviert ist) oder der Administrator.
      3. Die Backup-E-Mail sollte eine andere E-Mail sein, als die des Mailkontos, f\u00fcr welches das Passwort zur\u00fcckgesetzt werden soll.
      4. Ebenfalls muss diese Backup-E-Mail externe E-Mails empfangen d\u00fcrfen und sollte (wenn m\u00f6glich) bei einem anderen Anbieter liegen und nicht direkt auf dem mailcow-Server sein. (Dieser Punkt ist allerdings optional und dient nur als Empfehlung).
      5. Der Nutzer muss Zugriff auf das Postfach der Backup-E-Mail haben, da die Links nur eine begrenzte Zeit g\u00fcltig sind.
      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#einstellungsmoglichkeiten-in-der-mailcow-ui","title":"Einstellungsm\u00f6glichkeiten in der mailcow UI","text":""},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#mailbox-einstellungen","title":"Mailbox-Einstellungen","text":"

      Durch dieses Feature wird ein neues Feld in den Mailbox-Optionen hinzugef\u00fcgt:

      Achtung

      Zur Erinnerung: Dieses Feld MUSS ausgef\u00fcllt sein, damit der Benutzer sein Passwort zur\u00fccksetzen kann! Sollte es nicht gesetzt sein, ist es ihm nicht m\u00f6glich, sein Passwort zur\u00fcckzusetzen!

      F\u00fcr Administratoren gibt es eine neue ACL, die entweder pro Mailbox im Nachhinein oder auch als Vorlage f\u00fcr Mailboxen gesetzt werden kann: Verwalten der E-Mail zur Passwortwiederherstellung erlauben:

      Hinweis

      Wenn ein Benutzer bereits eine Backup-E-Mail gesetzt hat, aber der Admin ihm diese ACL entzieht, so kann er trotzdem sein Passwort zur\u00fccksetzen, da die Backup-E-Mail weiterhin im System existiert. Die ACL verbietet dadurch also nicht automatisch die M\u00f6glichkeit, das Passwort zur\u00fcckzusetzen, wenn es eine E-Mail gibt!

      Um dies zu erreichen, muss zus\u00e4tzlich noch die Backup-E-Mail f\u00fcr den Benutzer von einem Administrator entfernt werden.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#server-einstellungen","title":"Server-Einstellungen","text":"

      Der mailcow-Administrator kann (\u00e4hnlich wie die Quota- und Quarant\u00e4ne-Mails) auch f\u00fcr die Passwort-vergessen-E-Mails das Template bearbeiten, wie die Mails dann verschickt werden sollen. Standardm\u00e4\u00dfig ist das Template immer auf Englisch.

      Dieses kann unter dem Reiter: System -> Konfiguration -> Einstellungen -> Passwort-Einstellungen erreicht werden:

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#versteckte-einstellungen-nicht-in-der-mailcow-ui","title":"Versteckte Einstellungen (nicht in der mailcow UI)","text":"

      Standardm\u00e4\u00dfig kann jeder Nutzer maximal 3 Passwort-Reset-Tokens anfordern, die dann standardm\u00e4\u00dfig 15 Minuten g\u00fcltig sind.

      Server-Administratoren k\u00f6nnen die Ablaufzeit sowie die maximalen Tokens pro Nutzer allerdings konfigurieren.

      Daf\u00fcr muss (falls noch nicht vorhanden) eine Datei namens vars.local.inc.php in dem Ordner MAILCOW_ROOT/data/web/inc angelegt werden.

      Diese muss dann mindestens Folgendes enthalten:

      <?php\n\n// Maximum number of password reset tokens that can be generated at once per user\n$PW_RESET_TOKEN_LIMIT = 3; // Zahl hier ab\u00e4ndern auf einen anderen Wert\n\n// Maximum time in minutes a password reset token is valid\n$PW_RESET_TOKEN_LIFETIME = 15; // Zahl hier ab\u00e4ndern auf einen anderen Wert. Wert in Minuten\n

      Die Datei wird automatisch eingelesen, es ist kein Neustart von mailcow oder einem der Container erforderlich!

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-ban-einstellungen-andern","title":"Netfilter Ban-Einstellungen \u00e4ndern","text":"

      Um die Netfilter Ban-Einstellungen zu \u00e4ndern navigieren Sie zu dem Men\u00fc Punkt: Konfiguration -> Server-Konfiguration -> Konfiguration -> Fail2ban-Parameter.

      Sie sollten dann dieses Fenster sehen:

      Hier k\u00f6nnen Sie verschiedene Optionen f\u00fcr die Banns selbst festlegen. Zum Beispiel die max. Ban-Zeit oder die max. Versuche bevor ein Ban ausgef\u00fchrt wird.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-regex-andern","title":"Netfilter Regex \u00e4ndern","text":"

      Achtung

      Folgender Bereich erfordert zumindest grundlegende Regex kenntnisse. Sollten Sie sich nicht sicher sein, was Sie dort tun, k\u00f6nnen wir Ihnen nur von der Umkonfiguration abraten.

      Sie k\u00f6nnen neben den Sperreinstellungen ebenfalls definieren, was genau aus den Logs der mailcow Container verwendet werden soll um einen m\u00f6glichen Angreifer zu sperren.

      Daf\u00fcr m\u00fcssen Sie das Regex Feld erst einmal aufklappen, was dann in etwa so aussieht:

      Dort k\u00f6nnen Sie nun verschiedenste neue Filter-Regeln anlegen.

      Hinweis

      Mit weiterschreitenden Updates ist es m\u00f6glich, dass neue Netfilter Regex Regeln dazu kommen oder entfernt werden. Sollte das der Fall sein empfiehlt es sich mit einem Klick auf Zur\u00fccksetzen auf Standard die Netfilter Regex Regeln neu laden zu lassen.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-entscheidungen-via-url-als-quelle-fur-firewall-blockregeln-bereitstellen","title":"Netfilter Entscheidungen via URL als Quelle f\u00fcr Firewall Blockregeln bereitstellen","text":"

      Hinweis

      Die Option ist jedoch standardm\u00e4\u00dfig deaktiviert und muss erst von Ihnen aktiviert werden.

      Seit dem 2023-12 Update bietet mailcow die M\u00f6glichkeit die Netfilter Entscheidungen als externer Endpoint zu exportieren um die Daten daraus in einem externen Firewall System einbinden zu k\u00f6nnen, Quasi als Blocklisten Quelle.

      Was bringt mir diese Funktion?

      Mit dieser Funktionalit\u00e4t k\u00f6nnen Sie die von Netfilter als gesperrt Markierten IPs an einen Endpunkt weitergeben, welcher diese IPs dann verarbeiten kann. Bspw. eine OPNsense Firewall kann diese Liste dynamisch reinladen.

      Schauen wir uns doch mal diese Einstellungen dazu an:

      Um die generelle Funktion zu aktivieren muss der Haken bei Fail2Ban extern verwalten gesetzt werden.

      Sobald dies getan ist kann die URL (Punkt 2) kopiert werden und in den jeweiligen Endpunkt eingesetzt werden.

      Wichtig

      Die URL kann bei bedarf regeneriert werden. Daf\u00fcr auf das Symbol neben Kopieren Neuladen Symbol klicken.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/","title":"Templates f\u00fcr Benachrichtigungen","text":"

      mailcow verwendet f\u00fcr die Benachrichtigungs-Mails die Template-Engine Jinja. Durch Platzhalter k\u00f6nnen mit diesen Templates dynamische Inhalte erzeugt werden, indem bei der Ausf\u00fchrung diese Platzhalter mit \u00fcbergeben Variablen ersetzt werden. Eine Doku zur Entwicklung von Jinja Templates findet sich hier.

      F\u00fcr die Templates der Benachrichtungs-Emails k\u00f6nnen die folgenden Variablen verwendet werden:

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quarantane-template","title":"Quarant\u00e4ne Template","text":"

      Die bereitgestellten Variablen k\u00f6nnen auch auf GitHub aus dem Script dovecot/quarantine_notify.py entnommen werden.

      Info

      Das Template f\u00fcr die Qarant\u00e4ne Mails kann man als Administrator in der Benutzeroberfl\u00e4che in den globalen Quarant\u00e4ne-Einstellungen bearbeiten und dort ebenso das Standard Template wiederherstellen. Code Beispiele kann man dem Standard Template entnehmen. Es kann auch auf GitHub eingesehen werden.

      Name Inhalt username E-Mail Adresse des Mailbox Benutzers counter Anzahl der Nachrichten in der Quarant\u00e4ne, \u00fcber die in dieser Mail benachrichtigt wird hostname Name der Mailcow Instanz (Siehe auch die Umgebungsvariable MAILCOW_HOSTNAME) quarantine_acl Einstellung der Quarant\u00e4ne ACL des Benutzers (Berechtigung zur Bearbeitung von Mails in der Quarant\u00e4ne) meta Array/Liste aller Nachrichten/Eintr\u00e4ge in der Quarant\u00e4ne, \u00fcber die benachrichtigt wird meta.qhash Hashwert des Quarant\u00e4ne Eintrags (Bspw f\u00fcr Direktlink zur Nachricht in der Quarant\u00e4ne) meta.id ID des Quarant\u00e4ne Eintrags meta.subject Titel der E-Mail des Quarant\u00e4ne Eintrags meta.score Spam Score der E-Mail des Quarant\u00e4ne Eintrags meta.sender Absender Adresse der E-Mail des Quarant\u00e4ne Eintrags meta.created Datum der Erstellung des Quarant\u00e4ne Eintrags, bzw Empfang der E-Mail meta.action Aktion des Spamfilters (Verschoben in Spam-Ordner oder in die Quarant\u00e4ne)"},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quota-template","title":"Quota Template","text":"

      Die bereitgestellten Variablen k\u00f6nnen auch auf GitHub aus dem Script dovecot/quota_notify.py entnommen werden.

      Info

      Das Template f\u00fcr die Quota Mails kann man als Administrator in der Benutzeroberfl\u00e4che in den Quota-Einstellungen bearbeiten und dort ebenso das Standard Template wiederherstellen. Code Beispiele kann man dem Standard Template entnehmen. Es kann auch auf GitHub eingesehen werden.

      Name Inhalt username E-Mail Adresse des Mailbox Benutzers percent Prozentualer Anteil des belegten Speicherplatzes der Mailbox"},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-pushover/","title":"Pushover","text":"

      Info

      Pushover macht es einfach, Echtzeit-Benachrichtigungen auf Ihrem Android, iPhone, iPad und Desktop zu erhalten

      Sie k\u00f6nnen Pushover verwenden, um eine Push-Benachrichtigung \u00fcber jede E-Mail zu erhalten, die Sie f\u00fcr jede Mailbox erhalten, in der Sie diese Funktion aktiviert haben.

      1. \u00d6ffnen Sie als Administrator die Einstellungen Ihres Postfachs und scrollen Sie nach unten zu den Pushover-Einstellungen

      2. Registrieren Sie sich bei Pushover

      3. Geben Sie Ihren \"Benutzerschl\u00fcssel\" in das Feld \"Benutzer-/Gruppenschl\u00fcssel\" in den Einstellungen Ihres Postfachs ein

      4. Erstellen Sie eine Anwendung, um das API-Token/den API-Schl\u00fcssel zu erhalten, das/den Sie ebenfalls in Ihre Postfacheinstellungen eintragen m\u00fcssen.

      5. Optional k\u00f6nnen Sie den Titel/Text der Benachrichtigung bearbeiten und bestimmte Absender-E-Mail-Adressen festlegen, bei denen eine Push-Benachrichtigung ausgel\u00f6st wird

      6. Speichern Sie alles und \u00fcberpr\u00fcfen Sie dann Ihre Anmeldedaten.

      Wenn alles erledigt ist, k\u00f6nnen Sie testen, ob Sie eine E-Mail senden k\u00f6nnen, und Sie erhalten eine Push-Nachricht auf Ihrem Telefon

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-spamalias/","title":"Tempor\u00e4re E-Mail-Aliase","text":"

      Diese tempor\u00e4ren E-Mail-Aliasnamen werden meist dort verwendet, wo wir eine E-Mail-Adresse angeben m\u00fcssen, aber keine weitere E-Mails w\u00fcnschen. Sie werden auch Spam-Alias genannt.

      Um ein tempor\u00e4res E-Mail-Alias zu erstellen, zu l\u00f6schen oder zu erweitern, m\u00fcssen Sie sich in mailcow's UI als Mailbox-Nutzer anmelden und zum Reiter Tempor\u00e4re E-Mail-Aliase navigieren:

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-spamfilter/","title":"Spamfilter","text":"

      Ein Mailbox-Nutzer kann den Spam-Filter und die Black-/Whitelist-Einstellungen f\u00fcr seine Mailbox individuell anpassen, indem er zum Reiter Spam-Filter in der mailcow-Benutzeroberfl\u00e4che navigiert.

      Info

      F\u00fcr globale Einstellungen Ihres Spamfilters lesen Sie bitte unseren Abschnitt \u00fcber Rspamd. F\u00fcr eine domainweite Black- und Whitelist lesen Sie bitte unsere Anleitung zu Black / Whitelist

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/","title":"Sub-Adressierung","text":"

      Mailbox-Nutzer k\u00f6nnen ihre Mailadresse wie in \"me+facebook@example.org\" markieren. Sie k\u00f6nnen die Tag-Behandlung im mailcow UI Panel (f\u00fcr den Benutzer) unter Mailbox > Einstellungen kontrollieren.

      Sub-Adressierung (RFC 5233) oder Plus-Adressierung auch als Tagging bekannt (nicht zu verwechseln mit Tags)

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/#verfugbare-aktionen","title":"Verf\u00fcgbare Aktionen","text":"

      1. Diese Nachricht in einen Unterordner \"facebook\" verschieben (wird in Kleinbuchstaben erstellt, falls nicht vorhanden)

      2. Den Tag dem Betreff voranstellen: \"[facebook] Betreff\"

      Bitte beachten Sie: Gro\u00dfgeschriebene Tags werden in Kleinbuchstaben umgewandelt, mit Ausnahme des ersten Buchstabens. Wenn Sie den Tag so lassen wollen, wie er ist, wenden Sie bitte den folgenden Diff an und starten Sie mailcow neu: 

      diff --git a/data/conf/dovecot/global_sieve_after b/data/conf/dovecot/global_sieve_after\nindex e047136e..933c4137 100644\n--- a/data/conf/dovecot/global_sieve_after\n+++ b/data/conf/dovecot/global_sieve_after\n@@ -15,7 +15,7 @@ if allof (\n   envelope :detail :matches \"to\" \"*\",\n   header :contains \"X-Moo-Tag\" \"YES\"\n   ) {\n-  set :lower :upperfirst \"tag\" \"${1}\";\n+  set \"tag\" \"${1}\";\n   if mailboxexists \"INBOX/${1}\" {\n     fileinto \"INBOX/${1}\";\n   } else {\n

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/","title":"Tags (f\u00fcr Domains und Mailboxen)","text":"

      Hinweis

      Um diese Funktion nutzen zu k\u00f6nnen ist das Update 2022-05 (oder h\u00f6her) erforderlich! Sollten Sie das Update nicht installiert haben, denken Sie bitte \u00fcber ein Update nach. F\u00fcr weitere Informationen bez\u00fcglich dem Update Prozess schauen Sie hier.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wofur-wurden-die-tags-implementiert","title":"Wof\u00fcr wurden die Tags implementiert?","text":"

      Mit den Tags ist es deutlich einfacher gezielt nach Domains bzw. Mailboxen zu suchen (wenn diese einen Tag haben).

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wo-lassen-sich-die-tags-finden","title":"Wo lassen sich die Tags finden?","text":"

      Die Tags befinden sich in der Domain/Mailbox Sektion der mailcow UI. Um sie zu sehen, klicken Sie einfach auf das kleine Plus-Symbol auf der linken Seite Ihrer Domain/Mailbox (das folgende Bild zeigt das Domain-Ribbon-Men\u00fc):

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wie-kann-ich-ein-tag-hinzufugenentfernen","title":"Wie kann ich ein Tag hinzuf\u00fcgen/entfernen?","text":"

      Sie k\u00f6nnen bei der Erstellung einer neuen Domain/eines neuen Postfachs einfach ein Tag hinzuf\u00fcgen/entfernen. Sie k\u00f6nnen sie auch hinzuf\u00fcgen/entfernen, wenn Sie Ihre gew\u00fcnschte Domain/Mailbox bearbeiten.

      Es sieht \u00e4hnlich aus wie hier (das folgende Bild zeigt den Bereich zur Bearbeitung der Dom\u00e4ne):

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wie-kann-ich-nach-einem-tag-suchen","title":"Wie kann ich nach einem Tag suchen?","text":"

      Geben Sie einfach den Tag-Namen in die Suchleiste im Bereich Domain/Postfach ein und warten Sie, bis der Vorgang abgeschlossen ist.

      Sie k\u00f6nnen sogar angeben, ob Sie nur nach Tags suchen m\u00f6chten.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/","title":"Zwei-Faktor Authentifizierung","text":"

      Bislang sind drei Methoden f\u00fcr die Zwei-Faktor-Authentifizierung implementiert: WebAuthn (ersetzt seit Februar 2022 U2F), Yubi OTP und TOTP

      • Damit WebAuthn funktioniert, ben\u00f6tigen Sie eine verschl\u00fcsselte Verbindung zum Server (HTTPS) sowie einen FIDO-Sicherheitsschl\u00fcssel.
      • Sowohl WebAuthn als auch Yubi OTP funktionieren gut mit dem fantastischen Yubikey.
      • W\u00e4hrend Yubi OTP eine aktive Internetverbindung und eine API ID + Schl\u00fcssel ben\u00f6tigt, funktioniert WebAuthn mit jedem Fido Security Key, kann aber nur verwendet werden, wenn der Zugriff auf mailcow \u00fcber HTTPS erfolgt.
      • WebAuthn und Yubi OTP unterst\u00fctzen mehrere Schl\u00fcssel pro Nutzer.
      • Als dritte TFA-Methode verwendet mailcow TOTP: zeitbasierte Einmal-Passw\u00f6rter. Diese Passw\u00f6rter k\u00f6nnen mit Apps wie \"Google Authenticator\" generiert werden, nachdem zun\u00e4chst ein QR-Code gescannt oder das gegebene Geheimnis manuell eingegeben wurde.

      Als Administrator k\u00f6nnen Sie den TFA-Login eines Domain-Administrators vor\u00fcbergehend deaktivieren, bis dieser sich erfolgreich eingeloggt hat.

      Der f\u00fcr die Anmeldung verwendete Schl\u00fcssel wird in gr\u00fcner Farbe angezeigt, w\u00e4hrend andere Schl\u00fcssel grau bleiben.

      Informationen zum Entfernen von 2FA finden Sie hier.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#yubi-otp","title":"Yubi OTP","text":"

      Die Yubi API ID und der Schl\u00fcssel werden mit der Yubico Cloud API abgeglichen. Bei der Einrichtung von TFA werden Sie nach Ihrem pers\u00f6nlichen API-Konto f\u00fcr diesen Schl\u00fcssel gefragt. Die API-ID, der API-Schl\u00fcssel und die ersten 12 Zeichen (Ihre YubiKeys ID in modhex) werden in der MySQL-Tabelle als Geheimnis gespeichert.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#beispiel-einrichtung","title":"Beispiel-Einrichtung","text":"

      Als erstes muss der YubiKey f\u00fcr die Verwendung als OTP-Generator konfiguriert werden. Laden Sie dazu den YubiKey Manager von der Yubico Website herunter: hier

      Im Folgenden konfigurieren Sie den YubiKey f\u00fcr OTP. \u00dcber den Men\u00fcpunkt Anwendungen -> OTP und einem Klick auf den Konfigurieren Button. W\u00e4hlen Sie im folgenden Men\u00fc Credential Type -> Yubico OTP und klicken Sie auf Next.

      Setzen Sie ein H\u00e4kchen in die Checkbox Use serial, generieren Sie eine Private ID und einen Secret key \u00fcber die Schaltfl\u00e4chen. Damit der YubiKey sp\u00e4ter validiert werden kann, muss auch das H\u00e4kchen in der Upload Checkbox gesetzt werden und klicken Sie dann auf Finish.

      Nun \u00f6ffnet sich ein neues Browserfenster, in dem Sie unten im Formular ein OTP Ihres YubiKey eingeben m\u00fcssen (auf das Feld klicken und dann auf Ihren YubiKey tippen). Best\u00e4tigen Sie das Captcha und laden Sie die Daten auf den Yubico-Server hoch, indem Sie auf 'Hochladen' klicken. Die Verarbeitung der Daten wird einen Moment dauern.

      Nachdem die Generierung erfolgreich war, werden Ihnen eine Client ID und ein Secret key angezeigt, notieren Sie sich diese Informationen an einem sicheren Ort.

      Nun k\u00f6nnen Sie Yubico OTP-Authentifizierung aus dem Dropdown-Men\u00fc in der mailcow UI auf der Startseite unter Zugang -> Zwei-Faktor-Authentifizierung ausw\u00e4hlen. In dem sich nun \u00f6ffnenden Dialog k\u00f6nnen Sie einen Namen f\u00fcr diesen YubiKey eingeben und die zuvor notierte Client ID sowie den Secret key in die vorgesehenen Felder eintragen. Geben Sie schlie\u00dflich Ihr aktuelles Kontopasswort ein und ber\u00fchren Sie nach Auswahl des Feldes Touch Yubikey die Schaltfl\u00e4che Ihres YubiKey.

      Herzlichen Gl\u00fcckwunsch! Sie k\u00f6nnen sich nun mit Ihrem YubiKey in die mailcow UI einloggen!

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#webauthn-u2f-ersatz","title":"WebAuthn (U2F, Ersatz)","text":"

      Warnung

      Seit Februar 2022 hat Google Chrome die Unterst\u00fctzung f\u00fcr U2F aufgegeben und die Verwendung von WebAuthn standardisiert. Die WebAuthn API (der Ersatz f\u00fcr U2F) ist seit dem 21. Januar 2022 Teil von mailcow, wenn Sie also den Key \u00fcber Februar 2022 hinaus nutzen wollen, sollten Sie ein Update mit der update.sh in Betracht ziehen.

      Um WebAuthn zu nutzen, muss der Browser diesen Standard unterst\u00fctzen:

      • Edge (>=18)
      • Firefox (>=60)
      • Chrome (>=67)
      • Safari (>=13)
      • Opera (>=54)

      Die folgenden mobilen Browser unterst\u00fctzen diesen Authentifizierungstyp:

      • Safari auf iOS (>=14.5)
      • Android-Browser (>=97)
      • Opera Mobil (>=64)
      • Chrome f\u00fcr Android (>=97)

      Quellen: caniuse.com, blog.mozilla.org

      WebAuthn funktioniert auch ohne Internetverbindung.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#was-passiert-mit-meinem-registrierten-fido-security-key-nach-dem-update-von-u2f-auf-webauthn","title":"Was passiert mit meinem registrierten Fido Security Key nach dem Update von U2F auf WebAuthn?","text":"

      Warnung

      Mit dem neuen U2F-Ersatz (WebAuthn) m\u00fcssen Sie Ihren Fido Security Key neu registrieren, zum Gl\u00fcck ist WebAuthn abw\u00e4rtskompatibel und unterst\u00fctzt das U2F-Protokoll.

      Im Idealfall sollten Sie beim n\u00e4chsten Einloggen (mit dem Schl\u00fcssel) ein Textfeld erhalten, das besagt, dass Ihr Fido Security Key aufgrund des Updates auf WebAuthn entfernt und als 2-Faktor-Authentifikator gel\u00f6scht wurde.

      Aber keine Sorge! Sie k\u00f6nnen Ihren bestehenden Schl\u00fcssel einfach neu registrieren und ihn wie gewohnt verwenden. Sie werden wahrscheinlich nicht einmal einen Unterschied bemerken, au\u00dfer dass Ihr Browser die U2F-Deaktivierungsmeldung nicht mehr anzeigt.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#deaktivieren-inoffizieller-unterstutzter-fido-security-keys","title":"Deaktivieren inoffizieller unterst\u00fctzter Fido Security Keys","text":"

      Mit WebAuthn gibt es die M\u00f6glichkeit, nur offizielle Fido Security Keys zu verwenden (von den gro\u00dfen Marken wie: Yubico, Apple, Nitro, Google, Huawei, Microsoft, usw.) zu verwenden.

      Dies dient in erster Linie der Sicherheit, da es Administratoren erm\u00f6glicht, sicherzustellen, dass nur offizielle Hardware in ihrer Umgebung verwendet werden kann.

      Um diese Funktion zu aktivieren, \u00e4ndern Sie den Wert WEBAUTHN_ONLY_TRUSTED_VENDORS in mailcow.conf von n auf y und starten Sie die betroffenen Container mit dem folgenden Befehl neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Die mailcow wird nun die Vendor-Zertifikate verwenden, die sich in Ihrem mailcow-Verzeichnis unter data/web/inc/lib/WebAuthn/rootCertificates befinden.

      Beispiel

      Wenn Sie die offiziellen Hersteller-Ger\u00e4te nur auf Apple beschr\u00e4nken wollen, brauchen Sie nur das Apple Hersteller-Zertifikat im data/web/inc/lib/WebAuthn/rootCertificates. Nachdem Sie alle anderen Zertifikate gel\u00f6scht haben, k\u00f6nnen Sie WebAuthn 2FA nur noch mit Apple-Ger\u00e4ten aktivieren.

      Das ist f\u00fcr jeden Hersteller gleich, also w\u00e4hlen Sie aus, was Ihnen gef\u00e4llt (wenn Sie wollen).

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#eigene-zertifikate-fur-webauthn-verwenden","title":"Eigene Zertifikate f\u00fcr WebAuthn verwenden","text":"

      Wenn Sie ein g\u00fcltiges Zertifikat vom Hersteller eines Schl\u00fcssels haben, k\u00f6nnen Sie es auch zu ihrer mailcow hinzuf\u00fcgen!

      Kopieren Sie einfach das Zertifikat in den data/web/inc/lib/WebAuthn/rootCertificates Ordner und starten Sie Ihre mailcow neu.

      Nun sollten Sie in der Lage sein, auch dieses Ger\u00e4t zu registrieren, obwohl die \u00dcberpr\u00fcfung f\u00fcr die Herstellerzertifikate aktiviert ist, da Sie das Zertifikat manuell hinzugef\u00fcgt haben.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#ist-es-gefahrlich-den-vendor-check-deaktiviert-zu-lassen","title":"Ist es gef\u00e4hrlich, den Vendor Check deaktiviert zu lassen?","text":"

      Nein, das ist es nicht! Diese Herstellerzertifikate werden nur zur \u00dcberpr\u00fcfung der Originalhardware verwendet, nicht zur Absicherung des Registrierungsprozesses.

      Wie Sie in diesen Artikeln lesen k\u00f6nnen, hat die Deaktivierung nichts mit der Software-Sicherheit zu tun:

      • https://developers.yubico.com/U2F/Attestation_and_Metadata/
      • https://medium.com/webauthnworks/webauthn-fido2-demystifying-attestation-and-mds-efc3b3cb3651
      • https://medium.com/webauthnworks/sorting-fido-ctap-webauthn-terminology-7d32067c0b01

      Letztendlich ist es aber nat\u00fcrlich Ihre Entscheidung, ob Sie dieses H\u00e4kchen deaktiviert oder aktiviert lassen.

      "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#totp","title":"TOTP","text":"

      Die bekannteste TFA-Methode, die meist mit einem Smartphone verwendet wird.

      Um die TOTP-Methode einzurichten, loggen Sie sich in die Admin UI ein und w\u00e4hlen Sie Time-based OTP (TOTP) aus der Liste.

      Nun \u00f6ffnet sich ein Modal, in dem Sie einen Namen f\u00fcr Ihr 2FA-\"Ger\u00e4t\" (Beispiel: John Deer's Smartphone) und das Passwort des betroffenen Admin-Kontos (mit dem Sie derzeit eingeloggt sind) eingeben m\u00fcssen.

      Sie haben zwei verschiedene Methoden, um TOTP f\u00fcr Ihr Konto zu registrieren: 1. Scannen Sie den QR-Code mit Ihrer Authenticator App auf einem Smartphone oder Tablet. 2. Verwenden Sie den TOTP-Code (unter dem QR-Code) in Ihrem TOTP-Programm oder Ihrer App (wenn Sie keinen QR-Code scannen k\u00f6nnen).

      Nachdem Sie den QR- oder TOTP-Code in der TOTP-App/dem TOTP-Programm Ihrer Wahl registriert haben, m\u00fcssen Sie nur noch den nun generierten TOTP-Token (in der App/dem Programm) als Best\u00e4tigung in der mailcow UI eingeben, um die TOTP 2FA endg\u00fcltig zu aktivieren, ansonsten wird sie nicht aktiviert, obwohl der TOTP-Token bereits in Ihrer App/ Ihrem Programm generiert wurde.

      "},{"location":"de/models/model-acl/","title":"ACL","text":"

      Die Bearbeitung eines Dom\u00e4nenadministrators oder eines Mailboxbenutzers erm\u00f6glicht es, Einschr\u00e4nkungen f\u00fcr dieses Konto festzulegen.

      Wichtig: Bei sich \u00fcberschneidenden Modulen wie Synchronisierungsauftr\u00e4gen, auf die sowohl Dom\u00e4nenadministratoren als auch Mailbox-Benutzer Zugriff erhalten k\u00f6nnen, werden die Rechte des Dom\u00e4nenadministrators geerbt, wenn man sich als Mailbox-Benutzer anmeldet.

      Einige Beispiele:

      1.

      • Ein Dom\u00e4nenadministrator hat keinen Zugriff auf Synchronisierungsauftr\u00e4ge, kann sich aber als Mailbox-Benutzer anmelden
      • Wenn er sich als Mailbox-Benutzer anmeldet, erh\u00e4lt er keinen Zugriff auf Synchronisierungsauftr\u00e4ge, auch wenn der betreffende Mailbox-Benutzer bei der direkten Anmeldung Zugriff hat.

      2.

      • Ein Dom\u00e4nenadministrator hat Zugriff auf Synchronisierungsauftr\u00e4ge und kann sich als Postfachbenutzer anmelden
      • Der Mailbox-Benutzer, als der er sich anzumelden versucht, hat keinen Zugang zu Synchronisierungsauftr\u00e4gen
      • Der Dom\u00e4nenadministrator, der nun als Mailbox-Benutzer angemeldet ist, erbt die Berechtigung des Mailbox-Benutzers und kann auf Synchronisierungsauftr\u00e4ge zugreifen.

      3.

      • Ein Dom\u00e4nenadministrator meldet sich als Mailbox-Benutzer an
      • Jede Berechtigung, die nicht in der ACL eines Dom\u00e4nenadministrators vorhanden ist, wird automatisch gew\u00e4hrt (Beispiel: zeitlich begrenzter Alias, TLS-Richtlinie usw.)
      "},{"location":"de/models/model-passwd/","title":"Passwort-Hashing","text":""},{"location":"de/models/model-passwd/#vollstandig-unterstutzte-hashing-methoden","title":"Vollst\u00e4ndig unterst\u00fctzte Hashing-Methoden","text":"

      Die aktuellste Version von mailcow unterst\u00fctzt die folgenden Hashing-Methoden vollst\u00e4ndig. Die Standard-Hashing-Methode ist fett geschrieben:

      • BLF-CRYPT
      • SSHA
      • SSHA256
      • SSHA512

      Die obigen Methoden k\u00f6nnen in mailcow.conf als MAILCOW_PASS_SCHEME Wert verwendet werden.

      "},{"location":"de/models/model-passwd/#nur-lese-hashing-methoden","title":"Nur-Lese-Hashing-Methoden","text":"

      Die folgenden Methoden werden nur lesend unterst\u00fctzt. Wenn Sie planen, SOGo zu benutzen (wie standardm\u00e4\u00dfig), ben\u00f6tigen Sie eine SOGo-kompatible Hash-Methode. Bitte beachten Sie den Hinweis am Ende dieser Seite, wie Sie die Ansicht bei Bedarf aktualisieren k\u00f6nnen. Wenn SOGo deaktiviert ist, k\u00f6nnen alle unten aufgef\u00fchrten Hashing-Methoden von mailcow und Dovecot gelesen werden.

      • ARGON2I (SOGo kompatibel)
      • ARGON2ID (SOGo kompatibel)
      • CLEAR
      • CLEARTEXT
      • CRYPT (SOGo-kompatibel)
      • DES-CRYPT
      • LDAP-MD5 (SOGo-kompatibel)
      • MD5 (SOGo-kompatibel)
      • MD5-CRYPT (SOGo-kompatibel)
      • PBKDF2 (SOGo-kompatibel)
      • PLAIN (SOGo-kompatibel)
      • PLAIN-MD4
      • PLAIN-MD5
      • PLAIN-TRUNC
      • SHA (SOGo-kompatibel)
      • SHA1 (SOGo-kompatibel)
      • SHA256 (SOGo-kompatibel)
      • SHA256-CRYPT (SOGo-kompatibel)
      • SHA512 (SOGo-kompatibel)
      • SHA512-CRYPT (SOGo-kompatibel)
      • SMD5 (SOGo kompatibel)

      Das bedeutet, mailcow ist in der Lage, Nutzer mit einem Hash wie {MD5}1a1dc91c907325c69271ddf0c944bc72 aus der Datenbank zu verifizieren.

      Der Wert von MAILCOW_PASS_SCHEME wird immer verwendet, um neue Passw\u00f6rter zu verschl\u00fcsseln.

      Ich habe die Passwort-Hashes in der SQL-Tabelle \"Mailbox\" ge\u00e4ndert und kann mich nicht anmelden.

      Eine \"Ansicht\" muss aktualisiert werden. Sie k\u00f6nnen dies durch einen Neustart von sogo-mailcow ausl\u00f6sen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart sogo-mailcow\n
      docker-compose restart sogo-mailcow\n
      "},{"location":"de/models/model-sender_rcv/","title":"Sender- und Empf\u00e4ngermodell","text":"

      Wenn eine Mailbox erstellt wird, kann ein Benutzer Mails von seiner eigenen Mailboxadresse senden und empfangen.

      Die Mailbox me@example.org wird erstellt. example.org ist eine prim\u00e4re Dom\u00e4ne.\nHinweis: Eine Mailbox kann nicht in einer Alias-Dom\u00e4ne erstellt werden.\n\nme@example.org ist nur als me@example.org bekannt.\nme@example.org darf als me@example.org senden.\n

      Wir k\u00f6nnen eine Alias-Dom\u00e4ne f\u00fcr example.org hinzuf\u00fcgen:

      Die Alias-Dom\u00e4ne alias.com wird hinzugef\u00fcgt und der prim\u00e4ren Dom\u00e4ne example.org zugewiesen.\nme@example.org ist nun als me@example.org und me@alias.com bekannt.\nme@example.org darf nun als me@example.org und me@alias.com senden.\n

      Wir k\u00f6nnen Aliase f\u00fcr eine Mailbox hinzuf\u00fcgen, um Mails von dieser neuen Adresse zu empfangen und zu senden.

      Es ist wichtig zu wissen, dass Sie nicht in der Lage sind, Mails f\u00fcr my-alias@my-alias-domain.tld zu empfangen. Sie m\u00fcssen diesen speziellen Alias erstellen.

      me@example.org wird der Alias alias@example.org zugewiesen.\nme@example.org ist jetzt bekannt als me@example.org, me@alias.com, alias@example.org\n\nme@example.org ist NICHT als alias@alias.com bekannt.\n

      Bitte beachten Sie, dass dies nicht f\u00fcr \"catch-all\"-Aliasnamen gilt:

      Die Alias-Dom\u00e4ne alias.com wird hinzugef\u00fcgt und der prim\u00e4ren Dom\u00e4ne example.org zugewiesen\nme@example.org wird der Catch-all-Alias @example.org zugewiesen\nme@example.org ist weiterhin nur als me@example.org bekannt, was die einzige verf\u00fcgbare send-as Option ist.\n\nJede an alias.com gesendete E-Mail wird mit dem Catch-All-Alias f\u00fcr example.org \u00fcbereinstimmen.\n

      Administratoren und Dom\u00e4nenadministratoren k\u00f6nnen Postf\u00e4cher bearbeiten, um bestimmten Benutzern zu erlauben, als andere Postfachbenutzer zu senden (sie zu \"delegieren\").

      Sie k\u00f6nnen zwischen Mailbox-Benutzern w\u00e4hlen oder die Absenderpr\u00fcfung f\u00fcr Dom\u00e4nen komplett deaktivieren.

      "},{"location":"de/models/model-sender_rcv/#sogo-mail-von-adressen","title":"SOGo \"Mail von\"-Adressen","text":"

      Mailbox-Benutzer k\u00f6nnen nat\u00fcrlich ihre eigene Mailbox-Adresse ausw\u00e4hlen, sowie alle Alias-Adressen und Aliase, die \u00fcber Alias-Dom\u00e4nen existieren.

      Wenn Sie einen anderen existierenden Mailbox-Benutzer als Ihre \"Mail von\"-Adresse ausw\u00e4hlen wollen, muss dieser Benutzer Ihnen den Zugriff \u00fcber SOGo delegieren (siehe SOGo-Dokumentation). Au\u00dferdem muss ein mailcow (Domain) Administrator Ihnen den Zugang wie oben beschrieben gew\u00e4hren.

      "},{"location":"de/post_installation/firststeps-authorize_watchdog_and_bounces/","title":"Authorisieren der Watchdog und Bounce Mails","text":"

      mailcow verwendet MAILCOW_HOSTNAME als Absenderdomain, um Watchdog-Benachrichtigungen zu senden und Bounce-E-Mails zu erstellen.

      1. WATCHDOG_NOTIFY_EMAIL sollte auf externe Empf\u00e4nger verweisen, die von einem anderen Mailserver verwaltet werden. Dies ist sehr wichtig, da der Watchdog \u00fcber Systemausf\u00e4lle informiert, und im Falle eines solchen Ausfalls w\u00e4re Ihre Instanz m\u00f6glicherweise nicht in der Lage, diese Benachrichtigung zu empfangen oder anzuzeigen.

      2. Da der Watchdog so konzipiert ist, dass er in allen Situationen funktioniert, einschlie\u00dflich F\u00e4llen, in denen Postfix, Rspamd oder Redis nicht funktionieren, senden wir E-Mails direkt \u00fcber den Watchdog-Container an den Empf\u00e4nger-MX, ohne DKIM-Signierung.

      Um Watchdog-Benachrichtigungen und Bounces ordnungsgem\u00e4\u00df an externe Mailserver zu senden, m\u00fcssen Sie SPF und DMARC f\u00fcr MAILCOW_HOSTNAME konfigurieren (ersetzen Sie mail.example.com und die IPs entsprechend Ihrer Konfiguration):

      _dmarc.mail.example.com IN TXT \"v=DMARC1; p=reject\"\nmail.example.com IN TXT \"v=spf1 ip4:192.0.2.146/32 ip6:2001:db8::1/128 -all\"\n

      Hinweis

      Wenn Sie m\u00f6chten, k\u00f6nnen Sie dieses SPF sp\u00e4ter als Include f\u00fcr andere Domains verwenden, wie zum Beispiel:

      example.com IN TXT \"v=spf1 include:mail.example.com -all\"\n
      "},{"location":"de/post_installation/firststeps-disable_ipv6/","title":"IPv6 deaktivieren","text":"

      ACHTUNG

      Bei Installationen, welche eine Docker Version zwischen 25.0.0 und 25.0.2 (zum \u00fcberpr\u00fcfen nutzt docker version) verwenden hat sich das Verhalten der IPv6-Adressen Allokation durch einen Bug ver\u00e4ndert. Ein simples enable_ipv6: false reicht damit NICHT mehr aus, um IPv6 komplett im Stack zu deaktivieren. Dies war ein Bug im Docker Daemon, welcher mit Version 25.0.3 gefixt wurde.

      Dies wird NUR empfohlen, wenn Sie kein IPv6-f\u00e4higes Netzwerk auf Ihrem Host haben!

      Wenn Sie es wirklich brauchen, k\u00f6nnen Sie die Verwendung von IPv6 in der Compose-Datei deaktivieren. Zus\u00e4tzlich k\u00f6nnen Sie auch den Start des Containers \"ipv6nat-mailcow\" deaktivieren, da er nicht ben\u00f6tigt wird, wenn Sie IPv6 nicht verwenden.

      Anstatt die Datei docker-compose.yml direkt zu bearbeiten, ist es besser, eine Override-Datei zu erstellen zu erstellen und Ihre \u00c4nderungen am Dienst dort zu implementieren. Leider scheint dies im Moment nur f\u00fcr Dienste zu funktionieren, nicht f\u00fcr Netzwerkeinstellungen.

      Um IPv6 im mailcow-Netzwerk zu deaktivieren, \u00f6ffnen Sie docker-compose.yml mit Ihrem bevorzugten Texteditor und suchen Sie nach dem Netzwerk-Abschnitt (er befindet sich am Ende der Datei).

      1. \u00c4ndern Sie docker-compose.yml

      \u00c4ndern Sie enable_ipv6: true in enable_ipv6: false:

      networks:\n  mailcow-network:\n    [...]\n    enable_ipv6: true # <<< auf false setzen\n    ipam:\n      driver: default\n      config:\n        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24\n    [...]\n

      2. ipv6nat-mailcow deaktivieren

      Um den ipv6nat-mailcow Container ebenfalls zu deaktivieren, gehen Sie in Ihr mailcow Verzeichnis und erstellen Sie eine neue Datei namens \"docker-compose.override.yml\":

      HINWEIS: Wenn Sie bereits eine Override-Datei haben, erstellen Sie diese nat\u00fcrlich nicht neu, sondern f\u00fcgen Sie die untenstehenden Zeilen entsprechend in Ihre bestehende Datei ein!

      # cd /opt/mailcow-dockerized\n# touch docker-compose.override.yml\n

      \u00d6ffnen Sie die Datei in Ihrem bevorzugten Texteditor und tragen Sie folgendes ein:

      services:\n\n    ipv6nat-mailcow:\n      image: bash:latest\n      restart: \"no\"\n      entrypoint: [\"echo\", \"ipv6nat disabled in compose.override.yml\"]\n

      Damit diese \u00c4nderungen wirksam werden, m\u00fcssen Sie den Stack vollst\u00e4ndig stoppen und dann neu starten, damit Container und Netzwerke neu erstellt werden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n

      3. Deaktivieren Sie IPv6 in unbound-mailcow

      Bearbeiten Sie data/conf/unbound/unbound.conf und setzen Sie do-ip6 auf \"no\":

      Server:\n  [...]\n  do-ip6: no\n  [...]\n

      unbound neu starten:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart unbound-mailcow\n
      docker-compose restart unbound-mailcow\n

      4. Deaktivieren Sie IPv6 in postfix-mailcow

      Erstellen Sie data/conf/postfix/extra.cf und setzen Sie smtp_address_preference auf ipv4:

      smtp_address_preference = ipv4\ninet_protocols = ipv4\n

      Starten Sie Postfix neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart postfix-mailcow\n
      docker-compose restart postfix-mailcow\n

      5. Wenn im Docker Daemon IPv6 komplett deaktiviert ist:

      Folgende NGINX, Dovecot und Php-fpm Konfigurationsdateien anpassen

      sed -i '/::/d' data/conf/nginx/templates/listen*\nsed -i '/::/d' data/conf/nginx/dynmaps.conf\nsed -i 's/,\\[::\\]//g' data/conf/dovecot/dovecot.conf\nsed -i 's/\\[::\\]://g' data/conf/phpfpm/php-fpm.d/pools.conf\n
      "},{"location":"de/post_installation/firststeps-dmarc_reporting/","title":"DMARC Reporting","text":"

      Die DMARC-Berichterstattung erfolgt \u00fcber das Rspamd DMARC-Modul.

      Die Rspamd-Dokumentation finden Sie hier: https://rspamd.com/doc/modules/dmarc.html

      Wichtig:

      1. \u00c4ndern Sie example.com, mail.example.com und Example so, dass sie Ihrer Einrichtung entsprechen

      2. Die DMARC-Berichterstattung erfordert zus\u00e4tzliche Aufmerksamkeit, insbesondere in den ersten Tagen

      3. Alle empfangenden Domains, die auf mailcow gehostet werden, senden von einer Reporting-Domain. Es wird empfohlen, die \u00fcbergeordnete Domain Ihres MAILCOW_HOSTNAME zu verwenden:

        • Wenn Ihr MAILCOW_HOSTNAME mail.example.com ist, \u00e4ndern Sie die folgende Konfiguration in domain = \"example.com\";
        • Setzen Sie email gleich, z.B. email = \"noreply-dmarc@example.com\";

      4. Es ist optional, aber empfohlen, einen E-Mail-Benutzer noreply-dmarc in mailcow zu erstellen, um Bounces zu behandeln.

      "},{"location":"de/post_installation/firststeps-dmarc_reporting/#aktivieren-sie-dmarc-berichterstattung","title":"Aktivieren Sie DMARC-Berichterstattung","text":"

      Erstellen Sie die Datei data/conf/rspamd/local.d/dmarc.conf und setzen Sie den folgenden Inhalt:

      reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    domain = 'example.com';\n    org_name = 'Example';\n    helo = 'rspamd';\n    smtp = 'postfix';\n    smtp_port = 25;\n    from_name = 'Example DMARC Report';\n    msgid_from = 'rspamd.mail.example.com';\n    max_entries = 2k;\n    keys_expire = 2d;\n}\n

      Erstellen oder \u00e4ndern Sie docker-compose.override.yml im mailcow-dockerized Basisverzeichnis:

      services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"@every 24h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

      Starten Sie den mailcow Stack mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-dmarc_reporting/#senden-sie-eine-kopie-der-berichte-an-sich-selbst","title":"Senden Sie eine Kopie der Berichte an sich selbst","text":"

      Um eine versteckte Kopie der von Rspamd erzeugten Berichte zu erhalten, k\u00f6nnen Sie eine bcc_addrs Liste im reporting Konfigurationsabschnitt von data/conf/rspamd/local.d/dmarc.conf setzen:

      reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    bcc_addrs = [\"noreply-dmarc@example.com\", \"parsedmarc@example.com\"];\n[...]\n

      Rspamd l\u00e4dt \u00c4nderungen in Echtzeit, so dass Sie den Container zu diesem Zeitpunkt nicht neu starten m\u00fcssen.

      Dies kann n\u00fctzlich sein, wenn Sie...

      • ...\u00fcberpr\u00fcfen wollen, ob Ihre DMARC-Berichte korrekt und authentifiziert gesendet werden.
      • ...Ihre eigenen Berichte analysieren wollen, um Statistiken zu erhalten, z.B. um sie mit ParseDMARC oder anderen Analysesystemen zu verwenden.
      "},{"location":"de/post_installation/firststeps-dmarc_reporting/#fehlersuche","title":"Fehlersuche","text":"

      Pr\u00fcfen Sie, wann der Berichtsplan zuletzt ausgef\u00fchrt wurde:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n
      docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n

      Sehen Sie sich die letzte Berichtsausgabe an:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n
      docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n

      Manuelles Ausl\u00f6sen eines DMARC-Berichts:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow rspamadm dmarc_report\n
      docker-compose exec rspamd-mailcow rspamadm dmarc_report\n

      Best\u00e4tigen Sie, dass Rspamd Daten in Redis aufgezeichnet hat: \u00c4ndern Sie 20220428 in Ihr gew\u00fcnschtes Datum zum \u00fcberpr\u00fcfen.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n
      docker-compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n

      Nehmen Sie eine der Zeilen aus der Ausgabe, die Sie interessiert, und fordern Sie sie an, z. B.:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
      docker-compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
      "},{"location":"de/post_installation/firststeps-dmarc_reporting/#andern-sie-die-haufigkeit-der-dmarc-berichte","title":"\u00c4ndern Sie die H\u00e4ufigkeit der DMARC-Berichte","text":"

      Im obigen Beispiel werden die Berichte einmal alle 24 Stunden sowie f\u00fcr den gestrigen Tag versendet. Dies ist f\u00fcr die meisten Konfigurationen ausreichend.

      Wenn Sie ein gro\u00dfes E-Mail-Aufkommen haben und die DMARC-Berichterstattung mehr als einmal am Tag durchf\u00fchren wollen, m\u00fcssen Sie einen zweiten Zeitplan erstellen und ihn mit dmarc_report $(date '+%Y%m%d') ausf\u00fchren, um den aktuellen Tag zu verarbeiten. Sie m\u00fcssen sicherstellen, dass der erste Lauf an jedem Tag auch den letzten Bericht vom Vortag verarbeitet, also muss er zweimal gestartet werden, einmal mit $(date --date yesterday '+%Y%m%d') um 0 5 0 * * * (00:05 AM) und dann mit $(date '+%Y%m%d') mit dem gew\u00fcnschten Intervall.

      Der Ofelia-Zeitplan hat die gleiche Implementierung wie cron in Go, die unterst\u00fctzte Syntax ist beschrieben in cron Documentation

      Um den Zeitplan zu \u00e4ndern:

      1. docker-compose.override.yml bearbeiten: 

        services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"0 5 0 * * *\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.schedule: \"@every 12h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

      2. Starten Sie die betroffenen Container neu:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

      3. F\u00fchren Sie einen Neustart nur von Ofelia aus:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart ofelia-mailcow\n
        docker-compose restart ofelia-mailcow\n
      "},{"location":"de/post_installation/firststeps-dmarc_reporting/#dmarc-berichterstattung-deaktivieren","title":"DMARC-Berichterstattung deaktivieren","text":"

      Zum Deaktivieren der Berichterstattung:

      1. Setzen Sie enabled auf false in data/conf/rspamd/local.d/dmarc.conf.

      2. Machen Sie \u00c4nderungen in docker-compose.override.yml an rspamd-mailcow und ofelia-mailcow r\u00fcckg\u00e4ngig

      3. Starten Sie die betroffenen Container neu:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ip_bindings/","title":"IP-Bindings","text":"

      Warnung

      Das \u00c4ndern der Bindung hat keinen Einfluss auf Source-NAT. Siehe SNAT f\u00fcr die erforderlichen Schritte.

      "},{"location":"de/post_installation/firststeps-ip_bindings/#ipv4-binding","title":"IPv4-Binding","text":"

      Um eine oder mehrere IPv4-Bind(ings) anzupassen, \u00f6ffne mailcow.conf und editiere eine, mehrere oder alle Variablen nach deinen Bed\u00fcrfnissen:

      # Aus technischen Gr\u00fcnden unterscheiden sich die http-Bindungen ein wenig von anderen Service-Bindungen.\n# Sie werden die folgenden Variablen finden, getrennt durch eine Bindungsadresse und deren Port:\n# Beispiel: HTTP_BIND=1.2.3.4\n\nHTTP_PORT=80\nHTTP_BIND=\nHTTPS_PORT=443\nHTTPS_BIND=\n\n# Andere Dienste werden nach folgendem Format gebunden:\n# SMTP_PORT=1.2.3.4:25 bindet SMTP an die IP 1.2.3.4 auf Port 25\n# Wichtig! Durch die Angabe einer IPv4-Adresse werden alle IPv6-Bindungen seit Docker 20.x \u00fcbersprungen.\n# doveadm, SQL sowie Solr sind nur an lokale Ports gebunden, bitte \u00e4ndern Sie das nicht, es sei denn, Sie wissen, was Sie tun.\n\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nIMAP_PORT=143\nIMAPS_PORT=993\nPOP_PORT=110\nPOPS_PORT=995\nSIEVE_PORT=4190\nDOVEADM_PORT=127.0.0.1:19991\nSQL_PORT=127.0.0.1:13306\nSOLR_PORT=127.0.0.1:18983\n

      Um Ihre \u00c4nderungen zu \u00fcbernehmen, f\u00fchren Sie folgende Befehle aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ip_bindings/#ipv6-binding","title":"IPv6-Binding","text":"

      Das \u00c4ndern von IPv6-Bindings ist anders als bei IPv4. Auch dies hat einen technischen Hintergrund.

      Eine docker-compose.override.yml Datei wird verwendet, anstatt die docker-compose.yml Datei direkt zu bearbeiten. Dies geschieht, um die Aktualisierbarkeit zu erhalten, da die Datei docker-compose.yml regelm\u00e4\u00dfig aktualisiert wird und Ihre \u00c4nderungen h\u00f6chstwahrscheinlich \u00fcberschrieben werden.

      Bearbeiten Sie die Datei \"docker-compose.override.yml\" und erstellen Sie sie mit dem folgenden Inhalt. Ihr Inhalt wird mit der produktiven Datei \"docker-compose.yml\" zusammengef\u00fchrt.

      Es wird eine beispielhafte IPv6 2001:db8:dead:beef::123 in [] angegeben. Das erste Suffix :PORT1 definiert den externen Port, w\u00e4hrend das zweite Suffix :PORT2 zu dem entsprechenden Port innerhalb des Containers f\u00fchrt und nicht ver\u00e4ndert werden darf.

      services:\n\n    dovecot-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:143:143'\n        - '[2001:db8:dead:beef::123]:993:993'\n        - '[2001:db8:dead:beef::123]:110:110'\n        - '[2001:db8:dead:beef::123]:995:995'\n        - '[2001:db8:dead:beef::123]:4190:4190'\n\n    postfix-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:25:25'\n        - '[2001:db8:dead:beef::123]:465:465'\n        - '[2001:db8:dead:beef::123]:587:587'\n\n    nginx-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:80:80'\n        - '[2001:db8:dead:beef::123]:443:443'\n

      Um Ihre \u00c4nderungen zu \u00fcbernehmen, f\u00fchren Sie folgendes aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-local_mta/","title":"Lokaler MTA auf Docker-Host","text":"

      Die einfachste M\u00f6glichkeit w\u00e4re, den Listener an Port 25/tcp zu deaktivieren.

      Postfix-Benutzer deaktivieren den Listener, indem sie die folgende Zeile (beginnend mit smtp oder 25) in /etc/postfix/master.cf auskommentieren: 

      #smtp      inet  n       -       -       -       -       smtpd\n

      Au\u00dferdem, um \u00fcber eine Dockerized mailcow weiterzuleiten, sollten Sie 172.22.1.1 als Relayhost hinzuf\u00fcgen und das Docker-Interface aus \"inet_interfaces\" entfernen:

      postconf -e 'relayhost = 172.22.1.1'\npostconf -e \"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128\"\npostconf -e \"inet_interfaces = loopback-only\"\npostconf -e \"relay_transport = relay\"\npostconf -e \"default_transport = smtp\"\n

      Jetzt ist es wichtig, dass Sie nicht denselben FQDN in myhostname haben, den Sie f\u00fcr Ihre mailcow verwenden. Pr\u00fcfen Sie Ihre lokale (nicht-Docker) Postfix' main.cf auf myhostname und setzen Sie ihn auf etwas anderes, zum Beispiel local.my.fqdn.tld.

      \"172.22.1.1\" ist das von mailcow erstellte Netzwerk-Gateway in Docker. Das Relaying \u00fcber diese Schnittstelle ist notwendig (anstatt - zum Beispiel - direkt \u00fcber ${MAILCOW_HOSTNAME}), um \u00fcber ein bekanntes internes Netzwerk weiterzuleiten.

      Starten Sie Postfix neu, nachdem Sie Ihre \u00c4nderungen vorgenommen haben.

      "},{"location":"de/post_installation/firststeps-logging/","title":"Logging","text":"

      Das Logging in mailcow: dockerized besteht aus mehreren Stufen, ist aber immerhin wesentlich flexibler und einfacher in einen Logging-Daemon zu integrieren als bisher.

      In Docker schreibt die containerisierte Anwendung (PID 1) ihre Ausgabe auf stdout. F\u00fcr echte Ein-Anwendungs-Container funktioniert das sehr gut. F\u00fchren Sie folgenden Befehl aus, um mehr zu erfahren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs --help\n
      docker-compose logs --help\n

      Einige Container protokollieren oder streamen an mehrere Ziele.

      Kein Container wird persistente Logs in sich behalten. Container sind fl\u00fcchtige Objekte!

      Am Ende wird jede Zeile der Logs den Docker-Daemon erreichen - ungefiltert.

      Der Standard-Logging-Treiber ist \"json \".

      "},{"location":"de/post_installation/firststeps-logging/#gefilterte-logs","title":"Gefilterte Logs","text":"

      Einige Logs werden gefiltert und in Redis-Schl\u00fcssel geschrieben, aber auch in einen Redis-Kanal gestreamt.

      Der Redis-Kanal wird verwendet, um Protokolle mit fehlgeschlagenen Authentifizierungsversuchen zu streamen, die von netfilter-mailcow gelesen werden.

      Die Redis-Schl\u00fcssel sind persistent und halten 10000 Zeilen von Logs f\u00fcr die Web-UI.

      Dieser Mechanismus macht es m\u00f6glich, jeden beliebigen Docker-Logging-Treiber zu verwenden, ohne die ohne die F\u00e4higkeit zu verlieren, Logs von der UI zu lesen oder verd\u00e4chtige Clients mit netfilter-mailcow zu sperren.

      Redis-Schl\u00fcssel enthalten nur Logs von Anwendungen und filtern Systemmeldungen heraus (man denke an Cron etc.).

      "},{"location":"de/post_installation/firststeps-logging/#logging-treiber","title":"Logging-Treiber","text":""},{"location":"de/post_installation/firststeps-logging/#uber-docker-composeoverrideyml","title":"\u00dcber docker-compose.override.yml","text":"

      Hier ist die gute Nachricht: Da Docker einige gro\u00dfartige Logging-Treiber hat, k\u00f6nnen Sie mailcow: dockerized mit Leichtigkeit in Ihre bestehende Logging-Umgebung integrieren.

      Erstellen Sie eine docker-compose.override.yml und f\u00fcgen Sie zum Beispiel diesen Block hinzu, um das \"gelf\" Logging-Plugin f\u00fcr postfix-mailcow zu verwenden:

      services:\n  postfix-mailcow: # oder ein anderer\n    logging:\n      driver: \"gelf\"\n      options:\n        gelf-address: \"udp://graylog:12201\"\n

      Ein weiteres Beispiel f\u00fcr Syslog:

      services:\n\n  postfix-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  dovecot-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  rspamd-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n
      "},{"location":"de/post_installation/firststeps-logging/#nur-fur-rsyslog","title":"Nur f\u00fcr rsyslog:","text":"

      Stellen Sie sicher, dass folgende Zeilen in /etc/rsyslog.conf nicht auskommentiert sind:

      # provides UDP syslog reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n

      Um Eing\u00e4nge von local3 in /var/log/mailcow.log zu leiten und danach die Verarbeitung zu stoppen, erstellen Sie die Datei /etc/rsyslog.d/docker.conf:

      local3.*        /var/log/mailcow.log\n& stop\n

      Starten Sie rsyslog danach neu.

      "},{"location":"de/post_installation/firststeps-logging/#uber-daemonjson-global","title":"\u00dcber daemon.json (global)","text":"

      Wenn Sie den Logging-Treiber global \u00e4ndern wollen, editieren Sie die Konfigurationsdatei des Docker-Daemons /etc/docker/daemon.json und starten Sie den Docker-Dienst neu:

      {\n[...]\n  \"log-driver\": \"gelf\",\n  \"log-opts\": {\n    \"gelf-address\": \"udp://graylog:12201\"\n  }\n[...]\n}\n

      F\u00fcr Syslog:

      {\n[...]\n  \"log-driver\": \"syslog\",\n  \"log-opts\": {\n    \"syslog-address\": \"udp://1.2.3.4:514\"\n  }\n[...]\n}\n

      Starten Sie den Docker-Daemon neu und f\u00fchren Sie die folgenden Befehle aus, um die Container mit dem neuen Protokollierungstreiber neu zu erstellen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-logging/#log-rotation","title":"Log rotation","text":"

      Da diese Logs sehr gro\u00df werden k\u00f6nnen, ist es eine gute Idee logrotate zu nutzen, um Logs nach einer gewissen Zeit zu komprimieren und zu l\u00f6schen.

      Erstellen Sie die Datei /etc/logrotate.d/mailcow mit folgendem Inhalt:

      /var/log/mailcow.log {\n        rotate 7\n        daily\n        compress\n        delaycompress\n        missingok\n        notifempty\n        create 660 root root\n}\n

      Mit dieser Konfiguration wird logrotate t\u00e4glich ausgef\u00fchrt und es werden maximal 7 Archive gespeichert.

      Um die Logdatei w\u00f6chentlich oder monatlich zu rotieren, muss daily durch weekly oder respektive monthly ersetzt werden.

      Um mehr Archive zu speichern, muss die Nummer hinter rotate angepasst werden.

      Danach kann logrotate neu gestartet werden.

      "},{"location":"de/post_installation/firststeps-snat/","title":"SNAT","text":"

      SNAT wird verwendet, um die Quelladresse der von mailcow gesendeten Pakete zu \u00e4ndern. Es kann verwendet werden, um die ausgehende IP-Adresse auf Systemen mit mehreren IP-Adressen zu \u00e4ndern.

      \u00d6ffnen Sie mailcow.conf, setzen Sie einen oder beide der folgenden Parameter:

      # Benutze diese IPv4 f\u00fcr ausgehende Verbindungen (SNAT)\nSNAT_TO_SOURCE=1.2.3.4\n\n# Benutze dieses IPv6 f\u00fcr ausgehende Verbindungen (SNAT)\nSNAT6_TO_SOURCE=dead:beef\n

      F\u00fchren Sie folgendes aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Die Werte werden von netfilter-mailcow gelesen. netfilter-mailcow stellt sicher, dass die Post-Routing-Regeln auf Position 1 in der Netfilter-Tabelle stehen. Es l\u00f6scht sie automatisch und legt sie neu an, wenn sie an einer anderen Position als 1 gefunden werden.

      \u00dcberpr\u00fcfen Sie die Ausgabe mit hilfe des folgendem Befehles um sicherzustellen, dass die SNAT-Einstellungen angewendet wurden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs --tail=200 netfilter-mailcow\n
      docker-compose logs --tail=200 netfilter-mailcow\n
      "},{"location":"de/post_installation/firststeps-ssl/","title":"Erweitertes SSL","text":""},{"location":"de/post_installation/firststeps-ssl/#lets-encrypt-wird-mitgeliefert","title":"Let's Encrypt (wird mitgeliefert)","text":"

      Der \"acme-mailcow\" Container wird versuchen, ein LE-Zertifikat f\u00fcr ${MAILCOW_HOSTNAME}, autodiscover.ADDED_MAIL_DOMAIN und autoconfig.ADDED_MAIL_DOMAIN zu erhalten.

      Warnung

      mailcow muss auf Port 80 verf\u00fcgbar sein, damit der acme-Client funktioniert. Unsere Reverse Proxy Beispielkonfigurationen decken das ab. Sie k\u00f6nnen auch jeden externen ACME-Client (z.B. certbot) verwenden, um Zertifikate zu erhalten, aber Sie m\u00fcssen sicherstellen, dass sie an den richtigen Ort kopiert werden und ein Post-Hook die betroffenen Container neu l\u00e4dt. Weitere Informationen finden Sie in der Reverse Proxy-Dokumentation.

      Standardm\u00e4\u00dfig, d.h. 0 Domains sind zu mailcow hinzugef\u00fcgt, wird es versuchen, ein Zertifikat f\u00fcr ${MAILCOW_HOSTNAME} zu erhalten.

      F\u00fcr jede hinzugef\u00fcgte Domain wird versucht, autodiscover.ADDED_MAIL_DOMAIN und autoconfig.ADDED_MAIL_DOMAIN in die IPv6-Adresse oder - falls IPv6 in der Domain nicht konfiguriert ist - in die IPv4-Adresse aufzul\u00f6sen. Wenn dies gelingt, wird ein Name als SAN zur Zertifikatsanforderung hinzugef\u00fcgt.

      Nur Namen, die validiert werden k\u00f6nnen, werden als SAN hinzugef\u00fcgt.

      F\u00fcr jede Domain, die Sie entfernen, wird das Zertifikat verschoben und ein neues Zertifikat angefordert. Es ist nicht m\u00f6glich, Domains in einem Zertifikat zu behalten, wenn wir nicht in der Lage sind, die Challenge f\u00fcr diese zu validieren.

      Wenn Sie den ACME-Client neu starten wollen, verwenden Sie den folgenden Befehl:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart acme-mailcow\n
      docker-compose restart acme-mailcow\n

      \u00dcberwachen Sie die Logs mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs --tail=200 -f acme-mailcow\n
      docker-compose logs --tail=200 -f acme-mailcow\n
      "},{"location":"de/post_installation/firststeps-ssl/#zusatzliche-domain-namen","title":"Zus\u00e4tzliche Domain-Namen","text":"

      Bearbeiten Sie \"mailcow.conf\" und f\u00fcgen Sie einen Parameter ADDITIONAL_SAN wie folgt hinzu:

      Verwenden Sie keine Anf\u00fchrungszeichen (\") und keine Leerzeichen zwischen den Namen!

      ADDITIONAL_SAN=smtp.*,cert1.example.com,cert2.example.org,whatever.*\n

      Jeder Name wird anhand seiner IPv6-Adresse oder - wenn IPv6 in Ihrer Dom\u00e4ne nicht konfiguriert ist - anhand seiner IPv4-Adresse \u00fcberpr\u00fcft.

      Ein Wildcard-Name wie smtp.* wird versuchen, ein smtp.DOMAIN_NAME SAN f\u00fcr jede zu mailcow hinzugef\u00fcgte Domain zu erhalten.

      F\u00fchren Sie den folgenden Befehl aus, um betroffene Container automatisch neu zu erstellen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Info

      Die Verwendung anderer Namen als MAILCOW_HOSTNAME f\u00fcr den Zugriff auf das mailcow UI kann weitere Konfiguration erfordern.

      Wenn Sie planen, einen anderen Servernamen als MAILCOW_HOSTNAME f\u00fcr den Zugriff auf die mailcow UI zu verwenden (z.B. durch Hinzuf\u00fcgen von mail.* zu ADDITIONAL_SAN), stellen Sie sicher, dass Sie diesen Namen in mailcow.conf \u00fcber ADDITIONAL_SERVER_NAMES eintragen. Die Namen m\u00fcssen durch Kommas getrennt sein und d\u00fcrfen keine Leerzeichen enthalten. Wenn Sie diesen Schritt auslassen, kann mailcow mit einer falschen Seite antworten.

      ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

      F\u00fchren Sie den folgenden Befehl aus, um es anzuwenden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#erneuerung-erzwingen","title":"Erneuerung erzwingen","text":"

      Um eine Erneuerung zu erzwingen, m\u00fcssen Sie eine Datei namens force_renew erstellen und den acme-mailcow Container neu starten:

      docker compose (Plugin)docker-compose (Standalone) 
      cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker compose restart acme-mailcow\n# Pr\u00fcfen Sie nun die Logs auf eine Erneuerung\ndocker compose logs --tail=200 -f acme-mailcow\n
      cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker-compose restart acme-mailcow\n# Pr\u00fcfen Sie nun die Logs auf eine Erneuerung\ndocker-compose logs --tail=200 -f acme-mailcow\n

      Die Datei wird automatisch gel\u00f6scht.

      "},{"location":"de/post_installation/firststeps-ssl/#validierungsfehler-und-wie-man-die-validierung-uberspringt","title":"Validierungsfehler und wie man die Validierung \u00fcberspringt","text":"

      Sie k\u00f6nnen die IP-\u00dcberpr\u00fcfung \u00fcberspringen, indem Sie SKIP_IP_CHECK=y in mailcow.conf setzen (keine Anf\u00fchrungszeichen). Seien Sie gewarnt, dass eine Fehlkonfiguration dazu f\u00fchrt, dass Sie von Let's Encrypt eingeschr\u00e4nkt werden! Dies ist vor allem f\u00fcr Multi-IP-Setups n\u00fctzlich, bei denen der IP-Check die falsche Quell-IP-Adresse zur\u00fcckgeben w\u00fcrde. Aufgrund der Verwendung von dynamischen IPs f\u00fcr acme-mailcow ist Source-NAT bei Neustarts nicht konsistent.

      Wenn Sie Probleme mit der \"HTTP-Validierung\" haben, aber Ihre IP-Adressbest\u00e4tigung erfolgreich ist, verwenden Sie h\u00f6chstwahrscheinlich firewalld, ufw oder eine andere Firewall, die Verbindungen von br-mailcow zu Ihrem externen Interface verbietet. Sowohl firewalld als auch ufw lassen dies standardm\u00e4\u00dfig nicht zu. Es reicht oft nicht aus, diese Firewall-Dienste einfach zu stoppen. Sie m\u00fcssen mailcow stoppen, den Firewall-Dienst stoppen, die Chains flushen und Docker neu starten.

      Sie k\u00f6nnen diese Validierungsmethode auch \u00fcberspringen, indem Sie SKIP_HTTP_VERIFICATION=y in \"mailcow.conf\" setzen. Seien Sie gewarnt, dass dies nicht zu empfehlen ist. In den meisten F\u00e4llen wird die HTTP-\u00dcberpr\u00fcfung \u00fcbersprungen, um unbekannte NAT-Reflection-Probleme zu umgehen, die durch das Ignorieren dieser spezifischen Netzwerk-Fehlkonfiguration nicht gel\u00f6st werden. Wenn Sie Probleme haben, TLSA-Eintr\u00e4ge in der DNS-\u00dcbersicht innerhalb von mailcow zu generieren, haben Sie h\u00f6chstwahrscheinlich Probleme mit NAT-Reflexion, die Sie beheben sollten.

      Wenn Sie einen SKIP_* Parameter ge\u00e4ndert haben, f\u00fchren Sie den folgenden Befehl aus, um die \u00c4nderungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#deaktivieren-sie-lets-encrypt","title":"Deaktivieren Sie Let's Encrypt","text":""},{"location":"de/post_installation/firststeps-ssl/#deaktivieren-sie-lets-encrypt-vollstandig","title":"Deaktivieren Sie Let's Encrypt vollst\u00e4ndig","text":"

      Setzen Sie SKIP_LETS_ENCRYPT=y in \"mailcow.conf\" und erstellen Sie \"acme-mailcow\" neu, mit dem folgenden Befehl:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#alle-namen-auer-mailcow_hostname-uberspringen","title":"Alle Namen au\u00dfer ${MAILCOW_HOSTNAME} \u00fcberspringen","text":"

      F\u00fcgen Sie ONLY_MAILCOW_HOSTNAME=y zu \"mailcow.conf\" hinzu und erstellen Sie \"acme-mailcow\" neu, mit dem folgenden Befehl:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#das-lets-encrypt-subjectaltname-limit-von-100-domains","title":"Das Let's Encrypt subjectAltName-Limit von 100 Domains","text":"

      Let's Encrypt hat derzeit ein Limit von 100 Domainnamen pro Zertifikat.

      Standardm\u00e4\u00dfig erstellt \"acme-mailcow\" ein einzelnes SAN-Zertifikat f\u00fcr alle validierten Domains (siehe den ersten Abschnitt und Zus\u00e4tzliche Domainnamen). Dies bietet beste Kompatibilit\u00e4t, bedeutet aber, dass das Let's Encrypt-Limit \u00fcberschritten wird, wenn Sie zu viele Domains zu einer einzelnen mailcow-Installation hinzuf\u00fcgen.

      Um dies zu l\u00f6sen, k\u00f6nnen Sie ENABLE_SSL_SNI so konfigurieren, dass es generiert wird:

      • Ein Hauptserver-Zertifikat mit MAILCOW_HOSTNAME und allen voll qualifizierten Domainnamen in der ADDITIONAL_SAN Konfiguration
      • Ein zus\u00e4tzliches Zertifikat f\u00fcr jede in der Datenbank gefundene Domain mit autodiscover., autoconfig. und jeder anderen in diesem Format konfigurierten ADDITIONAL_SAN (subdomain.*).
      • Begrenzungen: Ein Zertifikatsname ADDITIONAL_SAN=test.example.com wird als SAN zum Hauptzertifikat hinzugef\u00fcgt. Ein separates Zertifikat/Schl\u00fcsselpaar wird f\u00fcr dieses Format nicht erzeugt.

      Postfix, Dovecot und Nginx werden dann diese Zertifikate mit SNI bedienen.

      Setzen Sie ENABLE_SSL_SNI=y in \"mailcow.conf\" und erstellen Sie \"acme-mailcow\" mit dem folgenden Befehl neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Warnung

      Nicht alle Clients unterst\u00fctzen SNI, siehe Dovecot Dokumentation oder Wikipedia. Sie sollten sicherstellen, dass diese Clients den MAILCOW_HOSTNAME f\u00fcr sichere Verbindungen verwenden, wenn Sie diese Funktion aktivieren.

      Hier ist ein Beispiel:

      • MAILCOW_HOSTNAME=server.email.tld
      • ADDITIONAL_SAN=webmail.email.tld,mail.*
      • mailcow E-Mail-Dom\u00e4nen: \"domain1.tld\" und \"domain2.tld\"

      Die folgenden Zertifikate werden generiert:

      • server.email.tld, webmail.email.tld -> dies ist das Standard-Zertifikat, alle Clients k\u00f6nnen sich mit diesen Domains verbinden
      • mail.domain1.tld, autoconfig.domain1.tld, autodiscover.domain1.tld -> individuelles Zertifikat f\u00fcr domain1.tld, kann von Clients ohne SNI-Unterst\u00fctzung nicht verwendet werden
      • mail.domain2.tld, autoconfig.domain2.tld, autodiscover.domain2.tld -> individuelles Zertifikat f\u00fcr domain2.tld, kann von Clients ohne SNI-Unterst\u00fctzung nicht verwendet werden
      "},{"location":"de/post_installation/firststeps-ssl/#ein-eigenes-zertifikat-verwenden","title":"Ein eigenes Zertifikat verwenden","text":"

      Stellen Sie sicher, dass Sie mailcows internen LE-Client deaktivieren (siehe oben).

      Um Ihre eigenen Zertifikate zu verwenden, speichern Sie einfach das kombinierte Zertifikat (mit dem Zertifikat und der zwischengeschalteten CA/CA, falls vorhanden) unter data/assets/ssl/cert.pem und den entsprechenden Schl\u00fcssel unter data/assets/ssl/key.pem.

      WICHTIG: Verwenden Sie keine symbolischen Links! Stellen Sie sicher, dass Sie die Zertifikate kopieren und sie nicht mit data/assets/ssl verkn\u00fcpfen.

      Starten Sie die betroffenen Dienste anschlie\u00dfend neu:

      docker restart $(docker ps -qaf name=postfix-mailcow)\ndocker restart $(docker ps -qaf name=nginx-mailcow)\ndocker restart $(docker ps -qaf name=dovecot-mailcow)\n

      Siehe Post-Hook-Skript f\u00fcr Nicht-mailcow-ACME-Clients f\u00fcr ein vollst\u00e4ndiges Beispielskript.

      "},{"location":"de/post_installation/firststeps-ssl/#test-gegen-das-acme-verzeichnis","title":"Test gegen das ACME-Verzeichnis","text":"

      Bearbeiten Sie mailcow.conf und f\u00fcgen Sie LE_STAGING=y hinzu.

      F\u00fchren Sie den folgenden Befehl aus, um Ihre \u00c4nderungen zu aktivieren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#benutzerdefinierte-verzeichnis-url","title":"Benutzerdefinierte Verzeichnis-URL","text":"

      Editieren Sie mailcow.conf und f\u00fcgen Sie die entsprechende Verzeichnis-URL in die neue Variable DIRECTORY_URL ein:

      DIRECTORY_URL=https://acme-custom-v9000.api.letsencrypt.org/directory\n

      Sie k\u00f6nnen LE_STAGING nicht mit DIRECTORY_URL verwenden. Wenn beide gesetzt sind, wird nur LE_STAGING verwendet.

      F\u00fchren Sie den folgenden Befehl aus, um Ihre \u00c4nderungen zu aktivieren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/firststeps-ssl/#caa-eintrage-mit-dem-accounturi-parameter","title":"CAA-Eintr\u00e4ge mit dem accounturi-Parameter","text":"

      Let's Encrypt erm\u00f6glicht es, mithilfe des accounturi-Paramaters in CAA-Eintr\u00e4gen die Zertifikatsausstellung auf spezifische Account-IDs zu beschr\u00e4nken. Sie k\u00f6nnen das Helper-Skript generate_caa_record.py verwenden, um einen CAA-Eintrag mit accounturi zu erstellen, welchen Sie dann bei Ihrem DNS-Anbieter eintragen k\u00f6nnen:

      ./helper-scripts/generate_caa_record.py --account-key data/assets/ssl/acme/account.pem --contact mailto:ihre_acme_email@beispiel.de\n
      "},{"location":"de/post_installation/firststeps-ssl/#uberprufen-sie-ihre-konfiguration","title":"\u00dcberpr\u00fcfen Sie Ihre Konfiguration","text":"

      F\u00fchren Sie den folgenden Befehl aus, um herauszufinden, warum eine Validierung fehlschl\u00e4gt:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs --tail=200 acme-mailcow\n
      docker-compose logs --tail=200 acme-mailcow\n

      Um zu \u00fcberpr\u00fcfen, ob nginx das richtige Zertifikat verwendet, benutzen Sie einfach einen Browser Ihrer Wahl und \u00fcberpr\u00fcfen Sie das angezeigte Zertifikat.

      Um das von Postfix, Dovecot und Nginx verwendete Zertifikat zu \u00fcberpr\u00fcfen, verwenden wir openssl:

      # Verbindung \u00fcber SMTP STARTTLS (587)\nopenssl s_client -starttls smtp -connect MAILCOW_HOSTNAME:587 | openssl x509 -noout -text\n# Verbindung \u00fcber SMTP (465)\nopenssl s_client -connect MAILCOW_HOSTNAME:465 | openssl x509 -noout -text\n\n# Verbindung \u00fcber IMAP STARTTLS (143)\nopenssl s_client -starttls imap -connect MAILCOW_HOSTNAME:143 | openssl x509 -noout -text\n# Verbindung \u00fcber IMAP (993)\nopenssl s_client -connect MAILCOW_HOSTNAME:993 | openssl x509 -noout -text\n\n# Verbindung \u00fcber HTTPS (443)\nopenssl s_client -connect MAILCOW_HOSTNAME:443 | openssl x509 -noout -text\n

      Um die von openssl zur\u00fcckgegebenen Verfallsdaten gegen MAILCOW_HOSTNAME zu validieren, k\u00f6nnen Sie unser Hilfsskript verwenden:

      cd /opt/mailcow-dockerized\nbash helper-scripts/expiry-dates.sh\n
      "},{"location":"de/post_installation/firststeps-sync_jobs_migration/","title":"Migration mit Sync Jobs","text":"

      Sync-Auftr\u00e4ge werden verwendet, um bestehende E-Mails von einem externen IMAP-Server oder innerhalb von mailcow's bestehenden Mailboxen zu kopieren oder zu verschieben.

      Info

      Abh\u00e4ngig von der ACL Ihrer Mailbox haben Sie m\u00f6glicherweise nicht die M\u00f6glichkeit, einen Sync-Job hinzuzuf\u00fcgen. Bitte kontaktieren Sie in diesem Fall Ihren Domain-Administrator.

      "},{"location":"de/post_installation/firststeps-sync_jobs_migration/#einrichten-eines-sync-jobs","title":"Einrichten eines Sync-Jobs","text":"

      1. Erstellen Sie unter dem Punkt \"Konfiguration > E-Mail-Setup\" oder \"Benutzereinstellungen\" einen neuen Synchronisierungsauftrag.

      2. Wenn Sie ein Administrator sind, w\u00e4hlen Sie den Benutzernamen der nachgelagerten mailcow-Mailbox im Dropdown-Men\u00fc \"Benutzername\".

      3. F\u00fcllen Sie die Felder \"Host\" und \"Port\" mit den entsprechenden korrekten Werten des vorgelagerten IMAP-Servers aus.

      4. Geben Sie in den Feldern \"Benutzername\" und \"Passwort\" die korrekten Zugangsdaten des vorgelagerten IMAP-Servers ein.

      5. W\u00e4hlen Sie die \"Verschl\u00fcsselungsmethode\". Wenn der vorgelagerte IMAP-Server Port 143 verwendet, ist es wahrscheinlich, dass die Verschl\u00fcsselungsmethode TLS und SSL f\u00fcr Port 993 ist. Sie k\u00f6nnen auch PLAIN-Authentifizierung verwenden, aber davon wird dringend abgeraten.

      6. Alle anderen Felder k\u00f6nnen Sie so lassen, wie sie sind, oder sie nach Belieben \u00e4ndern.

      7. Vergewissern Sie sich, dass Sie \"Aktiv\" ankreuzen und klicken Sie auf \"Hinzuf\u00fcgen\".

      Info

      Sobald Sie fertig sind, melden Sie sich in der Mailbox an und \u00fcberpr\u00fcfen Sie, ob alle E-Mails korrekt importiert wurden. Wenn alles gut geht, werden alle Ihre E-Mails in Ihrem neuen Postfach landen. Vergessen Sie nicht, den Synchronisierungsauftrag zu l\u00f6schen oder zu deaktivieren, nachdem er verwendet wurde.

      "},{"location":"de/post_installation/reverse-proxy/r_p-apache24/","title":"Apache 2.4","text":"

      Wichtig

      Lesen Sie zuerst die \u00dcbersicht.

      Erforderliche Module: 

      a2enmod rewrite proxy proxy_http headers ssl\n

      Let's Encrypt wird unserem Rewrite folgen, Zertifikatsanfragen in mailcow werden problemlos funktionieren.

      Die hervorgehobenen Zeilen m\u00fcssen beachtet werden.

      <VirtualHost *:80>\n  ServerName ZU MAILCOW HOSTNAMEN \u00c4NDERN\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n  RewriteEngine on\n\n  RewriteCond %{HTTPS} off\n  RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]\n\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"http\"\n</VirtualHost>\n<VirtualHost *:443>\n  ServerName ZU MAILCOW HOSTNAMEN \u00c4NDERN\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n\n  # You should proxy to a plain HTTP session to offload SSL processing\n  ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000\n  ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"https\"\n\n  SSLCertificateFile MAILCOW_ORDNER/data/assets/ssl/cert.pem\n  SSLCertificateKeyFile MAILCOW_ORDNER/data/assets/ssl/key.pem\n\n  # Wenn Sie einen HTTPS-Host als Proxy verwenden m\u00f6chten:\n  #SSLProxyEngine On\n\n  # Wenn Sie einen Proxy f\u00fcr einen nicht vertrauensw\u00fcrdigen HTTPS-Host einrichten wollen:\n  #SSLProxyVerify none\n  #SSLProxyCheckPeerCN off\n  #SSLProxyCheckPeerName off\n  #SSLProxyCheckPeerExpire off\n</VirtualHost>\n
      "},{"location":"de/post_installation/reverse-proxy/r_p-caddy2/","title":"Caddy v2 (von der Community unterst\u00fctzt)","text":"

      Wichtig

      Lesen Sie zuerst die \u00dcbersicht.

      Warnung

      Dies ist ein nicht unterst\u00fctzter Communitybeitrag. Korrekturen sind immer erw\u00fcnscht!

      Die Konfiguration von Caddy mit mailcow ist sehr simpel.

      In der Caddyfile muss einfach nur ein Bereich f\u00fcr den E-Mailserver angelegt werden.

      Bspw:

      MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {\n        log {\n                output file /var/log/caddy/MAILCOW_HOSTNAME.log {\n                        roll_disabled\n                        roll_size 512M\n                        roll_uncompressed\n                        roll_local_time\n                        roll_keep 3\n                        roll_keep_for 48h\n                }\n        }\n\n        reverse_proxy 127.0.0.1:HTTP_BIND\n}\n

      Dies erlaubt es Caddy automatisch die Zertifikate zu erstellen und den Traffic f\u00fcr diese erw\u00e4hnten Domains anzunehmen und an mailcow weiterzuleiten.

      Wichtig: Der ACME Client der mailcow muss deaktiviert sein, da es sonst zu Fehlern seitens mailcow kommt.

      Da Caddy sich direkt selbst um die Zertifikate k\u00fcmmert, k\u00f6nnen wir mit dem folgenden Skript die Caddy generierten Zertifikate in die mailcow inkludieren:

      #!/bin/bash\nMAILCOW_HOSTNAME=your.domain.tld\nCADDY_CERTS_DIR=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory\nMD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))\nMD5SUM_NEW_CERT=($(md5sum $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt))\n\nif [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/key.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/key.pem\n        postfix_c=$(docker ps -qaf name=postfix-mailcow)\n        dovecot_c=$(docker ps -qaf name=dovecot-mailcow)\n        nginx_c=$(docker ps -qaf name=nginx-mailcow)\n        docker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n\nelse\n        echo \"Certs not copied from Caddy (Not needed)\"\nfi\n

      Achtung

      Der Zertifikatspfad von Caddy variiert je nach Installationsart. Bei diesem Installationsbeispiel wurde Caddy mithilfe des Caddy Repos (weitere Informationen hier) installiert. Um den Caddy Zertifikatspfad auf Ihrem System herauszufinden, gen\u00fcgt ein find / -name \"certificates\".

      Dieses Skript k\u00f6nnte dann als Cronjob jede Stunde aufgerufen werden:

      0 * * * * /bin/bash /path/to/script/deploy-certs.sh  >/dev/null 2>&1\n
      "},{"location":"de/post_installation/reverse-proxy/r_p-haproxy/","title":"HAProxy (von der Community unterst\u00fctzt)","text":"

      Wichtig

      Lesen Sie zuerst die \u00dcbersicht.

      Warnung

      Dies ist ein nicht unterst\u00fctzter Community Beitrag. Korrekturen sind immer erw\u00fcnscht!

      Dieses Beispiel leitet den gesamten HTTP-Verkehr zu HTTPS um, au\u00dfer f\u00fcr den eingebauten ACME-Client von mailcow. Wenn Sie den eingebauten ACME-Client nicht verwenden m\u00f6chten, \u00e4ndern Sie bitte die Konfiguration selbst.

      frontend https-in\n  bind :::80 v4v6\n  bind :::443 v4v6 ssl crt mailcow.pem\n\n  acl mailcow_acme path -i -m beg /.well-known/\n\n  redirect scheme https unless { ssl_fc || mailcow_acme }\n\n  default_backend mailcow\n\nbackend mailcow\n  option forwardfor\n  http-request set-header X-Forwarded-Proto https if { ssl_fc }\n  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }\n  server mailcow 127.0.0.1:8080 check\n
      "},{"location":"de/post_installation/reverse-proxy/r_p-nginx/","title":"Nginx","text":"

      Wichtig

      Lesen Sie zuerst die \u00dcbersicht.

      Let's Encrypt folgt unserem Rewrite, Zertifikatsanfragen funktionieren problemlos.

      Achten Sie auf die hervorgehobenen Zeilen.

      server {\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  server_name ZU MAILCOW HOSTNAMEN \u00c4NDERN autodiscover.* autoconfig.*;\n  return 301 https://$host$request_uri;\n}\nserver {\n  listen 443 ssl http2;\n  listen [::]:443 ssl http2;\n  server_name ZU MAILCOW HOSTNAMEN \u00c4NDERN autodiscover.* autoconfig.*;\n\n  ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;\n  ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;\n  ssl_session_timeout 1d;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_tickets off;\n\n  # Siehe https://ssl-config.mozilla.org/#server=nginx f\u00fcr die neuesten Empfehlungen zu ssl-Einstellungen\n  # Ein Beispiel f\u00fcr eine Konfiguration ist unten angegeben\n  ssl_protocols TLSv1.2;\n  ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;\n  ssl_prefer_server_ciphers off;\n\n  location /Microsoft-Server-ActiveSync {\n    proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_connect_timeout 75;\n    proxy_send_timeout 3650;\n    proxy_read_timeout 3650;\n    proxy_buffers 64 512k; # Seit dem 2022-04 Update n\u00f6tig f\u00fcr SOGo\n    client_body_buffer_size 512k;\n    client_max_body_size 0;\n  }\n\n  location / {\n    proxy_pass http://127.0.0.1:8080/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  # Die folgenden Proxy-Buffer m\u00fcssen gesetzt werden, wenn Sie SOGo nach dem Update 2022-04 (April 2022) verwenden wollen\n  # Andernfalls wird ein Login wie folgt fehlschlagen: https://github.com/mailcow/mailcow-dockerized/issues/4537\n    proxy_buffer_size 128k;\n    proxy_buffers 64 512k;\n    proxy_busy_buffers_size 512k;\n  }\n}\n
      "},{"location":"de/post_installation/reverse-proxy/r_p-traefik2/","title":"Traefik v2 (von der Community unterst\u00fctzt)","text":"

      Wichtig

      Lesen Sie zuerst die \u00dcbersicht.

      Warnung

      Dies ist ein nicht unterst\u00fctzter Community Beitrag. Korrekturen sind immer erw\u00fcnscht!

      Wichtig: Diese Konfiguration deckt nur das \"Reverseproxing\" des Webpanels (nginx-mailcow) unter Verwendung von Traefik v2 ab. Wenn Sie auch die Mail-Dienste wie dovecot, postfix... reproxen wollen, m\u00fcssen Sie die folgende Konfiguration an jeden Container anpassen und einen EntryPoint in Ihrer traefik.toml oder traefik.yml (je nachdem, welche Konfiguration Sie verwenden) f\u00fcr jeden Port erstellen.

      In diesem Abschnitt gehen wir davon aus, dass Sie Ihren Traefik 2 [certificatesresolvers] in Ihrer Traefik-Konfigurationsdatei richtig konfiguriert haben und auch acme verwenden. Das folgende Beispiel verwendet Lets Encrypt, aber Sie k\u00f6nnen es gerne auf Ihren eigenen Zertifikatsresolver \u00e4ndern. Eine grundlegende Traefik 2 toml-Konfigurationsdatei mit allen oben genannten Elementen, die f\u00fcr dieses Beispiel verwendet werden kann, finden Sie hier traefik.toml, falls Sie eine solche Datei ben\u00f6tigen oder einen Hinweis, wie Sie Ihre Konfiguration anpassen k\u00f6nnen.

      Zuallererst werden wir den acme-mailcow-Container deaktivieren, da wir die von traefik bereitgestellten Zertifikate verwenden werden. Dazu m\u00fcssen wir SKIP_LETS_ENCRYPT=y in unserer mailcow.conf setzen und den folgenden Befehl ausf\u00fchren, um die \u00c4nderungen zu \u00fcbernehmen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Dann erstellen wir eine docker-compose.override.yml Datei, um die Hauptdatei docker-compose.yml zu \u00fcberschreiben, die sich im mailcow-Stammverzeichnis befindet. 

      services:\n    nginx-mailcow:\n      networks:\n        # Traefiks Netzwerk hinzuf\u00fcgen\n        web:\n      labels:\n        - traefik.enable=true\n        # Erstellt einen Router namens \"moo\" f\u00fcr den Container und richtet eine Regel ein, um den Container mit einer bestimmten Regel zu verkn\u00fcpfen,\n        # in diesem Fall eine Host-Regel mit unserer MAILCOW_HOSTNAME-Variable.\n        - traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)\n        # Aktiviert tls \u00fcber den zuvor erstellten Router.\n        - traefik.http.routers.moo.tls=true\n        # Gibt an, welche Art von Cert-Resolver wir verwenden werden, in diesem Fall le (Lets Encrypt).\n        - traefik.http.routers.moo.tls.certresolver=le\n        # Erzeugt einen Dienst namens \"moo\" f\u00fcr den Container und gibt an, welchen internen Port des Containers\n        # Traefik die eingehenden Daten weiterleiten soll.\n        - traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}\n        # Gibt an, welchen Eingangspunkt (externer Port) traefik f\u00fcr diesen Container abh\u00f6ren soll.\n        # Websecure ist Port 443, siehe die Datei traefik.toml wie oben.\n        - traefik.http.routers.moo.entrypoints=websecure\n        # Stellen Sie sicher, dass traefik das Web-Netzwerk verwendet, nicht das mailcowdockerized_mailcow-network\n        - traefik.docker.network=traefik_web\n\n    certdumper:\n        image: ghcr.io/kereis/traefik-certs-dumper\n        command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1\n        network_mode: none\n        volumes:\n          # Binden Sie das Volume, das Traefiks `acme.json' Datei enth\u00e4lt, ein\n          - acme:/traefik:ro\n          # SSL-Ordner von mailcow einh\u00e4ngen\n          - ./data/assets/ssl/:/output:rw\n          # Binden Sie den Docker Socket ein, damit traefik-certs-dumper die Container neu starten kann\n          - /var/run/docker.sock:/var/run/docker.sock:ro\n        restart: always\n        environment:\n          # \u00c4ndern Sie dies nur, wenn Sie eine andere Domain f\u00fcr mailcows Web-Frontend verwenden als in der Standard-Konfiguration\n          - DOMAIN=${MAILCOW_HOSTNAME}\n\nnetworks:\n  web:\n    external: true\n    # Name des externen Netzwerks\n    name: traefik_web\n\nvolumes:\n  acme:\n    external: true\n    # Name des externen Docker Volumes, welches Traefiks `acme.json' Datei enth\u00e4lt\n    name: traefik_acme\n

      Starten Sie die neuen Container mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Da Traefik 2 ein acme v2 Format verwendet, um ALLE Zertifikaten von allen Domains zu speichern, m\u00fcssen wir einen Weg finden, die Zertifikate auszulagern. Zum Gl\u00fcck haben wir [diesen kleinen Container] (https://hub.docker.com/r/humenius/traefik-certs-dumper), der die Datei acme.json \u00fcber ein Volume und eine Variable DOMAIN=example. org, und damit wird der Container die cert.pem und key.pem Dateien ausgeben, daf\u00fcr lassen wir einfach den traefik-certs-dumper Container laufen, binden das /traefik Volume an den Ordner, in dem unsere acme.json gespeichert ist, binden das /output Volume an unseren mailcow data/assets/ssl/ Ordner, und setzen die DOMAIN=example.org Variable auf die Domain, von der wir die Zertifikate ausgeben wollen.

      Dieser Container \u00fcberwacht die Datei acme.json auf \u00c4nderungen und generiert die Dateien cert.pem und key.pem direkt in data/assets/ssl/, wobei der Pfad mit dem /output-Pfad des Containers verbunden ist.

      Sie k\u00f6nnen es \u00fcber die Kommandozeile ausf\u00fchren oder das hier gezeigte docker-compose.yml verwenden.

      Nachdem wir die Zertifikate \u00fcbertragen haben, m\u00fcssen wir die Konfigurationen aus unseren Postfix- und Dovecot-Containern neu laden und die Zertifikate \u00fcberpr\u00fcfen. Wie das geht, sehen Sie hier.

      Und das sollte es gewesen sein \ud83d\ude0a, Sie k\u00f6nnen \u00fcberpr\u00fcfen, ob der Traefik-Router einwandfrei funktioniert, indem Sie das Dashboard von Traefik / traefik logs / \u00fcber https auf die eingestellte Domain zugreifen, oder / und HTTPS, SMTP und IMAP mit den Befehlen auf der zuvor verlinkten Seite \u00fcberpr\u00fcfen.

      "},{"location":"de/post_installation/reverse-proxy/r_p/","title":"\u00dcbersicht","text":"

      Sie m\u00fcssen die Nginx-Seite, die mit mailcow: dockerized geliefert wird, nicht \u00e4ndern. mailcow: dockerized vertraut auf das Standard-Gateway IP 172.22.1.1 als Proxy.

      Stellen Sie sicher, dass Sie HTTP_BIND und HTTPS_BIND in mailcow.conf auf eine lokale Adresse \u00e4ndern und die Ports entsprechend einstellen, zum Beispiel: 

      HTTP_BIND=127.0.0.1\nHTTP_PORT=8080\nHTTPS_BIND=127.0.0.1\nHTTPS_PORT=8443\n

      Dadurch werden auch die Bindungen innerhalb des Nginx-Containers ge\u00e4ndert! Dies ist wichtig, wenn Sie sich entscheiden, einen Proxy innerhalb von Docker zu verwenden.

      WICHTIG: Verwenden Sie nicht Port 8081, 9081 oder 65510!

      Erzeugen Sie die betroffenen Container neu, indem Sie den folgenden Befehl ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/post_installation/reverse-proxy/r_p/#wichtige-informationen-bitte-lesen-sie-diese-sorgfaltig-durch","title":"Wichtige Informationen, bitte lesen Sie diese sorgf\u00e4ltig durch!","text":"

      Info

      Wenn Sie planen, einen Reverse-Proxy zu verwenden und einen anderen Servernamen als MAILCOW_HOSTNAME verwenden wollen, m\u00fcssen Sie Zus\u00e4tzliche Servernamen f\u00fcr mailcow UI hierunter.

      Warnung

      Stellen Sie sicher, dass Sie generate_config.sh ausf\u00fchren, bevor Sie die Konfigurationsbeispiele aktivieren. Das Skript generate_config.sh kopiert die Snake-oil Zertifikate an den richtigen Ort, so dass die Dienste nicht aufgrund fehlender Dateien nicht starten k\u00f6nnen.

      Warnung

      Wenn Sie TLS SNI aktivieren (ENABLE_SSL_SNI in mailcow.conf), m\u00fcssen die Zertifikatspfade in Ihrem Reverse-Proxy mit den korrekten Pfaden in data/assets/ssl/{hostname} \u00fcbereinstimmen. Die Zertifikate werden in data/assets/ssl/{hostname1,hostname2,etc} aufgeteilt und werden daher nicht funktionieren, wenn Sie die Beispiele von unten kopieren, die auf data/assets/ssl/cert.pem etc. zeigen.

      Info

      Die Verwendung der Konfigurationsbeispiele wird acme-Anfragen an mailcow weiterleiten und es die Zertifikate selbst verwalten lassen. Der Nachteil der Verwendung von mailcow als ACME-Client hinter einem Reverse-Proxy ist, dass Sie Ihren Webserver neu laden m\u00fcssen, nachdem acme-mailcow das Zertifikat ge\u00e4ndert/erneuert/erstellt hat. Sie k\u00f6nnen entweder Ihren Webserver t\u00e4glich neu laden oder ein Skript schreiben, um die Datei auf \u00c4nderungen zu \u00fcberwachen. Auf vielen Servern wird logrotate den Webserver sowieso t\u00e4glich neu laden.

      Wenn Sie eine lokale Certbot-Installation verwenden m\u00f6chten, m\u00fcssen Sie die SSL-Zertifikatsparameter entsprechend \u00e4ndern. Stellen Sie sicher, dass Sie ein Post-Hook-Skript ausf\u00fchren, wenn Sie sich entscheiden, externe ACME-Clients zu verwenden. Ein Beispiel finden Sie hierunter.

      Konfigurieren Sie Ihren lokalen Webserver als Reverse Proxy anhand folgender Konfigurationsbeispiele:

      • Apache 2.4
      • Nginx
      • HAProxy
      • Traefik v2
      • Caddy v2
      "},{"location":"de/post_installation/reverse-proxy/r_p/#optional-post-hook-skript-fur-nicht-mailcow-acme-clients","title":"Optional: Post-Hook-Skript f\u00fcr nicht-mailcow ACME-Clients","text":"

      Die Verwendung eines lokalen Certbots (oder eines anderen ACME-Clients) erfordert den Neustart einiger Container, was Sie mit einem Post-Hook-Skript erledigen k\u00f6nnen. Stellen Sie sicher, dass Sie die Pfade entsprechend \u00e4ndern: 

      #!/bin/bash\ncp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem\ncp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem\npostfix_c=$(docker ps -qaf name=postfix-mailcow)\ndovecot_c=$(docker ps -qaf name=dovecot-mailcow)\nnginx_c=$(docker ps -qaf name=nginx-mailcow)\ndocker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n

      "},{"location":"de/post_installation/reverse-proxy/r_p/#hinzufugen-weiterer-servernamen-fur-mailcow-ui","title":"Hinzuf\u00fcgen weiterer Servernamen f\u00fcr mailcow UI","text":"

      Wenn Sie vorhaben, einen Servernamen zu verwenden, der nicht MAILCOW_HOSTNAME in Ihrem Reverse-Proxy ist, stellen Sie sicher, dass Sie diesen Namen zuerst in mailcow.conf \u00fcber ADDITIONAL_SERVER_NAMES einpflegen. Die Namen m\u00fcssen durch Kommas getrennt werden und d\u00fcrfen keine Leerzeichen enthalten. Wenn Sie diesen Schritt \u00fcberspringen, kann es sein, dass mailcow auf Ihren Reverse-Proxy mit einer falschen Seite antwortet.

      ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

      F\u00fchren Sie zum Anwenden folgendes aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#einfuhrung","title":"Einf\u00fchrung","text":"

      Borgmatic ist ein gro\u00dfartiger Weg, um Backups auf Ihrem mailcow-Setup durchzuf\u00fchren, da es Ihre Daten sicher verschl\u00fcsselt und extrem einfach einzurichten ist.

      Aufgrund seiner Deduplizierungsf\u00e4higkeiten k\u00f6nnen Sie eine gro\u00dfe Anzahl von Backups speichern, ohne gro\u00dfe Mengen an Speicherplatz zu verschwenden. So k\u00f6nnen Sie Backups in sehr kurzen Abst\u00e4nden durchf\u00fchren, um einen minimalen Datenverlust zu gew\u00e4hrleisten, wenn die Notwendigkeit besteht, Daten aus einer Sicherung wiederherzustellen.

      Dieses Dokument f\u00fchrt Sie durch den Prozess zur Aktivierung kontinuierlicher Backups f\u00fcr mailcow mit borgmatic. Die borgmatic Funktionalit\u00e4t wird durch das borgmatic Docker Image bereitgestellt. Schauen Sie sich die README in diesem Repository an, um mehr \u00fcber die anderen Optionen (wie z.B. Push-Benachrichtigungen) zu erfahren, die verf\u00fcgbar sind. Diese Anleitung behandelt nur die Grundlagen.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#einrichten-von-borgmatic","title":"Einrichten von borgmatic","text":""},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-oder-andern-sie-docker-composeoverrideyml","title":"Erstellen oder \u00e4ndern Sie docker-compose.override.yml","text":"

      Im mailcow-dockerized Stammverzeichnis erstellen oder bearbeiten Sie docker-compose.override.yml und f\u00fcgen Sie die folgende Konfiguration ein:

      services:\n  borgmatic-mailcow:\n    image: ghcr.io/borgmatic-collective/borgmatic\n    hostname: mailcow\n    restart: always\n    dns: ${IPV4_NETWORK:-172.22.1}.254\n    volumes:\n      - vmail-vol-1:/mnt/source/vmail:ro\n      - crypt-vol-1:/mnt/source/crypt:ro\n      - redis-vol-1:/mnt/source/redis:ro\n      - rspamd-vol-1:/mnt/source/rspamd:ro\n      - postfix-vol-1:/mnt/source/postfix:ro\n      - mysql-socket-vol-1:/var/run/mysqld/\n      - borg-config-vol-1:/root/.config/borg\n      - borg-cache-vol-1:/root/.cache/borg\n      - ./data/conf/borgmatic/etc:/etc/borgmatic.d:Z\n      - ./data/conf/borgmatic/ssh:/root/.ssh:Z\n    environment:\n      - TZ=${TZ}\n      - BORG_PASSPHRASE=${BORG_PASSPHRASE}\n      - DBNAME=${DBNAME}\n      - DBUSER=${DBUSER}\n      - DBPASS=${DBPASS}\n    networks:\n      mailcow-network:\n        aliases:\n          - borgmatic\n\nvolumes:\n  borg-cache-vol-1:\n  borg-config-vol-1:\n

      F\u00fcgen Sie BORG_PASSPHRASE=YouBetterPutSomethingRealGoodHere zu Ihrer mailcow.conf hinzu und stellen Sie sicher, dass Sie die BORG_PASSPHRASE in eine sichere Passphrase Ihrer Wahl \u00e4ndern.

      Aus Sicherheitsgr\u00fcnden mounten wir das maildir als schreibgesch\u00fctzt. Wenn Sie sp\u00e4ter Daten wiederherstellen wollen, m\u00fcssen Sie das ro-Flag entfernen, bevor Sie die Daten wiederherstellen. Dies wird im Abschnitt \u00fcber die Wiederherstellung von Backups beschrieben.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-sie-dataconfborgmaticetcconfigyaml","title":"Erstellen Sie data/conf/borgmatic/etc/config.yaml","text":"

      Als n\u00e4chstes m\u00fcssen wir die borgmatic-Konfiguration erzeugen. Borgmatic unterst\u00fctzt Umgebungsvariableninterpolation, dadurch erhalten wir die korrekten MySQL-Zugangsdaten \u00fcber Docker bzw. \u00fcber unsere mailcow.conf, ohne dass diese in der Konfigurationsdatei offengelegt werden.

      Vergewissern Sie sich, alle folgenden Zeilen zu kopieren!

      cat <<EOF > data/conf/borgmatic/etc/config.yaml\nsource_directories:\n    - /mnt/source/vmail\n    - /mnt/source/crypt\n    - /mnt/source/redis\n    - /mnt/source/rspamd\n    - /mnt/source/postfix\nrepositories:\n    - path: ssh://user@rsync.net:22/./mailcow\n      label: rsync\nexclude_patterns:\n    - '/mnt/source/postfix/public/'\n    - '/mnt/source/postfix/private/'\n    - '/mnt/source/rspamd/rspamd.sock'\n\nkeep_hourly: 24\nkeep_daily: 7\nkeep_weekly: 4\nkeep_monthly: 6\n\nmysql_databases:\n    - name: ${DBNAME}\n      username: ${DBUSER}\n      password: ${DBPASS}\n      options: --default-character-set=utf8mb4\nEOF\n

      Warning

      Ab borgmatic 1.8.0 (erschienen am 19. Juli 2023) wurde der Aufbau der Konfigurationsdatei ge\u00e4ndert. Sie k\u00f6nnen die Docker-Logs des Borgmatic-Containers auf Deprecation-Warnmeldungen pr\u00fcfen, um festzustellen, ob Sie betroffen sind und Ihre Konfigurationsdatei f\u00fcr eine \u00e4ltere Version von borgmatic erstellt wurde. In diesem Fall sollten Sie eine neue config.yaml-Datei wie oben beschrieben erstellen, um Probleme mit zuk\u00fcnftigen Versionen von borgmatic zu vermeiden.

      Diese Datei ist ein minimales Beispiel f\u00fcr die Verwendung von borgmatic mit einem Konto user beim Cloud-Speicheranbieter rsync.net f\u00fcr ein Repository namens mailcow (siehe Einstellung repositories). Dies muss entsprechend angepasst werden.

      Es wird sowohl das maildir als auch die MySQL-Datenbank gesichert, was alles ist, was Sie brauchen, um Ihre mailcow nach einem Vorfall wiederherzustellen.

      Im Backup wird jeweils ein Archiv f\u00fcr jede der letzten 24 Stunden, eines f\u00fcr jeden der letzten 7 Wochentage, eines f\u00fcr jede der letzten 4 Wochen und eines pro Monat des letzten halben Jahrs behalten.

      Schauen Sie in der borgmatic Dokumentation nach, wie Sie andere Arten von Repositories oder Konfigurationsoptionen nutzen k\u00f6nnen. Wenn Sie ein lokales Dateisystem als Backup-Ziel verwenden, stellen Sie sicher, dass Sie es in den Container einbinden. Der Container definiert zu diesem Zweck ein Volume namens /mnt/borg-repository.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-sie-einen-crontab","title":"Erstellen Sie einen crontab","text":"

      Erstellen Sie eine neue Textdatei in data/conf/borgmatic/etc/crontab.txt mit folgendem Inhalt:

      14 * * * * PATH=$PATH:/usr/local/bin /usr/local/bin/borgmatic --stats -v 0 2>&1\n

      Diese Datei erwartet eine crontab-Syntax. Das hier gezeigte Beispiel veranlasst das Backup, jede Stunde um 14 Minuten nach der vollen Stunde auszuf\u00fchren und am Ende einige nette Statistiken zu protokollieren.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#ssh-schlussel-in-ordner-ablegen","title":"SSH-Schl\u00fcssel in Ordner ablegen","text":"

      Legen Sie die SSH-Schl\u00fcssel, die Sie f\u00fcr Verbindungen zu entfernten Repositories verwenden wollen, in data/conf/borgmatic/ssh ab. OpenSSH erwartet die \u00fcbliche id_rsa, id_ed25519 oder \u00e4hnliches in diesem Verzeichnis zu finden. Stellen Sie sicher, dass die Datei chmod 600 und nicht f\u00fcr alle lesbar ist, oder OpenSSH wird sich weigern, den SSH-Schl\u00fcssel zu benutzen.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#den-container-hochfahren","title":"Den Container hochfahren","text":"

      F\u00fcr den n\u00e4chsten Schritt m\u00fcssen wir den Container in einem konfigurierten Zustand hochfahren und laufen lassen. Um das zu tun, f\u00fchren Sie aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#das-backup-repository-initialisieren","title":"Das Backup Repository initialisieren","text":"

      Zwar ist Ihr borgmatic-Container jetzt betriebsbereit, aber die Backups schlagen derzeit fehl, da das Repository nicht initialisiert wurde.

      Um das Repository zu initialisieren, f\u00fchren Sie folgenden Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n
      docker-compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n

      Sie werden aufgefordert, den SSH-Hostschl\u00fcssel Ihres entfernten Repository-Servers zu authentifizieren. Pr\u00fcfen Sie, ob er \u00fcbereinstimmt und best\u00e4tigen Sie die Aufforderung mit yes. Das Repository wird mit der Passphrase initialisiert, die Sie zuvor in der Umgebungsvariable BORG_PASSPHRASE gesetzt haben.

      Bei Verwendung einer der repokey-Verschl\u00fcsselungsmethoden wird der Verschl\u00fcsselungsschl\u00fcssel im Repository selbst gespeichert und nicht auf dem Client, so dass in dieser Hinsicht keine weiteren Ma\u00dfnahmen erforderlich sind. Wenn Sie sich f\u00fcr die Verwendung eines keyfile anstelle von repokey entscheiden, stellen Sie sicher, dass Sie den Schl\u00fcssel exportieren und separat sichern. Lesen Sie den Abschnitt Exportieren von Schl\u00fcsseln um zu erfahren, wie Sie den Schl\u00fcssel abrufen k\u00f6nnen.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#container-neustarten","title":"Container neustarten","text":"

      Nachdem wir nun die Konfiguration und Initialisierung des Repositorys abgeschlossen haben, starten wir den Container neu, um sicherzustellen, dass er sich in einem definierten Zustand befindet:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart borgmatic-mailcow\n
      docker-compose restart borgmatic-mailcow\n
      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#wiederherstellung-von-einem-backup","title":"Wiederherstellung von einem Backup","text":"

      Das Wiederherstellen eines Backups setzt voraus, dass Sie mit einer neuen Installation von mailcow beginnen, und dass Sie derzeit keine benutzerdefinierten Daten in ihrem maildir oder ihrer mailcow-Datenbank haben.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#wiederherstellen-von-maildir","title":"Wiederherstellen von maildir","text":"

      Warnung

      Dies wird Dateien in Ihrem maildir \u00fcberschreiben! F\u00fchren Sie dies nicht aus, es sei denn, Sie beabsichtigen tats\u00e4chlich, Mail Dateien von einem Backup wiederherzustellen.

      Wenn Sie SELinux im Enforcing-Modus verwenden

      Wenn Sie mailcow auf einem Host mit SELinux im Enforcing-Modus verwenden, m\u00fcssen Sie ihn w\u00e4hrend der Extraktion des Archivs vor\u00fcbergehend deaktivieren, da das mailcow-Setup das vmail-Volume als privat kennzeichnet, das ausschlie\u00dflich dem Dovecot-Container geh\u00f6rt. SELinux wird (berechtigterweise) jeden anderen Container, wie z.B. den borgmatic Container, daran hindern, auf dieses Volume zu schreiben.

      Bevor Sie eine Wiederherstellung durchf\u00fchren, m\u00fcssen Sie das vmail-Volume in docker-compose.override.yml beschreibbar machen, indem Sie das ro-Flag aus dem Volume entfernen. Dann k\u00f6nnen Sie den folgenden Befehl verwenden, um das Maildir aus einem Backup wiederherzustellen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n
      docker-compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n

      Alternativ k\u00f6nnen Sie auch einen beliebigen Archivnamen aus der Liste der Archive angeben (siehe Auflistung aller verf\u00fcgbaren Archive)

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#mysql-wiederherstellen","title":"MySQL wiederherstellen","text":"

      Warnung

      Die Ausf\u00fchrung dieses Befehls l\u00f6scht und erstellt die mailcow-Datenbank neu! F\u00fchren Sie diesen Befehl nicht aus, es sei denn Sie beabsichtigen, die mailcow-Datenbank von einem Backup wiederherzustellen.

      Um die MySQL-Datenbank aus dem letzten Archiv wiederherzustellen, verwenden Sie diesen Befehl:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borgmatic restore --archive latest\n
      docker-compose exec borgmatic-mailcow borgmatic restore --archive latest\n

      Alternativ k\u00f6nnen Sie auch einen beliebigen Archivnamen aus der Liste der Archive angeben (siehe Auflistung aller verf\u00fcgbaren Archive)

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#nach-der-wiederherstellung","title":"Nach der Wiederherstellung","text":"

      Nach der Wiederherstellung m\u00fcssen Sie mailcow neu starten. Wenn Sie den Enforcing-Modus von SELinux deaktiviert haben, w\u00e4re jetzt ein guter Zeitpunkt, um ihn wieder zu aktivieren.

      Um mailcow neu zu starten, verwenden Sie den folgenden Befehl:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down && docker compose up -d\n
      docker-compose down && docker-compose up -d\n

      Wenn Sie SELinux verwenden, werden dadurch auch alle Dateien in Ihrem vmail-Volume neu benannt. Seien Sie geduldig, denn dies kann eine Weile dauern kann, wenn Sie viele Dateien haben.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#nutzliche-befehle","title":"N\u00fctzliche Befehle","text":""},{"location":"de/third_party/borgmatic/third_party-borgmatic/#manueller-archivierungslauf-mit-debugging-ausgabe","title":"Manueller Archivierungslauf (mit Debugging-Ausgabe)","text":"docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borgmatic -v 2\n
      docker-compose exec borgmatic-mailcow borgmatic -v 2\n
      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#auflistung-aller-verfugbaren-archive","title":"Auflistung aller verf\u00fcgbaren Archive","text":"docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borgmatic list\n
      docker-compose exec borgmatic-mailcow borgmatic list\n
      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#sperre-aufheben","title":"Sperre aufheben","text":"

      Wenn borg w\u00e4hrend eines Archivierungslaufs unterbrochen wird, hinterl\u00e4sst es eine Sperre, die gel\u00f6scht werden muss, bevor neue Operationen durchgef\u00fchrt werden k\u00f6nnen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borg break-lock\n
      docker-compose exec borgmatic-mailcow borg break-lock\n

      Jetzt w\u00e4re ein guter Zeitpunkt, einen manuellen Archivierungslauf durchzuf\u00fchren, um sicherzustellen, dass er erfolgreich durchgef\u00fchrt werden kann.

      "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#exportieren-von-schlusseln","title":"Exportieren von Schl\u00fcsseln","text":"

      Wenn Sie eine der keyfile-Methoden zur Verschl\u00fcsselung verwenden, M\u00dcSSEN Sie sich selbst um die Sicherung der Schl\u00fcsseldateien k\u00fcmmern. Die Schl\u00fcsseldateien werden erzeugt, wenn Sie das Repository initialisieren. Die repokey-Methoden speichern die Schl\u00fcsseldatei innerhalb des Repositories, so dass eine manuelle Sicherung nicht so wichtig ist.

      Beachten Sie, dass Sie in beiden F\u00e4llen auch die Passphrase haben m\u00fcssen, um die Archive zu entschl\u00fcsseln.

      Um das keyfile zu holen, f\u00fchren Sie aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n
      docker-compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n

      Wobei user@rsync.net:mailcow die URI zu Ihrem Repository ist.

      "},{"location":"de/third_party/checkmk/u_e-checkmk/","title":"CheckMK","text":"

      mailcow bietet mittels des eigenen Update-Scripts die M\u00f6glichkeit zu pr\u00fcfen, ob Updates vorhanden sind.

      Sofern mailcow-Updates mittels checkmk abgefragt werden soll, kann man im local-Verzeichnis des checkmk-Agents (normalerweise /usr/lib/check_mk_agent/local/) eine ausf\u00fchrbare Datei mit dem Namen mailcow_update und nachfolgendem Inhalt erstellen:

      #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh --check-tags >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No newer tags available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 New tag is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/releases/latest\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

      Um jeden neu verf\u00fcgbaren Code als Update angezeigt zu bekommen, kann die ausf\u00fchrbare Datei mit folgendem Inhalt erstellt werden: 

      #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No updates available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

      Sofern das mailcow-Installationsverzeichnis nicht /opt/ ist, kann der Pfad in der zweiten Zeile angepasst werden.

      Danach f\u00fcr den mailcow-Host in checkmk die Services neu inventarisieren und es sollte ein neuer Check mit Namen mailcow_update ausw\u00e4hlbar sein.

      Der Check mailcow_update wird jedes Mal ausgef\u00fchrt, wenn der checkmk Agent den mailcow Server \u00fcberpr\u00fcft. Sie k\u00f6nnen das Ergebnis zwischenspeichern, indem Sie das Skript in einem Unterordner mit dem Namen der Anzahl von Sekunden ablegen, f\u00fcr die Sie es zwischenspeichern m\u00f6chten. \\ /usr/lib/check_mk_agent/local/3600/ speichert die Antwort f\u00fcr 3600 Sekunden (1 Stunde).

      "},{"location":"de/third_party/checkmk/u_e-checkmk/#keine-updates-verfugbar","title":"Keine Updates verf\u00fcgbar","text":"

      Sofern keine Updates / keine neuen Tags vorhanden sind, wird OK ausgegeben.

      "},{"location":"de/third_party/checkmk/u_e-checkmk/#neue-updates-verfugbar","title":"Neue Updates verf\u00fcgbar","text":"

      Sofern Updates / Neue Tags vorhanden sind, wird WARN ausgegeben.

      Sollte stattdessen CRIT gew\u00fcnscht sein, ist die 7. Zeile durch folgendes zu ersetzen:

      echo \"2 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\n
      "},{"location":"de/third_party/checkmk/u_e-checkmk/#detailierter-check-output","title":"Detailierter Check-Output","text":"
      • Hier wird ein Link zu den GitHub Commits / des letzten Release von mailcow ausgegeben, sofern Updates verf\u00fcgbar sind.
      • Metriken werden ebenfalls ausgegeben (nicht nur bei vorhandenen Updates):
      • 0 = Keine Updates verf\u00fcgbar
      • 1 = Neue Updates verf\u00fcgbar
      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/","title":"Exchange Hybrid Setup","text":"

      Die Verwendung von Microsoft Exchange in einem hybriden Setup ist mit mailcow m\u00f6glich. Mit diesem Setup k\u00f6nnen Sie Postf\u00e4cher auf Ihrer mailcow hinzuf\u00fcgen und trotzdem Exchange Online Protection nutzen. Alle Postf\u00e4cher, die in Exchange eingerichtet sind, erhalten ihre Mails wie gewohnt, w\u00e4hrend mit dem hybriden Ansatz zus\u00e4tzliche Postf\u00e4cher in mailcow ohne weitere Konfiguration eingerichtet werden k\u00f6nnen.

      Dieses Setup ist sehr praktisch, wenn Sie die Office 365 Sicherheitsvorgaben aktiviert haben und Anwendungen von Drittanbietern sich nicht mehr in Ihre Postf\u00e4cher mit einer der unterst\u00fctzten Methoden einloggen k\u00f6nnen.

      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#voraussetzungen","title":"Voraussetzungen","text":"
      • Der mx Record Ihrer Domain muss auf den Exchange Mail Service zeigen. Melden Sie sich in Ihrem Admin-Center an und suchen Sie in den DNS-Einstellungen Ihrer Dom\u00e4ne nach Ihrer personalisierten Gateway-Dom\u00e4ne. Sie sollte wie folgt aussehen: contoso-com.mail.protection.outlook.com. Wenden Sie sich an Ihren Domainregistrator, um weitere Informationen zur \u00c4nderung des mx-Eintrags zu erhalten.
      • Die Dom\u00e4ne, f\u00fcr die Sie zus\u00e4tzliche Postf\u00e4cher haben m\u00f6chten, muss in Exchange als \"Interne Relay-Dom\u00e4ne\" eingerichtet werden.
        1. Melden Sie sich bei Ihrem Exchange Admin Center an.
        2. W\u00e4hlen Sie den Bereich \"Mailflow\" und klicken Sie auf \"Akzeptierte Dom\u00e4nen\".
        3. W\u00e4hlen Sie die Dom\u00e4ne aus und schalten Sie sie von \"autorisiert\" auf \"internes Relais\" um.
      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#einrichten-der-mailcow","title":"Einrichten der mailcow","text":"

      Ihre mailcow muss alle Mails an Ihren personalisierten Exchange Host weiterleiten. Es ist die gleiche Host-Adresse, die wir bereits f\u00fcr den mx Record gesucht haben.

      1. F\u00fcgen Sie die Domain zu Ihrer mailcow hinzu
      2. F\u00fcgen Sie Ihre personalisierte Exchange Host Adresse als relayhost hinzu
      3. F\u00fcgen Sie Ihre personalisierte Exchange Host Adresse als Weiterleitungshost hinzu, um alle weitergeleiteten Mails von Exchange bedingungslos zu akzeptieren. (Admin > Konfiguration & Details > Konfigurations-Dropdown > Weiterleitungshosts)
      4. Gehen Sie zu den Dom\u00e4neneinstellungen und w\u00e4hlen Sie den neu hinzugef\u00fcgten Host in der Dropdown-Liste \"Absenderabh\u00e4ngige Transporte\" aus. Aktivieren Sie die Weiterleitung, indem Sie die Kontrollk\u00e4stchen \"Diese Dom\u00e4ne weiterleiten\", \"Alle Empf\u00e4nger weiterleiten\" und \"Nur nicht vorhandene Postf\u00e4cher weiterleiten\" aktivieren.

      Info

      Von nun an wird Ihre mailcow alle Mails akzeptieren, die von Exchange weitergeleitet werden. Die Eingangsfilterung und damit das neuronale Lernen Ihrer Kuh wird nicht mehr funktionieren. Da alle Mails \u00fcber Exchange geroutet werden, wird der Filterungsprozess dort abgewickelt.

      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#connectors-in-exchange-einrichten","title":"Connectors in Exchange einrichten","text":"

      Der gesamte Mailverkehr l\u00e4uft nun \u00fcber Exchange. Zu diesem Zeitpunkt filtert der Exchange Online-Schutz bereits alle ein- und ausgehenden Mails. Jetzt m\u00fcssen wir zwei Konnektoren einrichten, um eingehende Mails von unserem Exchange Service an die mailcow weiterzuleiten und einen weiteren, um Mails zuzulassen, die von der mailcow an unseren Exchange Service weitergeleitet werden. Sie k\u00f6nnen der [offiziellen Anleitung von Microsoft] folgen (https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#2-set-up-a-connector-from-microsoft-365-or-office-365-to-your-email-server).

      Warnung

      F\u00fcr den Connector, der die Mails von Ihrer mailcow zu Exchange weiterleitet, bietet Microsoft zwei M\u00f6glichkeiten der Authentifizierung an. Der empfohlene Weg ist die Verwendung eines tls-Zertifikats, das mit einem Subject-Namen konfiguriert ist, der mit einer akzeptierten Dom\u00e4ne in Exchange \u00fcbereinstimmt. Andernfalls m\u00fcssen Sie die Authentifizierung mit der statischen IP-Adresse Ihrer mailcow w\u00e4hlen.

      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#validierung","title":"Validierung","text":"

      Der einfachste Weg, die hybride Einrichtung zu \u00fcberpr\u00fcfen, ist das Senden einer Mail aus dem Internet an eine Mailbox, die nur auf der mailcow existiert und andersherum.

      "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#allgemeine-probleme","title":"Allgemeine Probleme","text":"
      • Die Validierung des Connectors von Exchange zu Ihrer mailcow schlug fehl mit 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient test@contoso.com not found by SMTP address lookup M\u00f6gliche L\u00f6sung: Ihre Dom\u00e4ne ist nicht als \"internes Relay\" eingerichtet. Exchange kann daher den Empf\u00e4nger nicht finden.
      • Mails, die von der mailcow an eine Mailbox im Internet gesendet werden, k\u00f6nnen nicht zugestellt werden. Non Delivery Report mit Fehler 550 5.7.64 TenantAttribution; Relay Access Denied M\u00f6gliche L\u00f6sung: Die Authentifizierungsmethode ist fehlgeschlagen. Stellen Sie sicher, dass der Betreff des Zertifikats mit einer akzeptierten Dom\u00e4ne in Exchange \u00fcbereinstimmt. Versuchen Sie stattdessen die Authentifizierung \u00fcber eine statische IP.

      Microsoft-Anleitung f\u00fcr die Einrichtung des Connectors und zus\u00e4tzliche Anforderungen: https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#prerequisites-for-your-on-premises-email-environment

      "},{"location":"de/third_party/gitea/third_party-gitea/","title":"Gitea","text":"

      Mit der F\u00e4higkeit von Gitea, sich \u00fcber SMTP zu authentifizieren, ist es trivial, es mit mailcow zu integrieren. Es sind nur wenige \u00c4nderungen erforderlich:

      1. Um eine Datenbank f\u00fcr Gitea zu erstellen, verbinden Sie sich mit ihrem Server und f\u00fchren Sie folgende Befehle aus: 

      source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gitea;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gitea'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'%';\"\n

      2. \u00d6ffnen Sie docker-compose.override.yml und f\u00fcgen Sie Gitea hinzu:

      services:\n\n        gitea-mailcow:\n            image: gitea/gitea:1\n            volumes:\n                - ./data/gitea:/data\n            networks:\n                mailcow-network:\n                    aliases:\n                        - gitea\n            ports:\n                - \"${GITEA_SSH_PORT:-127.0.0.1:4000}:22\"\n

      3. Erstellen Sie data/conf/nginx/site.gitea.custom, f\u00fcgen Sie folgendes hinzu: 

      location /gitea/ {\n        proxy_pass http://gitea:3000/;\n}\n

      4. \u00d6ffne mailcow.conf und definiere den Port Bind, den Gitea f\u00fcr SSH verwenden soll. Beispiel:

      GITEA_SSH_PORT=127.0.0.1:4000\n

      5. F\u00fchren Sie folgenden Befehl aus, um den Gitea-Container hochzufahren und f\u00fchren Sie anschlie\u00dfend einen Neustart von NGINX mit dem zweiten Befehl durch:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\ndocker compose restart nginx-mailcow\n
      docker-compose up -d\ndocker-compose restart nginx-mailcow\n

      6. Wenn Sie mailcow zu https gezwungen haben, f\u00fchren Sie Schritt 9 aus und starten Sie gitea mit dem folgenden Befehl neu.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart gitea-mailcow\n
      docker-compose restart gitea-mailcow\n

      Fahren Sie mit Schritt 7 fort (Denken Sie daran, https anstelle von http zu verwenden, https://mx.example.org/gitea/)

      7. \u00d6ffnen Sie http://${MAILCOW_HOSTNAME}/gitea/, zum Beispiel http://mx.example.org/gitea/. F\u00fcr Datenbank-Details setzen Sie mysql als Datenbank-Host. Verwenden Sie gitea als Datenbankname, gitea als Datenbankbenutzer und your_strong_password als Datenbankpasswort, welches Sie in Schritt 1 definiert haben.

      8. Sobald die Installation abgeschlossen ist, loggen Sie sich als Administrator ein und setzen Sie \"Einstellungen\" -> \"Autorisierung\" -> \"SMTP aktivieren\". SMTP-Host sollte postfix mit Port 587 sein, setzen Sie Skip TLS Verify, da wir ein nicht gelistetes SAN verwenden (\"postfix\" ist h\u00f6chstwahrscheinlich nicht Teil Ihres Zertifikats).

      9. Erstellen Sie data/gitea/gitea/conf/app.ini und setzen Sie die folgenden Werte. Sie k\u00f6nnen gitea cheat sheet, leider bisher nur in Englisch verf\u00fcgbar f\u00fcr deren Bedeutung und andere m\u00f6gliche Werte konsultieren.

      [server]\nSSH_LISTEN_PORT = 22\n# F\u00fcr GITEA_SSH_PORT=127.0.0.1:4000 in mailcow.conf, setzen:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# F\u00fcr MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (und Standard-Ports f\u00fcr HTTPS), setzen:\nROOT_URL = https://mx.example.org/gitea/\n

      10. Starten Sie gitea neu mit dem kommenden Befehl. Ihre Nutzer sollten in der Lage sein, sich mit von mailcow verwalteten Konten anzumelden.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart gitea-mailcow\n
      docker-compose restart gitea-mailcow\n
      "},{"location":"de/third_party/gogs/third_party-gogs/","title":"Gogs","text":"

      Mit Gogs' F\u00e4higkeit, sich \u00fcber SMTP zu authentifizieren, ist es einfach, es mit mailcow zu verbinden. Es sind nur wenige \u00c4nderungen erforderlich:

      1. Um eine Datenbank f\u00fcr Gogs zu erstellen, verbinden Sie sich mit ihrem Server und f\u00fchren Sie folgende Befehle aus: 

      source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gogs;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gogs'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gogs.* TO 'gogs'@'%';\n

      2. \u00d6ffne docker-compose.override.yml und f\u00fcge Gogs hinzu:

      services:\n\n    gogs-mailcow:\n      image: gogs/gogs\n      volumes:\n        - ./data/gogs:/data\n      networks:\n        mailcow-network:\n          aliases:\n            - gogs\n      ports:\n        - \"${GOGS_SSH_PORT:-127.0.0.1:4000}:22\"\n

      3. Erstelle data/conf/nginx/site.gogs.custom, f\u00fcge hinzu: 

      location /gogs/ {\n    proxy_pass http://gogs:3000/;\n}\n

      4. \u00d6ffne mailcow.conf und definiere die Bindung, die Gogs f\u00fcr SSH verwenden soll. Beispiel:

      GOGS_SSH_PORT=127.0.0.1:4000\n

      5. F\u00fchren Sie folgenden Befehl aus, um den Gogs-Container hochzufahren und f\u00fchren Sie anschlie\u00dfend einen Neustart von NGINX mit dem zweiten Befehl durch:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\ndocker compose restart nginx-mailcow\n
      docker-compose up -d\ndocker-compose restart nginx-mailcow\n

      6. \u00d6ffnen Sie http://${MAILCOW_HOSTNAME}/gogs/, zum Beispiel http://mx.example.org/gogs/. F\u00fcr Datenbank-Details setzen Sie mysql als Datenbank-Host. Verwenden Sie gogs als Datenbankname, gogs als Datenbankbenutzer und your_strong_password als Datenbankpasswort, welches Sie in Schritt 1 definiert haben.

      7. Sobald die Installation abgeschlossen ist, loggen Sie sich als Administrator ein und setzen Sie \"Einstellungen\" -> \"Autorisierung\" -> \"SMTP aktivieren\". SMTP-Host sollte postfix mit Port 587 sein, setzen Sie Skip TLS Verify, da wir ein nicht gelistetes SAN verwenden (\"postfix\" ist h\u00f6chstwahrscheinlich nicht Teil Ihres Zertifikats).

      8. Erstellen Sie data/gogs/gogs/conf/app.ini und setzen Sie die folgenden Werte. Sie k\u00f6nnen Gogs cheat sheet f\u00fcr ihre Bedeutung und andere m\u00f6gliche Werte konsultieren.

      [server]\nSSH_LISTEN_PORT = 22\n# F\u00fcr GOGS_SSH_PORT=127.0.0.1:4000 in mailcow.conf, setzen:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# F\u00fcr MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (und Standard-Ports f\u00fcr HTTPS), setzen:\nROOT_URL = https://mx.example.org/gogs/\n

      9. Starten Sie Gogs neu mit dem kommenden Befehl. Ihre Nutzer sollten in der Lage sein, sich mit von mailcow verwalteten Konten anzumelden.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart gogs-mailcow\n
      docker-compose restart gogs-mailcow\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/","title":"Installation von mailcow und Mailman 3 auf der Basis von dockerisierten Versionen","text":"

      Info

      Diese Anleitung ist eine Kopie von dockerized-mailcow-mailman. Bitte posten Sie Probleme, Fragen und Verbesserungen in den issue tracker dort.

      Warnung

      mailcow ist nicht verantwortlich f\u00fcr Datenverlust, Hardwaresch\u00e4den oder kaputte Tastaturen. Diese Anleitung kommt ohne jegliche Garantie. Macht Backups bevor ihr anfangt, Kein Backup kein Mitleid!

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#einleitung","title":"Einleitung","text":"

      Diese Anleitung zielt darauf ab, mailcow-dockerized mit [docker-mailman] (https://github.com/maxking/docker-mailman) zu installieren und zu konfigurieren und einige n\u00fctzliche Skripte bereitzustellen. Eine wesentliche Bedingung ist, dass mailcow und Mailman in ihren eigenen Installationen f\u00fcr unabh\u00e4ngige Updates erhalten bleiben.

      Es gibt einige Anleitungen und Projekte im Internet, aber sie sind nicht auf dem neuesten Stand und/oder unvollst\u00e4ndig in der Dokumentation oder Konfiguration. Diese Anleitung basiert auf der Arbeit von:

      • mailcow-mailman3-dockerized von Shadowghost
      • mailman-mailcow-integration

      Nach Beendigung dieser Anleitung werden mailcow-dockerized und docker-mailman laufen und Apache als Reverse-Proxy wird die Web-Frontends bedienen.

      Das verwendete Betriebssystem ist ein Ubuntu 20.04 LTS.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#installation","title":"Installation","text":"

      Diese Anleitung basiert auf verschiedenen Schritten:

      1. DNS-Einrichtung
      2. Installieren Sie Apache als Reverse Proxy
      3. Beziehen Sie SSL-Zertifikate mit Let's Encrypt.
      4. Installieren Sie mailcow mit Mailman Integration
      5. Installieren Sie Mailman.
      6. \ud83c\udfc3 Ausf\u00fchren
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#dns-einrichtung","title":"DNS-Einrichtung","text":"

      Der gr\u00f6\u00dfte Teil der Konfiguration ist in mailcows DNS Konfiguration enthalten. Nachdem diese Einrichtung abgeschlossen ist, f\u00fcgen Sie eine weitere Subdomain f\u00fcr Mailman hinzu, z.B. lists.example.org, die auf denselben Server zeigt:

      # Name Typ Wert\nlists IN A 1.2.3.4\nlists IN AAAA dead:beef\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-apache-als-reverse-proxy","title":"Installieren Sie Apache als Reverse Proxy","text":"

      Installieren Sie Apache, z.B. mit dieser Anleitung von Digital Ocean: How To Install the Apache Web Server on Ubuntu 20.04 (Englisch).

      Aktivieren Sie bestimmte Apache Module (als root oder sudo):

      a2enmod rewrite proxy proxy_http headers ssl wsgi proxy_uwsgi http2\n

      M\u00f6glicherweise m\u00fcssen Sie weitere Pakete installieren, um diese Module zu erhalten. Dieses PPA von Ond\u0159ej Sur\u00fd k\u00f6nnte Ihnen helfen.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#vhost-konfiguration","title":"vHost-Konfiguration","text":"

      Kopieren Sie die mailcow.conf und die mailman.conf in den Apache conf Ordner sites-available (z.B. unter /etc/apache2/sites-available).

      \u00c4nderung in mailcow.conf: - MAILCOW_HOSTNAME zu Ihrem MAILCOW_HOSTNAME

      \u00c4nderung in mailman.conf: - MAILMAN_DOMAIN in Ihre Mailman-Domain (z.B. Lists.example.org)

      **Aktivieren Sie die Konfiguration noch nicht, da die ssl-Zertifikate und Verzeichnisse noch fehlen.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#beziehen-sie-ssl-zertifikate-mit-lets-encrypt","title":"Beziehen Sie SSL-Zertifikate mit Let's Encrypt.","text":"

      Pr\u00fcfen Sie, ob Ihre DNS-Konfiguration \u00fcber das Internet verf\u00fcgbar ist und auf die richtigen IP-Adressen zeigt, z.B. mit MXToolBox:

      • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILCOW_HOSTNAME
      • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILCOW_HOSTNAME
      • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILMAN_DOMAIN
      • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILMAN_DOMAIN

      Installieren Sie certbot (als root oder sudo):

      apt install certbot\n

      Holen Sie sich die gew\u00fcnschten Zertifikate (als root oder sudo):

      certbot certonly -d mailcow_HOSTNAME\ncertbot certonly -d MAILMAN_DOMAIN\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailcow-mit-mailman-integration","title":"Installieren Sie mailcow mit Mailman Integration","text":""},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailcow","title":"Installieren Sie mailcow","text":"

      Folgen Sie der mailcow installation. Schritt 5 auslassen und nicht mit starten!

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailcow-konfigurieren","title":"mailcow konfigurieren","text":"

      Dies ist auch Schritt 4 in der offiziellen mailcow-Installation (nano mailcow.conf). Passen Sie also Ihre Bed\u00fcrfnisse an und \u00e4ndern Sie die folgenden Variablen:

      HTTP_PORT=18080 # verwenden Sie nicht 8080, da mailman es braucht\nHTTP_BIND=127.0.0.1 #\nHTTPS_PORT=18443 # Sie k\u00f6nnen 8443 verwenden\nHTTPS_BIND=127.0.0.1 # # HTTPS_BIND=127.0.0.1\n\nSKIP_LETS_ENCRYPT=y # Der Reverse Proxy wird die SSL-Verifizierung durchf\u00fchren\n\nSNAT_TO_SOURCE=1.2.3.4 # \u00e4ndern Sie dies in Ihre IPv4\nSNAT6_TO_SOURCE=dead:beef # \u00c4ndern Sie dies in Ihre globale IPv6\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailman-integration-hinzufugen","title":"Mailman-Integration hinzuf\u00fcgen","text":"

      Erstelle die Datei /opt/mailcow-dockerized/docker-compose.override.yml (z.B. mit nano) und f\u00fcge die folgenden Zeilen hinzu:

      services:\n  postfix-mailcow:\n    volumes:\n      - /opt/mailman:/opt/mailman\n    networks:\n      - docker-mailman_mailman\n\nnetworks:\n  docker-mailman_mailman:\n    external: true\n

      Das zus\u00e4tzliche Volume wird von Mailman verwendet, um zus\u00e4tzliche Konfigurationsdateien f\u00fcr mailcow postfix zu generieren. Das externe Netzwerk wird von Mailman erstellt und verwendet. mailcow ben\u00f6tigt es, um eingehende Listenmails an Mailman zu liefern.

      Erstellen Sie die Datei /opt/mailcow-dockerized/data/conf/postfix/extra.cf (z.B. mit nano) und f\u00fcgen Sie die folgenden Zeilen hinzu:

      # mailman\n\nrecipient_delimiter = +\nunknown_local_recipient_reject_code = 550\nowner_request_special = no\n\nlocal_recipient_maps =\n  regexp:/opt/mailman/core/var/data/postfix_lmtp,\n  proxy:unix:passwd.byname,\n  $alias_maps\nvirtual_mailbox_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\ntransport_maps =\n  pcre:/opt/postfix/conf/custom_transport.pcre,\n  pcre:/opt/postfix/conf/local_transport,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\nrelay_domains =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_relay_domain_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_domains\nrelay_recipient_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\n

      Da wir hier die mailcow postfix Konfiguration \u00fcberschreiben, kann dieser Schritt Ihre normalen Mailtransporte unterbrechen. \u00dcberpr\u00fcfen Sie die originalen Konfigurationsdateien, wenn sich etwas ge\u00e4ndert hat.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#ssl-zertifikate","title":"SSL-Zertifikate","text":"

      Da wir mailcow als Proxy verwenden, m\u00fcssen wir die SSL-Zertifikate in die mailcow-Dateistruktur kopieren. Diese Aufgabe wird das Skript renew-ssl.sh f\u00fcr uns erledigen:

      • Kopieren Sie die Datei nach /opt/mailcow-dockerized
      • \u00c4ndere mailcow_HOSTNAME in deinen mailcow Hostnamen
      • Machen Sie es ausf\u00fchrbar (chmod a+x renew-ssl.sh)
      • Noch nicht ausf\u00fchren, da wir zuerst Mailman ben\u00f6tigen

      Sie m\u00fcssen einen cronjob erstellen, so dass neue Zertifikate kopiert werden. F\u00fchren Sie ihn als root oder sudo aus:

      crontab -e\n

      Um das Skript jeden Tag um 5 Uhr morgens laufen zu lassen, f\u00fcgen Sie hinzu:

      0 5 * * * /opt/mailcow-dockerized/renew-ssl.sh\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailman","title":"Installieren Sie Mailman.","text":"

      Befolgen Sie im Wesentlichen die Anweisungen unter docker-mailman. Da sie sehr umfangreich sind, ist hier in aller K\u00fcrze beschrieben, was zu tun ist:

      Als root oder sudo:

      cd /opt\nmkdir -p mailman/core\nmkdir -p mailman/web\ngit clone https://github.com/maxking/docker-mailman\ncd docker-mailman\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailman-konfigurieren","title":"Mailman konfigurieren","text":"

      Erstellen Sie einen langen Schl\u00fcssel f\u00fcr Hyperkitty, z.B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie diesen Schl\u00fcssel vorerst als HYPERKITTY_KEY.

      Erstellen Sie ein langes Passwort f\u00fcr die Datenbank, z. B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie dieses Passwort zun\u00e4chst als DBPASS.

      Erstellen Sie einen langen Schl\u00fcssel f\u00fcr Django, z. B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie diesen Schl\u00fcssel f\u00fcr einen Moment als DJANGO_KEY.

      Erstellen Sie die Datei /opt/docker-mailman/docker compose.override.yaml und ersetzen Sie HYPERKITTY_KEY, DBPASS und DJANGO_KEY durch die generierten Werte:

      services:\n  mailman-core:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - MTA=postfix\n    restart: always\n    networks:\n      - mailman\n\n  mailman-web:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - SECRET_KEY=DJANGO_KEY\n    - SERVE_FROM_DOMAIN=MAILMAN_DOMAIN # e.g. lists.example.org\n    - MAILMAN_ADMIN_USER=admin # the admin user\n    - MAILMAN_ADMIN_EMAIL=admin@example.org # the admin mail address\n    - UWSGI_STATIC_MAP=/static=/opt/mailman-web-data/static\n    restart: always\n\n  database:\n    environment:\n    - POSTGRES_PASSWORD=DBPASS\n    restart: always\n

      Bei mailman-web geben Sie die korrekten Werte f\u00fcr SERVE_FROM_DOMAIN (z.B. lists.example.org), MAILMAN_ADMIN_USER und MAILMAN_ADMIN_EMAIL ein. Sie ben\u00f6tigen die Admin-Zugangsdaten, um sich in der Web-Oberfl\u00e4che (Pistorius) anzumelden. Um das Passwort zum ersten Mal zu setzen, verwenden Sie die Funktion Passwort vergessen im Webinterface.

      \u00dcber andere Konfigurationsoptionen lesen Sie die Dokumentationen Mailman-web und Mailman-core.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#konfigurieren-sie-mailman-core-und-mailman-web","title":"Konfigurieren Sie Mailman core und Mailman web","text":"

      Erstellen Sie die Datei /opt/mailman/core/mailman-extra.cfg mit dem folgenden Inhalt. mailman@example.org sollte auf ein g\u00fcltiges Postfach oder eine Umleitung verweisen.

      [mailman]\ndefault_language: de\nsite_owner: mailman@example.org\n

      Erstellen Sie die Datei /opt/mailman/web/settings_local.py mit dem folgenden Inhalt. mailman@example.org sollte auf ein g\u00fcltiges Postfach oder eine Umleitung verweisen.

      # Gebietsschema\nLANGUAGE_CODE = 'de-de'\n\n# soziale Authentifizierung deaktivieren\nMAILMAN_WEB_SOCIAL_AUTH = []\n\n# \u00e4ndern\nDEFAULT_FROM_EMAIL = 'mailman@example.org'\n\nDEBUG = False\n
      Sie k\u00f6nnen LANGUAGE_CODE und SOCIALACCOUNT_PROVIDERS an Ihre Bed\u00fcrfnisse anpassen.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#ausfuhren","title":"\ud83c\udfc3 Ausf\u00fchren","text":"

      Ausf\u00fchren (als root oder sudo)

      docker compose (Plugin)docker-compose (Standalone) 
      a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker compose pull\ndocker compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker compose pull\n./renew-ssl.sh\n
      a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker-compose pull\ndocker-compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker-compose pull\n./renew-ssl.sh\n

      Warten Sie ein paar Minuten! Die Container m\u00fcssen ihre Datenbanken und Konfigurationsdateien erstellen. Dies kann bis zu 1 Minute und mehr dauern.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#bemerkungen","title":"Bemerkungen","text":""},{"location":"de/third_party/mailman3/third_party-mailman3/#neue-listen-werden-von-postfix-nicht-sofort-erkannt","title":"Neue Listen werden von Postfix nicht sofort erkannt","text":"

      Wenn man eine neue Liste anlegt und versucht, sofort eine E-Mail zu versenden, antwortet postfix mit Benutzer existiert nicht, weil postfix die Liste noch nicht an Mailman \u00fcbergeben hat. Die Konfiguration unter /opt/mailman/core/var/data/postfix_lmtp wird nicht sofort aktualisiert. Wenn Sie die Liste sofort ben\u00f6tigen, starten Sie postifx manuell neu:

      docker compose (Plugin)docker-compose (Standalone) 
      cd /opt/mailcow-dockerized\ndocker compose restart postfix-mailcow\n
      cd /opt/mailcow-dockerized\ndocker-compose restart postfix-mailcow\n
      "},{"location":"de/third_party/mailman3/third_party-mailman3/#update","title":"Update","text":"

      mailcow hat sein eigenes Update-Skript in /opt/mailcow-dockerized/update.sh, siehe die Dokumentation.

      F\u00fcr Mailman holen Sie sich einfach die neueste Version aus dem github repository.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#sicherung","title":"Sicherung","text":"

      mailcow hat ein eigenes Backup-Skript. Lies die Docs f\u00fcr weitere Informationen.

      Mailman gibt keine Backup-Anweisungen in der README.md an. Im gitbucket von pgollor befindet sich ein Skript, das hilfreich sein k\u00f6nnte.

      "},{"location":"de/third_party/mailman3/third_party-mailman3/#skript-installieren","title":"Skript installieren","text":"

      Schreiben Sie ein Skript wie in mailman-mailcow-integration/mailman-install.sh, da viele der Schritte automatisierbar sind.

      1. Fragen Sie alle Konfigurationsvariablen ab und erstellen Sie Passw\u00f6rter und Schl\u00fcssel.
      2. F\u00fchren Sie eine (halb)automatische Installation durch.
      3. Viel Spa\u00df!
      "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/","title":"Mailpiler Integration","text":"

      Dies ist eine einfache Integration von mailcow-Aliasen und dem Mailbox-Namen in mailpiler bei Verwendung von IMAP-Authentifizierung.

      Disclaimer: Dies wird weder offiziell vom mailcow-Projekt noch von seinen Mitwirkenden gepflegt oder unterst\u00fctzt. Es wird keine Garantie oder Unterst\u00fctzung angeboten, jedoch steht es Ihnen frei, Themen auf GitHub zu \u00f6ffnen, um einen Fehler zu melden oder weitere Ideen zu liefern. GitHub Repo kann hier gefunden werden.

      Info

      Die Unterst\u00fctzung f\u00fcr Domain Wildcards wurde in Piler 1.3.10 implementiert, das am 03.01.2021 ver\u00f6ffentlicht wurde. Fr\u00fchere Versionen funktionieren grunds\u00e4tzlich, aber nach dem Einloggen sehen Sie keine E-Mails, die von oder an den Domain-Alias gesendet werden. (z.B. wenn @example.com ein Alias f\u00fcr admin@example.com ist)

      "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#das-zu-losende-problem","title":"Das zu l\u00f6sende Problem","text":"

      mailpiler bietet die Authentifizierung auf Basis von IMAP an, zum Beispiel:

      $config['ENABLE_IMAP_AUTH'] = 1;\n$config['IMAP_HOST'] = 'mail.example.com';\n$config['IMAP_PORT'] = 993;\n$config['IMAP_SSL'] = true;\n
      • Wenn Sie sich also mit patrik@example.com anmelden, sehen Sie nur zugestellte E-Mails, die von oder an diese spezielle E-Mail-Adresse gesendet wurden.
      • Wenn zus\u00e4tzliche Aliase in mailcow definiert werden, wie z.B. team@example.com, werden Sie keine Emails sehen, die an oder von dieser Email-Adresse gesendet wurden, auch wenn Sie ein Empf\u00e4nger von Emails sind, die an diese Alias-Adresse gesendet wurden.

      Indem wir uns in den Authentifizierungsprozess von mailpiler einklinken, sind wir in der Lage, die erforderlichen Daten \u00fcber die mailcow API w\u00e4hrend des Logins zu erhalten. Dies l\u00f6st API-Anfragen an die mailcow-API aus (die einen Nur-Lese-API-Zugang erfordern), um die Aliase auszulesen, an denen Ihre E-Mail-Adresse teilnimmt, und auch den \"Namen\" des Postfachs, der angegeben wurde, um ihn nach dem Login oben rechts in mailpiler anzuzeigen.

      Zugelassene E-Mail-Adressen k\u00f6nnen in den Mailpiler-Einstellungen oben rechts nach dem Einloggen eingesehen werden.

      Info

      Dies wird nur einmal w\u00e4hrend des Authentifizierungsprozesses abgefragt. Die autorisierten Aliase und der Realname sind f\u00fcr die gesamte Dauer der Benutzersitzung g\u00fcltig, da mailpiler sie in den Sitzungsdaten setzt. Wird ein Benutzer aus einem bestimmten Alias entfernt, so wird dies erst nach dem n\u00e4chsten Login wirksam.

      "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#die-losung","title":"Die L\u00f6sung","text":"

      Hinweis: Die Dateipfade k\u00f6nnen je nach Einrichtung variieren.

      "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#voraussetzungen","title":"Voraussetzungen","text":"
      • Eine funktionierende mailcow-Instanz
      • Eine funktionierende mailpiler Instanz (Sie finden eine Installationsanleitung hier, \u00fcberpr\u00fcfen Sie unterst\u00fctzte Versionen hier)
      • Ein mailcow API-Schl\u00fcssel (Nur-Lesen funktioniert): Konfiguration & Details - Zugang - Nur-Lesen-Zugang. Vergessen Sie nicht, den API-Zugang von Ihrer mailpiler IP zu erlauben.

      Warnung

      Da mailpiler sich gegen\u00fcber mailcow, unserem IMAP-Server, authentifiziert, k\u00f6nnen fehlgeschlagene Logins von Nutzern oder Bots eine Sperre f\u00fcr Ihre mailpiler-Instanz ausl\u00f6sen. Daher sollten Sie in Erw\u00e4gung ziehen, die IP-Adresse der mailpiler-Instanz innerhalb von mailcow auf eine Whitelist zu setzen: Konfiguration & Details - Konfiguration - Fail2ban-Parameter - Whitelisted networks/hosts.

      "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#einrichtung","title":"Einrichtung","text":"

      1. Setzen Sie die benutzerdefinierte Abfragefunktion von mailpiler und f\u00fcgen Sie diese an /usr/local/etc/piler/config-site.php an:

        $config['MAILCOW_API_KEY'] = 'YOUR_READONLY_API_KEY';\n$config['MAILCOW_SET_REALNAME'] = true; // wenn nicht angegeben, dann ist der Standardwert false\n$config['CUSTOM_EMAIL_QUERY_FUNCTION'] = 'query_mailcow_for_email_access';\ninclude('auth-mailcow.php');\n

        Sie k\u00f6nnen auch den mailcow-Hostnamen \u00e4ndern, falls erforderlich: 

        $config['MAILCOW_HOST'] = 'mail.domain.tld'; // standardm\u00e4\u00dfig $config['IMAP_HOST']\n

      2. Laden Sie die PHP-Datei mit den Funktionen aus dem GitHub Repo herunter:

        curl -o /usr/local/etc/piler/auth-mailcow.php https://raw.githubusercontent.com/patschi/mailpiler-mailcow-integration/master/auth-mailcow.php\n

      3. Erledigt!

      Stellen Sie sicher, dass Sie sich erneut mit Ihren IMAP-Zugangsdaten anmelden, damit die \u00c4nderungen wirksam werden.

      Wenn es nicht funktioniert, ist h\u00f6chstwahrscheinlich etwas mit der API-Abfrage selbst nicht in Ordnung. Versuchen Sie eine Fehlersuche, indem Sie manuelle API-Anfragen an die API senden. (Tipp: \u00d6ffnen Sie https://mail.domain.tld/api auf Ihrer Instanz)

      "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#nextcloud-mit-dem-helper-skript-verwalten","title":"Nextcloud mit dem Helper-Skript verwalten","text":"

      Deprecation Hinweis

      Diese Anleitung ist deprecated und betrifft das Nextcloud Helper-Skript, welches innerhalb mailcows geb\u00fcndelt ist. Ab Dezember 2024 wird diese Installationsart aus mailcow entfernt und kein Support daf\u00fcr geleistet. Sollten Sie noch besagte Installation nutzen, migrieren Sie ihre Nextcloud Installation in eine eigenst\u00e4ndige Nextcloud Instanz (entweder auch per Docker oder Nativ).

      Die Anleitung f\u00fcr die Nutzung von mailcow als Authentifizierungsquelle innerhalb Nextcloud's wird auch nach der Entfernung des Skriptes im Dezember 2024 erhalten und funktional bleiben.

      Nextcloud kann mit dem helper script, das in mailcow enthalten ist, eingerichtet (Parameter -i) und entfernt (Parameter -p) werden. Um Nextcloud zu installieren, navigieren Sie einfach zu Ihrem mailcow-dockerized Root-Ordner und f\u00fchren Sie das Helper-Skript wie folgt aus:

      ./helper-scripts/nextcloud.sh -i

      F\u00fcr den Fall, dass Sie das Passwort (z.B. f\u00fcr admin) vergessen haben und kein neues anfordern k\u00f6nnen [\u00fcber den Passwort-Reset-Link auf dem Login-Bildschirm] (https://docs.nextcloud.com/server/20/admin_manual/configuration_user/reset_admin_password.html?highlight=reset), k\u00f6nnen Sie durch den Aufruf des Helper-Skripts mit -r als Parameter ein neues Passwort setzen. Verwenden Sie diese Option nur, wenn Ihre Nextcloud nicht so konfiguriert ist, dass Sie mailcow zur Authentifizierung verwendet, wie im n\u00e4chsten Abschnitt beschrieben.

      Damit mailcow ein Zertifikat f\u00fcr die Nextcloud Domain generieren kann, muss die Domain unter welcher die Nextcloud sp\u00e4ter erreichbar sein soll als ADDITIONAL_SAN in die mailcow.conf hinzuf\u00fcgt werden und folgender Befehl zur \u00dcbernahme ausgef\u00fchrt werden.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      F\u00fcr weitere Informationen siehe: Erweitertes SSL.

      "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#hintergrund-aufgaben","title":"Hintergrund-Aufgaben","text":"

      Zur Verwendung der empfohlenen Einstellung (Cron) zur Verarbeitung der Hintergrund-Aufgaben m\u00fcssen in der docker-compose.override.yml folgende Zeilen hinzugef\u00fcgt werden:

      services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.nextcloud-cron.schedule: \"@every 5m\"\n      ofelia.job-exec.nextcloud-cron.command: \"su www-data -s /bin/bash -c \\\"/usr/local/bin/php -f /web/nextcloud/cron.php\\\"\"\n

      Zus\u00e4tzlich muss eine bestimmte Funktion f\u00fcr den php-fpm Worker aktiviert werden. Tun Sie dies in dem Sie die Datei data/conf/phpfpm/php-fpm.d/pools.conf bearbeiten und shell_exec aus allen Punkten samt dem , entfernen.

      Nachdem die beiden Schritte erledigt wurden muss der folgende Befehl ausgef\u00fchrt werden, um das Docker Image mit den entsprechenden Labels zu versehen und den Stack neuzustarten.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n

      Danach muss zudem der docker scheduler neu gestartet werden, um den neuen Job zu registrieren. Dazu wird der folgende Befehl ausgef\u00fchrt.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart ofelia-mailcow\n
      docker-compose restart ofelia-mailcow\n

      Zur \u00dcberpr\u00fcfung, ob die ofelia Konfiguration korrekt ist geladen wurde, kann mittels dem untenstehenden Befehl nach einer Zeile mit dem Inhalt New job registered \"nextcloud-cron\" - ... gesucht werden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs ofelia-mailcow\n
      docker-compose logs ofelia-mailcow\n

      Hierdurch wird alle 5 Minuten die Hintergrundverarbeitung gestartet. Da die Ausf\u00fchrung selbst keine Ausgabe liefert, kann die korrekte Funktionsweise in den Grundeinstellungen von Nextcloud \u00fcberpr\u00fcft werden. Hier wird automatisch mit der ersten Ausf\u00fchrung die Hintergrund-Aufgaben Verarbeitung auf (X) Cron gesetzt und der Zeitstempel Letzte Aufgabe ausgef\u00fchrt aktualisiert.

      "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#konfigurieren-sie-nextcloud-um-mailcow-fur-die-authentifizierung-zu-verwenden","title":"Konfigurieren Sie Nextcloud, um mailcow f\u00fcr die Authentifizierung zu verwenden","text":"

      Im Folgenden wird beschrieben, wie die Authentifizierung \u00fcber mailcow unter Verwendung des OAuth2-Protokolls eingerichtet wird. Wir nehmen nur an, dass Sie Nextcloud bereits unter cloud.example.com eingerichtet haben und dass Ihre mailcow unter mail.example.com l\u00e4uft. Es spielt keine Rolle, wenn Ihre Nextcloud auf einem anderen Server l\u00e4uft, Sie k\u00f6nnen immer noch mailcow f\u00fcr die Authentifizierung verwenden.

      1. Melden Sie sich bei mailcow als Administrator an.

      2. Klicken Sie im Dropdown Men\u00fc (oben rechts) auf Konfiguration.

      3. W\u00e4hlen Sie dann im Reiter \"Zugang\" den Dropdown Punkt OAuth2 aus.

      4. Scrollen Sie nach unten und klicken Sie auf die Schaltfl\u00e4che F\u00fcge OAuth2 Client hinzu. Geben Sie die Redirect URI als https://cloud.example.com/index.php/apps/sociallogin/custom_oauth2/mailcow an und klicken Sie auf Hinzuf\u00fcgen. Speichern Sie die Client-ID und das Geheimnis f\u00fcr sp\u00e4ter.

      Info

      Einige Installationen, einschlie\u00dflich derer, die mit dem Helper-Skript von mailcow eingerichtet wurden, m\u00fcssen index.php/ aus der URL entfernen, um einen erfolgreichen Redirect zu erhalten: https://cloud.example.com/apps/sociallogin/custom_oauth2/mailcow

      3. Melden Sie sich bei Nextcloud als Administrator an.

      4. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Apps. Klicken Sie auf die Schaltfl\u00e4che \"Suchen\" in der Symbolleiste, suchen Sie nach dem Plugin Social Login und klicken Sie daneben auf Herunterladen und aktivieren.

      5. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Einstellungen. Scrollen Sie zum Abschnitt Administration auf der linken Seite und klicken Sie auf Social Login.

      6. Entfernen Sie das H\u00e4kchen bei den folgenden Punkten:

      • \"Automatische Erstellung neuer Benutzer deaktivieren\"
      • \"Benutzern erlauben, soziale Logins mit ihren Konten zu verbinden\".
      • \"Nicht verf\u00fcgbare Benutzergruppen bei der Anmeldung nicht entfernen\"
      • \"Gruppen automatisch erstellen, wenn sie nicht vorhanden sind\"
      • \"Anmeldung f\u00fcr Benutzer ohne zugeordnete Gruppen einschr\u00e4nken\".

      7. \u00dcberpr\u00fcfen Sie die folgenden Punkte:

      • \"Die Erstellung eines Kontos verhindern, wenn die E-Mail-Adresse in einem anderen Konto existiert\"
      • \"Benutzerprofil bei jeder Anmeldung aktualisieren\"
      • \"Benachrichtigung der Administratoren \u00fcber neue Benutzer deaktivieren\".

      Klicken Sie auf die Schaltfl\u00e4che Speichern.

      8. Scrollen Sie nach unten zu Custom OAuth2 und klicken Sie auf die Schaltfl\u00e4che +. 9. Konfigurieren Sie die Parameter wie folgt:

      • Interner Name: mailcow
      • Titel: mailcow
      • API Basis-URL: https://mail.example.com
      • Autorisierungs-URL: https://mail.example.com/oauth/authorize
      • Token-URL: https://mail.example.com/oauth/token
      • Profil-URL: https://mail.example.com/oauth/profile
      • Abmelde-URL: (leer lassen)
      • Kunden-ID: (die Sie in Schritt 1 erhalten haben)
      • Client Secret: (was Sie in Schritt 1 erhalten haben)
      • Bereich: Profil

      Klicken Sie auf die Schaltfl\u00e4che Speichern ganz unten auf der Seite.

      Wenn Sie bisher Nextcloud mit mailcow-Authentifizierung \u00fcber user_external/IMAP verwendet haben, m\u00fcssen Sie einige zus\u00e4tzliche Schritte durchf\u00fchren, um Ihre bestehenden Benutzerkonten mit OAuth2 zu verkn\u00fcpfen.

      1. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Apps. Scrollen Sie nach unten zur App Externe Benutzerauthentifizierung und klicken Sie daneben auf Entfernen.

      2. F\u00fchren Sie die folgenden Abfragen in Ihrer Nextcloud-Datenbank aus (wenn Sie Nextcloud mit dem Skript von mailcow einrichten, k\u00f6nnen Sie folgenden Befehl nutzen um in den Container zu gelangen)

      docker compose (Plugin)docker-compose (Standalone) 
      source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
      source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
      INSERT INTO oc_users (uid, uid_lower) SELECT DISTINCT uid, LOWER(uid) FROM oc_users_external;\nINSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users_external;\n

      Wenn Sie Nextcloud bisher ohne mailcow-Authentifizierung, aber mit den gleichen Benutzernamen wie mailcow genutzt haben, k\u00f6nnen Sie Ihre bestehenden Benutzerkonten auch mit OAuth2 verkn\u00fcpfen.

      1. F\u00fchren Sie die folgenden Abfragen in Ihrer Nextcloud-Datenbank aus (wenn Sie Nextcloud mit dem Skript von mailcow einrichten, k\u00f6nnen Sie folgenden Befehl nutzen um in den Container zu gelangen):

      docker compose (Plugin)docker-compose (Standalone) 
      source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
      source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
      INSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users;\n
      "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#aktualisieren","title":"Aktualisieren","text":"

      Die Nextcloud-Instanz kann einfach mit dem Web-Update-Mechanismus aktualisiert werden. Bei gr\u00f6\u00dferen Updates k\u00f6nnen nach dem Update weitere \u00c4nderungen vorgenommen werden. Nachdem die Nextcloud-Instanz gepr\u00fcft wurde, werden Probleme angezeigt. Dies k\u00f6nnen z.B. fehlende Indizes in der DB oder \u00e4hnliches sein. Es wird angezeigt, welche Befehle ausgef\u00fchrt werden m\u00fcssen, diese m\u00fcssen im php-fpm-mailcow Container platziert werden.

      F\u00fchren Sie z.B. folgenden Befehl aus, um die fehlenden Indizes hinzuzuf\u00fcgen:

      docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/occ db:add-missing-indices\"

      Das Update kann bei Bedarf auch per CLI durchgef\u00fchrt werden. Dies ist mit folgedem Befehl im interaktiven Modus m\u00f6glich:

      docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar\"

      Um das Update ohne R\u00fcckfragen auszuf\u00fchren, z.B. durch einen CRON Job, kann folgender Befehl verwendet werden:

      Achtung

      Wir empfehlen dieses Vorgehen nicht! Es k\u00f6nnte \u00fcber die Zeit kaputt gehen und irreperable Sch\u00e4den an der Nextcloud Instanz erzeugen. NUTZUNG AUF EIGENE GEFAHR!!

      docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar --no-interaction\"

      "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#fehlersuche-und-fehlerbehebung","title":"Fehlersuche und Fehlerbehebung","text":"

      Es kann vorkommen, dass Sie die Nextcloud-Instanz von Ihrem Netzwerk aus nicht erreichen k\u00f6nnen. Dies kann daran liegen, dass der Eintrag Ihres Subnetzes im Array 'trusted_proxies' fehlt. Sie k\u00f6nnen \u00c4nderungen in der Nextcloud config.php in data/web/nextcloud/config/* vornehmen.

      'trusted_proxies' =>\n  array (\n    0 => 'fd4d:6169:6c63:6f77::/64',\n    1 => '172.22.1.0/24',\n    2 => 'NewSubnet/24',\n  ),\n

      Nachdem die \u00c4nderungen vorgenommen wurden, muss der nginx-Container neu gestartet werden.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart nginx-mailcow\n
      docker-compose restart nginx-mailcow\n
      "},{"location":"de/third_party/portainer/third_party-portainer/","title":"Portainer","text":"

      Um Portainer zu aktivieren, m\u00fcssen die docker-compose.yml und site.conf f\u00fcr Nginx ge\u00e4ndert werden.

      1. Erstellen Sie eine neue Datei docker-compose.override.yml im mailcow-dockerized Stammverzeichnis und f\u00fcgen Sie die folgende Konfiguration ein 

      services:\n    portainer-mailcow:\n      image: portainer/portainer-ce\n      volumes:\n        - /var/run/docker.sock:/var/run/docker.sock\n        - ./data/conf/portainer:/data\n      restart: always\n      dns:\n        - 172.22.1.254\n      dns_search: mailcow-network\n      networks:\n        mailcow-network:\n          aliases:\n            - portainer\n
      2a. Erstelle data/conf/nginx/portainer.conf: 
      upstream portainer {\n  server portainer-mailcow:9000;\n}\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  '' close;\n}\n

      2b. F\u00fcgen Sie einen neuen Standort f\u00fcr die Standard-mailcow-Site ein, indem Sie die Datei data/conf/nginx/site.portainer.custom erstellen: 

        location /portainer/ {\n    proxy_http_version 1.1;\n    proxy_set_header Host              $http_host;   # required for docker client's sake\n    proxy_set_header X-Real-IP         $remote_addr; # pass on real client's IP\n    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_read_timeout                 900;\n\n    proxy_set_header Connection \"\";\n    proxy_buffers 32 4k;\n    proxy_pass http://portainer/;\n  }\n\n  location /portainer/api/websocket/ {\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_pass http://portainer/api/websocket/;\n  }\n

      3. \u00dcbernehmen Sie Ihre \u00c4nderungen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d && docker compose restart nginx-mailcow\n
      docker-compose up -d && docker-compose restart nginx-mailcow\n

      Nun k\u00f6nnen Sie einfach zu https://${MAILCOW_HOSTNAME}/portainer/ navigieren, um Ihre Portainer-Container-\u00dcberwachungsseite anzuzeigen. Sie werden dann aufgefordert, ein neues Passwort f\u00fcr den admin Account anzugeben. Nachdem Sie Ihr Passwort eingegeben haben, k\u00f6nnen Sie sich mit der Portainer UI verbinden.

      "},{"location":"de/third_party/portainer/third_party-portainer/#reverse-proxy","title":"Reverse Proxy","text":"

      Wenn Sie einen Reverse-Proxy verwenden, muss dieser noch konfiguriert werden die Websocket Requests richtig weiterzuleiten.

      Dies wird f\u00fcr die Docker Konsole und andere Komponenten ben\u00f6tigt.

      Hier ist ein Bespiel f\u00fcr Apache:

      <Location /portainer/api/websocket/>\n  RewriteEngine on\n  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\n  RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\n  RewriteRule /portainer/api/websocket/(.*) ws://127.0.0.1:8080/portainer/api/websocket/$1 [P]\n</Location>\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#installation-von-roundcube","title":"Installation von Roundcube","text":"

      Beachten Sie

      Sofern nicht abweichend angegeben wird f\u00fcr alle aufgef\u00fchrten Kommandos angenommen, dass diese im mailcow Installationsverzeichnis ausgef\u00fchrt werden, d. h. dem Verzeichnis, welches mailcow.conf usw. enth\u00e4lt. Bitte f\u00fchren Sie die Kommandos nicht blind aus, sondern verstehen Sie was diese bewirken. Keines der Kommandos sollte einen Fehler ausgeben; sollten Sie dennoch auf einen Fehler sto\u00dfen, beheben Sie diesen sofern notwendig bevor Sie mit den nachfolgenden Kommandos fortfahren.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#hinweise-zur-verwendung-von-composer","title":"Hinweise zur Verwendung von composer","text":"

      Diese Anweisungen verwenden das Programm composer zur Aktualisierung der Abh\u00e4ngigkeiten von Roundcube und um Roundcube-Plugins zu installieren bzw. zu aktualisieren.

      Das roundcube-plugin-installer composer Plugin hat eine Design-Schw\u00e4che, die dazu f\u00fchren kann, dass composer bei Operationen fehlschl\u00e4gt, im Rahmen derer Pakete aktualisiert oder deinstalliert werden.

      Die Fehlermeldung in diesem Falle besagt, dass eine require-Anweisung in autoload_real.php fehlgeschlagen ist, weil eine Datei nicht gefunden werden konnte. Beispiel:

      In autoload_real.php line 43:\n  require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory\n

      Leider treten diese Fehler relativ h\u00e4ufig auf, sie lassen sich jedoch leicht beheben indem der Autoloader aktualisiert wird und das fehlgeschlagene Kommando im Anschluss erneut ausgef\u00fchrt wird:

      docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o\n# Nun das fehlgeschlagene Kommando erneut ausf\u00fchren\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#vorbereitung","title":"Vorbereitung","text":"

      Zun\u00e4chst laden wir mailcow.conf um Zugriff auf die mailcow-Einstellungen innerhalb der nachfolgenden Kommandos zu erhalten.

      source mailcow.conf\n

      Laden Sie Roundcube 1.6.x (pr\u00fcfen Sie das aktuellste Release und passen Sie die URL entsprechend an) in das web Verzeichnis herunter und entpacken Sie es (hier rc/):

      mkdir -m 755 data/web/rc\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#optional-rechtschreibprufung","title":"Optional: Rechtschreibpr\u00fcfung","text":"

      Wenn Sie eine Rechtschreibpr\u00fcfung ben\u00f6tigen, erstellen Sie eine Datei data/hooks/phpfpm/aspell.sh mit folgendem Inhalt und geben Sie dann chmod +x data/hooks/phpfpm/aspell.sh ein. Dadurch wird eine lokale Rechtschreibpr\u00fcfung installiert. Beachten Sie, dass die meisten modernen Webbrowser eine eingebaute Rechtschreibpr\u00fcfung haben, so dass Sie diese vielleicht nicht ben\u00f6tigen.

      #!/bin/bash\napk update\napk add aspell-de # oder jede andere Sprache\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#installation-des-mime-typ-verzeichnisses","title":"Installation des MIME-Typ-Verzeichnisses","text":"

      Laden Sie die mime.types Datei herunter, da diese nicht im php-fpm-Container enthalten ist.

      wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#anlegen-der-roundcube-datenbank","title":"Anlegen der Roundcube-Datenbank","text":"

      Erstellen Sie eine Datenbank f\u00fcr Roundcube im mailcow mysql Container. Dies erstellt einen neuen roundcube Datenbank-Benutzer mit einem Zufallspasswort, welches in die Shell ausgegeben wird und in einer Shell-Variable f\u00fcr die Verwendung durch die nachfolgenden Kommandos gespeichert wird. Beachten Sie, dass Sie die DBROUNDCUBE-Shell-Variable manuell auf das ausgegebene Passwort setzen m\u00fcssen, falls sie den Installationsprozess unterbrechen und sp\u00e4ter in einer neuen Shell fortsetzen sollten.

      DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)\necho Das Datenbank-Password f\u00fcr den Benutzer roundcube lautet $DBROUNDCUBE\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';\"\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-konfigurationsdatei","title":"Roundcube-Konfigurationsdatei","text":"

      Erstellen Sie eine Datei data/web/rc/config/config.inc.php mit dem folgenden Inhalt. - Die des_key-Einstellung wird auf einen Zufallswert gesetzt. Sie wird u. a. zur Verschl\u00fcsselung vor\u00fcbergehend gespeicherter IMAP-Passw\u00f6rter verwendet. - Die Liste der Plugins kann nach Belieben angepasst werden. Die folgende Liste enth\u00e4lt eine Liste von Standard-Plugins, welche ich als allgemein n\u00fctzlich empfinde und die gut mit mailcow zusammenspielen: - Das archive-Plugin f\u00fcgt einen Archiv-Button hinzu, der ausgew\u00e4hlte E-Mails in ein konfigurierbares Archiv-Verzeichnis verschiebt. - Das managesieve-Plugin bietet eine benutzerfreundliche Oberfl\u00e4che zur Verwaltung serverseitiger E-Mail-Filter und Abwesenheits-Benachrichtigungen. - Das acl-Plugin erm\u00f6glicht die Verwaltung von Zugriffskontroll-Listen auf IMAP-Verzeichnissen, mit der M\u00f6glichkeit IMAP-Verzeichnisse mit anderen Benutzern zu teilen. - Das markasjunk-Plugin f\u00fcgt Buttons hinzu, um ausgew\u00e4hlte E-Mails als Spam (oder E-Mails im Junk-Verzeichnis nicht als Spam) zu markieren und diese in das Junk-Verzeichnis (oder zur\u00fcck in den Posteingang) zu verschieben. Die in mailcow enthaltenen Sieve-Filter l\u00f6sen automatisch die zugeh\u00f6rige Lern-Operation in rspamd aus, so dass keine weitere Konfiguration des Plugins erforderlich ist. - Das zipdownload-Plugin erlaubt es, mehrere E-Mail-Anh\u00e4nge oder E-Mails als ZIP-Archiv herunterzuladen. - Wenn Sie die Rechtschreibpr\u00fcfung im obigen Schritt nicht installiert haben, entfernen Sie den Parameter spellcheck_engine.

      cat <<EOCONFIG >data/web/rc/config/config.inc.php\n<?php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\n\\$config['imap_host'] = 'dovecot:143';\n\\$config['smtp_host'] = 'postfix:588';\n\\$config['smtp_user'] = '%u';\n\\$config['smtp_pass'] = '%p';\n\\$config['support_url'] = '';\n\\$config['product_name'] = 'Roundcube Webmail';\n\\$config['cipher_method'] = 'chacha20-poly1305';\n\\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc \"A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\\\]^_{|}~\" 2> /dev/null | head -c 32)';\n\\$config['plugins'] = [\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n];\n\\$config['spellcheck_engine'] = 'aspell';\n\\$config['mime_types'] = '/web/rc/config/mime.types';\n\\$config['enable_installer'] = true;\n\n\\$config['managesieve_host'] = 'dovecot:4190';\n// Enables separate management interface for vacation responses (out-of-office)\n// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section\n\\$config['managesieve_vacation'] = 1;\nEOCONFIG\n\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#initialisierung-der-datenbank","title":"Initialisierung der Datenbank","text":"

      Richten Sie Ihren Browser auf https://myserver/rc/installer. Pr\u00fcfen Sie, dass die Webseite in keinem der Schritte \"NOT OK\"-Testergebnisse zeigt. Einige \"NOT AVAILABLE\"-Testergebnisse sind bzgl. der verschiedenen Datenbank-Erweiterungen erwartet, von denen nur MySQL ben\u00f6tigt wird.

      Initialisieren Sie die Datenbank und verlassen Sie das Installationsprogramm. Es ist nicht notwendig, die Konfigurationsdatei mit der heruntergeladenen Datei zu aktualisieren, sofern Sie keine \u00c4nderungen an den Einstellungen innerhalb des Installationsprogramms durchgef\u00fchrt habe, die Sie \u00fcbernehmen m\u00f6chten.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#webserver-konfiguration","title":"Webserver-Konfiguration","text":"

      Das Roundcube-Verzeichnis enth\u00e4lt einige Inhalte, die nicht an Web-Nutzer ausgeliefert werden sollen. Wir erstellen daher eine Konfigurations-Erg\u00e4nzung f\u00fcr nginx, um nur die \u00f6ffentlichen Teile von Roundcube im Web zu exponieren:

      cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#deaktivieren-und-entfernen-des-installationsprogramms","title":"Deaktivieren und entfernen des Installationsprogramms","text":"

      L\u00f6schen Sie das Verzeichnis data/web/rc/installer nach einer erfolgreichen Installation, und setzen Sie die enable_installer-Option in data/web/rc/config/config.inc.php auf false:

      rm -r data/web/rc/installer\nsed -i -e \"s/\\(\\$config\\['enable_installer'\\].* = \\)true/\\1false/\" data/web/rc/config/config.inc.php\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-der-roundcube-abhangigkeiten","title":"Aktualisierung der Roundcube-Abh\u00e4ngigkeiten","text":"

      Dieser Schritt ist nicht unbedingt notwendig, aber zumindest zum Zeitpunkt der Erstellung dieser Anweisungen enthielten die mit Roundcube ausgelieferten Abh\u00e4ngigkeiten Versionen mit Sicherheitsl\u00fccken, daher k\u00f6nnte es eine gute Idee sein, die Abh\u00e4ngigkeiten auf die neusten Versionen zu aktualisieren. Aus demselben Grund sollte composer update hin und wieder ausgef\u00fchrt werden.

      cp -n data/web/rc/composer.json-dist data/web/rc/composer.json\ndocker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n

      Sie k\u00f6nnen au\u00dferdem composer audit verwenden, um bekannte Sicherheitsl\u00fccken in den installierten composer-Paketen anzuzeigen.

      docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#ermoglichen-der-klartext-authentifizierung-fur-den-php-fpm-container-ohne-die-verwendung-von-tls","title":"Erm\u00f6glichen der Klartext-Authentifizierung f\u00fcr den php-fpm-Container ohne die Verwendung von TLS","text":"

      Wir m\u00fcssen die Verwendung von Klartext-Authentifizierung \u00fcber nicht verschl\u00fcsselte Verbindungen (innerhalb der Container-Netzwerks) in Dovecot zulassen, was in der Standard-Installation von mailcow nur f\u00fcr den SOGo-Container zum gleichen Zweck m\u00f6glich ist. Danach starten Sie den Dovecot-Container neu, damit die \u00c4nderung wirksam wird.

      cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nremote ${IPV4_NETWORK}.0/24 {\n  disable_plaintext_auth = no\n}\nremote ${IPV6_NETWORK} {\n  disable_plaintext_auth = no\n}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#ofelia-job-fur-roundcube-aufraumtatigkeiten","title":"Ofelia-Job f\u00fcr Roundcube-Aufr\u00e4umt\u00e4tigkeiten","text":"

      Roundcube muss regelm\u00e4ssig die Datenbank von nicht mehr ben\u00f6tigter Information befreien. Wir legen einen Ofelia-Job an, der das Roundcube cleandb.sh-Skript regelm\u00e4ssig ausf\u00fchrt.

      Um dies zu tun, f\u00fcgen Sie folgendes zu docker-compose.override.yml hinzu (falls Sie bereits einige Anpassungen f\u00fcr den php-fpm-Container durchgef\u00fchrt haben, f\u00fcgen Sie die Label dem bestehenden Abschnitt hinzu):

      services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.roundcube_cleandb.schedule: \"@every 168h\"\n      ofelia.job-exec.roundcube_cleandb.user: \"www-data\"\n      ofelia.job-exec.roundcube_cleandb.command: \"/bin/bash -c \\\"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\\\"\"\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#optionale-zusatz-funktionalitaten","title":"Optionale Zusatz-Funktionalit\u00e4ten","text":""},{"location":"de/third_party/roundcube/third_party-roundcube/#aktivieren-der-funktion-passwort-andern-in-roundcube","title":"Aktivieren der Funktion \"Passwort \u00e4ndern\" in Roundcube","text":"

      Das \u00c4ndern des mailcow Passworts aus der Roundcube-Benutzeroberfl\u00e4che wird durch das password-Plugin erm\u00f6glicht. Wir konfigurieren dieses zur Verwendung der mailcow-API zur Passwort-Aktualisierung, was es zun\u00e4chst erfordert, die API zu aktivieren und den API-Schl\u00fcssel zu ermitteln (Lese-/Schreib-Zugriff notwendig). Die API kann in der mailcow-Administrationsoberfl\u00e4che aktiviert werden, wo Sie auch den API-Schl\u00fcssel finden.

      \u00d6ffnen Sie data/web/rc/config/config.inc.php und aktivieren Sie das Passwort-Plugin, indem Sie es dem $config['plugins']-Array hinzuf\u00fcgen, zum Beispiel:

      $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n);\n

      Konfigurieren Sie das password-Plugin (stellen Sie sicher, **API_KEY** auf Ihren mailcow Lese-/Schreib-API-Schl\u00fcssel anzupassen):

      cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'http://nginx';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n

      Hinweis: Sollten Sie die mailcow nginx-Konfiguration so angepasst haben, dass http-Anfragen auf https umgeleitet werden (wie z. B. hier beschrieben), dann wird die direkte Verbindung zum nginx-Container via HTTP nicht funktionieren, da nginx kein im Zertifikat enthaltener Hostname ist. In solchen F\u00e4llen setzen Sie password_mailcow_api_host stattdessen auf die \u00f6ffentliche URI:

      cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#carddav-adressbucher-in-roundcube-einbinden","title":"CardDAV-Adressb\u00fccher in Roundcube einbinden","text":"

      Installieren Sie die neuste v5-Version (die untenstehende Konfiguration ist kompatibel zu v5-Releases) mit composer. Antworten Sie Y, wenn Sie gefragt werden, ob Sie das Plugin aktivieren m\u00f6chten.

      docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"roundcube/carddav:~5\"\n

      Editieren Sie die Datei data/web/rc/plugins/carddav/config.inc.php und f\u00fcgen Sie folgenden Inhalt hinzu:

      cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php\n<?php\n\\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';\n\n\\$prefs['SOGo'] = [\n    'accountname'    => 'SOGo',\n    'username'       => '%u',\n    'password'       => '%p',\n    'discovery_url'  => 'http://sogo:20000/SOGo/dav/',\n    'name'           => '%N',\n    'use_categories' => true,\n    'fixed'          => ['username', 'password'],\n];\nEOCONFIG\n

      RCMCardDAV legt alle Adressb\u00fccher des Benutzers beim Login in Roundcube an, einschlie\u00dflich abonnierten Adressb\u00fcchern die mit dem Benutzers von anderen Benutzern geteilt werden.

      Wenn Sie das Standard-Adressbuch (gespeichert in der Roundcube-Datenbank) entfernen m\u00f6chten, so dass nur CardDAV-Adressb\u00fccher verwendet werden k\u00f6nnen, f\u00fcgen Sie der Konfigurationsdatei data/web/rc/config/config.inc.php die Option $config['address_book_type'] = ''; hinzu.

      Hinweis: RCMCardDAV verwendet zus\u00e4tzliche Datenbank-Tabellen. Nach der Installation (oder Aktualisierung) von RCMCardDAV ist es notwendig, sich in Roundcube neu anzumelden (melden Sie sich vorher ab, wenn Sie bereits eingeloggt sind), da die Erzeugung der Datenbank-Tabellen bzw. \u00c4nderungen nur bei der Anmeldung in Roundcube durchgef\u00fchrt werden.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#ubermittlung-der-client-netzwerkadresse-an-dovecot","title":"\u00dcbermittlung der Client-Netzwerkadresse an Dovecot","text":"

      Normalerweise sieht der IMAP-Server Dovecot die Netzwerkadresse des php-fpm-Containers wenn Roundcube zu diesem Verbindungen aufbaut. Durch Verwendung einer IMAP-Erweiterung und dem dovecot_client_ip Roundcube-Plugin ist es m\u00f6glich, dass Roundcube Dovecot die Client-Netzwerkadresse \u00fcbermittelt, so dass in den Log-Dateien die Client-Netzwerkadresse erscheint. Dies f\u00fchrt dazu, dass Login-Versuche an Roundcube in den Dovecot-Logs genauso wie direkte Client-Verbindungen zu Dovecot aufgezeichnet werden, und fehlgeschlagene Login-Versuche an Roundcube analog zu fehlgeschlagenen direkten IMAP-Logins durch den netfilter-Container oder andere ggf. verf\u00fcgbare Mechanismen zur Behandlung von Bruteforce-Attacken auf den IMAP-Server aufgegriffen werden und z. B. zu einer Blockierung des Clients f\u00fchren.

      Hierzu muss das Roundcube-Plugin installiert werden:

      docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"foorschtbar/dovecot_client_ip:~2\"\n

      Bearbeiten Sie die Datei data/web/rc/config/config.inc.php und f\u00fcgen Sie den folgenden Inhalt ein:

      cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['dovecot_client_ip_trusted_proxies'] = ['${IPV4_NETWORK}.0/24', '${IPV6_NETWORK}'];\nEOCONFIG\n

      Weiterhin m\u00fcssen wir Dovecot konfigurieren, so dass der php-fpm-Container als Teil eines vertrauensw\u00fcrdigen Netzwerks betrachtet wird und somit die Client-Netzwerkadresse innerhalb einer IMAP-Sitzung \u00fcberschreiben darf. Beachten Sie, dass dies auch die Klartext-Authentifizierung f\u00fcr die aufgef\u00fchrten Netzwerkbereiche erlaubt, so dass das explizite \u00dcberschreiben von disable_plaintext_auth weiter oben in diesem Fall nicht notwendig ist.

      cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nlogin_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-zur-mailcow-apps-liste-hinzufugen","title":"Roundcube zur mailcow Apps-Liste hinzuf\u00fcgen","text":"

      Optional k\u00f6nnen Sie Roundcubes Link zu der mailcow Apps Liste hinzuf\u00fcgen. Um dies zu tun, \u00f6ffnen oder erstellen Sie data/web/inc/vars.local.inc.php und stellen Sie sicher, dass es den folgenden Konfigurationsblock beinhaltet:

      <?php\n\n$MAILCOW_APPS = [\n    [\n        'name' => 'SOGo',\n        'link' => '/SOGo/'\n    ],\n    [\n        'name' => 'Roundcube',\n        'link' => '/rc/'\n    ]\n];\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#administratoren-ohne-passwort-in-roundcube-einloggen-lassen","title":"Administratoren ohne Passwort in Roundcube einloggen lassen","text":"

      Installieren Sie zun\u00e4chst das Plugin dovecot_impersonate und f\u00fcgen Sie Roundcube als App hinzu (siehe oben).

      docker exec -it -w /web/rc/plugins $(docker ps -f name=php-fpm-mailcow -q) git clone https://github.com/corbosman/dovecot_impersonate.git\n

      Editieren Sie data/web/rc/config/config.inc.php und aktivieren Sie das dovecot_impersonate Plugin indem Sie es zum Array $config['plugins'] hinzuf\u00fcgen, zum Beispiel:

      $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n  'dovecot_impersonate'\n);\n

      Editieren Sie mailcow.conf und f\u00fcgen Sie folgendes hinzu:

      # Erlaube Admins, sich in Roundcube als Email-Benutzer einzuloggen (ohne Passwort)\n# Roundcube mit Plugin dovecot_impersonate muss zuerst installiert werden\n\nALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=y\n

      Editieren Sie docker-compose.override.yml und verfassen/erweitern Sie den Abschnitt f\u00fcr php-fpm-mailcow:

      services:\n  php-fpm-mailcow:\n    environment:\n      - ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}\n

      Bearbeiten Sie data/web/js/site/mailbox.js und den folgenden Code nach if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }

      if (ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE) {\n  item.action += '<a href=\"/rc-auth.php?login=' + encodeURIComponent(item.username) + '\" class=\"login_as btn btn-sm btn-xs-half btn-primary\" target=\"_blank\"><i class=\"bi bi-envelope-fill\"></i> Roundcube</a>';\n}\n

      Bearbeiten Sie data/web/mailbox.php und f\u00fcgen Sie diese Zeile zum Array $template_data hinzu:

        'allow_admin_email_login_roundcube' => (preg_match(\"/^(yes|y)+$/i\", $_ENV[\"ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE\"])) ? 'true' : 'false',\n

      Bearbeiten Sie data/web/templates/mailbox.twig und f\u00fcgen Sie diesen Code am Ende des Javascript-Abschnitts ein:

        var ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE = {{ allow_admin_email_login_roundcube }};\n

      Kopieren Sie den Inhalt der folgenden Dateien aus diesem Snippet:

      • data/web/inc/lib/RoundcubeAutoLogin.php
      • data/web/rc-auth.php
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#abschluss-der-installation","title":"Abschluss der Installation","text":"

      Starten Sie schlie\u00dflich mailcow neu

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-von-roundcube","title":"Aktualisierung von Roundcube","text":"

      Ein Upgrade von Roundcube ist recht einfach: Gehen Sie auf die GitHub releases Seite f\u00fcr Roundcube und holen Sie sich den Link f\u00fcr die \"complete.tar.gz\" Datei f\u00fcr die gew\u00fcnschte Version. Dann folgen Sie den untenstehenden Befehlen und \u00e4ndern Sie die URL und den Namen des Roundcube-Ordners, falls n\u00f6tig.

      # Starten Sie eine Bash-Sitzung des mailcow PHP-Containers\ndocker exec -it mailcowdockerized-php-fpm-mailcow-1 bash\n\n# Installieren Sie die erforderliche Upgrade-Abh\u00e4ngigkeit, dann aktualisieren Sie Roundcube auf die gew\u00fcnschte Version\napk add rsync\ncd /tmp\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar xfvz -\ncd roundcubemail-1.6.9\nbin/installto.sh /web/rc\n\n# Geben Sie 'Y' ein und dr\u00fccken Sie die Eingabetaste, um Ihre Installation von Roundcube zu aktualisieren.\n# Geben Sie 'N' ein, wenn folgender Dialog erscheint: \"Do you want me to fix your local configuration\".\n\n# Sollte im Output eine Notice kommen \"NOTICE: Update dependencies by running php composer.phar update --no-dev\" f\u00fchren\nSie composer aus:\ncd /web/rc\ncomposer update --no-dev -o\n# Auf die Frage \"Do you trust \"roundcube/plugin-installer\" to execute code and wish to enable it now? (writes \"allow-plugins\" to composer.json) [y,n,d,?] \" bitte mit y antworten.\n\n# Entfernen Sie \u00fcbrig gebliebene Dateien\nrm -rf /tmp/roundcube*\n\n# Falls Sie von Version 1.5 auf 1.6 updaten, dann f\u00fchren Sie folgende Befehle aus, um die Konfigurationsdatei anzupassen:`\nsed -i \"s/\\$config\\['default_host'\\].*$/\\$config\\['imap_host'\\]\\ =\\ 'dovecot:143'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['default_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['smtp_server'\\].*$/\\$config\\['smtp_host'\\]\\ =\\ 'postfix:588'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['smtp_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['managesieve_host'\\].*$/\\$config\\['managesieve_host'\\]\\ =\\ 'dovecot:4190'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['managesieve_port'\\].*$/d\" /web/rc/config/config.inc.php\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-von-composer-plugins","title":"Aktualisierung von composer-Plugins","text":"

      Um Roundcube-Plugins und -Abh\u00e4ngigkeiten zu aktualisieren, die mit composer installiert wurden (z. B. RCMCardDAV-Plugin), f\u00fchren Sie einfach composer im Container aus:

      docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-des-mime-typ-verzeichnisses","title":"Aktualisierung des MIME-Typ-Verzeichnisses","text":"

      Um das MIME-Typ-Verzeichnis zu aktualisieren, laden Sie dieses erneut mit dem Kommando aus den Installations-Anweisungen herunter.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#deinstallation-von-roundcube","title":"Deinstallation von Roundcube","text":"

      F\u00fcr die Deinstallation wird ebenfalls angenommen, dass die Kommandos im mailcow-Installationsverzeichnis ausgef\u00fchrt werden und dass mailcow.conf in die Shell geladen wurde, siehe Abschnitt Vorbereitung oben.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-des-web-verzeichnisses","title":"Entfernen des Web-Verzeichnisses","text":"

      Dies entfernt die Roundcube-Installation mit allen Plugins und Abh\u00e4ngigkeiten die Sie ggf. installiert haben, einschlie\u00dflich solcher, die mit composer installiert wurden.

      Hinweis: Dies entfernt auch alle angepassten Konfigurationen die Sie ggf. in Roundcube durchgef\u00fchrt haben. Sollten Sie diese erhalten wollen, verschieben Sie das Verzeichnis an einen anderen Ort statt es zu entfernen.

      rm -r data/web/rc\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-datenbank","title":"Entfernen der Datenbank","text":"

      Hinweis: Dies l\u00f6scht alle Daten, die Roundcube abgespeichert hat. Wenn Sie diese erhalten m\u00f6chten, k\u00f6nnen Sie mysqldump ausf\u00fchren, bevor Sie die Datenbank l\u00f6schen, oder die Datenbank einfach nicht l\u00f6schen.

      docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP USER 'roundcube'@'%';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP DATABASE roundcubemail;\"\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-konfigurationsanpassungen-fur-mailcow","title":"Entfernen der Konfigurationsanpassungen f\u00fcr mailcow","text":"

      Um die Dateien zu ermitteln, lesen Sie bitte die Installationsanweisungen und machen Sie die Schritte, die Sie dort zuvor durchgef\u00fchrt haben, r\u00fcckg\u00e4ngig.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#migration-von-einer-alteren-mailcow-roundcube-installation","title":"Migration von einer \u00e4lteren mailcow-Roundcube-Installation","text":"

      \u00c4ltere Versionen dieser Anleitung verwendeten die mailcow-Datenbank auch f\u00fcr Roundcube, mit einem konfigurierten Pr\u00e4fix mailcow_rc1 f\u00fcr alle Roundcube-Tabellen.

      Zur Migration wird ebenfalls angenommen, dass alle Kommandos im mailcow-Installationsverzeichnis ausgef\u00fchrt werden und mailcow.conf in die Shell geladen wurde, siehe Vorbereitung oben. Dies Kommandos der verschiedenen Schritte bauen aufeinander auf und m\u00fcssen innerhalb derselben Shell ausgef\u00fchrt werden. Insbesondere setzen einige Schritte Shell-Variablen (besonders die DBROUNDCUBE-Variable mit dem Datenbank-Passwort f\u00fcr den roundcube-Datenbankbenutzer), die in sp\u00e4teren Schritten verwendet werden.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#anlegen-eines-neuen-roundcube-datenbankbenutzers-und-der-datenbank","title":"Anlegen eines neuen roundcube-Datenbankbenutzers und der Datenbank","text":"

      Folgen Sie den Anweisungen oben um den roundcube-Datenbankbenutzer und die getrennte Datenbank anzulegen.

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#migration-der-roundcube-daten-aus-der-mailcow-datenbank","title":"Migration der Roundcube-Daten aus der mailcow-Datenbank","text":"

      Bevor wir mit der Migration starten, deaktivieren wir Roundcube, um weitere \u00c4nderungen an dessen Datenbank-Tabellen zu vermeiden.

      cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation ^~ /rc/ {\n  return 503;\n}\nEOCONFIG\ndocker compose exec nginx-mailcow nginx -s reload\n

      Nun kopieren wir die Roundcube-Daten in die neue Datenbank. Wir entfernen das Datenbank-Tabellen-Pr\u00e4fix in diesem Schritt, welches Sie ggf. anpassen m\u00fcssen, wenn Sie ein anderes Pr\u00e4fix als mailcow_rc1 verwendet haben. Es ist auch m\u00f6glich, das Pr\u00e4fix beizubehalten (in diesem Fall behalten Sie auch die zugeh\u00f6rige Roundcube-Einstellung db_prefix bei). \u00c4ndern Sie dann die Datenbank-Fremdschl\u00fcssel.

      RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"show tables like 'mailcow_rc1%';\" | tr '\\n\\r' ' ')\ndocker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c \"mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail\"\nFOREIGNKEYS=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SELECT CONCAT('ALTER TABLE \\`', TABLE_NAME, '\\` ', 'DROP FOREIGN KEY \\`', CONSTRAINT_NAME, '\\`;', 'ALTER TABLE \\`', TABLE_NAME, '\\` ', 'ADD FOREIGN KEY \\`', CONSTRAINT_NAME, '\\` (', COLUMN_NAME, ') ', 'REFERENCES \\`', REPLACE(REFERENCED_TABLE_NAME, 'mailcow_rc1', ''), '\\` (', REFERENCED_COLUMN_NAME, ');') FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = 'roundcubemail' AND REFERENCED_TABLE_NAME IS NOT NULL;\")\ndocker exec $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} roundcubemail -e \"$FOREIGNKEYS\"\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-der-roundcube-konfiguration","title":"Aktualisierung der Roundcube-Konfiguration","text":"

      F\u00fchren Sie folgende Kommandos aus, um die nicht mehr notwendige db_prefix Option zu entfernen. Wir aktivieren au\u00dferdem das Logging in Roundcube, indem wir die Einstellungen log_dir und temp_dir entfernen, welche Teil der alten Anweisungen waren.

      sed -i \"/\\$config\\['db_prefix'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['log_dir'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['temp_dir'\\].*$/d\" data/web/rc/config/config.inc.php\n

      Wir m\u00fcssen die nginx-Konfiguration anpassen, so dass nicht-\u00f6ffentliche Verzeichnisse von Roundcube nicht exponiert werden, insbesondere die Verzeichnisse, welche Log-Dateien und tempor\u00e4re Dateien enthalten:

      cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n

      Wir k\u00f6nnen auch die cipher_method-Einstellung auf eine sicherere Einstellung \u00e4ndern, aber beachten Sie, dass mit der alten Methode verschl\u00fcsselte Daten danach nicht mehr entschl\u00fcsselt werden k\u00f6nnen. Dies betrifft insbesondere CardDAV-Passw\u00f6rter, sofern Sie RCMCardDAV verwenden und Ihre Nutzer benutzerdefinierte Adressb\u00fccher hinzugef\u00fcgt haben (die Admin-Voreinstellungen f\u00fcr die SOGo-Adressb\u00fccher werden automatisch beim n\u00e4chsten Login f\u00fcr den jeweiligen Nutzer korrigiert). Wenn Sie die cipher_method \u00e4ndern wollen, f\u00fchren Sie folgendes Kommando aus:

      cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['cipher_method'] = 'chacha20-poly1305';\nEOCONFIG\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#umstellung-des-rcmcarddav-plugins-auf-die-installation-mittels-composer","title":"Umstellung des RCMCardDAV-Plugins auf die Installation mittels composer","text":"

      Dieser Schritt ist optional, aber er gleicht Ihre Installation an die aktuelle Fassung der Anweisungen an und erm\u00f6glicht die Aktualisierung von RCMCardDAV mittels composer. Dies wird einfach dadurch erreicht, dass das carddav-Plugin aus dem Installationsverzeichnis gel\u00f6scht und entsprechend der Anweisungen oben installiert wird, einschlie\u00dflich der Erstellung einer neuen RCMCardDAV v5-Konfiguration. Falls Sie das RCMCardDAV angepasst haben, sollten Sie dieses sichern, bevor Sie das Plugin l\u00f6schen, und Ihre Anpassungen sp\u00e4ter in die neue Konfigurationsdatei \u00fcbernehmen.

      Um das carddav-Plugin zu l\u00f6schen, f\u00fchren Sie folgendes Kommando aus, danach befolgen Sie zur Neuinstallation die Anweisungen oben:

      rm -r data/web/rc/plugins/carddav\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#umschalten-von-roundcube-auf-die-neue-datenbank","title":"Umschalten von Roundcube auf die neue Datenbank","text":"

      Zun\u00e4chst passen wir die Roundcube-Konfiguration an, so dass die neue Datenbank verwendet wird. 

      sed -i \"/\\$config\\['db_dsnw'\\].*$/d\" data/web/rc/config/config.inc.php\ncat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\nEOCONFIG\n

      "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-web-zugriff-reaktivieren","title":"Roundcube Web-Zugriff reaktivieren","text":"

      F\u00fchren Sie chown und chmod auf den sensitiven Roundcube-Verzeichnissen, welche in Vorbereitung aufgef\u00fchrt sind aus, um sicherzustellen, dass der nginx-Webserver nicht auf Dateien zugreifen darf, die er nicht ausliefern soll.

      Dann reaktivieren Sie den Web-Zugriff f\u00fcr Roundcube, indem Sie die tempor\u00e4re Roundcube-Konfigurations-Erweiterung f\u00fcr nginx durch die oben beschriebene ersetzen, und laden anschlie\u00dfend die nginx-Konfiguration neu:

      docker compose exec nginx-mailcow nginx -s reload\n
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#andere-anpassungen","title":"Andere Anpassungen","text":"

      Sie m\u00fcssen auch die Konfiguration des Roundcube password-Plugins entsprechend dieser Anweisungen anpassen, sofern Sie diese Funktionalit\u00e4t aktiviert haben, da die alten Anweisungen das Passwort direkt in der mailcow-Datenbank \u00e4nderten, wohingegen diese Fassung der Anweisungen die mailcow-API zur Passwort-\u00c4nderung verwendet.

      Bez\u00fcglich weiterer Anpassungen und Neuerungen (z. B. roundcube-dovecot_client_ip Plugin) k\u00f6nnen Sie die aktuellen Anweisungen durchgehen und Ihre Konfiguration entsprechend anpassen bzw. die genannten Installationsschritte f\u00fcr neue Funktionalit\u00e4ten ausf\u00fchren.

      Insbesondere beachten Sie folgende Abschnitte:

      • Ofelia-Job f\u00fcr Roundcube-Aufr\u00e4umt\u00e4tigkeiten
      • Erm\u00f6glichen der Klartext-Authentifizierung f\u00fcr den php-fpm-Container ohne die Verwendung von TLS
      • \u00dcbermittlung der Client-Netzwerkadresse an Dovecot
      "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-roundcube-tabellen-aus-der-mailcow-datenbank","title":"Entfernen der Roundcube-Tabellen aus der mailcow-Datenbank","text":"

      Nachdem Sie sichergestellt haben, dass die Migration erfolgreich durchgef\u00fchrt wurde und Roundcube mit der getrennten Datenbank funktioniert, k\u00f6nnen Sie die Roundcube-Tabellen aus der mailcow-Datenbank mit dem folgenden Kommando entfernen:

      docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \\+/,/g');\"\n
      "},{"location":"de/troubleshooting/debug-admin_login_sogo/","title":"Admin-Anmeldung bei SOGo","text":"

      Dies ist eine experimentelle Funktion, die es Admins und Dom\u00e4nenadmins erlaubt, sich direkt als Mailbox-Benutzer bei SOGo anzumelden, ohne das Passwort des Benutzers zu kennen. Dazu wird ein zus\u00e4tzlicher Link zu SOGo in der Mailbox-Liste (mailcow UI) angezeigt.

      Auch mehrere gleichzeitige Admin-Logins auf verschiedene Postf\u00e4cher sind mit dieser Funktion m\u00f6glich.

      "},{"location":"de/troubleshooting/debug-admin_login_sogo/#aktivieren-der-funktion","title":"Aktivieren der Funktion","text":"

      Die Funktion ist standardm\u00e4\u00dfig deaktiviert. Es kann in der mailcow.conf durch Setzen aktiviert werden: 

      ALLOW_ADMIN_EMAIL_LOGIN=y\n
      und die betroffenen Container neu erstellen mit

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose up -d\n
      docker-compose up -d\n
      "},{"location":"de/troubleshooting/debug-admin_login_sogo/#nachteile-bei-aktivierung","title":"Nachteile bei Aktivierung","text":"
      • Jeder SOGo-Seiten-Load und jede Active-Sync-Anfrage verursacht eine zus\u00e4tzliche Ausf\u00fchrung eines internen PHP-Skripts. Dies kann die Ladezeiten von SOGo / EAS beeintr\u00e4chtigen. In den meisten F\u00e4llen sollte dies nicht sp\u00fcrbar sein, aber Sie sollten es im Hinterkopf behalten, wenn Sie Performance-Probleme haben.
      • SOGo zeigt keinen Logout-Link f\u00fcr Admin-Logins an, um sich normal anzumelden, muss man sich von der mailcow UI abmelden, so dass die PHP-Sitzung zerst\u00f6rt wird.
      • Das Abonnieren des Kalenders oder Adressbuchs eines anderen Nutzers, w\u00e4hrend man als Admin eingeloggt ist, funktioniert nicht. Ebenso wenig funktioniert das Einladen anderer Nutzer zu Kalender-Events. Die Seite wird neu geladen, wenn diese Dinge versucht werden.
      "},{"location":"de/troubleshooting/debug-admin_login_sogo/#technische-details","title":"Technische Details","text":"

      Die Option SOGoTrustProxyAuthentication ist auf YES gesetzt, so dass SOGo dem x-webobjects-remote-user-Header vertraut.

      Dovecot erh\u00e4lt ein zuf\u00e4lliges Master-Passwort, das f\u00fcr alle Mailboxen g\u00fcltig ist, wenn es vom SOGo-Container verwendet wird.

      Ein Klick auf den SOGo-Button in der Mailbox-Liste \u00f6ffnet die Datei sogo-auth.php, die Berechtigungen pr\u00fcft, Session-Variablen setzt und auf die SOGo-Mailbox umleitet.

      Jede SOGo, CardDAV, CalDAV und EAS http-Anfrage verursacht einen zus\u00e4tzlichen, nginx-internen auth_request-Aufruf an sogo-auth.php mit folgendem Verhalten:

      • Wenn ein basic_auth-Header vorhanden ist, wird das Skript die Anmeldedaten anstelle von SOGo validieren und die folgenden Header bereitstellen: x-webobjects-remote-user, Authorization und x-webobjects-auth-type.

      • Wenn kein basic_auth-Header vorhanden ist, wird das Skript nach einer aktiven mailcow-Admin-Sitzung f\u00fcr den angeforderten E-Mail-Benutzer suchen und die gleichen Header bereitstellen, aber mit dem Dovecot-Master-Passwort, das im Authorization-Header verwendet wird.

      • Wenn beides fehlschl\u00e4gt, werden die Header leer gesetzt, was SOGo dazu bringt, seine Standard-Authentifizierungsmethoden zu verwenden.

      Alle diese Optionen/Verhaltensweisen sind deaktiviert, wenn die Option ALLOW_ADMIN_EMAIL_LOGIN in der Konfiguration nicht aktiviert ist.

      "},{"location":"de/troubleshooting/debug-attach_service/","title":"In einen Container wechseln (CLI)","text":""},{"location":"de/troubleshooting/debug-attach_service/#anhangen-eines-containers-an-ihre-shell","title":"Anh\u00e4ngen eines Containers an Ihre Shell","text":"

      Um einen Container an Ihre Shell anzuh\u00e4ngen, k\u00f6nnen Sie einfach folgendes ausf\u00fchren

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec $Dienst_Name /bin/bash\n
      docker-compose exec $Dienst_Name /bin/bash\n
      "},{"location":"de/troubleshooting/debug-attach_service/#verbindung-zu-diensten-herstellen","title":"Verbindung zu Diensten herstellen","text":"

      Wenn Sie sich direkt mit einem Dienst / einer Anwendung verbinden wollen, ist es immer eine gute Idee, source mailcow.conf zu benutzen, um alle relevanten Variablen in Ihre Umgebung zu bekommen.

      "},{"location":"de/troubleshooting/debug-attach_service/#dienstbeschreibungen","title":"Dienstbeschreibungen","text":"

      Hier ist eine kurze \u00dcbersicht, welcher Container / Dienst was macht:

      Dienstname Dienstbeschreibungen unbound-mailcow Lokaler (DNSSEC) DNS-Aufl\u00f6ser mysql-mailcow Speichert die SOGo's und die meisten Einstellungen von mailcow postfix-mailcow Empf\u00e4ngt und sendet Mails dovecot-mailcow Benutzer-Logins und Siebfilter redis-mailcow Speicher-Backend f\u00fcr DKIM-Schl\u00fcssel und Rspamd rspamd-mailcow Mail-Filter-System. Verwendet f\u00fcr Av-Behandlung, DKIM-Signierung, Spam-Behandlung clamd-mailcow Scannt Anh\u00e4nge auf Viren olefy-mailcow Scannt angeh\u00e4ngte Office-Dokumente auf Makro-Viren solr-mailcow Bietet Volltextsuche in Dovecot sogo-mailcow Webmail-Client, der Microsoft ActiveSync und Cal- / CardDav verarbeitet nginx-mailcow Nginx Remote-Proxy, der alle mailcow-bezogenen HTTP / HTTPS-Anfragen bearbeitet acme-mailcow Automatisiert den Einsatz von HTTPS (SSL/TLS) Zertifikaten memcached-mailcow Internes Caching-System f\u00fcr mailcow-Dienste watchdog-mailcow Erm\u00f6glicht die \u00dcberwachung von Docker-Containern / Diensten php-fpm-mailcow Betreibt die mailcow Web UI netfilter-mailcow Fail2Ban \u00e4hnliche Integration"},{"location":"de/troubleshooting/debug-common_problems/","title":"H\u00e4ufig auftretende Probleme","text":"

      Hier sind h\u00e4ufige Probleme und m\u00f6gliche L\u00f6sungen:

      "},{"location":"de/troubleshooting/debug-common_problems/#mail-kommt-in-einer-schleife-zu-sich-selbst-zuruck","title":"Mail kommt in einer Schleife zu sich selbst zur\u00fcck.","text":"

      Bitte \u00fcberpr\u00fcfen Sie in Ihrer mailcow UI, ob Sie die Domain als Backup MX eingestellt haben:

      "},{"location":"de/troubleshooting/debug-common_problems/#ich-kann-mails-empfangen-aber-nicht-senden","title":"Ich kann Mails empfangen, aber nicht senden","text":"

      Es gibt viele Gr\u00fcnde, die Sie daran hindern k\u00f6nnen, Mails zu versenden:

      • Pr\u00fcfen Sie, ob Ihre IP-Adresse auf einer schwarzen Liste steht. Sie k\u00f6nnen dnsbl.info oder einen \u00e4hnlichen Dienst verwenden, um Ihre IP-Adresse zu \u00fcberpr\u00fcfen.
      • Es gibt einige ISP-Router, die Mail-Ports f\u00fcr nicht auf der Blacklist stehende Domains blockieren. Bitte \u00fcberpr\u00fcfen Sie, ob Sie Ihren Server \u00fcber die Ports 465 oder 587 erreichen k\u00f6nnen:
      # telnet 74.125.133.27 465\nVersucht 74.125.133.27...\nVerbunden mit 74.125.133.27.\nEscape-Zeichen ist '^]'.\n
      "},{"location":"de/troubleshooting/debug-common_problems/#meine-mails-werden-als-spam-identifiziert","title":"Meine Mails werden als Spam identifiziert","text":"

      Bitte lesen Sie unsere DNS-Konfiguration Anleitung.

      "},{"location":"de/troubleshooting/debug-common_problems/#docker-compose-wirft-seltsame-fehler-aus","title":"docker compose wirft seltsame Fehler aus.","text":"

      ... wie:

      • ERROR: Ung\u00fcltiges Interpolationsformat ...
      • AttributeError: 'NoneType' Objekt hat kein Attribut 'keys'.
      • ERROR: In der Datei './docker-compose.yml' hat der Dienst 'version' keine Konfigurationsoptionen.

      Wenn Sie eine oder \u00e4hnliche Meldungen erhalten, w\u00e4hrend Sie versuchen, mailcow: dockerized auszuf\u00fchren, \u00fcberpr\u00fcfen Sie bitte, ob Sie die aktuellste Version von Docker und docker compose haben.

      "},{"location":"de/troubleshooting/debug-common_problems/#container-xy-ist-ungesund","title":"Container XY ist ungesund","text":"

      Dieser Fehler versucht Ihnen mitzuteilen, dass eine der (Gesundheits-)Bedingungen f\u00fcr einen bestimmten Container nicht erf\u00fcllt ist. Daher kann er nicht gestartet werden. Dies kann verschiedene Gr\u00fcnde haben, der h\u00e4ufigste ist ein aktualisierter Git-Klon, aber ein altes Docker-Image oder umgekehrt.

      Auch eine falsch konfigurierte Firewall kann einen solchen Fehler verursachen. Die Container m\u00fcssen in der Lage sein, \u00fcber das Netzwerk 172.22.1.1/24 miteinander zu kommunizieren.

      Es k\u00f6nnte auch eine falsch verkn\u00fcpfte Datei sein (z. B. ein SSL-Zertifikat), die den Start eines wichtigen Containers (nginx) verhindert. Pr\u00fcfen Sie daher immer Ihre Protokolle, um herauszufinden, woher das Problem kommt.

      "},{"location":"de/troubleshooting/debug-common_problems/#adresse-bereits-in-gebrauch","title":"Adresse bereits in Gebrauch","text":"

      Wenn Sie eine Fehlermeldung erhalten wie:

      ERROR: for postfix-mailcow Cannot start service postfix-mailcow: driver failed programming external connectivity on endpoint mailcowdockerized_postfix-mailcow_1: Error starting userland proxy: listen tcp 0.0.0:25: bind: address already in use\n

      w\u00e4hrend Sie versuchen, mailcow: dockerized zu starten / zu installieren, stellen Sie sicher, dass Sie unseren Abschnitt \u00fcber prerequisites befolgt haben.

      "},{"location":"de/troubleshooting/debug-common_problems/#xyz-kann-keine-verbindung-zu","title":"XYZ kann keine Verbindung zu ...","text":"

      Bitte \u00fcberpr\u00fcfen Sie Ihre lokale Firewall! Docker und iptables-basierte Firewalls erstellen manchmal widerspr\u00fcchliche Regeln. Deaktivieren Sie daher die Firewall auf Ihrem Host, um festzustellen, ob Ihre Verbindungsprobleme durch solche Konflikte verursacht werden. Wenn dies der Fall ist, m\u00fcssen Sie manuell entsprechende Regeln in Ihrer Host-Firewall erstellen, um die erforderlichen Verbindungen zuzulassen.

      Wenn Sie Verbindungsprobleme von zu Hause aus haben, \u00fcberpr\u00fcfen Sie bitte auch die Firewall Ihres ISP-Routers, da einige von ihnen den E-Mail-Verkehr \u00fcber die Ports SMTP (587) oder SMTPS (465) blockieren. Es k\u00f6nnte auch sein, dass Ihr ISP die Ports f\u00fcr SUBMISSION (25) blockiert.

      W\u00e4hrend Linux-Benutzer aus einer Vielzahl von Tools1 w\u00e4hlen k\u00f6nnen, um zu \u00fcberpr\u00fcfen, ob ein Port offen ist, steht Windows-Benutzern standardm\u00e4\u00dfig nur der PowerShell-Befehl Test-NetConnection -ComputerName host -Port port zur Verf\u00fcgung.

      Um Telnet auf einem Windows nach Vista zu aktivieren, lesen Sie bitte diese Anleitung oder geben Sie den folgenden Befehl in einem Terminal mit Administratorrechten ein:

      dism /online /Enable-Feature /FeatureName:TelnetClient\n
      "},{"location":"de/troubleshooting/debug-common_problems/#inotify-instanz-limit-uberschritten-fur-benutzer-5000-uid-vmail-siehe-453","title":"Inotify-Instanz-Limit \u00fcberschritten f\u00fcr Benutzer 5000 (UID vmail) (siehe #453).","text":"

      Docker-Container verwenden die inotify-Limits von Docker-Hosts. Wenn Sie sie auf Ihrem Docker-Host setzen, werden sie an den Container weitergegeben.

      "},{"location":"de/troubleshooting/debug-common_problems/#dovecot-startet-standig-neu-siehe-2672","title":"Dovecot startet st\u00e4ndig neu (siehe #2672).","text":"

      Stellen Sie sicher, dass Sie mindestens die folgenden Dateien in data/assets/ssl haben:

      cert.pem\ndhparams.pem\nkey.pem\n

      Wenn dhparams.pem fehlt, k\u00f6nnen Sie es mit Bash

      openssl dhparam -out data/assets/ssl/dhparams.pem 4096\n
      "},{"location":"de/troubleshooting/debug-common_problems/#rspamd-meldet-cannot-open-hyperscan-cache-file-varlibrspamdhs-compiled-for-a-different-platform","title":"Rspamd meldet: cannot open hyperscan cache file /var/lib/rspamd/{...}.hs: compiled for a different platform","text":"

      Bei einer Migration von mailcow auf ein anderes System (meistens mit einer anderen CPU) kann es unter Umst\u00e4nden passieren, dass Rspamd meldet er k\u00f6nne einige (evtl. alle) .hs Dateien nicht laden, da diese f\u00fcr eine andere Plattform (CPU) kompiliert wurden.

      Dies h\u00e4ngt mit Hyperscan2 zusammen einer Intel Technik zum vorkompilieren von regex Schemata, welche Rspamd einsetzt.

      Diese Funktion bringt einen erheblichen Performance Boost mit sich und ist deswegen stark in Rspamd verankert.

      Um diesen Fehler zu beheben, m\u00fcssen alle .hs und .hsmp Dateien aus dem Rspamd Verzeichnis gel\u00f6scht werden:

      docker compose (Plugin)docker-compose (Standalone) 
      cd MAILCOW_ROOT # Meistens /opt/mailcow-dockerized\ndocker compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n
      cd MAILCOW_ROOT # Meistens /opt/mailcow-dockerized\ndocker-compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n

      Anschlie\u00dfend Rspamd neustarten mit:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Nun kompiliert Rspamd die besagten Regex Maps wieder neu mit Hyperscan.

      1. netcat, nmap, openssl, telnet, etc.\u00a0\u21a9

      2. Hyperscan \u21a9

      "},{"location":"de/troubleshooting/debug-logs/","title":"Logs","text":"

      Warnung

      Dieser Abschnitt gilt nur f\u00fcr Docker's Standard-Logging-Treiber (JSON).

      Um die Logs aller mailcow: dockerized bezogenen Container zu sehen, k\u00f6nnen Sie den folgenden Befehl innerhalb Ihres mailcow-dockerized Ordners verwenden, der Ihre mailcow.conf enth\u00e4lt:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs\n
      docker-compose logs\n

      Dies ist normalerweise ein bisschen viel, aber Sie k\u00f6nnen die Ausgabe mit --tail=100 auf die letzten 100 Zeilen pro Container k\u00fcrzen, oder ein -f hinzuf\u00fcgen, um die Live-Ausgabe aller Ihrer Dienste zu verfolgen.

      Um die Logs eines bestimmten Dienstes zu sehen, kann man folgendes verwenden:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose logs [options] $service_name\n
      docker-compose logs [options] $service_name\n

      Info

      Die verf\u00fcgbaren Optionen f\u00fcr den Befehl obrigen Befehlsind:

      • -no-color: Erzeugt eine einfarbige Ausgabe.
      • -f: Der Log-Ausgabe folgen.
      • -t: Zeitstempel anzeigen.
      • --tail=\"all \": Anzahl der Zeilen, die ab dem Ende der Protokolle f\u00fcr jeden Container angezeigt werden sollen.
      "},{"location":"de/troubleshooting/debug-mysql_aria/","title":"Abgest\u00fcrzte Aria-Speicher-Engine wiederherstellen","text":""},{"location":"de/troubleshooting/debug-mysql_aria/#mariadb-aria-wiederherstellung-nach-absturz","title":"MariaDB: Aria-Wiederherstellung nach Absturz","text":"

      Wenn Ihr Server abgest\u00fcrzt ist und MariaDB eine Fehlermeldung \u00e4hnlich [ERROR] mysqld: Aria recovery failed. Please run aria_chk -r on all Aria tables (*.MAI) and delete all aria_log.######## files, k\u00f6nnen Sie Folgendes versuchen, um die Datenbank in einen gesunden Zustand zu bringen:

      Starten Sie den Stack und warten Sie, bis mysql-mailcow beginnt, einen Neustart zu melden. \u00dcberpr\u00fcfen Sie dies, indem Sie den folgenden Befehl ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose ps\n
      docker-compose ps\n

      F\u00fchren Sie nun die folgenden Befehle aus:

      Stoppen Sie den Stack, nicht \"down\" ausf\u00fchren

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose stop\n
      docker-compose stop\n

      F\u00fchren Sie eine Bash in dem gestoppten Container als Benutzer mysql aus

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n
      docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n

      cd in das SQL-Datenverzeichnis 

      cd /var/lib/mysql\n

      aria_chk ausf\u00fchren 

      aria_chk --check --force */*.MAI\n
      L\u00f6schen der aria-Logdateien 
      rm aria_log.*\n

      F\u00fchren Sie nun einen kompletten Stack neustart durch:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down\ndocker compose up -d\n
      docker-compose down\ndocker-compose up -d\n
      "},{"location":"de/troubleshooting/debug-mysql_upgrade/","title":"Manuelles MySQL-Upgrade","text":""},{"location":"de/troubleshooting/debug-mysql_upgrade/#fuhren-sie-ein-manuelles-mysql_upgrade-durch","title":"F\u00fchren Sie ein manuelles mysql_upgrade durch.","text":"

      Dieser Schritt ist normalerweise nicht notwendig.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose stop mysql-mailcow watchdog-mailcow\ndocker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n
      docker-compose stop mysql-mailcow watchdog-mailcow\ndocker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n

      Sobald die SQL-Shell gestartet wurde, f\u00fchren Sie mysql_upgrade aus und verlassen den Container:

      mysql_upgrade\nexit\n
      "},{"location":"de/troubleshooting/debug-resend-quarantine-notifications/","title":"Erneutes Senden von Quarant\u00e4ne-Benachrichtigungen","text":"

      Um eine Quarant\u00e4ne Benachrichtigung erneut zu versenden geben Sie folgenden Befehl ein:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n
      docker-compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n

      Info

      Wir empfehlen die Verwendung dieses Befehles NUR zum debugging Prozess, da die Benachrichtigung im Normalfall automatisiert, anhand der pro Mailbox gesetzten Einstellungen, ausgel\u00f6st wird.

      "},{"location":"de/troubleshooting/debug-reset_pw/","title":"Passw\u00f6rter zur\u00fccksetzen (inkl. SQL)","text":""},{"location":"de/troubleshooting/debug-reset_pw/#mailcow-admin-konto","title":"mailcow Admin-Konto","text":"

      Setzt den mailcow Admin Account auf ein zuf\u00e4lliges Passwort zur\u00fcck. \u00c4ltere mailcow: dockerisierte Installationen k\u00f6nnen das mailcow-reset-admin.sh Skript in ihrem mailcow Stammverzeichnis (mailcow_path) finden.

      cd mailcow_pfad\n./helper-scripts/mailcow-reset-admin.sh\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#mysql-passworter-zurucksetzen","title":"MySQL-Passw\u00f6rter zur\u00fccksetzen","text":"

      Stoppen Sie den Stack, indem Sie den folgenden Befehl ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose stop\n
      docker-compose stop\n

      Wenn die Container heruntergefahren sind, f\u00fchren Sie diesen Befehl aus:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
      docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#1-datenbank-name-finden","title":"1. Datenbank-Name finden","text":"docker compose (Plugin)docker-compose (Standalone) 
      # source mailcow.conf\n# docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| information_schema |\n| mailcow_database | <=====\n| mysql |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
      # source mailcow.conf\n# docker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| information_schema |\n| mailcow_database | <=====\n| mysql |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#2-einen-oder-mehrere-benutzer-zurucksetzen","title":"2. Einen oder mehrere Benutzer zur\u00fccksetzen","text":""},{"location":"de/troubleshooting/debug-reset_pw/#21-maria-db-104-altere-mailcow-installationen","title":"2.1 Maria DB < 10.4 (\u00e4ltere mailcow-Installationen)","text":"

      Sowohl \"password\" als auch \"authentication_string\" existieren. Derzeit wird \"password\" verwendet, aber besser ist es, beide zu setzen.

      MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user |\n+--------------+\n| mailcow | <=====\n| root |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('gotr00t'), password = PASSWORD('gotr00t') WHERE User = 'root';\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('mookuh'), password = PASSWORD('mookuh') WHERE User = 'mailcow' AND Host = '%';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#22-maria-db-104-aktuelle-mailcows","title":"2.2 Maria DB >= 10.4 (aktuelle mailcows)","text":"
      MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user |\n+--------------+\n| mailcow | <=====\n| root |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> ALTER USER 'mailcow'@'%' IDENTIFIED BY 'mookuh';\nMariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t'; MariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t'; MariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#zwei-faktor-authentifizierung-entfernen","title":"Zwei-Faktor-Authentifizierung entfernen","text":""},{"location":"de/troubleshooting/debug-reset_pw/#fur-mailcow-webui","title":"F\u00fcr mailcow WebUI:","text":"

      Dies funktioniert \u00e4hnlich wie das Zur\u00fccksetzen eines MySQL-Passworts, jetzt machen wir es vom Host aus, ohne uns mit dem MySQL CLI zu verbinden:

      docker compose (Plugin)docker-compose (Standalone) 
      source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
      source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
      "},{"location":"de/troubleshooting/debug-reset_pw/#fur-sogo","title":"F\u00fcr SOGo:","text":"docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
      docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
      "},{"location":"de/troubleshooting/debug-reset_tls/","title":"TLS-Zertifikate zur\u00fccksetzen","text":"

      Sollten Sie Probleme mit Ihrem Zertifikat, Schl\u00fcssel oder Let's Encrypt-Konto haben, versuchen Sie bitte, die TLS-Assets zur\u00fcckzusetzen:

      source mailcow.conf\ndocker compose down\nrm -rf data/assets/ssl\nmkdir data/assets/ssl\nopenssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl-example/key.pem -out data/assets/ssl-example/cert.pem -days 365 -subj \"/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${MAILCOW_HOSTNAME}\" -sha256 -nodes\ncp -n -d data/assets/ssl-example/*.pem data/assets/ssl/\ndocker compose up -d\n

      Dies wird mailcow stoppen, die ben\u00f6tigten Variablen beschaffen, ein selbstsigniertes Zertifikat erstellen und mailcow starten.

      Wenn Sie Let's Encrypt verwenden, sollten Sie vorsichtig sein, da Sie ein neues Konto und einen neuen Satz von Zertifikaten erstellen werden. Sie werden fr\u00fcher oder sp\u00e4ter auf ein Ratelimit sto\u00dfen.

      Bitte beachten Sie auch, dass fr\u00fchere TLSA-Datens\u00e4tze ung\u00fcltig werden.

      "},{"location":"de/troubleshooting/debug-rm_volumes/","title":"Persistente Daten l\u00f6schen","text":"

      Es kann sein, dass Sie einen Satz persistenter Daten entfernen wollen, um einen Konflikt zu l\u00f6sen oder um neu zu beginnen.

      mailcowdockerized kann variieren und h\u00e4ngt von Ihrem Compose-Projektnamen ab (wenn er unver\u00e4ndert ist, ist mailcowdockerized der richtige Wert). Wenn Sie sich unsicher sind, f\u00fchren Sie docker volume ls aus, um eine vollst\u00e4ndige Liste zu erhalten.

      L\u00f6schen Sie ein einzelnes Volume:

      docker volume rm mailcowdockerized_${VOLUME_NAME}\n
      • Entfernen Sie Volume mysql-vol-1, um alle MySQL-Daten zu entfernen.
      • Entfernen Sie Volume redis-vol-1 um alle Redis Daten zu entfernen.
      • Volume vmail-vol-1 entfernen, um alle Inhalte von /var/vmail zu entfernen, die in dovecot-mailcow eingebunden sind.
      • Entfernen Sie das Volume rspamd-vol-1, um alle Rspamd-Daten zu entfernen.
      • Entfernen Sie Volume crypt-vol-1, um alle Crypto-Daten zu entfernen. Dies wird alle Mails unlesbar machen.

      Alternativ dazu wird die Ausf\u00fchrung des folgenden Befehles alle mailcow: dockerized volumes zerst\u00f6ren und alle zugeh\u00f6rigen Container und Netzwerke l\u00f6schen:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down -v\n
      docker-compose down -v\n
      "},{"location":"de/troubleshooting/debug-rspamd_memory_leaks/","title":"Fortgeschritten: Memory-Leaks in Rspamd finden","text":"

      Eine kurze Anleitung, um einen schlecht funktionierenden Rspamd tiefgehend zu analysieren.

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# F\u00fcgen Sie vor \"exec \"$@\"\" die folgenden Zeilen ein:\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n
      docker-compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# F\u00fcgen Sie vor \"exec \"$@\"\" die folgenden Zeilen ein:\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n

      Starten Sie Rspamd neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Ihr Speicherverbrauch wird stark ansteigen, er wird auch stetig wachsen, was nicht mit einem m\u00f6glichen Memory Leak zusammenh\u00e4ngt, nach dem Sie suchen.

      Lassen Sie den Container f\u00fcr ein paar Minuten, Stunden oder Tage laufen (es sollte die Zeit sein, die Sie normalerweise warten, bis der Memory Leak \"passiert\") und starten Sie ihn neu:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart rspamd-mailcow\n
      docker-compose restart rspamd-mailcow\n

      Betreten Sie nun den Container, indem Sie den folgenden Befehl ausf\u00fchren:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec rspamd-mailcow bash\n
      docker-compose exec rspamd-mailcow bash\n

      Wechseln Sie das Verzeichnis zu /tmp und kopieren Sie die asan-Dateien an den gew\u00fcnschten Ort oder laden Sie sie \u00fcber termbin.com hoch (cat /tmp/rspamd-asan.* | nc termbin.com 9999).

      "},{"location":"de/troubleshooting/debug/","title":"Einf\u00fchrung","text":"

      Wenn ein Problem auftritt, dann immer aus einem bestimmten Grund! Was Sie in einem solchen Fall tun sollten, ist:

      1. Lesen Sie Ihre Logs; verfolgen Sie sie, um herauszufinden, was der Grund f\u00fcr Ihr Problem ist.
      2. Folgen Sie den Hinweisen in Ihren Logdateien und beginnen Sie mit der Untersuchung.
      3. Starten Sie den gest\u00f6rten Dienst oder den gesamten Stack neu, um zu sehen, ob das Problem weiterhin besteht.
      4. Lesen Sie die Dokumentation des gest\u00f6rten Dienstes und suchen Sie in dessen Bugtracker nach Ihrem Problem.
      5. Durchsuchen Sie unsere Github Issues nach Ihrem Problem.
      6. Erstelle einen Github Issue in unserem GitHub Repository, wenn Sie glauben, dass Ihr Problem ein Fehler oder eine fehlende Funktion ist, die Sie dringend ben\u00f6tigen. Bitte stellen Sie aber sicher, dass Sie alle Logs und eine vollst\u00e4ndige Beschreibung Ihres Problems mitschicken. Bitte fragen Sie nicht nach Support auf Github.
      7. Treten Sie unserer Telegram-Community bei oder finden Sie die offiziellen Support-Pakete bei Servercow. Alternativ fragen Sie Twitter um Rat und taggen uns mit @mailcow_email.
      "}]} \ No newline at end of file +{"config":{"lang":["en","de"],"separator":"[\\s\\-,:!=\\[\\]()\"/]+|(?!\\b)(?=[A-Z][a-z])|\\.(?!\\d)|&[lg]t;","pipeline":["stemmer","stopWordFilter","trimmer"]},"docs":[{"location":"","title":"Information & Support","text":""},{"location":"#mailcow-dockerized-","title":"mailcow: dockerized - + =","text":"

      The mailserver suite with the 'moo'

      "},{"location":"#what-is-mailcow-dockerized","title":"What is mailcow: dockerized?","text":"

      Question

      Mailcow, MailCow or mailcow? What is the exact name of the project?

      Correct: mailcow, because mailcow is a registered word mark with a small m

      mailcow: dockerized is an open source groupware/email suite based on docker.

      mailcow relies on many well known and long used components, which in combination result in an all around carefree email server.

      Each container represents a single application, connected in a bridged network:

      • ACME Automatic generation of Let's Encrypt certificates
      • ClamAV Antivirus scanner (optional)
      • Dovecot IMAP/POP server for retrieving e-mails with integrated Full-Text Search Engine \"Flatcurve\"
      • MariaDB Database for storing user information etc.
      • Memcached Cache for the webmailer SOGo
      • Netfilter Fail2ban-like integration of @mkuron
      • Nginx Web server for components of the stack
      • Olefy Analysis of Office documents for viruses, macros, etc.
      • PHP Programming language of most web-based mailcow applications
      • Postfix MTA (Mail Transfer Agent) for e-mail traffic on the Internet
      • Redis Storage for spam information, DKIM key, etc.
      • Rspamd Spam filter with automatic learning of spam mails
      • SOGo Integrated webmailer and Cal-/Carddav interface
      • Solr Full text search for IMAP connections to quickly search emails (Deprecated) (Optional)
      • Unbound Integrated DNS server for verifying DNSSEC etc.
      • Watchdog For basic monitoring of the container status within mailcow

      But the heart of mailcow is the graphical web interface, the mailcow UI.

      It offers a place for almost all settings and allows the comfortable creation of new domains and email addresses with just a few clicks.

      But also other or more tricky tasks can be done in it with ease:

      • DKIM and ARC support/generation.
      • Black and white lists per domain and per user.
      • Spam score management per user (reject spam, flag spam, greylist).
      • Allow mailbox users to create temporary spam aliases
      • Prepend email tags to subject or move emails to subfolders (per user)
      • Allow mailbox users to toggle TLS enforcement for inbound and outbound messages
      • Users can reset caches on SOGo ActiveSync devices
      • imapsync to periodically migrate or retrieve remote mailboxes
      • TFA: Yubikey OTP and WebAuthn USB (Google Chrome and derivatives only), TOTP
      • Add whitelist hosts to forward mail to mailcow
      • Fail2ban-like integration
      • Quarantine system
      • Anti-virus scanning including macro scanning in Office documents
      • Integrated basic monitoring
      • And much more...

      The mailcow data (such as emails, user data, etc.) is stored in Docker volumes - take good care of these volumes:

      • clamd-db-vol-1
      • crypt-vol-1
      • mysql-socket-vol-1
      • mysql-vol-1
      • postfix-vol-1
      • redis-vol-1
      • rspamd-vol-1
      • sogo-userdata-backup-vol-1
      • sogo-web-vol-1
      • solr-vol-1
      • vmail-index-vol-1
      • vmail-vol-1

      Warning

      The mails are compressed and encrypted. The key pair can be found in crypt-vol-1. Please don't forget to backup this and other volumes. #nobackupnopity

      "},{"location":"#support-the-mailcow-project","title":"Support the mailcow project","text":"

      Please consider a support contract for a small monthly fee at Servercow1 to support further development. We support you while you support us. :)

      If you are super awesome and would like to support without a contract, you can get a SAL (Stay-Awesome License) that confirms your awesomeness (a flexible one-time payment) at Servercow.

      "},{"location":"#need-help","title":"Need help?","text":"

      There are two ways to achieve support for your mailcow installation.

      "},{"location":"#commercial-support","title":"Commercial support","text":"

      For professional and prioritized commercial support you can sign a basic support subscription at Servercow. For custom inquiries or questions please contact us at info@servercow.de instead.

      Furthermore we do also provide a fully featured and managed mailcow here. This way we take care about the technical magic underneath and you can enjoy your whole mail experience in a hassle-free way.

      "},{"location":"#community-support-and-chat","title":"Community support and chat","text":"

      The other alternative is our free community-support on our various channels below. Please notice, that this support is driven by our awesome community around mailcow. This kind of support is best-effort, voluntary and there is no guarantee for anything.

      • mailcow Community @ community.mailcow.email

      • Telegram (Support) @ t.me/mailcow

      • Telegram (Off-Topic) @ t.me/mailcowOfftopic

      Telegram desktop clients are available for multiple platforms. You can search the groups history for keywords.

      For bug tracking, feature requests and code contributions only:

      • mailcow/mailcow-dockerized @ GitHub
      "},{"location":"#news-and-release-informations","title":"News and release informations","text":"

      For announcements and release informations you can find us on:

      • mailcow @ X/Twitter

      • @doncow @ mailcow.social

      Or alternatively on our blog:

      • mailcow.email
      "},{"location":"#interested-try-it-out-right-away","title":"Interested? Try it out right away!","text":"

      Have we got your interest? Get a first overview of the functionalities of mailcow and your mailcow UI in our official mailcow demos!

      We\u00b4re providing two seperate Demo instances:

      • demo.mailcow.email is the classic Demo based on the stable releases.
      • nightly-demo.mailcow.email is the new nightly demo based on unreleased testing features. (So especially interesting for those who have no possibility to create a test instance themselves.)

      Use these credentials for the demos

      • Administrator: admin / moohoo
      • Domain-Administrator: department / moohoo
      • Mailbox: demo@440044.xyz / moohoo

      The login credentials work for both variants.

      Always up to date

      The demo instances get the latest updates directly after releases from GitHub. Fully automatic, without any downtime!

      1. Servercow is a hosting/support division of The Infrastructure Company GmbH (mailcow maintainer).\u00a0\u21a9

      "},{"location":"backup_restore/b_n_r-accidental_deletion/","title":"Recover accidentally deleted data","text":"

      So you deleted a mailbox and have no backups, he?

      If you noticed your mistake within a few hours, you can probably recover the users data.

      "},{"location":"backup_restore/b_n_r-accidental_deletion/#sogo","title":"SOGo","text":"

      We automatically create daily backups (24h interval starting from running up -d) in /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/.

      Make sure the user you want to restore exists in your mailcow. Re-create them if they are missing.

      Copy the file named after the user you want to restore to __MAILCOW_DIRECTORY__/data/conf/sogo.

      1. Copy the backup: cp /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/restoreme@example.org __MAILCOW_DIRECTORY__/data/conf/sogo

      2. Run the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n
        docker-compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n

        Run sogo-tool without parameters to check for possible restore options.

      3. Delete the copied backup by running rm __MAILCOW_DIRECTORY__/data/conf/sogo

      4. Restart SOGo and Memcached:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose restart sogo-mailcow memcached-mailcow\n
      docker-compose restart sogo-mailcow memcached-mailcow\n
      "},{"location":"backup_restore/b_n_r-accidental_deletion/#mail","title":"Mail","text":"

      In case of an accidental deletion of a mailbox, you will be able to recover for (by default) 5 days. This depends on the MAILDIR_GC_TIME parameter in mailcow.conf.

      A deleted mailbox is copied in its encrypted form to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage.

      The folder inside _garbage follows the structure [timestamp]_[domain_sanitized][user_sanitized], for example 1629109708_exampleorgtest in case of test@example.org deleted on 1629109708.

      To restore make sure you are actually restoring to the same mailcow it was deleted from or you use the same encryption keys in crypt-vol-1.

      Make sure the user you want to restore exists in your mailcow. Re-create them if they are missing.

      Copy the folders from /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage/[timestamp]_[domain_sanitized][user_sanitized] back to /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/[domain]/[user] and resync the folder and recalc the quota:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
      docker-compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker-compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
      "},{"location":"backup_restore/b_n_r-backup/","title":"Backup","text":""},{"location":"backup_restore/b_n_r-backup/#backup","title":"Backup","text":""},{"location":"backup_restore/b_n_r-backup/#manual","title":"Manual","text":"

      You can use the provided script helper-scripts/backup_and_restore.sh to backup mailcow automatically.

      Danger

      Please do not copy this script to another location.

      To run a backup, write \"backup\" as first parameter and either one or more components to backup as following parameters. You can also use \"all\" as second parameter to backup all components. Append --delete-days n to delete backups older than n days.

      # Syntax:\n# ./helper-scripts/backup_and_restore.sh backup (vmail|crypt|redis|rspamd|postfix|mysql|all|--delete-days)\n\n# Backup all, delete backups older than 3 days\n./helper-scripts/backup_and_restore.sh backup all --delete-days 3\n\n# Backup vmail, crypt and mysql data, delete backups older than 30 days\n./helper-scripts/backup_and_restore.sh backup vmail crypt mysql --delete-days 30\n\n# Backup vmail\n./helper-scripts/backup_and_restore.sh backup vmail\n
      "},{"location":"backup_restore/b_n_r-backup/#variables-for-backuprestore-script","title":"Variables for backup/restore script","text":""},{"location":"backup_restore/b_n_r-backup/#multithreading","title":"Multithreading","text":"

      With the 2022-10 update it is possible to run the script with multithreading support. This can be used for backups as well as for restores.

      To start the backup/restore with multithreading you have to add THREADS as an environment variable in front of the command to execute the script.

      THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n
      The number after the = character indicates the number of threads. Please keep your core count -2 to leave enough CPU power for mailcow itself.

      "},{"location":"backup_restore/b_n_r-backup/#backup-path","title":"Backup path","text":"

      The script will ask you for a backup location. Inside of this location it will create folders in the format \"mailcow_DATE\". You should not rename those folders to not break the restore process.

      To run a backup unattended, define MAILCOW_BACKUP_LOCATION as environment variable before starting the script:

      MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

      Tip

      Both variables mentioned above can also be combined! Ex:\n```\nMAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n```\n
      "},{"location":"backup_restore/b_n_r-backup/#cronjob","title":"Cronjob","text":"

      You can run the backup script regularly via cronjob. Make sure BACKUP_LOCATION exists:

      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n5 4 * * * cd /opt/mailcow-dockerized/; MAILCOW_BACKUP_LOCATION=/mnt/mailcow_backups /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n

      Per default cron sends the full result of each backup operation by email. If you want cron to only mail on error (non-zero exit code) you may want to use the following snippet. Pathes need to be modified according to your setup (this script is a user contribution).

      This following script may be placed in /etc/cron.daily/mailcow-backup - do not forget to mark it as executable via chmod +x:

      #!/bin/sh\n\n# Backup mailcow data\n# https://docs.mailcow.email/backup_restore/b_n_r-backup/\n\nset -e\n\nOUT=\"$(mktemp)\"\nexport MAILCOW_BACKUP_LOCATION=\"/opt/backup\"\nSCRIPT=\"/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh\"\nPARAMETERS=\"backup all\"\nOPTIONS=\"--delete-days 30\"\n\n# run command\nset +e\n\"${SCRIPT}\" ${PARAMETERS} ${OPTIONS} 2>&1 > \"$OUT\"\nRESULT=$?\n\nif [ $RESULT -ne 0 ]\n    then\n            echo \"${SCRIPT} ${PARAMETERS} ${OPTIONS} encounters an error:\"\n            echo \"RESULT=$RESULT\"\n            echo \"STDOUT / STDERR:\"\n            cat \"$OUT\"\nfi\n
      "},{"location":"backup_restore/b_n_r-backup/#backup-strategy-with-rsync-and-mailcow-backup-script","title":"Backup strategy with rsync and mailcow backup script","text":"

      Create the destination directory for mailcows helper script: 

      mkdir -p /external_share/backups/backup_script\n

      Create cronjobs: 

      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n25 1 * * * rsync -aH --delete /opt/mailcow-dockerized /external_share/backups/mailcow-dockerized\n40 2 * * * rsync -aH --delete /var/lib/docker/volumes /external_share/backups/var_lib_docker_volumes\n5 4 * * * cd /opt/mailcow-dockerized/; BACKUP_LOCATION=/external_share/backups/backup_script /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n# If you want to, use the acl util to backup permissions of some/all folders/files: getfacl -Rn /path\n

      On the destination (in this case /external_share/backups) you may want to have snapshot capabilities (ZFS, Btrfs etc.). Snapshot daily and keep for n days for a consistent backup. Do not rsync to a Samba share, you need to keep the correct permissions!

      To restore you'd simply need to run rsync the other way round and restart Docker to re-read the volumes. Run:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose pull\ndocker compose up -d\n
      docker-compose pull\ndocker-compose up -d\n

      If you are lucky Redis and MariaDB can automatically fix the inconsistent databases (if they are inconsistent). In case of a corrupted database you'd need to use the helper script to restore the inconsistent elements. If a restore fails, try to extract the backups and copy the files back manually. Keep the file permissions!

      "},{"location":"backup_restore/b_n_r-backup_restore-maildir/","title":"Maildir","text":""},{"location":"backup_restore/b_n_r-backup_restore-maildir/#backup","title":"Backup","text":"

      This line backups the vmail directory to a file backup_vmail.tar.gz in the mailcow root directory:

      docker compose (Plugin)docker-compose (Standalone) 
      cd /path/to/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n
      cd /path/to/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n

      You can change the path by adjusting ${PWD} (which equals to the current directory) to any path you have write-access to. Set the filename backup_vmail.tar.gz to any custom name, but leave the path as it is. Example: [...] tar cvfz /backup/my_own_filename_.tar.gz

      "},{"location":"backup_restore/b_n_r-backup_restore-maildir/#restore","title":"Restore","text":"docker compose (Plugin)docker-compose (Standalone) 
      cd /path/to/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
      cd /path/to/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
      "},{"location":"backup_restore/b_n_r-backup_restore-mysql/","title":"MySQL (mysqldump)","text":""},{"location":"backup_restore/b_n_r-backup_restore-mysql/#backup","title":"Backup","text":"docker compose (Plugin)docker-compose (Standalone) 
      cd /path/to/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
      cd /path/to/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker-compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
      "},{"location":"backup_restore/b_n_r-backup_restore-mysql/#restore","title":"Restore","text":"

      Warning

      docker compose (Plugin)docker-compose (Standalone)

      You should redirect the SQL dump without docker compose to prevent parsing errors.

      You should redirect the SQL dump without docker-compose to prevent parsing errors.

      cd /path/to/mailcow-dockerized\nsource mailcow.conf\ndocker exec -i $(docker compose ps -q mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < backup_file.sql\n
      "},{"location":"backup_restore/b_n_r-coldstandby/","title":"Cold-standby backup","text":"

      mailcow offers an easy way to create a consistent copy of itself to be rsync'ed to a remote location without downtime.

      This may also be used to transfer your mailcow to a new server.

      "},{"location":"backup_restore/b_n_r-coldstandby/#you-should-know","title":"You should know","text":"

      The provided script will work on default installations.

      It may break when you use unsupported volume overrides. We don't support that and we will not include hacks to support that. Please run and maintain a fork if you plan to keep your changes.

      The script will use the same paths as your default mailcow installation. That is the mailcow base directory - for most users /opt/mailcow-dockerized - as well as the mountpoints.

      To find the paths of your source volumes we use docker inspect and read the destination directory of every volume related to your mailcow compose project. This means we will also transfer volumes you may have added in an override file. Local bind mounts may or may not work.

      The script uses rsync with the --delete flag. The destination will be an exact copy of the source.

      mariabackup is used to create a consistent copy of the SQL data directory.

      After rsync'ing the data we will run the command below (depending on your set docker compose type in mailcow.conf) and remove old image tags from the destination:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose pull\n
      docker-compose pull\n

      Your source will not be changed at any time.

      You may want to make sure to use the same /etc/docker/daemon.json on the remote target.

      You should not run disk snapshots (e.g. via ZFS, LVM etc.) on the target at the very same time as this script is run.

      Versioning is not part of this script, we rely on the destination (snapshots or backups). You may also want to use any other tool for that.

      "},{"location":"backup_restore/b_n_r-coldstandby/#prepare","title":"Prepare","text":"

      You will need an SSH-enabled destination and a keyfile to connect to said destination. The key should not be protected by a password for the script to work unattended.

      In your mailcow base directory, e.g. /opt/mailcow-dockerized you will find a file create_cold_standby.sh.

      Edit this file and change the exported variables:

      export REMOTE_SSH_KEY=/path/to/keyfile\nexport REMOTE_SSH_PORT=22\nexport REMOTE_SSH_HOST=mailcow-backup.host.name\n

      The key must be owned and readable by root only.

      Both the source and destination require rsync >= v3.1.0. The destination must have Docker and docker compose v2 available.

      The script will detect errors automatically and exit.

      You may want to test the connection by running ssh mailcow-backup.host.name -p22 -i /path/to/keyfile.

      Important for switching to a different architecture

      If you plan to use the Cold Standby script to migrate from x86 to ARM64 or vice versa, simply let the script run normally. The script will automatically recognize whether there are differences between the source and the target in terms of architecture and will behave accordingly and omit affected volumes from the sync.

      The reason for this is that Rspamd compiles regexp entries from our configurations to the corresponding platform and these cache files cannot be read when changing platforms. Rspamd would then crash and make it impossible to use mailcow in a meaningful way. Therefore the rspamd-vol-1 (Rspamd volume) will be ommited during the usage of the Cold-standby script.

      Don't worry! Rspamd will still work correctly after the migration as it generates these cache files automatically for the new platform.

      "},{"location":"backup_restore/b_n_r-coldstandby/#backup-and-refresh-the-cold-standby","title":"Backup and refresh the cold-standby","text":"

      Run the first backup, this may take a while depending on the connection:

      bash /opt/mailcow-dockerized/create_cold_standby.sh\n

      That was easy, wasn't it?

      Updating your cold-standby is just as easy:

      bash /opt/mailcow-dockerized/create_cold_standby.sh\n

      It's the same command.

      "},{"location":"backup_restore/b_n_r-coldstandby/#automated-backups-with-cron","title":"Automated backups with cron","text":"

      First make sure that the cron service is enabled and running:

      systemctl enable cron.service && systemctl start cron.service\n

      To automate the backups to the cold-standby server you can use a cron job. To edit the cron jobs for the root user run:

      crontab -e\n

      Add the following lines to synchronize the cold standby server daily at 03:00. In this example errors of the last execution are logged into a file.

      PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n0 3 * * * bash /opt/mailcow-dockerized/create_cold_standby.sh 2> /var/log/mailcow-coldstandby-sync.log\n

      If saved correctly, the cron job should be shown by typing:

      crontab -l\n
      "},{"location":"backup_restore/b_n_r-restore/","title":"Restore","text":""},{"location":"backup_restore/b_n_r-restore/#restore","title":"Restore","text":""},{"location":"backup_restore/b_n_r-restore/#variables-for-backuprestore-script","title":"Variables for backup/restore script","text":""},{"location":"backup_restore/b_n_r-restore/#multithreading","title":"Multithreading","text":"

      With the 2022-10 update it is possible to run the script with multithreading support. This can be used for backups as well as for restores.

      To start the backup/restore with multithreading you have to add THREADS as an environment variable in front of the command to execute the script.

      THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n
      The number after the = character indicates the number of threads. Please keep your core count -2 to leave enough CPU power for mailcow itself.

      "},{"location":"backup_restore/b_n_r-restore/#backup-path","title":"Backup path","text":"

      The script will ask you for a backup location. Inside of this location it will create folders in the format \"mailcow_DATE\". You should not rename those folders to not break the restore process.

      To run a backup unattended, define MAILCOW_BACKUP_LOCATION as environment variable before starting the script:

      MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

      Tip

      Both variables mentioned above can also be combined! Ex: 

      MAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

      "},{"location":"backup_restore/b_n_r-restore/#restoring-data","title":"Restoring Data","text":"

      Danger

      Please do not copy this script to another location.

      Warning

      To restore a backup on a new system, mailcow must be initialized and running! Therefore, reinstall mailcow according to the instructions and wait to proceed with the restoration until mailcow is up and running in an empty state.

      Danger for older installations

      Before restoring your mailcow system on a new server and a clean mailcow-dockerized folder, please check if the value MAILDIR_SUB is set in your mailcow.conf. If this value is not set, do not set it in your new mailcow or remove it, otherwise NO emails will be displayed. Dovecot loads emails from the mentioned subfolder of the Maildir volume under $DOCKER_VOLUME_PATH/mailcowdockerized_vmail-vol-1 and if there is any change compared to the original state, no emails will be available there.

      To run a restore, start mailcow, use the script with \"restore\" as first parameter.

      # Syntax:\n# ./helper-scripts/backup_and_restore.sh restore\n

      The script will ask you for a backup location containing the mailcow_DATE folders:

      Backup location (absolute path, starting with /): /opt/backup\n

      All available backups in the specified folder (in our example /opt/backup) are then displayed:

      Found project name mailcowdockerized\n[ 1 ] - /opt/backup/mailcow-2023-12-11-13-27-14/\n[ 2 ] - /opt/backup/mailcow-2023-12-11-14-02-06/\n

      Now you can enter the number of your backup that you want to restore, in this example the 2nd backup:

      Select a restore point: 2\n

      The script will now display all the backed up components that you can restore, in our case we have selected all for the backup process, so this will now appear here:

      [ 0 ] - all\n[ 1 ] - Crypt data\n[ 2 ] - Rspamd data\n[ 3 ] - Mail directory (/var/vmail)\n[ 4 ] - Redis DB\n[ 5 ] - Postfix data\n[ 6 ] - SQL DB\n

      Again, we select the component that we want to restore. Option 0 restores EVERYTHING.

      If you want to restore to a different architecture...

      If you have made the backup on a different architecture, e.g. x86, and now want to restore this backup to ARM64, the backup of Rspamd is displayed as incompatible and cannot be selected individually. When restoring with the 0 key, the restoration of Rspamd is also skipped.

      Example of incompatible Rspamd backup in the selection menu:

      [...]\n[ NaN ] - Rspamd data (incompatible Arch, cannot restore it)\n[...]\n

      Now mailcow will restore the backups you have selected. Please note that the restoration may take some time, depending on the size of the backups.

      "},{"location":"client/client-android/","title":"Android","text":"
      1. Open the Email app.
      2. If this is your first email account, tap Add Account; if not, tap More and Settings and then Add account.
      3. Select Microsoft Exchange ActiveSync.
      4. Enter your email address () and password.
      5. Tap Sign in.
      "},{"location":"client/client-apple/","title":"Apple macOS / iOS","text":""},{"location":"client/client-apple/#method-1-configuration-profile","title":"Method 1: Configuration Profile","text":"

      Email, contacts and calendars can be configured automatically on Apple devices by installing a configuration profile. To download such a profile you must login to the mailcow UI with the desired email account first.

      "},{"location":"client/client-apple/#method-11-imap-and-smtp","title":"Method 1.1: IMAP and SMTP","text":"

      This method configures IMAP and SMTP to access an email account.

      1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_emailmailcow.mobileconfig to download a customized configuration profile.
      2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
        • Steps for macOS
        • Steps for iOS
      3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
      "},{"location":"client/client-apple/#method-12-imap-smtp-and-calcarddav","title":"Method 1.2: IMAP, SMTP and Cal/CardDAV","text":"

      This method configures CardDAV (address book) and CalDAV (calendar) in addition to the email account.

      1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.phpmailcow.mobileconfig to download a customized configuration profile.
      2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
        • Steps for macOS
        • Steps for iOS
      3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
      "},{"location":"client/client-apple/#method-13-imap-and-smtp-with-app-password","title":"Method 1.3: IMAP and SMTP with App Password","text":"

      This method configures IMAP and SMTP to access an email account. A new app password is generated and added to the profile so that no password needs to be entered when setting up your device. Please do not share the file as it grants full access to your mailbox.

      1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_passwordmailcow.mobileconfig to download a customized configuration profile.
      2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
        • Steps for macOS
        • Steps for iOS
      3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
      "},{"location":"client/client-apple/#method-14-imap-smtp-and-calcarddav-with-app-password","title":"Method 1.4: IMAP, SMTP and Cal/CardDAV with App Password","text":"

      This method configures CardDAV (address book) and CalDAV (calendar) in addition to the email account. A new app password is generated and added to the profile so that no password needs to be entered when setting up your device. Please do not share the file as it grants full access to your mailbox.

      1. Open https://${MAILCOW_HOSTNAME}/mobileconfig.php?app_passwordmailcow.mobileconfig to download a customized configuration profile.
      2. Open the profile on your Mac, iPhone or iPad and follow Apple's instructions for your operating system version to install the profile:
        • Steps for macOS
        • Steps for iOS
      3. Since the profile is not digitally signed, you must confirm the respective notification during installation. Enter the password for your email account when asked.
      "},{"location":"client/client-apple/#method-2-exchange-activesync-emulation","title":"Method 2: Exchange ActiveSync emulation","text":"

      On iOS/iPadOS, Exchange ActiveSync is also supported as an alternative to the procedure above. It has the advantage of supporting push email (i.e. you are immediately notified of incoming messages), but has some limitations, e.g. it does not support more than three email addresses per contact in your address book. Follow the steps below if you decide to use Exchange instead.

      1. Follow Apple's instructions for your version of iOS/iPadOS and select Microsoft Exchange as email service.
      2. Enter your email address () and tap Next.
      3. Select Manual Configuration when asked if your mail address should be sent to Microsoft.
      4. Enter your password, tap Next again. With Two-factor authentication enabled, you have to use an app password instead of your regular password.
      5. Finally, tap Save.
      "},{"location":"client/client-emclient/","title":"eM Client","text":"
      1. Launch eM Client.
      2. If this is the first time you launched eM Client, it asks you to set up your account. Proceed to step 4.
      3. Go to Menu at the top, select Tools and Accounts.
      4. Enter your email address () and click Start Now.
      5. Enter your password and click Continue.
      6. Enter your name () and click Next.
      7. Click Finish.
      "},{"location":"client/client-kontact/","title":"KDE Kontact","text":"
      1. Launch Kontact.
      2. If this is the first time you launched Kontact or KMail, it asks you to set up your account. Proceed to step 4.
      3. Go to Mail in the sidebar. Go to the Tools menu and select Account Wizard.
      4. Enter your name (), email address () and your password. Click Next.
      5. Click Create Account. If prompted, re-enter your password and click OK.
      6. Close the window by clicking Finish.
      7. Go to Calendar in the sidebar.
      8. Go to the Settings menu and select Configure KOrganizer.
      9. Go to the Calendars tab and click the Add button.
      10. Choose DAV groupware resource and click OK.
      11. Enter your email address () and your password. Click Next.
      12. Select ScalableOGo from the dropdown menu and click Next.
      13. Enter your mailcow hostname into the Host field and click Next.
      14. Click Test Connection and then Finish. Finally, click OK twice.

      Once you have set up Kontact, you can also use KMail, KOrganizer and KAddressBook individually.

      "},{"location":"client/client-manual/","title":"Manual configuration","text":"

      These instructions are valid for unchanged port bindings only!

      "},{"location":"client/client-manual/#email","title":"Email","text":"Service Encryption Host Port IMAP STARTTLS mailcow hostname 143 IMAPS SSL mailcow hostname 993 POP3 STARTTLS mailcow hostname 110 POP3S SSL mailcow hostname 995 SMTP STARTTLS mailcow hostname 587 SMTPS SSL mailcow hostname 465

      Please use the \"plain\" password setting as the authentication mechanism. Contrary to what the name implies, the password will not be transferred to the server in plain text as no authentication is allowed to take place without TLS.

      "},{"location":"client/client-manual/#contacts-and-calendars","title":"Contacts and calendars","text":"

      SOGos default calendar (CalDAV) and contacts (CardDAV) URLs:

      1. CalDAV https://mail.example.com/SOGo/dav/user@example.com/Calendar/personal/https:///SOGo/dav//Calendar/personal/

      2. CardDAV https://mail.example.com/SOGo/dav/user@example.com/Contacts/personal/https:///SOGo/dav//Contacts/personal/

      Some applications may require you to use https://mail.example.com/SOGo/dav/https:///SOGo/dav/ or the full path to your calendar, which can be found and copied from within SOGo.

      "},{"location":"client/client-outlook/","title":"Microsoft Outlook","text":"
      1. Download and install Outlook CalDav Synchronizer.
      2. Launch Outlook.
      3. If this is the first time you launched Outlook, it asks you to set up your account. Proceed to step 5.
      4. Go to the File menu and click Add Account.
      5. Enter your name (), email address () and your password. Click Next.
      6. Click Finish.
      7. Go to the CalDav Synchronizer ribbon and click Synchronization Profiles.
      8. Click the second button at top (Add multiple profiles), select Sogo, click Ok.
      9. Click the Get IMAP/POP3 account settings button.
      10. Click Discover resources and assign to Outlook folders.
      11. In the Select Resource window that pops up, select your main calendar (usually Personal Calendar), click the ... button, assign it to Calendar, and click OK. Go to the Address Books and Tasks tabs and repeat repeat the process accordingly. Do not assign multiple calendars, address books or task lists!
      12. Close all windows with the OK buttons.
      "},{"location":"client/client-outlook/#outlook-2016-or-higher-from-office-365-on-windows","title":"Outlook 2016 or higher from Office 365 on Windows","text":"

      This is only applicable if your server administrator has not disabled EAS for Outlook. If it is disabled, please follow the guide for Outlook 2007 instead.

      Outlook 2016 has an issue with autodiscover. Only Outlook from Office 365 is affected. If you installed Outlook from another source, please follow the guide for Outlook 2013 or higher.

      For EAS you must use the old assistant by launching C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OLCFG.EXE. If this application opens, you can go to step 4 of the guide for Outlook 2013 below.

      If it does not open, you can completely disable the new account creation wizard and follow the guide for Outlook 2013 below.

      "},{"location":"client/client-outlook/#outlook-2007-or-2010-on-windows","title":"Outlook 2007 or 2010 on Windows","text":""},{"location":"client/client-outlook/#outlook-2007-or-higher-on-windows-calendercontacts-via-caldav-synchronizer","title":"Outlook 2007 or higher on Windows (Calender/Contacts via CalDav Synchronizer)","text":""},{"location":"client/client-outlook/#outlook-2013-or-higher-on-windows-active-sync-not-recommended","title":"Outlook 2013 or higher on Windows (Active Sync - not recommended)","text":"

      This is only applicable if your server administrator has not disabled EAS for Outlook. If it is disabled, please follow the guide for Outlook 2007 instead.

      1. Launch Outlook.
      2. If this is the first time you launched Outlook, it asks you to set up your account. Proceed to step 4.
      3. Go to the File menu and click Add Account.
      4. Enter your name (), email address () and your password. Click Next.
      5. When prompted, enter your password again, check Remember my credentials and click OK.
      6. Click the Allow button.
      7. Click Finish.
      "},{"location":"client/client-outlook/#outlook-2011-or-higher-on-macos","title":"Outlook 2011 or higher on macOS","text":"

      The Mac version of Outlook does not synchronize calendars and contacts and therefore is not supported.

      "},{"location":"client/client-thunderbird/","title":"Mozilla Thunderbird","text":"
      1. Launch Thunderbird.
      2. If this is the first time you launched Thunderbird, it asks you whether you would like a new email address. Click Skip this and use my existing email and proceed to step 4.
      3. Go to the File menu and select New, Existing Mail Account....
      4. Enter your name (), email address () and your password. Make sure the Remember password checkbox is selected and click Continue.
      5. Once the configuration has been automatically detected, make sure IMAP is selected and click Done.
      6. To use your contacts from the server, click on the arrow next to \"Address Books\" and click the Connect button on each address book you would like to use.
      7. To use your calendars from the server, click on the arrow next to \"Calendars\" and click the Connect button on each calendar you would like to use.
      8. (Optional) If you want Thunderbird to sync all subfolders, go to the Account Settings menu and select Server Settings. In the Server Settings tab, click on the Advanced button. In the Advanced Account Settings window, uncheck the \"Show only subscribed folders\" checkbox. Click OK to save the changes.
      9. Click Finish to close the Account Setup window.
      "},{"location":"client/client-windows/","title":"Windows Mail","text":"

      Windows 8 and higher support email, contacts and calendar via Exchange ActiveSync.

      1. Open the Mail app.
      2. If you have not previously used Mail, you can click Add Account in the main window. Proceed to step 4.
      3. Click Accounts in the sidebar on the left, then click Add Account on the far right.
      4. Select Exchange.
      5. Enter your email address () and click Next.
      6. Enter your password and click Log in.

      Once you have set up the Mail app, you can also use the People and Calendar apps.

      "},{"location":"client/client/","title":"Overview","text":"

      mailcow supports a variety of email clients, both on desktop computers and on smartphones. Below, you can find a number of configuration guides that explain how to configure your mailcow account.

      Tip

      If you access this page by logging into your mailcow server and clicking the \"Show configuration guides for email clients and smartphones\" link, all of the guides will be personalized with your email address and server name.

      Success

      Since you accessed this page after logging into your mailcow server, all of the guides have been personalized with your email address and server name.
      • Android
      • Apple iOS / macOS
      • eM Client
      • KDE Kontact / KMail
      • Microsoft Outlook
      • Mozilla Thunderbird
      • Windows Mail
      • Manual configuration
      "},{"location":"getstarted/install/","title":"Install mailcow","text":"

      It's the same

      The installation is exactly the same on x86 and ARM64 platforms!

      "},{"location":"getstarted/install/#docker-and-docker-compose-installation","title":"Docker and Docker Compose Installation","text":"

      You need Docker (a version >= 24.0.0 is required) and Docker Compose (a version >= 2.0 is required).

      Learn how to install Docker and Docker Compose.

      Quick installation for most operation systems:

      "},{"location":"getstarted/install/#docker","title":"Docker","text":"
      curl -sSL https://get.docker.com/ | CHANNEL=stable sh\n# After the installation process is finished, you may need to enable the service and make sure it is started (e.g. CentOS 7)\nsystemctl enable --now docker\n
      "},{"location":"getstarted/install/#docker-compose","title":"docker compose","text":"

      Danger

      mailcow requires the latest version of docker compose v2. If Docker was installed using the script above, the Docker Compose plugin is already automatically installed in a version >=2.0. Is your mailcow installation older or Docker was installed in a different way, the Compose plugin or the standalone version of Docker must be installed manually.

      "},{"location":"getstarted/install/#installation-via-paketmanager-plugin","title":"Installation via Paketmanager (plugin)","text":"

      Info

      This approach with the package sources is only possible if the Docker repository has been included. This can happen either through the instructions above (see Docker) or through a manually integration.

      On Debian/Ubuntu systems: 

      apt update\napt install docker-compose-plugin\n

      On Centos 7 systems: 

      yum update\nyum install docker-compose-plugin\n

      Danger

      The Docker Compose command syntax is docker compose for the plugin variant of Docker Compose!!!

      "},{"location":"getstarted/install/#installation-via-script-standalone","title":"Installation via Script (standalone)","text":"

      Info

      This installation is the old familiar way. It installs Docker Compose as a standalone program and does not rely on the Docker installation way.

      LATEST=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/docker/compose/releases/latest) && LATEST=${LATEST##*/} && curl -L https://github.com/docker/compose/releases/download/$LATEST/docker-compose-$(uname -s)-$(uname -m) > /usr/local/bin/docker-compose\nchmod +x /usr/local/bin/docker-compose\n

      Danger

      The Docker Compose command syntax is docker-compose for the standalone variant of Docker Compose!!!

      Please use the latest Docker engine available and do not use the engine that ships with your distros repository.

      "},{"location":"getstarted/install/#check-selinux-specifics","title":"Check SELinux specifics","text":"

      On SELinux enabled systems, e.g. CentOS 7:

      • Check if \"container-selinux\" package is present on your system:
      rpm -qa | grep container-selinux\n

      If the above command returns an empty or no output, you should install it via your package manager.

      • Check if docker has SELinux support enabled:
      docker info | grep selinux\n

      If the above command returns an empty or no output, create or edit /etc/docker/daemon.json and add \"selinux-enabled\": true. Example file content:

      {\n  \"selinux-enabled\": true\n}\n

      Restart the docker daemon and verify SELinux is now enabled.

      This step is required to make sure mailcows volumes are properly labeled as declared in the compose file. If you are interested in how this works, you can check out the readme of https://github.com/containers/container-selinux which links to a lot of useful information on that topic.

      "},{"location":"getstarted/install/#install-mailcow","title":"Install mailcow","text":"

      Clone the master branch of the repository, make sure your umask equals 0022. Please clone the repository as root user and also control the stack as root. We will modify attributes - if necessary - while bootstrapping the containers automatically and make sure everything is secured. The update.sh script must therefore also be run as root. It might be necessary to change ownership and other attributes of files you will otherwise not have access to. We drop permissions for every exposed application and will not run an exposed service as root! Controlling the Docker daemon as non-root user does not give you additional security. The unprivileged user will spawn the containers as root likewise. The behaviour of the stack is identical.

      $ su\n# umask\n0022 # <- Verify it is 0022\n# cd /opt\n# git clone https://github.com/mailcow/mailcow-dockerized\n# cd mailcow-dockerized\n
      "},{"location":"getstarted/install/#initialize-mailcow","title":"Initialize mailcow","text":"

      Generate a configuration file. Use a FQDN (host.domain.tld) as hostname when asked. 

      ./generate_config.sh\n

      Change configuration if you want or need to. 

      nano mailcow.conf\n
      If you plan to use a reverse proxy, you can, for example, bind HTTPS to 127.0.0.1 on port 8443 and HTTP to 127.0.0.1 on port 8080.

      You may need to stop an existing pre-installed MTA which blocks port 25/tcp. See this chapter to learn how to reconfigure Postfix to run besides mailcow after a successful installation.

      Some updates modify mailcow.conf and add new parameters. It is hard to keep track of them in the documentation. Please check their description and, if unsure, ask at the known channels for advise.

      "},{"location":"getstarted/install/#troubleshooting","title":"Troubleshooting","text":""},{"location":"getstarted/install/#users-with-a-mtu-not-equal-to-1500-eg-openstack","title":"Users with a MTU not equal to 1500 (e.g. OpenStack)","text":"

      Whenever you run into trouble and strange phenomena, please check your MTU.

      Edit docker-compose.yml and change the network settings according to your MTU. Add the new driver_opts parameter like this: 

      networks:\n  mailcow-network:\n    ...\n    driver_opts:\n      com.docker.network.driver.mtu: 1450\n    ...\n

      "},{"location":"getstarted/install/#users-without-an-ipv6-enabled-network-on-their-host-system","title":"Users without an IPv6 enabled network on their host system","text":"

      Please don't turn off IPv6, even if you don't like it. IPv6 is the future and should not be ignored.

      If you do not have an IPv6 enabled network on your host and you don't care for a better internet (thehe), it is recommended to disable IPv6 for the mailcow network to prevent unforeseen issues.

      "},{"location":"getstarted/install/#start-mailcow","title":"Start mailcow","text":"

      Pull the images and run the compose file. The parameter -d will start mailcow: dockerized detached:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose pull\ndocker compose up -d\n
      docker-compose pull\ndocker-compose up -d\n

      Done!

      You can now access https://${MAILCOW_HOSTNAME} with the default credentials admin + password moohoo.

      Info

      If you are not using mailcow behind a reverse proxy, you should redirect all HTTP requests to HTTPS.

      The database will be initialized right after a connection to MySQL can be established.

      Your data will persist in multiple Docker volumes, that are not deleted when you recreate or delete containers. Run docker volume ls to see a list of all volumes. You can safely run docker compose down without removing persistent data.

      "},{"location":"getstarted/prerequisite-dns/","title":"DNS setup","text":"

      Below you can find a list of recommended DNS records. While some are mandatory for a mail server (A, MX), others are recommended to build a good reputation score (TXT/SPF) or used for auto-configuration of mail clients (SRV).

      "},{"location":"getstarted/prerequisite-dns/#references","title":"References","text":"
      • A good article covering all relevant topics: \"3 DNS Records Every Email Marketer Must Know\"
      • Another great one, but Zimbra as an example platform: \"Best Practices on Email Protection: SPF, DKIM and DMARC\"
      • An in-depth discussion of SPF, DKIM and DMARC: \"How to eliminate spam and protect your name with DMARC\"
      • A thorough guide on understanding DMARC: \"Demystifying DMARC: A guide to preventing email spoofing\"
      "},{"location":"getstarted/prerequisite-dns/#reverse-dns-of-your-ip-address","title":"Reverse DNS of your IP address","text":"

      Make sure that the PTR record of your IP address matches the FQDN of your mailcow host: ${MAILCOW_HOSTNAME} 1. This record is usually set at the provider you leased the IP address (server) from. Please make sure that you create the record for IPv4 and IPv6 address (if you are using IPv6)!

      "},{"location":"getstarted/prerequisite-dns/#the-minimal-dns-configuration","title":"The minimal DNS configuration","text":"

      This example shows you a set of records for one domain managed by mailcow. Each domain that is added to mailcow needs at least this set of records to function correctly.

      # Name              Type       Value\nmail                IN A       1.2.3.4\nautodiscover        IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})\nautoconfig          IN CNAME   mail.example.org. (your ${MAILCOW_HOSTNAME})\n@                   IN MX 10   mail.example.org. (your ${MAILCOW_HOSTNAME})\n

      Note: The mail DNS record which binds the subdomain to the given ip address must only be set for the domain on which mailcow is running and that is used to access the web interface. For every other mailcow managed domain, the MX record will route the traffic.

      "},{"location":"getstarted/prerequisite-dns/#dkim-spf-and-dmarc","title":"DKIM, SPF and DMARC","text":"

      In the example DNS zone file snippet below, a simple SPF TXT record is used to only allow THIS server (the MX) to send mail for your domain. Every other server is disallowed but able to (\"~all\"). Please refer to SPF Project for further reading.

      # Name              Type       Value\n@                   IN TXT     \"v=spf1 mx a -all\"\n

      It is highly recommended to create a DKIM TXT record in your mailcow UI and set the corresponding TXT record in your DNS records. Please refer to OpenDKIM for further reading.

      # Name              Type       Value\ndkim._domainkey     IN TXT     \"v=DKIM1; k=rsa; t=s; s=email; p=...\"\n

      The last step in protecting yourself and others is the implementation of a DMARC TXT record, for example by using the DMARC Assistant (check).

      # Name              Type       Value\n_dmarc              IN TXT     \"v=DMARC1; p=reject; rua=mailto:mailauth-reports@example.org\"\n
      "},{"location":"getstarted/prerequisite-dns/#the-advanced-dns-configuration","title":"The advanced DNS configuration","text":"

      SRV records specify the server(s) for a specific protocol on your domain. If you want to explicitly announce a service as not provided, give \".\" as the target address (instead of \"mail.example.org.\"). Please refer to RFC 2782.

      # Name              Type       Priority Weight Port    Value\n_autodiscover._tcp  IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_caldavs._tcp       IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_caldavs._tcp       IN TXT                              \"path=/SOGo/dav/\"\n_carddavs._tcp      IN SRV     0        1      443      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_carddavs._tcp      IN TXT                              \"path=/SOGo/dav/\"\n_imap._tcp          IN SRV     0        1      143      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_imaps._tcp         IN SRV     0        1      993      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_pop3._tcp          IN SRV     0        1      110      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_pop3s._tcp         IN SRV     0        1      995      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_sieve._tcp         IN SRV     0        1      4190     mail.example.org. (your ${MAILCOW_HOSTNAME})\n_smtps._tcp         IN SRV     0        1      465      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_submission._tcp    IN SRV     0        1      587      mail.example.org. (your ${MAILCOW_HOSTNAME})\n_submissions._tcp   IN SRV     0        1      465      mail.example.org. (your ${MAILCOW_HOSTNAME})\n
      "},{"location":"getstarted/prerequisite-dns/#testing","title":"Testing","text":"

      Here are some tools you can use to verify your DNS configuration:

      • MX Toolbox (DNS, SMTP, RBL)
      • port25.com (DKIM, SPF)
      • Mail-tester (DKIM, DMARC, SPF)
      • DMARC Analyzer (DMARC, SPF)
      • MultiRBL.valli.org (DNSBL, RBL, FCrDNS)
      "},{"location":"getstarted/prerequisite-dns/#misc","title":"Misc","text":""},{"location":"getstarted/prerequisite-dns/#optional-dmarc-statistics","title":"Optional DMARC Statistics","text":"

      If you are interested in statistics, you can additionally register with some of the many below DMARC statistic services - or self-host your own.

      Tip

      It is worth considering that if you request DMARC statistic reports to your mailcow server and your mailcow server is not configured correctly to receive these reports, you may not get accurate and complete results. Please consider using an alternative email domain for receiving DMARC reports.

      It is worth mentioning, that the following suggestions are not a comprehensive list of all services and tools available, but only a small few of the many choices.

      • Postmaster Tool
      • parsedmarc (self-hosted)
      • Fraudmarc
      • Postmark
      • Dmarcian

      Tip

      These services may provide you with a TXT record you need to insert into your DNS records as the provider specifies. Please ensure you read the provider's documentation from the service you choose as this process may vary.

      "},{"location":"getstarted/prerequisite-dns/#email-test-for-spf-dkim-and-dmarc","title":"Email test for SPF, DKIM and DMARC:","text":"

      To run a rudimentary email authentication check, send a mail to check-auth at verifier.port25.com and wait for a reply. You will find a report similar to the following:

      ==========================================================\nSummary of Results\n==========================================================\nSPF check:          pass\n\"iprev\" check:      pass\nDKIM check:         pass\nDKIM check:         pass\nSpamAssassin check: ham\n\n==========================================================\nDetails:\n==========================================================\n....\n

      The full report will contain more technical details.

      "},{"location":"getstarted/prerequisite-dns/#fully-qualified-domain-name-fqdn","title":"Fully Qualified Domain Name (FQDN)","text":"

      1. A Fully Qualified Domain Name (FQDN) is the complete (absolute) domain name for a specific computer or host, on the Internet. The FQDN consists of at least three parts divided by a dot: the hostname, the domain name, and the Top Level Domain (TLD for short). In the example of mx.mailcow.email the hostname would be mx, the domain name mailcow and the TLD email.\u00a0\u21a9

      "},{"location":"getstarted/prerequisite-system/","title":"Prepare your system","text":"

      Before you run mailcow: dockerized, there are a few requirements that you should check:

      Warning

      Do not try to install mailcow on a Synology/QNAP device (any NAS), OpenVZ, LXC or other container platforms. KVM, ESX, Hyper-V and other full virtualization platforms are supported.

      Info

      • mailcow: dockerized requires some ports to be open for incoming connections, so make sure that your firewall is not blocking these.
      • Make sure that no other application is interfering with mailcow's configuration, such as another mail service
      • A correct DNS setup is crucial to every good mailserver setup, so please make sure you got at least the basics covered before you begin!
      • Make sure that your system has a correct date and time setup. This is crucial for various components like two factor TOTP authentication.
      "},{"location":"getstarted/prerequisite-system/#minimum-system-resources","title":"Minimum System Resources","text":"

      Please make sure that your system has at least the following resources:

      Resource Minimal Requirement CPU 1 GHz RAM Minimum 6 GiB + 1 GiB swap (default config) Disk 20 GiB (without emails) Architecture x86_64, ARM64

      Not supported

      OpenVZ, Virtuozzo and LXC

      ClamAV and Solr can be greedy with RAM. You may disable them in mailcow.conf by settings SKIP_CLAMD=y and SKIP_SOLR=y.

      Info

      We are aware that a pure MTA can run on 128 MiB RAM. mailcow is a full-grown and ready-to-use groupware with many extras making life easier. mailcow comes with a webserver, webmailer, ActiveSync (MS), antivirus, antispam, indexing (Solr), document scanner (Oletools), SQL (MariaDB), Cache (Redis), MDA, MTA, various web services etc.

      A single SOGo worker can acquire ~350 MiB RAM before it gets purged. The more ActiveSync connections you plan to use, the more RAM you will need. A default configuration spawns 20 workers.

      "},{"location":"getstarted/prerequisite-system/#ram-usage-examples","title":"RAM usage examples","text":"

      A company with 15 phones (EAS enabled) and about 50 concurrent IMAP connections should plan 16 GiB RAM.

      6 GiB RAM + 1 GiB swap are fine for most private installations while 8 GiB RAM are recommended for ~5 to 10 users.

      We can help to correctly plan your setup as part of our support.

      "},{"location":"getstarted/prerequisite-system/#supported-os","title":"Supported OS","text":"

      Important

      mailcow is using Docker as a base component, due to some technical differences across multiple platforms we do not support all, even if they can run Docker.

      The following table contains all operating systems officially supported and tested by us (as of December 2024):

      OS Compatibility Alpine since 3.17 \u26a0\ufe0f Debian 11, 12 \u2705 Ubuntu 20.04 - 24.04 \u2705 Alma Linux 8, 9 \u2705 Rocky Linux 9 \u2705

      Legend

      \u2705 = Works out of the box using the instructions. \u26a0\ufe0f = Requires some manual adjustments otherwise usable. \u274c = In general NOT Compatible. \u2754 = Pending.

      Warning

      Note: All other operating systems (not mentioned) may also work, but have not been officially tested.

      "},{"location":"getstarted/prerequisite-system/#firewall-ports","title":"Firewall & Ports","text":"

      Please check if any of mailcow's standard ports are open and not in use by other applications:

      ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n# or:\nnetstat -tulpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n

      Danger

      There are several problems with running mailcow on a firewalld/ufw enabled system. You should disable it (if possible) and move your ruleset to the DOCKER-USER chain, which is not cleared by a Docker service restart, instead. See this (blog.donnex.net) or this (unrouted.io) guide for information about how to use iptables-persistent with the DOCKER-USER chain. As mailcow runs dockerized, INPUT rules have no effect on restricting access to mailcow. Use the FORWARD chain instead.

      If this command returns any results please remove or stop the application running on that port. You may also adjust mailcows ports via the mailcow.conf configuration file.

      "},{"location":"getstarted/prerequisite-system/#incoming-ports","title":"Incoming Ports","text":"

      If you have a firewall in front of mailcow, please ensure that these ports are open for incoming connections:

      Service Protocol Port Container Variable Postfix SMTP TCP 25 postfix-mailcow ${SMTP_PORT} Postfix SMTPS TCP 465 postfix-mailcow ${SMTPS_PORT} Postfix Submission TCP 587 postfix-mailcow ${SUBMISSION_PORT} Dovecot IMAP TCP 143 dovecot-mailcow ${IMAP_PORT} Dovecot IMAPS TCP 993 dovecot-mailcow ${IMAPS_PORT} Dovecot POP3 TCP 110 dovecot-mailcow ${POP_PORT} Dovecot POP3S TCP 995 dovecot-mailcow ${POPS_PORT} Dovecot ManageSieve TCP 4190 dovecot-mailcow ${SIEVE_PORT} HTTP(S) TCP 80/443 nginx-mailcow ${HTTP_PORT} / ${HTTPS_PORT}

      To bind a service to an IP address, you can prefix the IP address as follows: SMTP_PORT=1.2.3.4:25

      Important: You cannot use IP:PORT bindings for HTTP_PORT and HTTPS_PORT. Please use HTTP_PORT=1234 and HTTP_BIND=1.2.3.4 instead.

      "},{"location":"getstarted/prerequisite-system/#outgoing-portshosts","title":"Outgoing Ports/Hosts","text":"

      Some outgoing connections are required to use mailcow. Ensure that mailcow can communicate with the following hosts or ports:

      Service Protocol Port Target Reason Clamd TCP 873 rsync.sanesecurity.net Download ClamAV signatures (prebundled in mailcow) Dovecot TCP 443 spamassassin.heinlein-support.de Download Spamassassin rules processed by Rspamd, downloaded via Dovecot mailcow Processes TCP 80/443 github.com Download mailcow updates (code-based) mailcow Processes TCP 443 hub.docker.com Download Docker images (directly from Docker Hub) mailcow Processes TCP 443 asn-check.mailcow.email API request for BAD ASN checks (for Spamhaus Free Blocklists) mailcow Processes TCP 80 ip4.mailcow.email & ip6.mailcow.email Retrieve public IP address for display in UI (optional) Postfix TCP 25, 465 Any Outgoing connection for MTA Rspamd TCP 80 fuzzy.mailcow.email Download bad subject regex maps (trained by Servercow) Rspamd TCP 443 bazaar.abuse.ch Download malware MD5 checksums for detection by Rspamd Rspamd TCP 443 urlhaus.abuse.ch Download malware download links for detection in Rspamd Rspamd UDP 11445 fuzzy.mailcow.email Connection to global mailcow fuzzy (trained by Servercow + community) Rspamd UDP 11335 fuzzy1.rspamd.com & fuzzy2.rspamd.com Connection to global Rspamd fuzzy (trained by the Rspamd team) Unbound TCP & UDP 53 Any DNS resolution for the mailcow stack (for DNSSEC validation and retrieval of spam list info)"},{"location":"getstarted/prerequisite-system/#important-for-hetzner-firewalls","title":"Important for Hetzner firewalls","text":"

      Quoting https://github.com/chermsen via https://github.com/mailcow/mailcow-dockerized/issues/497#issuecomment-469847380 (THANK YOU!):

      For all who are struggling with the Hetzner firewall:

      Port 53 unimportant for the firewall configuration in this case. According to the documentation unbound uses the port range 1024-65535 for outgoing requests. Since the Hetzner Robot Firewall is a static firewall (each incoming packet is checked isolated) - the following rules must be applied:

      For TCP 

      SRC-IP:       ---\nDST IP:       ---\nSRC Port:    ---\nDST Port:    1024-65535\nProtocol:    tcp\nTCP flags:   ack\nAction:      Accept\n

      For UDP 

      SRC-IP:       ---\nDST IP:       ---\nSRC Port:    ---\nDST Port:    1024-65535\nProtocol:    udp\nAction:      Accept\n

      If you want to apply a more restrictive port range you have to change the config of unbound first (after installation):

      {mailcow-dockerized}/data/conf/unbound/unbound.conf: 

      outgoing-port-avoid: 0-32767\n

      Now the firewall rules can be adjusted as follows:

      [...]\nDST Port:  32768-65535\n[...]\n
      "},{"location":"getstarted/prerequisite-system/#date-and-time","title":"Date and Time","text":"

      To ensure that you have the correct date and time setup on your system, please check the output of timedatectl status:

      $ timedatectl status\n      Local time: Sat 2017-05-06 02:12:33 CEST\n  Universal time: Sat 2017-05-06 00:12:33 UTC\n        RTC time: Sat 2017-05-06 00:12:32\n       Time zone: Europe/Berlin (CEST, +0200)\n     NTP enabled: yes\nNTP synchronized: yes\n RTC in local TZ: no\n      DST active: yes\n Last DST change: DST began at\n                  Sun 2017-03-26 01:59:59 CET\n                  Sun 2017-03-26 03:00:00 CEST\n Next DST change: DST ends (the clock jumps one hour backwards) at\n                  Sun 2017-10-29 02:59:59 CEST\n                  Sun 2017-10-29 02:00:00 CET\n

      The lines NTP enabled: yes and NTP synchronized: yes indicate whether you have NTP enabled and if it's synchronized.

      To enable NTP you need to run the command timedatectl set-ntp true. You also need to edit your /etc/systemd/timesyncd.conf:

      # vim /etc/systemd/timesyncd.conf\n[Time]\nNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org\n
      "},{"location":"getstarted/prerequisite-system/#hetzner-cloud-and-probably-others","title":"Hetzner Cloud (and probably others)","text":"

      Check /etc/network/interfaces.d/50-cloud-init.cfg and change the IPv6 interface from eth0:0 to eth0:

      # Wrong:\nauto eth0:0\niface eth0:0 inet6 static\n# Right:\nauto eth0\niface eth0 inet6 static\n

      Reboot or restart the interface. You may want to disable cloud-init network changes.

      "},{"location":"getstarted/prerequisite-system/#mtu","title":"MTU","text":"

      Especially relevant for OpenStack users: Check your MTU and set it accordingly in docker-compose.yml. See Troubleshooting in our Installation guide.

      "},{"location":"maintenance/deinstall/","title":"Deinstallation","text":"

      To remove mailcow: dockerized with all it's volumes, images and containers do:

      docker compose (Plugin)docker-compose (Standalone) 
      docker compose down -v --rmi all --remove-orphans\n
      docker-compose down -v --rmi all --remove-orphans\n

      Info

      • -v Remove named volumes declared in the volumes section of the Compose file and anonymous volumes attached to containers.
      • --rmi Remove images. Type must be one of: all: Remove all images used by any service. local: Remove only images that don't have a custom tag set by the image field.
      • --remove-orphans Remove containers for services not defined in the compose file.
      • By default docker compose down only removes currently active containers and networks defined in the docker-compose.yml.
        • "},{"location":"maintenance/migration/","title":"Migration","text":"

        Warning

        This guide assumes you intend to migrate an existing mailcow server (source) over to a brand new, empty server (target). It takes no care about preserving any existing data on your target server and will erase anything within /var/lib/docker/volumes and thus any Docker volumes you may have already set up.

        Tip

        Alternatively, you can use the ./helper-scripts/backup_and_restore.sh script to create a full backup on the source machine, then install mailcow on the target machine as usual, copy over your mailcow.conf and use the same script to restore your backup to the target machine.

        1. Follow the installation guide to install Docker and Compose.

        2. Stop Docker and assure Docker has stopped: 

        systemctl stop docker.service\nsystemctl status docker.service\n

        3. Run the following commands on the source machine (take care of adding the trailing slashes in the first path parameter as shown below!) - WARNING: This command will erase anything that may already exist under /var/lib/docker/volumes on the target machine:

        Within the same architectureTo other architecture 
        rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n
        rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete --exclude '*rspamd-vol-1' /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n

        Danger

        Please follow the instructions for the respective use case, as the volume rspamd-vol-1 must be omitted when migrating to a different architecture, as it contains incompatible hyperscan cache files that lead to crashes and subsequent failure to start Rspamd when switching platforms.

        The hyperscan cache files are automatically regenerated when Rspamd is restarted if they do not exist.

        4. Shut down mailcow and stop Docker on the source machine.

        docker compose (Plugin)docker-compose (Standalone) 
        cd /opt/mailcow-dockerized\ndocker compose down\nsystemctl stop docker.service\n
        cd /opt/mailcow-dockerized\ndocker-compose down\nsystemctl stop docker.service\n

        5. Repeat step 3 with the same commands. This will be much quicker than the first time as it now only syncs the diffs.

        6. Switch over to the target machine and start Docker. 

        systemctl start docker.service\n

        7. Now pull the mailcow Docker images on the target machine.

        docker compose (Plugin)docker-compose (Standalone) 
        cd /opt/mailcow-dockerized\ndocker compose pull\n
        cd /opt/mailcow-dockerized\ndocker-compose pull\n

        8. Start the whole mailcow stack and everything should be done!

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        9. Finally, change your DNS settings to point to the target server. Also check the SNAT_TO_SOURCE variable in your mailcow.conf file if you have changed your public IP address, otherwise SOGo may not work.

        "},{"location":"maintenance/update/","title":"Update","text":""},{"location":"maintenance/update/#automatic-update","title":"Automatic update","text":"

        An update script in your mailcow-dockerized directory will take care of updates.

        Run the update script: 

        ./update.sh\n

        If it needs to, it will ask you how you wish to proceed. Merge errors will be reported. Some minor conflicts will be auto-corrected (in favour for the mailcow-dockerized repository code).

        "},{"location":"maintenance/update/#options","title":"Options","text":"
        # Options can be combined\n\n# - Check for updates and show changes\n./update.sh --check\n\n# - Do not start mailcow after applying an update\n./update.sh --skip-start\n\n# - Skip ICMP Check to public DNS resolvers (Use it only if you\u00b4ve blocked any ICMP Connections to your mailcow machine)\n./update.sh --skip-ping-check\n\n# - Switch your mailcow updates to the unstable (nightly) branch.\nFOR TESTING PURPOSES ONLY!!!! NOT READY FOR PRODUCTION!!!\n./update.sh --nightly\n\n# - Switch your mailcow updates to the stable (master) branch. Default unless you changed it with --nightly.\n./update.sh --stable\n\n# - Force update (unattended, but unsupported, use at own risk)\n./update.sh --force\n\n# - Run garbage collector to cleanup old image tags and exit\n./update.sh --gc\n\n# - Update with merge strategy option \"ours\" instead of \"theirs\"\n#   This will **solve conflicts** when merging in favor for your local changes and should be avoided. Local changes will always be kept, unless we changed file XY, too.\n./update.sh --ours\n\n# - Don't update, but prefetch images and exit\n./update.sh --prefetch\n
        "},{"location":"maintenance/update/#i-forgot-what-i-changed-before-running-updatesh","title":"I forgot what I changed before running update.sh","text":"

        See git log --pretty=oneline | grep -i \"before update\", you will have an output similar to this:

        22cd00b5e28893ef9ddef3c2b5436453cc5223ab Before update on 2020-09-28_19_25_45\ndacd4fb9b51e9e1c8a37d84485b92ffaf6c59353 Before update on 2020-08-07_13_31_31\n

        Run git diff 22cd00b5e28893ef9ddef3c2b5436453cc5223ab to see what changed.

        "},{"location":"maintenance/update/#can-i-roll-back","title":"Can I roll back?","text":"

        Yes.

        See the topic above, instead of a diff, you run checkout:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker compose pull\ndocker compose up -d\n
        docker-compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker-compose pull\ndocker-compose up -d\n
        "},{"location":"maintenance/update/#hooks","title":"Hooks","text":"

        You can hook into the update mechanism by adding scripts called pre_commit_hook.sh and post_commit_hook.sh to your mailcows root directory. See this for more details.

        "},{"location":"maintenance/update/#update-cycle","title":"Update Cycle","text":"
        • We schedule a monthly release cycle for a major update.
        • The releases are numbered like this: YYYY-MM (e.g. 2022-05)
        • Fixes for a main Update will be stated as \"Revisions\" like a,b,c (e.g. 2022-05a, 2022-05b etc.)
        "},{"location":"maintenance/update/#update-variants","title":"Update variants","text":"

        stable (stable updates): These updates are suitable for productive usage. They appear in a cycle of at least 1x per month.

        nightly (unstable updates): These updates are NOT suitable for production use and are for testing only. The nightly updates are ahead of the stable updates, since in these updates we test newer and more extensive features before they go live for all users.

        "},{"location":"maintenance/update/#get-nightly-updates","title":"Get Nightly Updates","text":""},{"location":"maintenance/update/#info-about-the-nightly-updates","title":"Info about the Nightly Updates","text":"

        Since the 2022-08 update there is the possibility to change the update sources. Until now, the master branch on GitHub served as the only (official) update source. With the August 2022 update, however, there is now the Nightly Branch which contains unstable and major changes for testing and feedback.

        The Nightly Branch always gets new updates when something is finished on the mailcow project that will be included in the new main version.

        Besides the obvious changes that will be included in the next major update anyway, it also contains exclusive features that need a longer testing time (e.g. the UI update to Bootstrap 5).

        "},{"location":"maintenance/update/#how-do-i-get-nightly-updates","title":"How do I get Nightly Updates?","text":"

        The process is relatively simple. With the 2022-08 update (assuming an update to the version) it is possible to run update.sh with the parameter --nightly.

        Danger

        Please make a backup before or follow the Best Practice Nightly Update section before switching to mailcow nightly builds. We are not responsible for any data loss/corruption, so work with caution!

        The script will now change the branch with git checkout nightly, which means it will ask for the IPv6 settings again. But this is normal.

        If everything worked fine (for which we made a backup before) the mailcow UI should now show the current version number and date stamp in the lower right corner:

        "},{"location":"maintenance/update/#best-practice-nightly-update","title":"Best Practice Nightly Update","text":"

        Info

        We recommend using the Nightly Update only if you have another machine or VM and NOT use it productively.

        1. use the cold standby script to copy the machine before the switch to the nightly builds on another system.
        2. run the update.sh script on the new machine with the parameter --nightly and confirm.
        3. experience/test the nightly updates on the secondary machine.
        "},{"location":"manual-guides/u_e-80_to_443/","title":"Redirect HTTP to HTTPS","text":"

        Since February the 28th 2017 mailcow does come with port 80 and 443 enabled.

        Do not use the config below for reverse proxy setups, please see our reverse proxy guide for this, which includes a redirect from HTTP to HTTPS.

        Open mailcow.conf and set HTTP_BIND= - if not already set.

        Create a new file data/conf/nginx/redirect.conf and add the following server config to the file:

        server {\n  root /web;\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  include /etc/nginx/conf.d/server_name.active;\n  if ( $request_uri ~* \"%0A|%0D\" ) { return 403; }\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n  location / {\n    return 301 https://$host$uri$is_args$args;\n  }\n}\n

        In case you changed the HTTP_BIND parameter, recreate the container:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        Otherwise restart Nginx:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart\n
        docker-compose restart\n
        "},{"location":"manual-guides/u_e-autodiscover_config/","title":"Autodiscover / Autoconfig","text":"

        You do not need to change or create this file, autodiscover works out of the box. This guide is only meant for customizations to the autodiscover or autoconfig process.

        Newer Outlook clients (especially those delivered with O365) will not autodiscover mail profiles. Keep in mind, that ActiveSync should NOT be used with a desktop client.

        Open/create data/web/inc/vars.local.inc.php and add your changes to the configuration array.

        Changes will be merged with \"$autodiscover_config\" in data/web/inc/vars.inc.php):

        <?php\n$autodiscover_config = array(\n  // General autodiscover service type: \"activesync\" or \"imap\"\n  // emClient uses autodiscover, but does not support ActiveSync. mailcow excludes emClient from ActiveSync.\n  'autodiscoverType' => 'activesync',\n  // If autodiscoverType => activesync, also use ActiveSync (EAS) for Outlook desktop clients (>= Outlook 2013 on Windows)\n  // Outlook for Mac does not support ActiveSync\n  'useEASforOutlook' => 'yes',\n  // Please don't use STARTTLS-enabled service ports in the \"port\" variable.\n  // The autodiscover service will always point to SMTPS and IMAPS (TLS-wrapped services).\n  // The autoconfig service will additionally announce the STARTTLS-enabled ports, specified in the \"tlsport\" variable.\n  'imap' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('IMAPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('IMAP_PORT'))),\n  ),\n  'pop3' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('POPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('POP_PORT'))),\n  ),\n  'smtp' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('SMTPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('SUBMISSION_PORT'))),\n  ),\n  'activesync' => array(\n    'url' => 'https://'.$mailcow_hostname.($https_port == 443 ? '' : ':'.$https_port).'/Microsoft-Server-ActiveSync',\n  ),\n  'caldav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n  'carddav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n);\n

        To always use IMAP and SMTP instead of EAS, set 'autodiscoverType' => 'imap'.

        Disable ActiveSync for Outlook desktop clients by setting \"useEASforOutlook\" to \"no\".

        "},{"location":"manual-guides/u_e-reeanble-weak-protocols/","title":"Re-enable TLS 1.0 and TLS 1.1","text":"

        On February 12th, 2020, we disabled the deprecated protocols TLS 1.0 and 1.1 in Dovecot (POP3, POP3S, IMAP, IMAPS) and Postfix (SMTPS, SUBMISSION).

        With the June 2024 Patch (2024-06), TLS 1.0 and TLS 1.1 were also disabled for unauthenticated mail via SMTP on port 25/tcp, as most modern and well-configured email servers on the internet now use better encryptions than TLS 1.0/1.1.

        How to re-enable weak protocols if necessary?

        Edit data/conf/postfix/extra.cf:

        # For SMTPS/Submission\nsubmission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\nsmtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\n\n# For SMTP (via STARTTLS)\nsmtp_tls_protocols = !SSLv2, !SSLv3\nsmtpd_tls_protocols = !SSLv2, !SSLv3\n

        Edit data/conf/dovecot/extra.conf:

        ssl_min_protocol = TLSv1\n

        Restart the affected services:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart postfix-mailcow dovecot-mailcow\n
        docker-compose restart postfix-mailcow dovecot-mailcow\n

        Hint: You can enable TLS 1.2 in Windows 7.

        "},{"location":"manual-guides/u_e-update-hooks/","title":"Run scripts before and after updates","text":"

        It is possible to add pre- and post-update-hooks to the update.sh script that upgrades your whole mailcow installation.

        To do so, just add the corresponding bash script into your mailcow root directory:

        • pre_update_hook.sh for commands that should run before the update
        • post_update_hook.sh for commands that should run after the update is completed

        Keep in mind that pre_update_hook.sh runs every time you call update.sh and post_update_hook.sh will only run if the update was successful and the script doesn't have to be re-run.

        The scripts will be run by bash, an interpreter (e.g. #!/bin/bash) as well as an execute permission flag (\"+x\") are not required.

        "},{"location":"manual-guides/u_e-why_unbound/","title":"Why unbound?","text":"

        For DNS blacklist lookups and DNSSEC.

        Most systems use either a public or a local caching DNS resolver. That's a very bad idea when it comes to filter spam using DNS-based black hole lists (DNSBL) or similar technics. Most if not all providers apply a rate limit based on the DNS resolver that is used to query their service. Using a public resolver like Googles 4x8, OpenDNS or any other shared DNS resolver like your ISPs will hit that limit very soon.

        "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/","title":"Additional Databases","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#additional-databases-for-clamav","title":"Additional Databases for ClamAV","text":"

        Default ClamAV databases do not have great detection levels, but it can be enhanced with free or paid signature databases.

        "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#list-of-known-free-databases-as-of-april-2022","title":"List of known free databases | As of April 2022","text":"
        • SecurityInfo - free ClamAV DBs for testing purposes, required registration after which you can use them from 1 IP
        • InterServer - free to use ClamAV DBs, but they do not fit well for email scanning
        "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#enable-securiteinfo-databases","title":"Enable SecuriteInfo databases","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#work-todo-in-clamav","title":"Work todo in ClamAV","text":"
        1. Sign up for a free account at https://www.securiteinfo.com/clients/customers/signup
        2. You will receive an email to activate your account and then a follow-up email with your login name
        3. Login and navigate to your customer account: https://www.securiteinfo.com/clients/customers/account
        4. Click on the Setup tab
        5. You will need to get your_id from one of the download links, they are individual for every user

        6. Add to data/conf/clamav/freshclam.conf with replaced your_id part: 

          DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.ign2\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/javascript.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/spam_marketing.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfohtml.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfoascii.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfopdf.hdb\n

        7. For free SecuriteInfo databases, download speed is limited to 300 kB/s. In data/conf/clamav/freshclam.conf, increase the default ReceiveTimeout 20 value to ReceiveTimeout 90 (time in seconds), otherwise some of the database downloads could fail because of their size.

        8. Adjust data/conf/clamav/clamd.conf to align with next settings: 

          DetectPUA yes\nExcludePUA PUA.Win.Packer\nExcludePUA PUA.Win.Trojan.Packed\nExcludePUA PUA.Win.Trojan.Molebox\nExcludePUA PUA.Win.Packer.Upx\nExcludePUA PUA.Doc.Packed\nMaxScanSize 150M\nMaxFileSize 100M\nMaxRecursion 40\nMaxEmbeddedPE 100M\nMaxHTMLNormalize 50M\nMaxScriptNormalize 50M\nMaxZipTypeRcg 50M\n

        9. Restart ClamAV container:
        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart clamd-mailcow\n
        docker-compose restart clamd-mailcow\n

        Please note:

        • You can't use ExcludePUA and IncludePUA in clamd.conf simultaneously, so please comment any IncludePUA if you uncommented them before.
        • List of databases provided in this example fit most use-cases, but SecuriteInfo also provides other databases. Please check SecuriteInfo FAQ for additional information.
        • With the current DB set (including default DBs) ClamAV will consume about 1.3Gb of RAM on your server.
        • If you modified message_size_limit in Postfix you need to adapt MaxSize settings in ClamAV as well.
        "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#work-todo-in-rspamd","title":"Work todo in Rspamd","text":"

        Danger

        mailcow with Version >= 2023-07 is needed for this following guide to work, as it includes the predefined scores for SecuriteInfo Signatures!

        Now you have added the ClamAV signatures, but you will notice that Rspamd does not use them correctly or mercilessly labels EVERYTHING as VIRUS.

        However, we can tame Rspamd with a little bit of manual work so that it doesn't get completely out of hand.

        For this we proceed as follows:

        1. Add the following inside data/conf/rspamd/local.d/antivirus.conf:
        patterns {\n  # Extra Signatures (Securite) Not shipped with mailcow.\n  CLAM_SECI_SPAM = \"^SecuriteInfo\\.com\\.Spam.*\";\n  CLAM_SECI_JPG = \"^SecuriteInfo\\.com\\.JPG.*\";\n  CLAM_SECI_PDF = \"^SecuriteInfo\\.com\\.PDF.*\";\n  CLAM_SECI_HTML = \"^SecuriteInfo\\.com\\.HTML.*\";\n  CLAM_SECI_JS = \"^SecuriteInfo\\.com\\.JS.*\";\n}\n
        1. Restart Rspamd afterwards:
        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Now Rspamd will apply the weighting we specified to each signature instead of marking everything with a value of 2000 as VIRUS and thus rejecting it.

        Info

        You can change the weights at any time:

        data/conf/rspamd/local.d/composites.conf.

        You can also manually set/adjust the strings of the ClamAV to be registered.

        Just use the scheme given in the antivirus.conf of Rspamd.

        Warning

        Please note that the files antivirus.conf and composites.conf can be overwritten by a mailcow update.

        "},{"location":"manual-guides/ClamAV/u_e-clamav-additional_dbs/#enable-interserver-databases","title":"Enable InterServer databases","text":"
        1. Add to data/conf/clamav/freshclam.conf: 
          DatabaseCustomURL http://sigs.interserver.net/interserver256.hdb\nDatabaseCustomURL http://sigs.interserver.net/interservertopline.db\nDatabaseCustomURL http://sigs.interserver.net/shell.ldb\nDatabaseCustomURL http://sigs.interserver.net/whitelist.fp\n
        2. Restart ClamAV container:
        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart clamd-mailcow\n
        docker-compose restart clamd-mailcow\n
        "},{"location":"manual-guides/ClamAV/u_e-clamav-whitelist/","title":"Whitelist","text":""},{"location":"manual-guides/ClamAV/u_e-clamav-whitelist/#whitelist-specific-clamav-signatures","title":"Whitelist specific ClamAV signatures","text":"

        You may find that legitimate (clean) mail is being blocked by ClamAV (Rspamd will flag the mail with VIRUS_FOUND). For instance, interactive PDF form attachments are blocked by default because the embedded Javascript code may be used for nefarious purposes. Confirm by looking at the clamd logs, e.g.:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs clamd-mailcow | grep \"FOUND\"\n
        docker-compose logs clamd-mailcow | grep \"FOUND\"\n

        This line confirms that such was identified:

        clamd-mailcow_1      | Sat Sep 28 07:43:24 2019 -> instream(local): PUA.Pdf.Trojan.EmbeddedJavaScript-1(e887d2ac324ce90750768b86b63d0749:363325) FOUND\n

        To whitelist this particular signature (and enable sending this type of file attached), add it to the ClamAV signature whitelist file:

        echo 'PUA.Pdf.Trojan.EmbeddedJavaScript-1' >> data/conf/clamav/whitelist.ign2\n

        Then restart the clamd-mailcow service container in the mailcow UI or using docker compose:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart clamd-mailcow\n
        docker-compose restart clamd-mailcow\n

        Cleanup cached ClamAV results in Redis:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
        docker-compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
        "},{"location":"manual-guides/Docker/u_e-docker-cust_dockerfiles/","title":"Customize Dockerfiles","text":"

        You need to copy the override file with corresponding build tags to the mailcow: dockerized root folder (i.e. /opt/mailcow-dockerized):

        cp helper-scripts/docker-compose.override.yml.d/BUILD_FLAGS/docker-compose.override.yml docker-compose.override.yml\n

        Customize data/Dockerfiles/$service and build the image locally: 

        docker build data/Dockerfiles/$service -t mailcow/$service:$tag\n
        (without a personalized :$tag docker will use :latest automatically)

        Now the created image has to be activated in docker-compose.override.yml, e.g.: 

        $service-mailcow:\n    build: ./data/Dockerfiles/$service\n    image: mailcow/$service:$tag\n

        Now auto-recreate modified containers:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-any_acl/","title":"Enable \"any\" ACL settings","text":"

        On August the 17th, we disabled the possibility to share with \"any\" or \"all authenticated users\" by default.

        This function can be re-enabled by setting ACL_ANYONE to allow in mailcow.conf:

        ACL_ANYONE=allow\n

        Apply the changes by restarting the stack:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-catchall_vacation/","title":"Vacation replies for catchall addresses","text":"

        The Dovecot parameter sieve_vacation_dont_check_recipient - which was by default set to yes in mailcow configurations pre 21st July 2021 - allows for vacation replies even when a mail is sent to non-existent mailboxes like a catch-all addresses.

        We decided to switch this parameter back to no and allow a user to specify which recipient address triggers a vacation reply. The triggering recipients can also be configured in SOGos autoresponder feature.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/","title":"Expunge a Users mails","text":"

        If you want to delete old mails out of the .Junk or .Trash folders or maybe delete all read mails that are older than a certain amount of time you may use dovecot's tool doveadm man doveadm-expunge.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#the-manual-way","title":"The manual way","text":"

        That said, let's dive in:

        Delete a user's mails inside the junk folder that are read and older than 4 hours

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n
        docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n

        Delete all user's mails in the junk folder that are older than 7 days

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n
        docker-compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n

        Delete all mails (of all users) in all folders that are older than 52 weeks (internal date of the mail, not the date it was saved on the system => before instead of savedbefore). Useful for deleting very old mails on all users and folders (thus especially useful for GDPR-compliance).

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n
        docker-compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n

        Delete mails inside a custom folder inside a user's inbox that are not flagged and older than 2 weeks

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n
        docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n

        Info

        For possible time spans or search keys have a look at man doveadm-search-query

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#job-scheduler","title":"Job scheduler","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#via-the-host-system-cron","title":"via the host system cron","text":"

        If you want to automate such a task you can create a cron job on your host that calls a script like the one below:

        docker compose (Plugin)docker-compose (Standalone) 
        #!/bin/bash\n# Path to mailcow-dockerized, for example: /opt/mailcow-dockerized\ncd /path/to/your/mailcow-dockerized\n\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n
        #!/bin/bash\n# Path to mailcow-dockerized, for example: /opt/mailcow-dockerized\ncd /path/to/your/mailcow-dockerized\n\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n

        To create a cron job you may execute crontab -e and insert something like the following to execute a script:

        # Execute everyday at 04:00 A.M.\n0 4 * * * /path/to/your/expunge_mailboxes.sh\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-expunge/#via-docker-job-scheduler","title":"via Docker job scheduler","text":"

        To archive this with a docker job scheduler use this docker-compose.override.yml with your mailcow: 

        services:\n\n  dovecot-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.dovecot-expunge-trash.schedule: \"0 0 4 * * *\"\n      ofelia.job-exec.dovecot-expunge-trash.command: \"doveadm expunge -A mailbox 'Junk' savedbefore 2w\"\n      ofelia.job-exec.dovecot-expunge-trash.tty: \"false\"\n

        We add a few label to our dovecot-container to activate the job scheduler and tell him in a cron compatible scheduling format when to run. Note: Ofelia uses the scheduling format of the Go cron implementation which starts with a field for seconds instead of minutes.

        This docker-compose.override.yml deletes all mails older then 2 weeks from the \"Junk\" folder every day at 4 am. To see if things ran proper, you can not only see in your mailbox but also check Ofelia's docker log if it looks something like this:

        common.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Started - doveadm expunge -A mailbox 'Junk' savedbefore 2w,\ncommon.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Finished in \"285.032291ms\", failed: false, skipped: false, error: none,\n

        If it failed it will say so and give you the output of the doveadm in the log to make it easy on you to debug.

        In case you want to add more jobs, ensure you change the \"dovecot-expunge-trash\" part after \"ofelia.job-exec.\" to something else, it defines the name of the job. Syntax of the labels you find at mcuadros/ofelia.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-extra_conf/","title":"Customize/Expand dovecot.conf","text":"

        Create a file data/conf/dovecot/extra.conf - if missing - and add your additional content here.

        Restart dovecot-mailcow to apply your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart dovecot-mailcow\n
        docker-compose restart dovecot-mailcow\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/","title":"Full-Text Search","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-solr-deprecated","title":"FTS Solr (Deprecated)","text":"

        Warning

        Solr will only be supported until December 2024 and will then be removed from mailcow and replaced with Flatcurve.

        Solr is used for setups with memory >= 3.5 GiB to enable full-text search in Dovecot.

        Please note that applications like Solr may need to be maintained from time to time.

        Additionally, Solr consumes a lot of RAM, depending on your server's usage. Please avoid using it on machines with less than 3 GiB RAM.

        The default heap size (1024 M) is defined in mailcow.conf.

        Since we run in Docker and create our containers with the \"restart: always\" flag, an OOM situation will at least only trigger a container restart.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-flatcurve-experimental-since-2024-06","title":"FTS Flatcurve (Experimental since 2024-06)","text":"

        Flatcurve will soon replace the current FTS engine Solr to allow full-text search to function better on lower-performance systems.

        Starting with the June 2024 update, experimental support for Flatcurve as a full-text search has been implemented, which can only be activated via a mailcow.conf variable during the experimental phase.

        Note

        During the transition period, mailcow will specify the configuration for the FTS engine within Dovecot and overwrite any custom changes (unless explicitly defined in the extra.conf). This will no longer be the case with the full release of the engine within mailcow.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#activating-the-experimental-flatcurve-usage","title":"Activating the Experimental Flatcurve Usage","text":"

        Activation is simple and requires only two small steps:

        1. Edit mailcow.conf and add the following value:

          FLATCURVE_EXPERIMENTAL=y\n

        2. Restart mailcow:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

        mailcow will now use Flatcurve as the FTS backend.

        Unlike Solr, Flatcurve does not require an additional Docker volume. Flatcurve stores its FTS databases in the vmail-index volume and results in a similar folder structure as:

        /var/vmail_index/tester@develcow.de/.INBOX/\n\u251c\u2500\u2500 dovecot.index\n\u251c\u2500\u2500 dovecot.index.cache\n\u251c\u2500\u2500 dovecot.index.log\n\u2514\u2500\u2500 fts-flatcurve\n    \u2514\u2500\u2500 index.814\n        \u251c\u2500\u2500 flintlock\n        \u251c\u2500\u2500 iamglass\n        \u251c\u2500\u2500 postlist.glass\n        \u2514\u2500\u2500 termlist.glass\n

        Each subfolder on the IMAP server thus receives its own fts-flatcurve folder with the respective indices of the mails in the folder.

        Note

        The Solr container will still remain during the transition period (expected until December 2024) to allow for a smooth transition.

        Warning

        If you decide to switch the FTS engine, a complete reindexing is necessary, as the two systems are not compatible with each other. Learn below how to initiate a reindexing.

        However, we recommend performing this reindexing only under supervision, as excessive system load cannot be ruled out despite low system requirements!

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#fts-related-dovecot-commands","title":"FTS-Related Dovecot Commands","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#check-fts-database-for-errors-and-repair-if-necessary","title":"Check FTS Database for Errors and Repair if Necessary","text":"docker compose (Plugin)docker-compose (Standalone) 
        # Single user\ndocker compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# All users\ndocker compose exec dovecot-mailcow doveadm fts rescan -A\n
        # Single user\ndocker-compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# All users\ndocker-compose exec dovecot-mailcow doveadm fts rescan -A\n

        Dovecot Wiki: \"Scans which mails are present in the full-text search index and compares them with the mails actually present in the mailboxes. This removes mails from the index that have already been deleted and ensures that the next doveadm index indexes all missing mails (if any).\"

        This does not reindex a mailbox. It essentially repairs a given index.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#reindex-fts-database","title":"Reindex FTS Database","text":"

        If you want to reindex the data immediately, you can run the following command, where * can also be a mailbox mask like 'Sent'. You do not have to run these commands, but it will speed things up a bit:

        docker compose (Plugin)docker-compose (Standalone) 
        # Single user\ndocker compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# All users, but obviously slower and more dangerous\ndocker compose exec dovecot-mailcow doveadm index -A '*'\n
        # Single user\ndocker-compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# All users, but obviously slower and more dangerous\ndocker-compose exec dovecot-mailcow doveadm index -A '*'\n

        Note

        The indexing will take some time.

        Depending on the FTS engine, there is a possibility of excessive system usage, even leading to system crashes in rare cases. So, monitor the indexing process and your system load closely!

        Since reindexing can be somewhat fragile and particularly sensitive to system resources, we have not integrated it into the mailcow UI.

        You must manually handle any errors when reindexing a mailbox via CLI.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-fts/#delete-fts-database","title":"Delete FTS Database","text":"

        mailcow will automatically delete a user's index data when the corresponding mailbox is deleted.

        Alternatively, the index for Flatcurve can be manually deleted via CLI:

        docker compose (Plugin)docker-compose (Standalone) 
        # Single user\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# All users\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
        # Single user\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# All users\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-harden_ciphers/","title":"Hardening Ciphers","text":"

        If you want to change the default ciphers and TLS versions accepted in Dovecot as per it's current release to something stronger, you could add following to Dovecot's extra.conf:

        ssl_min_protocol = TLSv1.2\nssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305\n

        If you want to adjust the ciphers for Postfix as well you can find the corresponding tutorial here.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/","title":"Changing the IMAP IDLE interval","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#what-is-the-idle-interval","title":"What is the IDLE interval?","text":"

        Per default, Dovecot sends a \"I'm still here\" notification to every client that has an open connection with Dovecot to get mails as quickly as possible without manually polling it (IMAP PUSH). This notification is controlled by the setting imap_idle_notify_interval, which defaults to 2 minutes.

        A short interval results in the client getting a lot of messages for this connection, which is bad for mobile devices, because every time the device receives this message, the mailing app has to wake up. This can result in unnecessary battery drain.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#edit-the-value","title":"Edit the value","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#change-configuration","title":"Change configuration","text":"

        Create a new file data/conf/dovecot/extra.conf (or edit it if it already exists). Insert the setting followed by the new value. For example, to set the interval to 5 minutes you could type:

        imap_idle_notify_interval = 5 mins\n

        29 minutes is the maximum value allowed by the corresponding RFC.

        Warning

        This isn't a default setting in mailcow because we don't know how this setting changes the behavior of other clients. Be careful if you change this and monitor different behavior.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-idle_interval/#reload-dovecot","title":"Reload Dovecot","text":"

        Now reload Dovecot:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow dovecot reload\n
        docker-compose exec dovecot-mailcow dovecot reload\n

        Info

        You can check the value of this setting with

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n
        docker-compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n

        If you didn't change it, it should be at 2m. If you did change it, you should see your new value.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/","title":"Lazy Expunge (Dovecot Plugin)","text":"

        Danger

        This guide is still a work in progress, and errors may occur! Use this feature with caution!

        Info

        This feature is compatible with mailcow versions starting from 2024-11. Older versions are theoretically capable of using it as well, but due to internal changes, the implementation is more complicated, so it won't be stated here as unsupported.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#introduction","title":"Introduction","text":"

        Dovecot has supported a feature called Lazy Expunge for quite some time, which allows server administrators to temporarily retain deleted emails from a user account even after they have been deleted.

        mailcow also has a similar feature, but it is not easily accessible to users (see Recover accidentally deleted data (Mail)) and serves more as a fallback method for administrators.

        With the Dovecot option, users can view and restore emails that have been marked as deleted before they are automatically purged by the Dovecot server.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#setup","title":"Setup","text":"

        1. Edit the extra.conf file in the Dovecot configuration folder (usually located at MAILCOW_ROOT/data/conf/dovecot) with the following content: 

          plugin {\n    # Copy all deleted emails to the .EXPUNGED mailbox\n    lazy_expunge = .EXPUNGED\n\n    # Exclude marked-as-deleted emails from the quota\n    quota_rule = .EXPUNGED:ignore\n}\n\n# Define the .EXPUNGED mailbox\nnamespace inbox {\n    mailbox .EXPUNGED {\n        # Define how long emails will stay in this folder before they are deleted. Time is defined according to: https://doc.dovecot.org/2.3/settings/types/#time\n        autoexpunge = 7days\n        # Define how many emails can be kept in the EXPUNGED folder before it is cleared\n        autoexpunge_max_mails = 100000\n    }\n}\n

        2. Restart the Dovecot container:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart dovecot-mailcow\n
          docker-compose restart dovecot-mailcow\n

        3. Once the trash is emptied, a new folder named .EXPUNGED should appear. This folder will contain emails that, according to the rules defined in step 1, will be automatically deleted from the server after a certain period.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-mail-crypt/","title":"Mail crypt","text":"

        Warning

        Mails are stored compressed (lz4) and encrypted. The key pair can be found in crypt-vol-1.

        If you want to decode/encode existing maildir files, you can use the following script at your own risk:

        Enter Dovecot by running the following command in the mailcow-dockerized location:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow /bin/bash\n
        docker-compose exec dovecot-mailcow /bin/bash\n
        # Decrypt /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") == \"CRYPTED\" ]]; then\ndoveadm fs get compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" > \"/tmp/$(basename \"$file\")\"\n  if [[ -s \"/tmp/$(basename \"$file\")\" ]]; then\n    chmod 600 \"/tmp/$(basename \"$file\")\"\n    chown 5000:5000 \"/tmp/$(basename \"$file\")\"\n    mv \"/tmp/$(basename \"$file\")\" \"$file\"\n  else\n    rm \"/tmp/$(basename \"$file\")\"\n  fi\nfi\ndone\n\n# Encrypt /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") != \"CRYPTED\" ]]; then\ndoveadm fs put crypt private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" \"$file\"\n  chmod 600 \"$file\"\n  chown 5000:5000 \"$file\"\nfi\ndone\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/","title":"More Examples with DOVEADM","text":"

        Here is just an unsorted list of useful doveadm commands that could be useful.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/#doveadm-quota","title":"doveadm quota","text":"

        The quota get and quota recalc1 commands are used to display or recalculate the current user's quota usage. The reported values are in kilobytes.

        To list the current quota status for a user / mailbox, do:

        doveadm quota get -u 'mailbox@example.org'\n

        To list the quota storage value for all users, do:

        doveadm quota get -A |grep \"STORAGE\"\n

        Recalculate a single user's quota usage:

        doveadm quota recalc -u 'mailbox@example.org'\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-more/#doveadm-search","title":"doveadm search","text":"

        The doveadm search2 command is used to find messages matching your query. It can return the username, mailbox-GUID / -UID and message-GUIDs / -UIDs.

        To view the number of messages, by user, in their .Trash folder:

        doveadm search -A mailbox 'Trash' | awk '{print $1}' | sort | uniq -c\n

        Show all messages in a user's inbox older then 90 days:

        doveadm search -u 'mailbox@example.org' mailbox 'INBOX' savedbefore 90d\n

        Show all messages in any folder that are older then 30 days for mailbox@example.org:

        doveadm search -u 'mailbox@example.org' mailbox \"*\" savedbefore 30d\n

        1. https://wiki.dovecot.org/Tools/Doveadm/Quota \u21a9

        2. https://wiki.dovecot.org/Tools/Doveadm/Search \u21a9

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-performance/","title":"Performance Optimizations","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-performance/#maildir_very_dirty_syncs","title":"maildir_very_dirty_syncs","text":"

        Dovecot's maildir_very_dirty_syncs option is enabled by default since mailcow Release 2023-05. This option can significantly improve the performance of mailboxes that contain very large folders (over 100,000 emails).

        What this option does is it avoids rescanning the entire cur directory whenever loading an email. With this option disabled, Dovecot takes it safe and scans the entire cur directory (comparable with running an ls) to check if that particular email was touched (renamed, etc), by looking for all files whose names contain the correct ID. This is very slow if the directory is large, even on filesystems optimized for such use cases (such as ext4 with dir_index enabled) on fast SSD drives.

        This option is safe to use as long as you do not manually touch files under cur (as then Dovecot may not notice the changes). Even with this option enabled, Dovecot will still notice changes if the file's mtime (last modified time) is changed, but otherwise it will not scan the directory and just assumes the index is up-to-date. This is essentially the same as what sdbox/mdbox do, and with this option you can get some of the performance increase that would come with sdbox/mdbox while still using maildir.

        This option is safe to use on a standard Mailcow installation. However, if you use any third-party tools that manually modify files directly in the maildir (rather than via IMAP), you may wish to disable it. To disable this option, create a data/conf/dovecot/extra.conf file and add this setting to it:

        maildir_very_dirty_syncs=no\n

        Warning

        Please ALWAYS use the above mentioned extra.conf for your own customizations, as changes made in the normal dovecot.conf might be overwritten after an update from GitHub source code.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-public_folder/","title":"Public folders","text":"

        Create a new public namespace \"Public\" and a mailbox \"Develcow\" inside that namespace:

        Edit or create data/conf/dovecot/extra.conf, add:

        namespace {\n  type = public\n  separator = /\n  prefix = Public/\n  location = maildir:/var/vmail/public:INDEXPVT=~/public\n  subscriptions = yes\n  mailbox \"Develcow\" {\n    auto = subscribe\n  }\n}\n

        :INDEXPVT=~/public can be omitted if per-user seen flags are not wanted.

        The new mailbox in the public namespace will be auto-subscribed by users.

        To allow all authenticated users access full to that new mailbox (not the whole namespace), run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n
        docker-compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n

        Adjust the command to your needs if you like to assign more granular rights per user (use -u user@domain instead of -A for example).

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-public_folder/#allow-authenticated-users-access-to-the-whole-public-namespace","title":"Allow authenticated users access to the whole public namespace","text":"

        To allow all authenticated users access full access to the whole public namespace and its subfolders, create a new dovecot-acl file in the namespace root directory:

        Open/edit/create /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/public/dovecot-acl (adjust the path accordingly) to create the global ACL file with the following content:

        authenticated kxeilprwts\n

        kxeilprwts equals to lookup read write write-seen write-deleted insert post delete expunge create.

        You can use doveadm acl set -u user@domain \"Public/Develcow\" user=user@domain lookup read to limit access for a single user. You may also turn it around to limit access for all users to \"lr\" and grant only some users full access.

        See Dovecot ACL for further information about ACL.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-static_master/","title":"Static master user","text":"

        Random master usernames and passwords are automatically created on every restart of dovecot-mailcow.

        That's recommended and should not be changed.

        If you need the user to be static anyway, please specify two variables in mailcow.conf.

        Both parameters must not be empty!

        DOVECOT_MASTER_USER=mymasteruser\nDOVECOT_MASTER_PASS=mysecretpass\n

        Run the command below to apply your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        The static master username will be expanded to DOVECOT_MASTER_USER@mailcow.local.

        To login as test@example.org this would equal to test@example.org*mymasteruser@mailcow.local with the specified password above.

        A login to SOGo is not possible with this username. A click-to-login function for SOGo is available for admins as described here No master user is required.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/","title":"Move Maildir (vmail)","text":""},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#the-new-way","title":"The \"new\" way","text":"

        Warning

        Newer Docker versions seem to complain about existing volumes. You can fix this temporarily by removing the existing volume and start mailcow with the override file. But it seems to be problematic after a reboot (needs to be confirmed).

        An easy, dirty, yet stable workaround is to stop mailcow, remove /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data and create a new link to your remote filesystem location, for example:

        mv /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data_backup\nln -s /mnt/volume-xy/vmail_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\n

        Start mailcow afterwards.

        "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#the-old-way","title":"The \"old\" way","text":"

        If you want to use another folder for the vmail-volume, you can create a docker-compose.override.yml file and add the following content:

        volumes:\n  vmail-vol-1:\n    driver_opts:\n      type: none\n      device: /data/mailcow/vmail   \n      o: bind\n
        "},{"location":"manual-guides/Dovecot/u_e-dovecot-vmail-volume/#moving-an-existing-vmail-folder","title":"Moving an existing vmail folder:","text":"
        • Locate the current vmail folder by its \"Mountpoint\" attribute: docker volume inspect mailcowdockerized_vmail-vol-1
        [\n    {\n        \"CreatedAt\": \"2019-06-16T22:08:34+02:00\",\n        \"Driver\": \"local\",\n        \"Labels\": {\n            \"com.docker.compose.project\": \"mailcowdockerized\",\n            \"com.docker.compose.version\": \"1.23.2\",\n            \"com.docker.compose.volume\": \"vmail-vol-1\"\n        },\n        \"Mountpoint\": \"/var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\",\n        \"Name\": \"mailcowdockerized_vmail-vol-1\",\n        \"Options\": null,\n        \"Scope\": \"local\"\n    }\n]\n
        • Copy the content of the Mountpoint folder to the new location (e.g. /data/mailcow/vmail) using cp -a, rsync -a or a similar non strcuture breaking copy command
        • Stop mailcow by executing the following command from within your mailcow root folder (e.g. /opt/mailcow-dockerized):
        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\n
        docker-compose down    \n
        • Create the file docker-compose.override.yml, edit the device path accordingly
        • Delete the current vmail folder: docker volume rm mailcowdockerized_vmail-vol-1
        • Start mailcow by executing the following command from within your mailcow root folder (e.g. /opt/mailcow-dockerized):
        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"manual-guides/Nginx/u_e-nginx_custom/","title":"Custom sites","text":""},{"location":"manual-guides/Nginx/u_e-nginx_custom/#ssl","title":"SSL","text":"

        Please see Advanced SSL and explicitly check ADDITIONAL_SERVER_NAMES for SSL configuration.

        Please do not add ADDITIONAL_SERVER_NAMES when you plan to use a different web root.

        "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#new-site","title":"New site","text":"

        To create persistent (over updates) sites hosted by mailcow: dockerized, a new site configuration must be placed inside data/conf/nginx/:

        A good template to begin with:

        nano data/conf/nginx/my_custom_site.conf\n
        server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  # Location: data/web\n  root /web;\n  # Location: data/web/mysite.com\n  #root /web/mysite.com\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name mysite.example.org;\n  server_tokens off;\n\n  # This allows acme to be validated even with a different web root\n  location ^~ /.well-known/acme-challenge/ {\n    default_type \"text/plain\";\n    rewrite /.well-known/acme-challenge/(.*) /$1 break;\n    root /web/.well-known/acme-challenge/;\n  }\n\n  if ($scheme = http) {\n    return 301 https://$server_name$request_uri;\n  }\n}\n
        "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#new-site-with-proxy-to-a-remote-location","title":"New site with proxy to a remote location","text":"

        Another example with a reverse proxy configuration:

        nano data/conf/nginx/my_custom_site.conf\n
        server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name example.domain.tld;\n  server_tokens off;\n\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  if ($scheme = http) {\n    return 301 https://$host$request_uri;\n  }\n\n  location / {\n    proxy_pass http://service:3000/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  }\n}\n
        "},{"location":"manual-guides/Nginx/u_e-nginx_custom/#config-expansion-in-mailcows-nginx","title":"Config expansion in mailcows Nginx","text":"

        The filename used for a new site is not important, as long as the filename carries a .conf extension.

        It is also possible to extend the configuration of the default file site.conf file:

        nano data/conf/nginx/site.my_content.custom\n

        This filename does not need to have a \".conf\" extension but follows the pattern site.*.custom, where * is a custom name.

        If PHP is to be included in a custom site, please use the PHP-FPM listener on phpfpm:9002 or create a new listener in data/conf/phpfpm/php-fpm.d/pools.conf.

        Restart Nginx (and PHP-FPM, if a new listener was created):

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart nginx-mailcow\ndocker compose restart php-fpm-mailcow\n
        docker-compose restart nginx-mailcow\ndocker-compose restart php-fpm-mailcow\n
        "},{"location":"manual-guides/Nginx/u_e-nginx_webmail-site/","title":"Create subdomain webmail.example.org","text":"

        IMPORTANT: This guide only applies to non SNI enabled configurations. The certificate path needs to be adjusted if SNI is enabled. Something like ssl_certificate,key /etc/ssl/mail/webmail.example.org/cert.pem,key.pem; will do. But: The certificate should be acquired first and only after the certificate exists a site config should be created. Nginx will fail to start if it cannot find the certificate and key.

        To create a subdomain webmail.example.org and redirect it to SOGo, you need to create a new Nginx site. Take care of \"CHANGE_TO_MAILCOW_HOSTNAME\"!

        nano data/conf/nginx/webmail.conf

        server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name webmail.example.org;\n  server_tokens off;\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  location / {\n    return 301 https://CHANGE_TO_MAILCOW_HOSTNAME/SOGo;\n  }\n}\n

        Save and restart Nginx:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart nginx-mailcow\n
        docker-compose restart nginx-mailcow\n

        Now open mailcow.conf and find ADDITIONAL_SAN. Add webmail.example.org to this array, don't use quotes!

        ADDITIONAL_SAN=webmail.example.org\n

        Run the command to apply the changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        See \"acme-mailcow\" and \"nginx-mailcow\" logs if anything fails.

        "},{"location":"manual-guides/Postfix/u_e-postfix-attachment_size/","title":"Max. message size (attachment size)","text":"

        Open data/conf/postfix/extra.cf and set the message_size_limit accordingly in bytes. See main.cf for the default value.

        You will also need to adjust message size in Rspamd and Clamav configurations:

        • in data/conf/rspamd/local.d/options.inc add max_message parameter, check Rspamd Docs for defaults
        • in data/conf/rspamd/local.d/external_services.conf adjust max_size parameter for oletools
        • in data/conf/rspamd/local.d/antivirus.conf adjust max_size parameter for clamav
        • in data/conf/clamav/clamd.conf adjust MaxScanSize and MaxFileSize

        Restart Postfix, Rspamd and Clamav:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
        docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
        "},{"location":"manual-guides/Postfix/u_e-postfix-custom_transport/","title":"Custom transport maps","text":"

        For transport maps other than those to be configured in mailcow UI, please use data/conf/postfix/custom_transport.pcre to prevent existing maps or settings from being overwritten by updates.

        In most cases using this file is not necessary. Please make sure mailcow UI is not able to route your desired traffic properly before using that file.

        The file needs valid PCRE content and can break Postfix, if configured incorrectly.

        "},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/","title":"Disable Sender Addresses Verification","text":""},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/#new-guide","title":"New guide","text":"

        Edit a mailbox and select \"Allow to send as *\".

        For historical reasons we kept the old and deprecated guide below:

        "},{"location":"manual-guides/Postfix/u_e-postfix-disable_sender_verification/#deprecated-guide-do-not-use-on-newer-mailcows","title":"Deprecated guide (DO NOT USE ON NEWER MAILCOWS!)","text":"

        This option is not best-practice and should only be implemented when there is no other option available to achieve whatever you are trying to do.

        Simply create a file data/conf/postfix/check_sasl_access and enter the following content. This user must exist in your installation and needs to authenticate before sending mail. 

        user-to-allow-everything@example.com OK\n

        Open data/conf/postfix/main.cf and find smtpd_sender_restrictions. Prepend check_sasl_access hash:/opt/postfix/conf/check_sasl_access like this: 

        smtpd_sender_restrictions = check_sasl_access hash:/opt/postfix/conf/check_sasl_access reject_authenticated_sender_login_mismatch [...]\n

        Run postmap on check_sasl_access:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n
        docker-compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n

        Restart the Postfix container.

        "},{"location":"manual-guides/Postfix/u_e-postfix-extra_cf/","title":"Customize/Expand main.cf","text":"

        Please create a new file data/conf/postfix/extra.cf for overrides or additional content to main.cf.

        Postfix will complain about duplicate values once after starting postfix-mailcow, this is intended.

        Syslog-ng was configured to hide those warnings while Postfix is running, to not spam the log files with unnecessary information every time a service is used.

        Restart postfix-mailcow to apply your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart postfix-mailcow\n
        docker-compose restart postfix-mailcow\n
        "},{"location":"manual-guides/Postfix/u_e-postfix-harden_ciphers/","title":"Hardening Ciphers","text":"

        If you want to change the default ciphers and TLS versions accepted in postfix as per it's current release to something stronger, you could add following inside Postfix extra.cf:

        tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\ntls_preempt_cipherlist = yes\n\nsmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtp_tls_ciphers = high\nsmtp_tls_mandatory_ciphers = high\n\nsmtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtpd_tls_ciphers = high\nsmtpd_tls_mandatory_ciphers = high\n

        Such a configuration will pass current (2024-10-21) configuration checks against services like Internet.nl.

        If you want to adjust the ciphers for Dovecot as well you can find the corresponding tutorial here.

        "},{"location":"manual-guides/Postfix/u_e-postfix-pflogsumm/","title":"Statistics with pflogsumm","text":"

        To use pflogsumm with the default logging driver, we need to query postfix-mailcow via docker logs and direct the output to pflogsumm:

        docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | pflogsumm\n

        The above log output is limited to the last 24 hours.

        It is also possible to create a daily pflogsumm report via cron. Create the /etc/cron.d/pflogsumm file with the following content:

        SHELL=/bin/bash\n59 23 * * * root docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | /usr/sbin/pflogsumm -d today | mail -s \"Postfix Report of $(date)\" postmaster@example.net\n

        To work, a local postfix must be installed on the server, which relays to the mailcow postfix.

        Question

        More detailed information can be found in section Post installation tasks -> Local MTA on Dockerhost.

        Based on the postfix logs of the last 24 hours, this example then sends a pflogsumm report to postmaster@example.net every day at 23:59:00.

        "},{"location":"manual-guides/Postfix/u_e-postfix-postscreen_whitelist/","title":"Whitelist IP in Postscreen","text":"

        IPs can be removed from Postscreen and therefore also from RBL checks in data/conf/postfix/custom_postscreen_whitelist.cidr.

        Postscreen does multiple checks to identify malicious senders. In most cases you want to whitelist an IP to exclude it from blacklist lookups.

        The format of the file is as follows:

        CIDR ACTION

        Where CIDR is a single IP address or IP range in CIDR notation, and action is either \"permit\" or \"reject\".

        Example:

        # Rules are evaluated in the order as specified.\n# Blacklist 192.168.* except 192.168.0.1.\n192.168.0.1          permit\n192.168.0.0/16       reject\n

        The file is reloaded on the fly, postfix restart is not required.

        "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/","title":"Relayhosts","text":"

        As of September 12, 2018 you can setup relayhosts as admin by using the mailcow UI.

        This is useful if you want to relay outgoing emails for a specific domain to a third-party spam filter or a service like Mailgun or Sendgrid. This is also known as a smarthost.

        "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#add-a-new-relayhost","title":"Add a new relayhost","text":"

        Go to the Routing tab of the Configuration and Details section of the admin UI. Here you will see a list of relayhosts currently setup.

        Scroll to the Add sender-dependent transport section.

        Under Host, add the host you want to relay to. Example: if you want to use Mailgun to send emails instead of your server IP, enter smtp.mailgun.org

        If the relay host requires a username and password to authenticate, enter them in the respective fields. Keep in mind the credentials will be stored in plain text.

        "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#test-a-relayhost","title":"Test a relayhost","text":"

        To test that connectivity to the host works, click on Test from the list of relayhosts and enter a From: address. Then, run the test.

        You will then see the results of the SMTP transmission. If all went well, you should see SERVER -> CLIENT: 250 2.0.0 Ok: queued as A093B401D4 as one of the last lines.

        If not, review the error provided and resolve it.

        Note: Some hosts, especially those who do not require authentication, will deny connections from servers that have not been added to their system beforehand. Make sure you read the documentation of the relayhost to make sure you've added your domain and/or the server IP to their system.

        Tip: You can change the default test To: address the test uses from null@mailcow.email to any email address you choose by modifying the $RELAY_TO variable on the vars.inc.php file under /opt/mailcow-dockerized/data/web/inc This way you can check that the relay worked by checking the destination mailbox.

        "},{"location":"manual-guides/Postfix/u_e-postfix-relayhost/#set-the-relayhost-for-a-domain","title":"Set the relayhost for a domain","text":"

        Go to the Domains tab of the Mail setup section of the admin UI.

        Edit the desired domain.

        Select the newly added host on the Sender-dependent transports dropdown and save changes.

        Send an email from a mailbox on that domain and you should see postfix handing the message over to the relayhost in the logs.

        "},{"location":"manual-guides/Postfix/u_e-postfix-unauthenticated-relaying/","title":"Unauthenticated Relaying","text":"

        By default, mailcow's postfix considers all networks untrusted except its own IPV4_NETWORK and IPV6_NETWORK ranges, which are specified in mailcow.conf. Although this is reasonable in most cases, there may be circumstances where you want to add a host or subnet as an unauthenticated relayer.

        By default, mailcow uses mynetworks_style = subnet to specify internal subnets and leaves mynetworks unconfigured.

        If you decide to set mynetworks independently in Postfix's extra.conf, Postfix will ignore the mynetworks_style setting. This means that you will have to add the IPv4 and IPv6 addresses used internally by mailcow (specified in mailcow.conf as IPV4_NETWORK and IPV6_NETWORK respectively), as well as the loopback subnets manually!

        Explanation

        The setting mynetworks allows registered hosts or subnets to send e-mails to the Postfix MTA WITHOUT authentication. This is especially useful if monitoring e-mails are to be sent from Linux servers in the same network without extra authentication.

        Danger

        A wrong setting of mynetworks allows your server to be used as an open relay. If this is abused, it will impair your ability to send email and it may take some time for this to subside.

        Example

        As an example, let's take the subnet 192.168.2.0/24, which we want to relay unauthenticated.

        Edit data/conf/postfix/extra.cf:

        mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 [fe80::]/10 172.22.1.0/24 [fd4d:6169:6c63:6f77::]/64 192.168.2.0/24\n

        Edit data/conf/rspamd/local.d/options.inc aswell:

        local_addrs = [127.0.0.0/8, ::ffff:127.0.0.0/104, ::1/128, fe80::/10, 172.22.1.0/24, fd4d:6169:6c63:6f77::/64, 192.168.2.0/24];\n

        Warning

        The subnets before our attached example subnet MUST exists before or after your entered values. Otherwise some mailcow components such as Watchdog or some Sieve Filters (such as Absence Agents) will not work and errors will occur during operation.

        Run the following command to apply your new settings:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart postfix-mailcow rspamd-mailcow\n
        docker-compose restart postfix-mailcow rspamd-mailcow\n

        Good to know!

        IPv6 addresses MUST be entered with [] (square brackets) as mynetworks parameters in this case. Otherwise they cannot be processed.

        Info

        More information about mynetworks can be found in the Postfix documentation.

        "},{"location":"manual-guides/Redis/u_e-redis/","title":"Redis","text":"

        Redis is used as a key-value store for rspamd's and (some of) mailcow's settings and data. If you are unfamiliar with redis please read the introduction to redis and maybe visit this wonderful guide on how to use it.

        "},{"location":"manual-guides/Redis/u_e-redis/#client","title":"Client","text":"

        To connect to the redis cli execute:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow redis-cli\n
        docker-compose exec redis-mailcow redis-cli\n
        "},{"location":"manual-guides/Redis/u_e-redis/#debugging","title":"Debugging","text":"

        Here are some useful commands for the redis-cli for debugging:

        "},{"location":"manual-guides/Redis/u_e-redis/#monitor","title":"MONITOR","text":"

        Listens for all requests received by the server in real time:

        docker compose (Plugin)docker-compose (Standalone) 
        #docker compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
        #docker-compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
        "},{"location":"manual-guides/Redis/u_e-redis/#keys","title":"KEYS","text":"

        Get all keys matching your pattern:

        KEYS *\n
        "},{"location":"manual-guides/Redis/u_e-redis/#ping","title":"PING","text":"

        Test a connection:

        127.0.0.1:6379> PING\nPONG\n

        If you want to know more, here is a cheat sheet.

        "},{"location":"manual-guides/Rspamd/u-e-rspamd-add-additional-modules/","title":"Add Additional Modules","text":"

        Download the module and save it in the following path: data/conf/rspamd/plugins.d/.

        Next, add any necessary configuration for your module to data/conf/rspamd/rspamd.conf.local. \\ If you have a module named my_plugin.lua, configuration might look like the following:

        # rspamd.conf.local\nmy_plugin {\n    some_setting = \"some value\";\n}\n

        If your module does not require any additional configuration, simply add an empty configuration block, for example:

        # rspamd.conf.local\nmy_plugin { }\n

        If you do not add a configuration block, the module will be automatically disabled, and the rspamd-mailcow container log will contain a message such as:

        mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: lua module my_plugin is enabled but has not been configured\nmailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: my_plugin disabling unconfigured lua module\n

        If you have successfully configured your module, the rspamd-mailcow container logs should show:

        mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:04:50 #1(main) <8ayxpf>; cfg; rspamd_init_lua_filters: init lua module my_plugin from /etc/rspamd/plugins.d//my_plugin.lua; digest: 5cb88961e5\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/","title":"Tweaks","text":""},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#spam-filter-thresholds-global","title":"Spam filter thresholds (global)","text":"

        Each user is able to change their spam rating individually. To define a new server-wide limit, edit data/conf/rspamd/local.d/actions.conf:

        reject = 15;\nadd_header = 8;\ngreylist = 7;\n

        Save the file and restart \"rspamd-mailcow\":

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Warning

        Existing settings of users will not be overwritten!

        To reset custom defined thresholds, run:

        docker compose (Plugin)docker-compose (Standalone) 
        source mailcow.conf\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# or:\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
        source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# or:\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#custom-reject-messages","title":"Custom reject messages","text":"

        The default spam reject message can be changed by adding a new file data/conf/rspamd/override.d/worker-proxy.custom.inc with the following content:

        reject_message = \"My custom reject message\";\n

        Save the file and restart Rspamd:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        While the above works for rejected mails with a high spam score, prefilter reject actions will ignore this setting. For these maps, the multimap module in Rspamd needs to be adjusted:

        1. Find prefilet reject symbol for which you want change message, to do it run: grep -R \"SYMBOL_YOU_WANT_TO_ADJUST\" /opt/mailcow-dockerized/data/conf/rspamd/

        2. Add your custom message as new line:

          GLOBAL_RCPT_BL {\ntype = \"rcpt\";\nmap = \"${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map\";\nregexp = true;\nprefilter = true;\naction = \"reject\";\nmessage = \"Sending mail to this recipient is prohibited by postmaster@your.domain\";\n}\n

        3. Save the file and restart Rspamd:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-tweaks/#discard-instead-of-reject","title":"Discard instead of reject","text":"

        If you want to silently drop a message, create or edit the file data/conf/rspamd/override.d/worker-proxy.custom.inc and add the following content:

        discard_on_reject = true;\n

        Restart Rspamd:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/","title":"Work with Spam Data","text":""},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#learn-spam-ham","title":"Learn Spam & Ham","text":"

        Rspamd learns mail as spam or ham when you move a message in or out of the junk folder to any mailbox besides trash. This is achieved by using the Sieve plugin \"sieve_imapsieve\" and parser scripts.

        Rspamd also auto-learns mail when a high or low score is detected (see https://rspamd.com/doc/configuration/statistic.html#autolearning). We configured the plugin to keep a sane ratio between spam and ham learns.

        The bayes statistics are written to Redis as keys BAYES_HAM and BAYES_SPAM.

        Besides bayes, a local fuzzy storage is used to learn recurring patterns in text or images that indicate ham or spam.

        You can also use Rspamd's web UI to learn ham and / or spam or to adjust certain settings of Rspamd.

        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#learn-spam-or-ham-from-existing-directory","title":"Learn Spam or Ham from existing directory","text":"

        You can use a one-liner to learn mail in plain-text (uncompressed) format:

        docker compose (Plugin)docker-compose (Standalone) 
        # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n
        # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n

        Consider attaching a local folder as new volume to rspamd-mailcow in docker-compose.yml and learn given files inside the container. This can be used as workaround to parse compressed data with zcat. Example:

        for file in /data/old_mail/.Junk/cur/*; do rspamc learn_spam < zcat $file; done\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-learned-data-bayes-neural","title":"Reset learned data (Bayes, Neural)","text":"

        You need to delete keys in Redis to reset learned data, so create a copy of your Redis database now:

        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#copy-of-redis-database","title":"Copy of Redis database","text":"
        # It is better to stop Redis before you copy the file.\ncp /var/lib/docker/volumes/mailcowdockerized_redis-vol-1/_data/dump.rdb /root/\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-bayes-data","title":"Reset Bayes data","text":"docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
        docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-neural-data","title":"Reset Neural data","text":"docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
        docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
        "},{"location":"manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#reset-fuzzy-data","title":"Reset Fuzzy data","text":"docker compose (Plugin)docker-compose (Standalone) 
        # We need to enter the redis-cli first:\ndocker compose exec redis-mailcow redis-cli\n# In redis-cli:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n
        # We need to enter the redis-cli first:\ndocker-compose exec redis-mailcow redis-cli\n# In redis-cli:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n

        Info

        If redis-cli complains about... 

        (error) ERR wrong number of arguments for 'del' command\n
        ...the key pattern was not found and thus no data is available to delete - it is fine.

        "},{"location":"manual-guides/Rspamd/u_e-rspamd-disable-greylisting/","title":"Disable Greylisting","text":"

        Info

        In this guide we assume the default mailcow path (/opt/mailcow-dockerized). The path in your installation may vary.

        Only messages with a higher Rspamd score will be considered to be greylisted (soft rejected).

        We do NOT recommend deactivating greylisting.

        However, if you see a valid reason to disable greylisting, you can disable it server-wide by editing the greylist.conf:

        /opt/mailcow-dockerized/data/conf/rspamd/local.d/greylist.conf

        Add the line:

        enabled = false;\n

        Save the file and restart \"rspamd-mailcow\":

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Greylisting is now deactivated serverwide!

        "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/","title":"General Settings","text":"

        Rspamd is used for AV handling, DKIM signing and SPAM handling. It's a powerful and fast filter system. For a more in-depth documentation on Rspamd please visit its own documentation.

        "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#ui-access","title":"UI access","text":"

        Rspamd offers a comprehensive WebUI, which is included in every mailcow: dockerized installation.

        The Rspamd UI is provided with a login, which is set to a random password during the initial installation to deny third party access.

        To be able to log in to the Rspamd UI, you must first set your own password for the Rspamd interface.

        You do this as follows:

        1. Log in to your mailcow UI as administrator.
        2. Switch to the tab (top left) System Configuration and there the sub-tab: Access Rspamd UI.
        3. Change the Rspamd UI password here, or set one.
        4. Go to https://${MAILCOW_HOSTNAME}/rspamd in a browser and log in!

        Further configuration options and documentation for the WebUI can be found here: https://rspamd.com/webui/

        "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#cli-tools","title":"CLI tools","text":"

        Rspamd offers a variety of commands that can be used via CLI.

        Enter the following commands to get an overview of these:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow rspamc --help\ndocker compose exec rspamd-mailcow rspamadm --help\n
        docker-compose exec rspamd-mailcow rspamc --help\ndocker-compose exec rspamd-mailcow rspamadm --help\n
        "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#increase-history-retention","title":"Increase history retention","text":"

        By default Rspamd keeps 1000 elements in the history.

        The history is stored compressed.

        It is recommended not to use a disproportionate high value here, try something along 5000 or 10000 and see how your server handles it:

        Edit data/conf/rspamd/local.d/history_redis.conf:

        nrows = 1000; # change this value\n

        Restart Rspamd afterwards:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n
        "},{"location":"manual-guides/Rspamd/u_e-rspamd-general/#wipe-all-ratelimit-keys","title":"Wipe all ratelimit keys","text":"

        If you don't want to use the UI and instead wipe all keys in the Redis database, you can use redis-cli for that task:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow sh\n# Unlink (available in Redis >=4.) will delete in the backgronud\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n
        docker-compose exec redis-mailcow sh\n# Unlink (available in Redis >=4.) will delete in the backgronud\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n

        Restart Rspamd:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/","title":"SOGo","text":"

        SOGo is used for accessing your mails via a webbrowser, adding and sharing your contacts or calendars. For a more in-depth documentation on SOGo please visit its own documentation.

        "},{"location":"manual-guides/SOGo/u_e-sogo/#apply-custom-sogo-theme","title":"Apply custom SOGo theme","text":"

        mailcow builds after 28 January 2021 can change SOGo's theme by editing data/conf/sogo/custom-theme.js. Please check the AngularJS Material intro and documentation as well as the material style guideline to learn how this works.

        You can use the provided custom-theme.js as an example starting point by removing the comments. After you modified data/conf/sogo/custom-theme.js and made changes to your new SOGo theme you need to

        1. edit data/conf/sogo/sogo.conf and append/set SOGoUIxDebugEnabled = YES;

        2. restart SOGo and Memcached containers by executing the command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow sogo-mailcow\n
        docker-compose restart memcached-mailcow sogo-mailcow\n

        3. open SOGo in browser

        4. open browser developer console, usually shortcut is F12

        5. only if you use Firefox: write by hands in dev console allow pasting and press enter

        6. paste java script snippet in dev console: 

        copy([].slice.call(document.styleSheets)\n  .map(e => e.ownerNode)\n  .filter(e => e.hasAttribute('md-theme-style'))\n  .map(e => e.textContent)\n  .join('\\n')\n)\n

        7. open text editor and paste data from clipboard (Ctrl+V), you should get minified CSS, save it

        8. copy CSS file to mailcow server data/conf/sogo/custom-theme.css

        9. edit data/conf/sogo/sogo.conf and set SOGoUIxDebugEnabled = NO;

        10. append/create docker-compose.override.yml with: 

        services:\n  sogo-mailcow:\n    volumes:\n      - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n

        11. Run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        12. Run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow\n
        docker-compose restart memcached-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#reset-to-sogo-default-theme","title":"Reset to SOGo default theme","text":"

        1. checkout data/conf/sogo/custom-theme.js by executing git fetch ; git checkout origin/master data/conf/sogo/custom-theme.js data/conf/sogo/custom-theme.js

        2. find in data/conf/sogo/custom-theme.js: 

        // Apply new palettes to the default theme, remap some of the hues\n    $mdThemingProvider.theme('default')\n      .primaryPalette('green-cow', {\n        'default': '400',  // background color of top toolbars\n        'hue-1': '400',\n        'hue-2': '600',    // background color of sidebar toolbar\n        'hue-3': 'A700'\n      })\n      .accentPalette('green', {\n        'default': '600',  // background color of fab buttons and login screen\n        'hue-1': '300',    // background color of center list toolbar\n        'hue-2': '300',    // highlight color for selected mail and current day calendar\n        'hue-3': 'A700'\n      })\n      .backgroundPalette('frost-grey');\n
        and replace it with: 
            $mdThemingProvider.theme('default');\n

        3. remove from docker-compose.override.yml volume mount in sogo-mailcow: 

        - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n

        4. Run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        5. Run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow\n
        docker-compose restart memcached-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#change-favicon","title":"Change favicon","text":"

        mailcow builds after 31 January 2021 can change SOGo's favicon by replacing data/conf/sogo/custom-favicon.ico for SOGo and data/web/favicon.png for mailcow UI. Note: You can use .png favicons for SOGo by renaming them to custom-favicon.ico. For both SOGo and mailcow UI favicons you need use one of the standard dimensions: 16x16, 32x32, 64x64, 128x128 and 256x256. After you replaced said file you need to restart SOGo and Memcached containers by executing:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow sogo-mailcow\n
        docker-compose restart memcached-mailcow sogo-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#change-logo","title":"Change logo","text":"

        mailcow builds after 21 December 2018 can change SOGo's logo by replacing or creating (if missing) data/conf/sogo/sogo-full.svg. After you replaced said file you need to restart SOGo and Memcached containers by executing:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow sogo-mailcow\n
        docker-compose restart memcached-mailcow sogo-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#connect-domains","title":"Connect domains","text":"

        Domains are usually isolated from eachother.

        You can change that by modifying data/conf/sogo/sogo.conf:

        Search... 

           // SOGoDomainsVisibility = (\n    //  (domain1.tld, domain5.tld),\n    //  (domain3.tld, domain2.tld)\n    // );\n
        ...and replace it by - for example:

            SOGoDomainsVisibility = (\n      (example.org, example.com, example.net)\n    );\n

        Restart SOGo:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart sogo-mailcow\n
        docker-compose restart sogo-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#enable-password-changing","title":"Enable password changing","text":"

        The password change option in SOGo is disabled by default because it:

        • doesn't take into account the password policy set in the mailcow UI
        • doesn't work when the user is logged in into SOGo using the Login to Webmail function in the mailcow UI (Auth Proxy)

        If you still want enable this option edit data/conf/sogo/sogo.conf and change SOGoPasswordChangeEnabled to YES. Please do not add a new parameter.

        Run this command to activate the changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart memcached-mailcow sogo-mailcow\n
        docker-compose restart memcached-mailcow sogo-mailcow\n
        "},{"location":"manual-guides/SOGo/u_e-sogo/#reset-totp-disable-totp","title":"Reset TOTP / Disable TOTP","text":"

        Run the following command from within the mailcow directory:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
        docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
        "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/","title":"Using an external DNS service","text":"

        If you want or have to use an external DNS service, you can either set a forwarder in Unbound or copy an override file to define external DNS servers:

        Warning

        Please do not use a public resolver like we did in the example above. Many - if not all - blacklist lookups will fail with public resolvers, because blacklist server has limits on how much requests can be done from one IP and public resolvers usually reach this limits. Important: Only DNSSEC validating DNS services will work.

        "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/#method-a-unbound","title":"Method A, Unbound","text":"

        Edit data/conf/unbound/unbound.conf and append the following parameters:

        forward-zone:\n  name: \".\"\n  forward-addr: 8.8.8.8 # DO NOT USE PUBLIC DNS SERVERS - JUST AN EXAMPLE\n  forward-addr: 8.8.4.4 # DO NOT USE PUBLIC DNS SERVERS - JUST AN EXAMPLE\n

        Restart Unbound:

        docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart unbound-mailcow\n
          docker-compose restart unbound-mailcow\n
        "},{"location":"manual-guides/Unbound/u_e-unbound-fwd/#method-b-override-file","title":"Method B, Override file","text":"
        cd /opt/mailcow-dockerized\ncp helper-scripts/docker-compose.override.yml.d/EXTERNAL_DNS/docker-compose.override.yml .\n

        Edit docker-compose.override.yml and adjust the IP.

        Afterwards stop and start the Docker Stack again:

        docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\n  docker compose up -d\n
          docker-compose down\n  docker-compose up -d\n
        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/","title":"Thresholds","text":"

        Watchdog uses default values for all thresholds defined in docker-compose.yml.

        The default values will work for most setups. Example: 

        - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}\n- UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}\n- REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}\n- MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}\n- MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}\n- SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}\n- POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}\n- CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}\n- DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}\n- DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}\n- PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}\n- RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}\n- FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}\n- ACME_THRESHOLD=${ACME_THRESHOLD:-1}\n- RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}\n- OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}\n- MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}\n- MAILQ_CRIT=${MAILQ_CRIT:-30}\n

        To adjust them just add necessary threshold variables (e.g. MAILQ_THRESHOLD=10) to mailcow.conf and run the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#thresholds-descriptions","title":"Thresholds descriptions","text":""},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#nginx_threshold","title":"NGINX_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to Nginx on port 8081 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#unbound_threshold","title":"UNBOUND_THRESHOLD","text":"

        Notifies administrators if Unbound can not resolve/valide external domains/DNSSEC and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#redis_threshold","title":"REDIS_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to Redis on port 6379 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_threshold","title":"MYSQL_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to MySQL or can not query a table and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_replication_threshold","title":"MYSQL_REPLICATION_THRESHOLD","text":"

        Notifies administrators if the MySQL replication fails.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#sogo_threshold","title":"SOGO_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to SOGo on port 20000 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#postfix_threshold","title":"POSTFIX_THRESHOLD","text":"

        Notifies administrators if watchdog can not sent a test mail via port 589 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#clamd_threshold","title":"CLAMD_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to Clamd and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_threshold","title":"DOVECOT_THRESHOLD","text":"

        Notifies administrators if watchdog fails with various tests with Dovecot container and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_repl_threshold","title":"DOVECOT_REPL_THRESHOLD","text":"

        Notifies administrators if the Dovecot replication fails.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#phpfpm_threshold","title":"PHPFPM_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to PHP-FPM on port 9001/9002 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#ratelimit_threshold","title":"RATELIMIT_THRESHOLD","text":"

        Notifies administrators if a ratelimit got hit.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#fail2ban_threshold","title":"FAIL2BAN_THRESHOLD","text":"

        Notifies administrators if a fail2ban banned an IP.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#acme_threshold","title":"ACME_THRESHOLD","text":"

        Notifies administrators if something is wrong with the acme-mailcow container. You may check its logs.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#rspamd_threshold","title":"RSPAMD_THRESHOLD","text":"

        Notifies administrators if watchdog fails with various tests with Rspamd container and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#olefy_threshold","title":"OLEFY_THRESHOLD","text":"

        Notifies administrators if watchdog can not establish a connection to olefy on port 10005 and it will restart the container automatically when issues were found and the threshold has been reached.

        "},{"location":"manual-guides/Watchdog/u_e-watchdog-thresholds/#mailq_crit-and-mailq_threshold","title":"MAILQ_CRIT and MAILQ_THRESHOLD","text":"

        Notifies administrators if number of emails in the postfix queue is greater then MAILQ_CRIT for period of MAILQ_THRESHOLD * (60\u00b130) seconds.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/","title":"Blacklist / Whitelist","text":"

        To add or edit an entry to your domain-wide filter table, log in to your mailcow UI as (domain) administrator and go to: Configuration > Email Setup > Domains > Edit Domain > Spam Filter.

        Info

        Be aware that a user can override this setting by setting their own blacklist and whitelist!

        There is also a global filter table in Configuration > Configuration & Details > Global filter maps to configure a server wide filter for multiple regex maps (todo: screenshots).

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-config/","title":"Configuration","text":"

        Several configuration parameters of the mailcow UI can be changed by creating a file data/web/inc/vars.local.inc.php which overrides defaults settings found in data/web/inc/vars.inc.php.

        The local configuration file is persistent over updates of mailcow. Try not to change values inside data/web/inc/vars.inc.php, but use them as template for the local override.

        mailcow UI configuration parameters can be used to...

        • ...change the default language1
        • ...change the default bootstrap theme
        • ...set a password complexity regex
        • ...enable DKIM private key visibility
        • ...set a pagination trigger size
        • ...set default mailbox attributes
        • ...change session lifetimes
        • ...create fixed app menus (which cannot be changed in mailcow UI)
        • ...set a default \"To\" field for relayhost tests
        • ...set a timeout for Docker API requests
        • ...toggle IP anonymization

        1. To change SOGos default language, you will need to edit data/conf/sogo/sogo.conf and replace \"English\" by your preferred language.\u00a0\u21a9

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-css/","title":"CSS overrides","text":"

        For custom overrides of specific elements via CSS, use data/web/css/build/0081-custom-mailcow.css.

        The file is excluded from tracking and persists over updates.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/","title":"WebAuthn / FIDO2","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#how-is-uv-handled-in-mailcow","title":"How is UV handled in mailcow?","text":"

        The UV flag (as in \"user verification\") enforces WebAuthn to verify the user before it allows access to the key (think of a PIN). We don't enforce UV to allow logins via iOS and NFC (YubiKey).

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#login-and-key-processing","title":"Login and key processing","text":"

        mailcow uses client-side key processing. We ask the authenticator (i.e. YubiKey) to save the registration in its memory.

        A user does not need to enter a username. The available credentials - if any - will be shown to the user when selecting the \"key login\" via mailcow UI login.

        When calling the login process, the authenticator is not given any credential IDs. This will force it to lookup credentials in its own memory.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#who-can-use-webauthn-to-login-to-mailcow","title":"Who can use WebAuthn to login to mailcow?","text":"

        As of today, only administrators and domain administrators are able to setup WebAuthn/FIDO2.

        You want to use WebAuthn/Fido as 2FA? Check it out here: Two-Factor Authentication

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/","title":"Forgot Password Feature","text":"

        Note

        This feature requires a mailcow installation at 2024-08!

        The currently installed patch level can be viewed in the mailcow versions since 2022 within the UI.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#preface","title":"Preface","text":"

        Thank You!

        This functionality was integrated into mailcow due to the Youth Foundation Baden-W\u00fcrttemberg (Germany) as part of a sponsored development in August 2024.

        Thank you for sponsoring this feature!

        With the \"Forgot Password\" function, mailbox users can request a link to reset their password by providing a backup email address and then reset their password.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#requirements","title":"Requirements","text":"

        To activate and use this feature for a user, the following must be noted:

        1. The mailcow administrator must have configured a sender email and a subject (see below). The sender email does not need to exist as a mailbox; however, the domain must be fully set up in mailcow to ensure that sending and especially delivery of emails is guaranteed.
        2. The mailbox user must have a backup email address set in their options. This can be done by the user themselves (if the corresponding ACL is not disabled) or by the administrator.
        3. The backup email should be different from the email address of the account for which the password is to be reset.
        4. The backup email must also be able to receive external emails and should, if possible, be from a different provider and not directly on the mailcow server (this point is optional and serves only as a recommendation).
        5. The user must have access to the backup email's mailbox since the links are only valid for a limited time.
        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#configuration-options-in-the-mailcow-ui","title":"Configuration Options in the mailcow UI","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#mailbox-settings","title":"Mailbox Settings","text":"

        This feature adds a new field to the mailbox options:

        Attention

        Reminder: This field MUST be filled in for the user to reset their password! If it is not set, they will not be able to reset their password!

        For administrators, there is a new ACL that can be set either per mailbox afterwards or as a template for mailboxes: Allow management of the password recovery email:

        Note

        If a user has already set a backup email but the admin removes this ACL from them, they can still reset their password since the backup email remains in the system. The ACL does not automatically forbid the possibility of resetting the password if there is an email!

        To achieve this, the backup email for the user must also be removed by an administrator.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#server-settings","title":"Server Settings","text":"

        The mailcow administrator can also edit the template for the \"Forgot Password\" emails, similar to the quota and quarantine emails, to customize how the emails are sent. By default, the template is always in English.

        This can be accessed under the tab: System -> Configuration -> Options -> Password Settings:

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#hidden-settings-not-in-the-mailcow-ui","title":"Hidden Settings (not in the mailcow UI)","text":"

        By default, each user can request a maximum of 3 password reset tokens, which are valid for 15 minutes.

        Server administrators can configure the expiration time and the maximum tokens per user.

        For this, a file named vars.local.inc.php must be created in the folder MAILCOW_ROOT/data/web/inc if it does not already exist.

        This file must contain at least the following:

        <?php\n\n// Maximum number of password reset tokens that can be generated at once per user\n$PW_RESET_TOKEN_LIMIT = 3; // Change this number to another value\n\n// Maximum time in minutes a password reset token is valid\n$PW_RESET_TOKEN_LIFETIME = 15; // Change this number to another value. Value in minutes\n

        The file is automatically loaded, no restart of mailcow or any of the containers is required!

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/","title":"Netfilter","text":""},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#change-netfilter-ban-settings","title":"Change Netfilter Ban Settings","text":"

        To change the Netfilter settings in general please navigate to: Configuration -> Configuration & Details -> Configuration -> Fail2ban parameters.

        You should now see a familar interface:

        Here you can set several options regarding the bans itself. For example the max. Ban time or the max. attempts before a ban is executed.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#change-netfilter-regex","title":"Change Netfilter Regex","text":"

        Danger

        The following area requires at least basic regex knowledge. If you are not sure what you are doing there, we can only advise you not to attempt a reconfiguration.

        In addition to the ban settings, you can also define what exactly should be used from the mailcow container logs to ban a possible attacker.

        To do this, you must first expand the regex field, which will look something like this:

        There you can now create various new filter rules.

        Info

        As updates progress, it is possible that new Netfilter regex rules will be added or removed. If this is the case, it is recommended to reset the Netfilter regex rules by clicking on Reset to default.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#provide-netfilter-decisions-via-url-as-source-for-firewall-block-rules","title":"Provide Netfilter decisions via URL as source for firewall block rules","text":"

        Info

        However, the option is deactivated by default and must first be activated by you.

        Since the 2023-12 update, mailcow offers the possibility to export the netfilter decisions as an external endpoint in order to be able to integrate the data from it into an external firewall system, quasi as a blocklist source.

        What does this function do for me?

        With this functionality, you can forward the IPs marked as blocked by Netfilter to an endpoint, which can then process these IPs. For example, an OPNsense firewall can dynamically load this list.

        Let's take a look at these settings:

        To activate the general function, the checkbox Manage Fail2Ban externally must be checked.

        As soon as this is done, the URL (point 2) can be copied and pasted into the respective endpoint.

        Important

        The URL can be regenerated if required. To do this, click on the symbol next to Copy Reload symbol.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/","title":"Notification templates","text":"

        mailcow uses the template engine Jinja for the notification mails. Placeholders can be used to create dynamic content with these templates by replacing them with passed variables during execution. A documentation about the development of Jinja templates can be found here.

        The following variables can be used for the notification email templates:

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quarantine-template","title":"Quarantine template","text":"

        The provided variables can also be obtained on GitHub from the script dovecot/quarantine_notify.py.

        Info

        As an administrator, you can edit the template for the quarantine mails in the mailcow user interface in the global quarantine settings and restore the default template there as well. Code examples can be found in the default template. It can also be viewed on GitHub.

        Name Content username E-mail address of the mailbox user counter Number of messages in the quarantine, about which this e-mail informs hostname Name of the mailcow instance (See also the environment variable MAILCOW_HOSTNAME) quarantine_acl Quarantine ACL setting of the mailbox user (Permission to process the mails in the quarantine) meta Array/list of all messages in the quarantine about which this e-mail informs meta.qhash Hash value of the quarantine entry (e.g. for direct link to the message in the quarantine) meta.id ID of the quarantine entry meta.subject Title of the quarantine entry meta.score Spam score of the quarantine entry meta.sender Sender address of the quarantine entry meta.created Creation date of the quarantine entry / receipt of the e-mail meta.action Action of the spam filter (moved to spam folder or quarantine)."},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quota-template","title":"Quota template","text":"

        The provided variables can also be obtained on GitHub from the script dovecot/quota_notify.py.

        Info

        The template for the quota mails can be edited as an administrator in the mailcow user interface in the quota settings and there also restore the default template. Code examples can be found in the default template. It can also be viewed on GitHub.

        Name Content username E-mail address of the mailbox user percent Percentage of the occupied space of the mailbox"},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-pushover/","title":"Pushover","text":"

        Info

        Pushover makes it easy to get real-time notifications on your Android, iPhone, iPad, and Desktop

        You can use Pushover to get a push notification on every mail you receive for each mailbox where you enabled this feature.

        1. As admin open your mailbox' settings and scroll down to the Pushover settings

        2. Register yourself on Pushover

        3. Put your 'User Key' in the 'User/Group Key' field in your mailbox settings

        4. Create an Applications to get the API Token/Key which you also need to put in your mailbox settings

        5. Optional you can edit the notification title/text and define certain sender email addresses where a push notification is triggered

        6. Save everything and then you can verify your credentials

        If everything is done you can test sending a mail and you will receive a push message on your phone

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-spamalias/","title":"Temporary email aliases","text":"

        These temporary email aliases are mostly used for places where we need to provide an email address but don't want future correspondence with. They are also called spam alias.

        To create, delete or extend a temporary email aliases you need to login to mailcow's UI as a mailbox user and navigate to the tab Temporary email aliases:

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-spamfilter/","title":"Spamfilter","text":"

        A mailbox user may adjust the spam filter and black- / whitelist settings for his mailbox individually by navigating to the Spam filter tab in the users mailcow UI.

        Info

        For global adjustments on your spam filter please check our section on Rspamd. For a domain wide black- and whitelist please check our guide on Black / Whitelist

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/","title":"Sub-addressing","text":"

        Mailbox users can tag their mail address like in me+facebook@example.org. They can control the tag handling in the users mailcow UI panel under Mailbox > Settings.

        sub-addressing (RFC 5233) or plus addressing also known as tagging (do not mix with Tags)

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/#available-actions","title":"Available Actions","text":"

        1. Move this message to a sub folder \"facebook\" (will be created lower case if not existing)

        2. Prepend the tag to the subject: \"[facebook] Subject\"

        Please note: Uppercase tags are converted to lowercase except for the first letter. If you want to keep the tag as it is, please apply the following diff and restart mailcow: 

        diff --git a/data/conf/dovecot/global_sieve_after b/data/conf/dovecot/global_sieve_after\nindex e047136e..933c4137 100644\n--- a/data/conf/dovecot/global_sieve_after\n+++ b/data/conf/dovecot/global_sieve_after\n@@ -15,7 +15,7 @@ if allof (\n   envelope :detail :matches \"to\" \"*\",\n   header :contains \"X-Moo-Tag\" \"YES\"\n   ) {\n-  set :lower :upperfirst \"tag\" \"${1}\";\n+  set \"tag\" \"${1}\";\n   if mailboxexists \"INBOX/${1}\" {\n     fileinto \"INBOX/${1}\";\n   } else {\n

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/","title":"Tags (for Domains and Mailboxes)","text":"

        Info

        You need the mailcow Version 2022-05 at least for this feature. If you don\u00b4t have the Version installed please consider a update. For more informations about a mailcow update please take a look at the Update section here in the docs.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#what-are-tags-designed-for","title":"What are Tags designed for?","text":"

        With the Tags you can easily sort your Domains and Mailboxes by the tags instead of their name.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#where-are-the-tags-located","title":"Where are the Tags located?","text":"

        The Tags are located in the Domain/Mailbox section of the mailcow UI. To view them simply click on the small plus symbol on the left of your Domain/Mailbox (following picture is showing the domain ribbon menu):

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#how-can-i-addremove-a-tag","title":"How can i add/remove a Tag?","text":"

        You can simply add/remove a Tag during the creation of a new Domain/Mailbox. You also can add/remove them if you edit your desired Domain/Mailbox.

        It looks similar to this (following picture showing the domain edit section):

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#how-can-i-search-for-a-tag","title":"How can i search for a tag?","text":"

        Simply type the Tag Name in the search bar in the Domain/Mailbox Section and wait for it to complete.

        You can even specify if you want to search for tags only.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/","title":"Two-Factor Authentication","text":"

        So far three methods for Two-Factor Authentication are implemented: WebAuthn (replacing U2F since February 2022), Yubi OTP, and TOTP

        • For WebAuthn to work, you need an encrypted connection to the server (HTTPS) as well as a FIDO security key.
        • Both WebAuthn and Yubi OTP work well with the fantastic Yubikey.
        • While Yubi OTP needs an active internet connection and an API ID + key, WebAuthn will work with any Fido Security Key out of the box, but can only be used when mailcow is accessed over HTTPS.
        • WebAuthn and Yubi OTP support multiple keys per user.
        • As the third TFA method mailcow uses TOTP: time-based one-time passwords. Those passwords can be generated with apps like \"Google Authenticator\" after initially scanning a QR code or entering the given secret manually.

        As administrator you are able to temporary disable a domain administrators TFA login until they successfully logged in.

        The key used to login will be displayed in green, while other keys remain grey.

        Information on how to remove 2FA can be found here.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#yubi-otp","title":"Yubi OTP","text":"

        The Yubi API ID and Key will be checked against the Yubico Cloud API. When setting up TFA you will be asked for your personal API account for this key. The API ID, API key and the first 12 characters (your YubiKeys ID in modhex) are stored in the MySQL table as secret.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#example-setup","title":"Example setup","text":"

        First of all, the YubiKey must be configured for use as an OTP Generator. To do this, download the YubiKey Manager from the Yubico website: here

        In the following you configure the YubiKey for OTP. Via the menu item Applications -> OTP and a click on the Configure button. In the following menu select Credential Type -> Yubico OTP and click on Next.

        Set a checkmark in the Use serial checkbox, generate a Private ID and a Secret key via the buttons. So that the YubiKey can be validated later, the checkmark in the Upload checkbox must also be set and then click on Finish.

        Now a new browser window will open in which you have to enter an OTP of your YubiKey at the bottom of the form (click on the field and then tap on your YubiKey). Confirm the captcha and upload the information to the Yubico server by clicking 'Upload'. The processing of the data will take a moment.

        After the generation was successful, you will be shown a Client ID and a Secret key, make a note of this information in a safe place.

        Now you can select Yubico OTP authentication from the dropdown menu in the mailcow UI on the start page under Access -> Two-factor authentication. In the dialog that opened now you can enter a name for this YubiKey and insert the Client ID you noted before as well as the Secret key into the fields provided. Finally, enter your current account password and, after selecting the Touch Yubikey field, touch your YubiKey button.

        Congratulations! You can now log in to the mailcow UI using your YubiKey!

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#webauthn-u2f-replacement","title":"WebAuthn (U2F, replacement)","text":"

        Warning

        Since February 2022 Google Chrome has discarded support for U2F and standardized the use of WebAuthn. The WebAuthn (U2F removal) is part of mailcow since 21th January 2022, so if you want to use the Key past February 2022 please consider a update with the update.sh

        To use WebAuthn, the browser must support this standard.

        The following desktop browsers support this authentication type:

        • Edge (>=18)
        • Firefox (>=60)
        • Chrome (>=67)
        • Safari (>=13)
        • Opera (>=54)

        The following mobile browsers support this authentication type:

        • Safari on iOS (>=14.5)
        • Android Browser (>=97)
        • Opera Mobile (>=64)
        • Chrome for Android (>=97)

        Sources: caniuse.com, blog.mozilla.org

        WebAuthn works without an internet connection.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#what-will-happen-to-my-registered-fido-security-key-after-the-update-from-u2f-to-webauthn","title":"What will happen to my registered Fido Security Key after the Update from U2F to WebAuthn?","text":"

        Warning

        With this new U2F replacement (WebAuthn) you have to re-register your Fido Security Key, thankfully WebAuthn is backwards compatible and supports the U2F protocol.

        Ideally, the next time you log in (with the key), you should get a text box saying that your Fido Security Key has been removed due to the update to WebAuthn and deleted as a 2-factor authenticator.

        But don't worry! You can simply re-register your existing key and use it as usual, you probably won't even notice a difference, except that your browser won't show the U2F deactivation message anymore.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#disable-unofficial-supported-fido-security-keys","title":"Disable unofficial supported Fido Security Keys","text":"

        With WebAuthn there is the possibility to use only official Fido Security Keys (from the big brands like: Yubico, Apple, Nitro, Google, Huawei, Microsoft, etc.).

        This is primarily for security purposes, as it allows administrators to ensure that only official hardware can be used in their environment.

        To enable this feature, change the value WEBAUTHN_ONLY_TRUSTED_VENDORS in mailcow.conf from n to y and restart the affected containers with the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        The mailcow will now use the Vendor Certificates located in your mailcow directory under data/web/inc/lib/WebAuthn/rootCertificates.

        Example

        If you want to limit the official Vendor devices to Apple only you only need the Apple Vendor Certificate inside the data/web/inc/lib/WebAuthn/rootCertificates. After you deleted all other certs you now only can activate WebAuthn 2FA with Apple devices.

        Every vendor (listed there) behaves the same, so choose what you like (if you want to).

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#use-own-certificates-for-webauthn","title":"Use own certificates for WebAuthn","text":"

        If you have a valid certificate from the vendor of your key you can also add it to your mailcow!

        Just copy the certificate into the data/web/inc/lib/WebAuthn/rootCertificates folder and restart your mailcow.

        Now you should be able to register this device as well, even though the verification for the vendor certificates is enabled, since you just added the certificate manually.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#is-it-dangerous-to-keep-the-vendor-check-disabled","title":"Is it dangerous to keep the Vendor Check disabled?","text":"

        No, it isn\u00b4t! These vendor certificates are only used to verify original hardware, not to secure the registration process.

        As you can read in these articles, the deactivation is not software security related:

        • https://developers.yubico.com/U2F/Attestation_and_Metadata/
        • https://medium.com/webauthnworks/webauthn-fido2-demystifying-attestation-and-mds-efc3b3cb3651
        • https://medium.com/webauthnworks/sorting-fido-ctap-webauthn-terminology-7d32067c0b01

        In the end, however, it is of course your decision to leave this check disabled or enabled.

        "},{"location":"manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#totp","title":"TOTP","text":"

        The best known TFA method mostly used with a smartphone.

        To setup the TOTP method login to the Admin UI and select Time-based OTP (TOTP) from the list.

        Now a modal will open in which you have to type in a name for your 2FA \"device\" (example: John Deer\u00b4s Smartphone) and the password of the affected Admin account (you are currently logged in with).

        You have two seperate methods to register TOTP to your account: 1. Scan the QR-Code with your Authenticator App on a Smartphone or Tablet. 2. Use the TOTP Code (under the QR Code) in your TOTP Program or App (if you can\u00b4t scan a QR Code).

        After you have registered the QR or TOTP code in the TOTP app/program of your choice you only need to enter the now generated TOTP token (in the app/program) as confirmation in the mailcow UI to finally activate the TOTP 2FA, otherwise it will not be activated even though the TOTP token is already generated in your app/program.

        "},{"location":"models/model-acl/","title":"ACL","text":"

        Editing a domain administrator or a mailbox user allows to set restrictions to that account.

        Important: For overlapping modules like sync jobs, which both domain administrators and mailbox users can be granted access to, the domain administrators permissions are inherited, when logging in as mailbox user.

        Some examples:

        1.

        • A domain administror has not access to sync jobs but can login as mailbox user
        • When logging in as mailbox user, he does not gain access to sync jobs, even if the given mailbox user has access when logging in directly

        2.

        • A domain administror has access to sync jobs and can login as mailbox user
        • The mailbox user he tries to login as has not access to sync jobs
        • The domain administrator, now logged in as mailbox user, inherits its permission to the mailbox user and can access sync jobs

        3.

        • A domain administrator logs in as mailbox user
        • Every permission, that does not exist in a domain administrators ACL, is automatically granted (example: time-limited alias, TLS policy etc.)
        "},{"location":"models/model-passwd/","title":"Password hashing","text":""},{"location":"models/model-passwd/#fully-supported-hashing-methods","title":"Fully supported hashing methods","text":"

        The most current mailcow fully supports the following hashing methods. The default hashing method is written in bold:

        • BLF-CRYPT
        • SSHA
        • SSHA256
        • SSHA512

        The methods above can be used in mailcow.conf as MAILCOW_PASS_SCHEME value.

        "},{"location":"models/model-passwd/#read-only-hashing-methods","title":"Read-only hashing methods","text":"

        The following methods are supported read only. If you plan to use SOGo (as per default), you need a SOGo compatible hashing method. Please see the note at the bottom of this page how to update the view if necessary. With SOGo disabled, all hashing methods below will be able to be read by mailcow and Dovecot.

        • ARGON2I (SOGo compatible)
        • ARGON2ID (SOGo compatible)
        • CLEAR
        • CLEARTEXT
        • CRYPT (SOGo compatible)
        • DES-CRYPT
        • LDAP-MD5 (SOGo compatible)
        • MD5 (SOGo compatible)
        • MD5-CRYPT (SOGo compatible)
        • PBKDF2 (SOGo compatible)
        • PLAIN (SOGo compatible)
        • PLAIN-MD4
        • PLAIN-MD5
        • PLAIN-TRUNC
        • SHA (SOGo compatible)
        • SHA1 (SOGo compatible)
        • SHA256 (SOGo compatible)
        • SHA256-CRYPT (SOGo compatible)
        • SHA512 (SOGo compatible)
        • SHA512-CRYPT (SOGo compatible)
        • SMD5 (SOGo compatible)

        That means mailcow is able to verify users with a hash like {MD5}1a1dc91c907325c69271ddf0c944bc72 from the database.

        The value of MAILCOW_PASS_SCHEME will always be used to encrypt new passwords.

        I changed the password hashes in the \"mailbox\" SQL table and cannot login.

        A \"view\" needs to be updated. You can trigger this by restarting sogo-mailcow:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart sogo-mailcow\n
        docker-compose restart sogo-mailcow\n
        "},{"location":"models/model-sender_rcv/","title":"Sender and receiver model","text":"

        When a mailbox is created, a user is allowed to send mail from and receive mail for his own mailbox address.

        Mailbox me@example.org is created. example.org is a primary domain.\nNote: a mailbox cannot be created in an alias domain.\n\nme@example.org is only known as me@example.org.\nme@example.org is allowed to send as me@example.org.\n

        We can add an alias domain for example.org:

        Alias domain alias.com is added and assigned to primary domain example.org.\nme@example.org is now known as me@example.org and me@alias.com.\nme@example.org is now allowed to send as me@example.org and me@alias.com.\n

        We can add aliases for a mailbox to receive mail for and to send from this new address.

        It is important to know, that you are not able to receive mail for my-alias@my-alias-domain.tld. You would need to create this particular alias.

        me@example.org is assigned the alias alias@example.org\nme@example.org is now known as me@example.org, me@alias.com, alias@example.org\n\nme@example.org is NOT known as alias@alias.com.\n

        Please note that this does not apply to catch-all aliases:

        Alias domain alias.com is added and assigned to primary domain example.org\nme@example.org is assigned the catch-all alias @example.org\nme@example.org is still just known as me@example.org, which is the only available send-as option\n\nAny email send to alias.com will match the catch-all alias for example.org\n

        Administrators and domain administrators can edit mailboxes to allow specific users to send as other mailbox users (\"delegate\" them).

        You can choose between mailbox users or completely disable the sender check for domains.

        "},{"location":"models/model-sender_rcv/#sogo-mail-from-addresses","title":"SOGo \"mail from\" addresses","text":"

        Mailbox users can, obviously, select their own mailbox address, as well as all alias addresses and aliases that exist through alias domains.

        If you want to select another existing mailbox user as your \"mail from\" address, this user has to delegate you access through SOGo (see SOGo documentation). Moreover a mailcow (domain) administrator needs to grant you access as described above.

        "},{"location":"post_installation/firststeps-authorize_watchdog_and_bounces/","title":"Authorize Watchdog and Bounce Mails","text":"

        mailcow uses MAILCOW_HOSTNAME as the sender domain to send watchdog notifications and compose bounce emails.

        1. WATCHDOG_NOTIFY_EMAIL should point to external recipients, managed by another mail server. This is very important because the watchdog notifies you about system outages. If this happens, your instance might not be capable of accepting or displaying this notification.
        2. Since the watchdog is designed to work in any situation, including cases when Postfix, Rspamd, or Redis is not functioning, we send emails directly via the watchdog container to the recipient's MX without any DKIM signing.

        To properly send watchdog notifications and bounces to external mail servers, you need to configure SPF and DMARC for MAILCOW_HOSTNAME (replace mail.example.com and the IPs to reflect your setup):

        _dmarc.mail.example.com IN TXT \"v=DMARC1; p=reject\"\nmail.example.com IN TXT \"v=spf1 ip4:192.0.2.146/32 ip6:2001:db8::1/128 -all\"\n

        Info

        If you want, later you can use this SPF as an include on other domains as: 

        example.com IN TXT \"v=spf1 include:mail.example.com -all\"\n

        "},{"location":"post_installation/firststeps-disable_ipv6/","title":"Disable IPv6","text":"

        Danger

        In installations using a Docker version between 25.0.0 and 25.0.2 (to check, use docker version) the behavior of IPv6 address allocation has changed due to a bug. Simply using enable_ipv6: false is NO LONGER sufficient to completely disable IPv6 in the stack. This was a bug in the Docker Daemon, which has been fixed with version 25.0.3.

        This is ONLY recommended if you do not have an IPv6 enabled network on your host!

        If you really need to, you can disable the usage of IPv6 in the compose file. Additionally, you can also disable the startup of container \"ipv6nat-mailcow\", as it's not needed if you won't use IPv6.

        Instead of editing docker-compose.yml directly, it is preferable to create an override file for it and implement your changes to the service there. Unfortunately, this right now only seems to work for services, not for network settings.

        To disable IPv6 on the mailcow network, open docker-compose.yml with your favourite text editor and search for the network section (it's near the bottom of the file).

        1. Modify docker-compose.yml

        Change enable_ipv6: true to enable_ipv6: false and comment out the IPv6 subnet:

        networks:\n  mailcow-network:\n    [...]\n    enable_ipv6: true # <<< set to false\n    ipam:\n      driver: default\n      config:\n        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24\n        - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64} # <<< comment out with #\n    [...]\n

        2. Disable ipv6nat-mailcow

        To disable the ipv6nat-mailcow container as well, go to your mailcow directory and create a new file called \"docker-compose.override.yml\":

        NOTE: If you already have an override file, of course don't recreate it, but merge the lines below into your existing one accordingly!

        # cd /opt/mailcow-dockerized\n# touch docker-compose.override.yml\n

        Open the file in your favourite text editor and fill in the following:

        services:\n\n    ipv6nat-mailcow:\n      image: bash:latest\n      restart: \"no\"\n      entrypoint: [\"echo\", \"ipv6nat disabled in compose.override.yml\"]\n

        For these changes to be effective, you need to fully stop and then restart the stack, so containers and networks are recreated:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n

        3. Disable IPv6 in unbound-mailcow

        Edit data/conf/unbound/unbound.conf and set do-ip6 to \"no\":

        server:\n  [...]\n  do-ip6: no\n  [...]\n

        Restart Unbound:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart unbound-mailcow\n
        docker-compose restart unbound-mailcow\n

        4. Disable IPv6 in postfix-mailcow

        Create data/conf/postfix/extra.cf and set smtp_address_preference to ipv4:

        smtp_address_preference = ipv4\ninet_protocols = ipv4\n

        Restart Postfix:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart postfix-mailcow\n
        docker-compose restart postfix-mailcow\n

        5. If your docker daemon completly disabled IPv6:

        Fix the following NGINX, Dovecot and php-fpm config files

        sed -i '/::/d' data/conf/nginx/templates/listen*\nsed -i '/::/d' data/conf/nginx/dynmaps.conf\nsed -i 's/,\\[::\\]//g' data/conf/dovecot/dovecot.conf\nsed -i 's/\\[::\\]://g' data/conf/phpfpm/php-fpm.d/pools.conf\n
        "},{"location":"post_installation/firststeps-dmarc_reporting/","title":"DMARC Reporting","text":"

        DMARC Reporting done via Rspamd DMARC Module.

        Rspamd documentation can be found here: https://rspamd.com/doc/modules/dmarc.html

        Important:

        1. Change example.com, mail.example.com and Example to reflect your setup

        2. DMARC reporting requires additional attention, especially over the first few days

        3. All receiving domains hosted on mailcow send from one reporting domain. It is recommended to use the parent domain of your MAILCOW_HOSTNAME:

          • If your MAILCOW_HOSTNAME is mail.example.com change the following config to domain = \"example.com\";
          • Set email equally, e.g. email = \"noreply-dmarc@example.com\";

        4. It is optional but recommended to create an email user noreply-dmarc in mailcow to handle bounces.

        "},{"location":"post_installation/firststeps-dmarc_reporting/#enable-dmarc-reporting","title":"Enable DMARC reporting","text":"

        Create the file data/conf/rspamd/local.d/dmarc.conf and set the following content:

        reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    domain = 'example.com';\n    org_name = 'Example';\n    helo = 'rspamd';\n    smtp = 'postfix';\n    smtp_port = 25;\n    from_name = 'Example DMARC Report';\n    msgid_from = 'rspamd.mail.example.com';\n    max_entries = 2k;\n    keys_expire = 2d;\n}\n

        Create or modify docker-compose.override.yml in the mailcow-dockerized base directory:

        services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"@every 24h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

        Start the mailcow stack with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-dmarc_reporting/#send-a-copy-reports-to-yourself","title":"Send a copy reports to yourself","text":"

        To receive a hidden copy of reports generated by Rspamd you can set a bcc_addrs list in the reporting config section of data/conf/rspamd/local.d/dmarc.conf:

        reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    bcc_addrs = [\"noreply-dmarc@example.com\",\"parsedmarc@example.com\"];\n[...]\n

        Rspamd will load changes in real time, so you won't need to restart the container at this point.

        This can be useful if you...

        • ...want to check that your DMARC reports are sent correctly and authenticated.
        • ...want to analyze your own reports to get statistics, i.e. to use with ParseDMARC or other analytic systems.
        "},{"location":"post_installation/firststeps-dmarc_reporting/#troubleshooting","title":"Troubleshooting","text":"

        Check when the report schedule last ran:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n
        docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n

        See the latest report output:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n
        docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n

        Manually trigger a DMARC report:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow rspamadm dmarc_report\n
        docker-compose exec rspamd-mailcow rspamadm dmarc_report\n

        Validate that Rspamd has recorded data in Redis: Change 20220428 to date which you interested in.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n
        docker-compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n

        Take one of the lines from output you interested in and request it, f.e.:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
        docker-compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
        "},{"location":"post_installation/firststeps-dmarc_reporting/#change-dmarc-reporting-frequency","title":"Change DMARC reporting frequency","text":"

        In the example above reports are sent once every 24 hours and send reports for yesterday. This will be okay for most setups.

        If you have a large mail volume and want to run the DMARC reporting more than once a day you need create second schedule and run it with dmarc_report $(date '+%Y%m%d') to process the current day. You have to make sure that the first run on each day also processes the last report from the day before, so it needs to be started twice, one time with $(date --date yesterday '+%Y%m%d') at 0 5 0 * * * (00:05 AM) and then with $(date '+%Y%m%d') with desired interval.

        The Ofelia schedule has the same implementation as cron in Go, supported syntax described at cron Documentation

        To change schedule:

        1. Edit docker-compose.override.yml:
        services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"0 5 0 * * *\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.schedule: \"@every 12h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

        1. Restart the desired containers with:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

        2. Restart the ofelia container only:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart ofelia-mailcow\n
          docker-compose restart ofelia-mailcow\n
        "},{"location":"post_installation/firststeps-dmarc_reporting/#disable-dmarc-reporting","title":"Disable DMARC Reporting","text":"

        To disable reporting:

        1. Set enabled to false in data/conf/rspamd/local.d/dmarc.conf

        2. Revert changes done in docker-compose.override.yml to rspamd-mailcow and ofelia-mailcow

        3. Restart the desired containers with:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ip_bindings/","title":"IP bindings","text":"

        Warning

        Changing the binding does not affect source NAT. See SNAT for required steps.

        "},{"location":"post_installation/firststeps-ip_bindings/#ipv4-binding","title":"IPv4 binding","text":"

        To adjust one or multiple IPv4 bindings, open mailcow.conf and edit one, multiple or all variables as per your needs:

        # For technical reasons, http bindings are a bit different from other service bindings.\n# You will find the following variables, separated by a bind address and its port:\n# Example: HTTP_BIND=1.2.3.4\n\nHTTP_PORT=80\nHTTP_BIND=\nHTTPS_PORT=443\nHTTPS_BIND=\n\n# Other services are bound by using the following format:\n# SMTP_PORT=1.2.3.4:25 will bind SMTP to the IP 1.2.3.4 on port 25\n# Important! Specifying an IPv4 address will skip all IPv6 bindings since Docker 20.x.\n# doveadm, SQL as well as Solr are bound to local ports only, please do not change that, unless you know what you are doing.\n\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nIMAP_PORT=143\nIMAPS_PORT=993\nPOP_PORT=110\nPOPS_PORT=995\nSIEVE_PORT=4190\nDOVEADM_PORT=127.0.0.1:19991\nSQL_PORT=127.0.0.1:13306\nSOLR_PORT=127.0.0.1:18983\n

        To apply your changes, run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n
        "},{"location":"post_installation/firststeps-ip_bindings/#ipv6-binding","title":"IPv6 binding","text":"

        Changing IPv6 bindings is different from IPv4. Again, this has a technical background.

        A docker-compose.override.yml file will be used instead of editing the docker-compose.yml file directly. This is to maintain updatability, as the docker-compose.yml file gets updated regularly and your changes will most likely be overwritten.

        Edit to create a file docker-compose.override.yml with the following content. Its content will be merged with the productive docker-compose.yml file.

        An example IPv6 2001:db8:dead:beef::123 is given. The first suffix :PORT1 defines the external port, while the second suffix :PORT2 routes to the corresponding port inside the container and must not be changed.

        services:\n\n    dovecot-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:143:143'\n        - '[2001:db8:dead:beef::123]:993:993'\n        - '[2001:db8:dead:beef::123]:110:110'\n        - '[2001:db8:dead:beef::123]:995:995'\n        - '[2001:db8:dead:beef::123]:4190:4190'\n\n    postfix-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:25:25'\n        - '[2001:db8:dead:beef::123]:465:465'\n        - '[2001:db8:dead:beef::123]:587:587'\n\n    nginx-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:80:80'\n        - '[2001:db8:dead:beef::123]:443:443'\n

        To apply your changes, run the commands below:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n
        "},{"location":"post_installation/firststeps-local_mta/","title":"Local MTA on Docker host","text":"

        The easiest option would be to disable the listener on port 25/tcp.

        Postfix users disable the listener by commenting the following line (starting with smtp or 25) in /etc/postfix/master.cf: 

        #smtp      inet  n       -       -       -       -       smtpd\n

        Furthermore, to relay over a dockerized mailcow, you may want to add 172.22.1.1 as relayhost and remove the Docker interface from \"inet_interfaces\":

        postconf -e 'relayhost = 172.22.1.1'\npostconf -e \"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128\"\npostconf -e \"inet_interfaces = loopback-only\"\npostconf -e \"relay_transport = relay\"\npostconf -e \"default_transport = smtp\"\n

        Now it is important to not have the same FQDN in myhostname as you use for your dockerized mailcow. Check your local (non-Docker) Postfix' main.cf for myhostname and set it to something different, for example local.my.fqdn.tld.

        \"172.22.1.1\" is the mailcow created network gateway in Docker. Relaying over this interface is necessary (instead of - for example - relaying directly over ${MAILCOW_HOSTNAME}) to relay over a known internal network.

        Restart Postfix after applying your changes.

        "},{"location":"post_installation/firststeps-logging/","title":"Logging","text":"

        Logging in mailcow: dockerized consists of multiple stages, but is, after all, much more flexible and easier to integrate into a logging daemon than before.

        In Docker the containerized application (PID 1) writes its output to stdout. For real one-application containers this works just fine. Run the command below to learn more:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs --help\n
        docker-compose logs --help\n

        Some containers log or stream to multiple destinations.

        No container will keep persistent logs in it. Containers are transient items!

        In the end, every line of logs will reach the Docker daemon - unfiltered.

        The default logging driver is \"json\".

        "},{"location":"post_installation/firststeps-logging/#filtered-logs","title":"Filtered logs","text":"

        Some logs are filtered and written to Redis keys but also streamed to a Redis channel.

        The Redis channel is used to stream logs with failed authentication attempts to be read by netfilter-mailcow.

        The Redis keys are persistent and will keep 10000 lines of logs for the web UI.

        This mechanism makes it possible to use whatever Docker logging driver you want to, without losing the ability to read logs from the UI or ban suspicious clients with netfilter-mailcow.

        Redis keys will only hold logs from applications and filter out system messages (think of cron etc.).

        "},{"location":"post_installation/firststeps-logging/#logging-drivers","title":"Logging drivers","text":""},{"location":"post_installation/firststeps-logging/#via-docker-composeoverrideyml","title":"Via docker-compose.override.yml","text":"

        Here is the good news: Since Docker has some great logging drivers, you can integrate mailcow: dockerized into your existing logging environment with ease.

        Create a docker-compose.override.yml and add, for example, this block to use the \"gelf\" logging plugin for postfix-mailcow:

        services:\n  postfix-mailcow: # or any other\n    logging:\n      driver: \"gelf\"\n      options:\n        gelf-address: \"udp://graylog:12201\"\n

        Another example for Syslog:

        services:\n\n  postfix-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  dovecot-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  rspamd-mailcow: # or any other\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n
        "},{"location":"post_installation/firststeps-logging/#for-rsyslog-only","title":"For Rsyslog only:","text":"

        Make sure the following lines aren't commented out in /etc/rsyslog.conf:

        # provides UDP syslog reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n

        To move local3 input to /var/log/mailcow.log and stop processing, create a file /etc/rsyslog.d/docker.conf:

        local3.*        /var/log/mailcow.log\n& stop\n

        Restart rsyslog afterwards.

        "},{"location":"post_installation/firststeps-logging/#via-daemonjson-globally","title":"via daemon.json (globally)","text":"

        If you want to change the logging driver globally, edit Dockers daemon configuration file /etc/docker/daemon.json and restart the Docker service:

        {\n...\n  \"log-driver\": \"gelf\",\n  \"log-opts\": {\n    \"gelf-address\": \"udp://graylog:12201\"\n  }\n...\n}\n

        For Syslog:

        {\n...\n  \"log-driver\": \"syslog\",\n  \"log-opts\": {\n    \"syslog-address\": \"udp://1.2.3.4:514\"\n  }\n...\n}\n

        Restart the Docker daemon and run the commands below to recreate the containers with the new logging driver:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n
        "},{"location":"post_installation/firststeps-logging/#log-rotation","title":"Log rotation","text":"

        As those logs can get quite big, it is a good idea to use logrotate to compress and delete them after a certain time period.

        Create /etc/logrotate.d/mailcow with the following content:

        /var/log/mailcow.log {\n        rotate 7\n        daily\n        compress\n        delaycompress\n        missingok\n        notifempty\n        create 660 root root\n}\n

        With this configuration, logrotate will run daily and keep a maximum of 7 archives.

        To rotate the logfile weekly or monthly replace daily with weekly or monthly respectively.

        To keep more archives, set the desired number of rotate.

        Afterwards, logrotate can be restarted.

        "},{"location":"post_installation/firststeps-snat/","title":"SNAT","text":"

        SNAT is used to change the source address of the packets sent by mailcow. It can be used to change the outgoing IP address on systems with multiple IP addresses.

        Open mailcow.conf, set either or both of the following parameters:

        # Use this IPv4 for outgoing connections (SNAT)\nSNAT_TO_SOURCE=1.2.3.4\n\n# Use this IPv6 for outgoing connections (SNAT)\nSNAT6_TO_SOURCE=dead:beef\n

        Run the command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        The values are read by netfilter-mailcow. netfilter-mailcow will make sure, the post-routing rules are on position 1 in the netfilter table. It does automatically delete and re-create them if they are found on another position than 1.

        Check the output with the following command to ensure the SNAT settings have been applied:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs --tail=200 netfilter-mailcow\n
        docker-compose logs --tail=200 netfilter-mailcow\n
        "},{"location":"post_installation/firststeps-ssl/","title":"Advanced SSL","text":""},{"location":"post_installation/firststeps-ssl/#lets-encrypt-out-of-the-box","title":"Let's Encrypt (out-of-the-box)","text":"

        The \"acme-mailcow\" container will try to obtain a LE certificate for ${MAILCOW_HOSTNAME}, autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN.

        Warning

        mailcow must be available on port 80 for the acme-client to work. Our reverse proxy example configurations do cover that. You can also use any external ACME client (certbot for example) to obtain certificates, but you will need to make sure, that they are copied to the correct location and a post-hook reloads affected containers. See more in the Reverse Proxy documentation.

        By default, which means 0 domains are added to mailcow, it will try to obtain a certificate for ${MAILCOW_HOSTNAME}.

        For each domain you add, it will try to resolve autodiscover.ADDED_MAIL_DOMAIN and autoconfig.ADDED_MAIL_DOMAIN to its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address. If it succeeds, a name will be added as SAN to the certificate request.

        Only names that can be validated, will be added as SAN.

        For every domain you remove, the certificate will be moved and a new certificate will be requested. It is not possible to keep domains in a certificate, when we are not able validate the challenge for those.

        If you want to re-run the ACME client, use the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart acme-mailcow\n
        docker-compose restart acme-mailcow\n

        Monitor its logs with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs --tail=200 -f acme-mailcow\n
        docker-compose logs --tail=200 -f acme-mailcow\n
        "},{"location":"post_installation/firststeps-ssl/#additional-domain-names","title":"Additional domain names","text":"

        Edit \"mailcow.conf\" and add a parameter ADDITIONAL_SAN like this:

        Do not use quotes (\") and do not use spaces between the names!

        ADDITIONAL_SAN=smtp.*,cert1.example.com,cert2.example.org,whatever.*\n

        Each name will be validated against its IPv6 address or - if IPv6 is not configured in your domain - IPv4 address.

        A wildcard name like smtp.* will try to obtain a smtp.DOMAIN_NAME SAN for each domain added to mailcow.

        Run the following command to recreate affected containers automatically:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        Info

        Using names other name MAILCOW_HOSTNAME to access the mailcow UI may need further configuration.

        If you plan to use a server name that is not MAILCOW_HOSTNAME to access the mailcow UI (for example by adding mail.* to ADDITIONAL_SAN make sure to populate that name in mailcow.conf via ADDITIONAL_SERVER_NAMES. Names must be separated by commas and must not contain spaces. If you skip this step, mailcow may respond with an incorrect site.

        ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

        Run the command below to apply:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#force-renewal","title":"Force renewal","text":"

        To force a renewal, you need to create a file named force_renew and restart the acme-mailcow container:

        docker compose (Plugin)docker-compose (Standalone) 
        cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker compose restart acme-mailcow\n# Now check the logs for a renewal\ndocker compose logs --tail=200 -f acme-mailcow\n
        cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker-compose restart acme-mailcow\n# Now check the logs for a renewal\ndocker-compose logs --tail=200 -f acme-mailcow\n

        The file will be deleted automatically.

        "},{"location":"post_installation/firststeps-ssl/#validation-errors-and-how-to-skip-validation","title":"Validation errors and how to skip validation","text":"

        You can skip the IP verification by setting SKIP_IP_CHECK=y in mailcow.conf (no quotes). Be warned that a misconfiguration will get you ratelimited by Let's Encrypt! This is primarily useful for multi-IP setups where the IP check would return the incorrect source IP address. Due to using dynamic IPs for acme-mailcow, source NAT is not consistent over restarts.

        If you encounter problems with \"HTTP validation\", but your IP address confirmation succeeds, you are most likely using firewalld, ufw or any other firewall, that disallows connections from br-mailcow to your external interface. Both firewalld and ufw disallow this by default. It is often not enough to just stop these firewall services. You'd need to stop mailcow, stop the firewall service, flush the chains and restart Docker.

        You can also skip this validation method by setting SKIP_HTTP_VERIFICATION=y in \"mailcow.conf\". Be warned that this is discouraged. In most cases, the HTTP verification is skipped to workaround unknown NAT reflection issues, which are not resolved by ignoring this specific network misconfiguration. If you encounter problems generating TLSA records in the DNS overview within mailcow, you are most likely having issues with NAT reflection you should fix.

        If you changed a SKIP_* parameter, run the command below to apply your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#disable-lets-encrypt","title":"Disable Let's Encrypt","text":""},{"location":"post_installation/firststeps-ssl/#disable-lets-encrypt-completely","title":"Disable Let's Encrypt completely","text":"

        Set SKIP_LETS_ENCRYPT=y in \"mailcow.conf\" and recreate \"acme-mailcow\" with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#skip-all-names-but-mailcow_hostname","title":"Skip all names but ${MAILCOW_HOSTNAME}","text":"

        Add ONLY_MAILCOW_HOSTNAME=y to \"mailcow.conf\" and recreate \"acme-mailcow\" with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#the-lets-encrypt-subjectaltname-limit-of-100-domains","title":"The Let's Encrypt subjectAltName limit of 100 domains","text":"

        Let's Encrypt currently has a limit of 100 Domain Names per Certificate.

        By default, \"acme-mailcow\" will create a single SAN certificate for all validated domains (see the first section and Additional domain names). This provides best compatibility but means the Let's Encrypt limit exceeds if you add too many domains to a single mailcow installation.

        To solve this, you can configure ENABLE_SSL_SNI to generate:

        • A main server certificate with MAILCOW_HOSTNAME and all fully qualified domain names in the ADDITIONAL_SAN config
        • One additional certificate for each domain found in the database with autodiscover., autoconfig. and any other ADDITIONAL_SAN configured in this format (subdomain.*).
        • Limitations: A certificate name ADDITIONAL_SAN=test.example.com will be added as SAN to the main certificate. A separate certificate/key pair will not be generated for this format.

        Postfix, Dovecot and Nginx will then serve these certificates with SNI.

        Set ENABLE_SSL_SNI=y in \"mailcow.conf\" and recreate \"acme-mailcow\" with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        Warning

        Not all clients support SNI, see Dovecot documentation or Wikipedia. You should make sure these clients use the MAILCOW_HOSTNAME for secure connections if you enable this feature.

        Here is an example:

        • MAILCOW_HOSTNAME=server.email.tld
        • ADDITIONAL_SAN=webmail.email.tld,mail.*
        • mailcow email domains: \"domain1.tld\" and \"domain2.tld\"

        The following certificates will be generated:

        • server.email.tld, webmail.email.tld -> this is the default certificate, all clients can connect with these domains
        • mail.domain1.tld, autoconfig.domain1.tld, autodiscover.domain1.tld -> individual certificate for domain1.tld, cannot be used by clients without SNI support
        • mail.domain2.tld, autoconfig.domain2.tld, autodiscover.domain2.tld -> individual certificate for domain2.tld, cannot be used by clients without SNI support
        "},{"location":"post_installation/firststeps-ssl/#how-to-use-your-own-certificate","title":"How to use your own certificate","text":"

        Make sure you disable mailcows internal LE client (see above).

        To use your own certificates, just save the combined certificate (containing the certificate and intermediate CA/CA if any) to data/assets/ssl/cert.pem and the corresponding key to data/assets/ssl/key.pem.

        IMPORTANT: Do not use symbolic links! Make sure you copy the certificates and do not link them to data/assets/ssl.

        Restart affected services afterwards:

        docker restart $(docker ps -qaf name=postfix-mailcow)\ndocker restart $(docker ps -qaf name=nginx-mailcow)\ndocker restart $(docker ps -qaf name=dovecot-mailcow)\n

        See Post-hook script for non-mailcow ACME clients for a full example script.

        "},{"location":"post_installation/firststeps-ssl/#test-against-staging-acme-directory","title":"Test against staging ACME directory","text":"

        Edit mailcow.conf and add LE_STAGING=y.

        Run the command below to activate your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#custom-directory-url","title":"Custom directory URL","text":"

        Edit mailcow.conf and add the corresponding directory URL to the new variable DIRECTORY_URL:

        DIRECTORY_URL=https://acme-custom-v9000.api.letsencrypt.org/directory\n

        You cannot use LE_STAGING with DIRECTORY_URL. If both are set, only LE_STAGING is used.

        Run the command below to activate your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/firststeps-ssl/#use-caa-records-with-the-accounturi-parameter","title":"Use CAA records with the accounturi parameter","text":"

        Let's Encrypt allows restricting certificate issuance to specific account IDs via the accounturi parameter in CAA records. You can use the generate_caa_record.py helper script to generate a CAA record with accounturi, which you can then enter with your DNS provider:

        ./helper-scripts/generate_caa_record.py --account-key data/assets/ssl/acme/account.pem --contact mailto:your_acme_email@example.com\n
        "},{"location":"post_installation/firststeps-ssl/#check-your-configuration","title":"Check your configuration","text":"

        Run the command below to find out why a validation fails:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs --tail=200 acme-mailcow\n
        docker-compose logs --tail=200 acme-mailcow\n

        To check if nginx serves the correct certificate, simply use a browser of your choice and check the displayed certificate.

        To check the certificate served by Postfix, Dovecot and Nginx we will use openssl:

        # Connect via SMTP STARTTLS (587)\nopenssl s_client -starttls smtp -connect MAILCOW_HOSTNAME:587 | openssl x509 -noout -text\n# Connect via SMTP (465)\nopenssl s_client -connect MAILCOW_HOSTNAME:465 | openssl x509 -noout -text\n\n# Connect via IMAP STARTTLS (143)\nopenssl s_client -starttls imap -connect MAILCOW_HOSTNAME:143 | openssl x509 -noout -text\n# Connect via IMAP (993)\nopenssl s_client -connect MAILCOW_HOSTNAME:993 | openssl x509 -noout -text\n\n# Connect via HTTPS (443)\nopenssl s_client -connect MAILCOW_HOSTNAME:443 | openssl x509 -noout -text\n

        To validate the expiry dates as returned by openssl against MAILCOW_HOSTNAME, you are able to use our helper script:

        cd /opt/mailcow-dockerized\nbash helper-scripts/expiry-dates.sh\n
        "},{"location":"post_installation/firststeps-sync_jobs_migration/","title":"Sync job migration","text":"

        Sync jobs are used to copy or move existing emails from an external IMAP server or within mailcow's existing mailboxes.

        Info

        Depending on your mailbox's ACL you may not have the option to add a sync job. Please contact your domain administrator if so.

        "},{"location":"post_installation/firststeps-sync_jobs_migration/#setup-a-sync-job","title":"Setup a Sync Job","text":"

        1. In the \"Configuration > Mail Setup\" or \"User Settings\" interface, create a new sync job.

        2. If you are an administrator, select the username of the downstream mailcow mailbox in the \"Username\" dropdown.

        3. Fill in the \"Host\" and \"Port\" fields with their respective correct values from the upstream IMAP server.

        4. In the \"Username\" and \"Password\" fields, supply the correct access credentials from the upstream IMAP server.

        5. Select the \"Encryption Method\". If the upstream IMAP server uses port 143, it is likely that the encryption method is TLS and SSL for port 993. Nevertheless, you can use PLAIN authentication, but it is stongly discouraged.

        6. For all ther other fields, you can leave them as is or modify them as desired.

        7. Make sure to tick \"Active\" and click \"Add\".

        Info

        Once Completed, log into the mailbox and check if all emails are imported correctly. If all goes well, all your mails shall end up in your new mailbox. And don't forget to delete or deactivate the sync job after it is used.

        "},{"location":"post_installation/reverse-proxy/r_p-apache24/","title":"Apache 2.4","text":"

        Important

        First read the overview.

        Required modules: 

        a2enmod rewrite proxy proxy_http headers ssl\n

        Let's Encrypt will follow our rewrite, certificate requests in mailcow will work fine.

        Take care of highlighted lines.

        <VirtualHost *:80>\n  ServerName CHANGE_TO_MAILCOW_HOSTNAME\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n  RewriteEngine on\n\n  RewriteCond %{HTTPS} off\n  RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]\n\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"http\"\n</VirtualHost>\n<VirtualHost *:443>\n  ServerName CHANGE_TO_MAILCOW_HOSTNAME\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n\n  # You should proxy to a plain HTTP session to offload SSL processing\n  ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000\n  ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"https\"\n\n  SSLCertificateFile MAILCOW_PATH/data/assets/ssl/cert.pem\n  SSLCertificateKeyFile MAILCOW_PATH/data/assets/ssl/key.pem\n\n  # If you plan to proxy to a HTTPS host:\n  #SSLProxyEngine On\n\n  # If you plan to proxy to an untrusted HTTPS host:\n  #SSLProxyVerify none\n  #SSLProxyCheckPeerCN off\n  #SSLProxyCheckPeerName off\n  #SSLProxyCheckPeerExpire off\n</VirtualHost>\n
        "},{"location":"post_installation/reverse-proxy/r_p-caddy2/","title":"Caddy v2 (community supported)","text":"

        Important

        First read the overview.

        Warning

        This is an unsupported community contribution. Feel free to provide fixes.

        The configuration of Caddy with mailcow is very simple.

        In the caddyfile you just have to create a section for the mailserver.

        For example 

        MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {\n        log {\n                output file /var/log/caddy/MAILCOW_HOSTNAME.log {\n                        roll_disabled\n                        roll_size 512M\n                        roll_uncompressed\n                        roll_local_time\n                        roll_keep 3\n                        roll_keep_for 48h\n                }\n        }\n\n        reverse_proxy 127.0.0.1:HTTP_BIND\n}\n

        This allows Caddy to automatically create the certificates and accept traffic for these mentioned domains and forward them to mailcow.

        Important: The ACME client of mailcow must be disabled, otherwise mailcow will fail.

        Since Caddy takes care of the certificates itself, we can use the following script to include the Caddy generated certificates into mailcow:

        #!/bin/bash\nMAILCOW_HOSTNAME=your.domain.tld\nCADDY_CERTS_DIR=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory\nMD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))\nMD5SUM_NEW_CERT=($(md5sum $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt))\n\nif [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/key.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/key.pem\n        postfix_c=$(docker ps -qaf name=postfix-mailcow)\n        dovecot_c=$(docker ps -qaf name=dovecot-mailcow)\n        nginx_c=$(docker ps -qaf name=nginx-mailcow)\n        docker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n\nelse\n        echo \"Certs not copied from Caddy (Not needed)\"\nfi\n

        Attention

        Caddy's certificate path varies depending on the installation type. In this installation example, Caddy was installed using the Caddy repo (more informations here). To find out the Caddy certificate path on your system, just run a find / -name \"certificates\".

        This script could be called as a cronjob every hour:

        0 * * * * /bin/bash /path/to/script/deploy-certs.sh  >/dev/null 2>&1\n
        "},{"location":"post_installation/reverse-proxy/r_p-haproxy/","title":"HAProxy (community supported)","text":"

        Important

        First read the overview.

        Warning

        This is an unsupported community contribution. Feel free to provide fixes.

        This example redirects all HTTP traffic to HTTPS except for mailcow's built-in ACME client. If you do not want to use the built-in ACME client, please modify the configuration yourself.

        frontend https-in\n  bind :::80 v4v6\n  bind :::443 v4v6 ssl crt mailcow.pem\n\n  acl mailcow_acme path -i -m beg /.well-known/\n\n  redirect scheme https unless { ssl_fc || mailcow_acme }\n\n  default_backend mailcow\n\nbackend mailcow\n  option forwardfor\n  http-request set-header X-Forwarded-Proto https if { ssl_fc }\n  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }\n  server mailcow 127.0.0.1:8080 check\n
        "},{"location":"post_installation/reverse-proxy/r_p-nginx/","title":"Nginx","text":"

        Important

        First read the overview.

        Let's Encrypt will follow our rewrite, certificate requests will work fine.

        Take care of highlighted lines.

        server {\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;\n  return 301 https://$host$request_uri;\n}\nserver {\n  listen 443 ssl http2;\n  listen [::]:443 ssl http2;\n  server_name CHANGE_TO_MAILCOW_HOSTNAME autodiscover.* autoconfig.*;\n\n  ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;\n  ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;\n  ssl_session_timeout 1d;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_tickets off;\n\n  # See https://ssl-config.mozilla.org/#server=nginx for the latest ssl settings recommendations\n  # An example config is given below\n  ssl_protocols TLSv1.2;\n  ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;\n  ssl_prefer_server_ciphers off;\n\n  location /Microsoft-Server-ActiveSync {\n    proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_connect_timeout 75;\n    proxy_send_timeout 3650;\n    proxy_read_timeout 3650;\n    proxy_buffers 64 512k; # Needed since the 2022-04 Update for SOGo\n    client_body_buffer_size 512k;\n    client_max_body_size 0;\n  }\n\n  location / {\n    proxy_pass http://127.0.0.1:8080/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  # The following Proxy Buffers has to be set if you want to use SOGo after the 2022-04 (April 2022) Update\n  # Otherwise a Login will fail like this: https://github.com/mailcow/mailcow-dockerized/issues/4537\n    proxy_buffer_size 128k;\n    proxy_buffers 64 512k;\n    proxy_busy_buffers_size 512k;\n  }\n}\n
        "},{"location":"post_installation/reverse-proxy/r_p-traefik2/","title":"Traefik v2 (community supported)","text":"

        Important

        First read the overview.

        Warning

        This is an unsupported community contribution. Feel free to provide fixes.

        Important: This config only covers the \"reverseproxing\" of the webpannel (nginx-mailcow) using Traefik v2, if you also want to reverseproxy the mail services such as dovecot, postfix... you'll just need to adapt the following config to each container and create an EntryPoint on your traefik.toml or traefik.yml (depending which config you use) for each port.

        For this section we'll assume you have your Traefik 2 [certificatesresolvers] properly configured on your traefik configuration file, and also using acme, also, the following example uses Lets Encrypt, but feel free to change it to your own cert resolver. You can find a basic Traefik 2 toml config file with all the above implemented which can be used for this example here traefik.toml if you need one, or a hint on how to adapt your config.

        So, first of all, we are going to disable the acme-mailcow container since we'll use the certs that traefik will provide us. For this we'll have to set SKIP_LETS_ENCRYPT=y on our mailcow.conf, and run the following command to apply the changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        Then we'll create a docker-compose.override.yml file in order to override the main docker-compose.yml found in your mailcow root folder. 

        services:\n    nginx-mailcow:\n      networks:\n        # Add Traefik's network\n        web:\n      labels:\n        - traefik.enable=true\n        # Creates a router called \"moo\" for the container, and sets up a rule to link the container to certain rule,\n        #   in this case, a Host rule with our MAILCOW_HOSTNAME var.\n        - traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)\n        # Enables tls over the router we created before.\n        - traefik.http.routers.moo.tls=true\n        # Specifies which kind of cert resolver we'll use, in this case le (Lets Encrypt).\n        - traefik.http.routers.moo.tls.certresolver=le\n        # Creates a service called \"moo\" for the container, and specifies which internal port of the container\n        #   should traefik route the incoming data to.\n        - traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}\n        # Specifies which entrypoint (external port) should traefik listen to, for this container.\n        #   websecure being port 443, check the traefik.toml file liked above.\n        - traefik.http.routers.moo.entrypoints=websecure\n        # Make sure traefik uses the web network, not the mailcowdockerized_mailcow-network\n        - traefik.docker.network=traefik_web\n\n    certdumper:\n        image: ghcr.io/kereis/traefik-certs-dumper\n        command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1\n        network_mode: none\n        volumes:\n          # Mount the volume which contains Traefik's `acme.json' file\n          #   Configure the external name in the volume definition\n          - acme:/traefik:ro\n          # Mount mailcow's SSL folder\n          - ./data/assets/ssl/:/output:rw\n          # Mount docker socket to restart containers\n          - /var/run/docker.sock:/var/run/docker.sock:ro\n        restart: always\n        environment:\n          # only change this, if you're using another domain for mailcow's web frontend compared to the standard config\n          - DOMAIN=${MAILCOW_HOSTNAME}\n\nnetworks:\n  web:\n    external: true\n    # Name of the external network\n    name: traefik_web\n\nvolumes:\n  acme:\n    external: true\n    # Name of the external docker volume which contains Traefik's `acme.json' file\n    name: traefik_acme\n

        Start the new containers with:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        Now, there's only one thing left to do, which is setup the certs so that the mail services can use them as well, since Traefik 2 uses an acme v2 format to save ALL the license from all the domains we have, we'll need to find a way to dump the certs, lucky we have this tiny container which grabs the acme.json file through a volume, and a variable DOMAIN=example.org, and with these, the container will output the cert.pem and key.pem files, for this we'll simply run the traefik-certs-dumper container binding the /traefik volume to the folder where our acme.json is saved, bind the /output volume to our mailcow data/assets/ssl/ folder, and set up the DOMAIN=example.org variable to the domain we want the certs dumped from.

        This container will watch over the acme.json file for any changes, and regenerate the cert.pem and key.pem files directly into data/assets/ssl/ being the path binded to the container's /output path.

        You can use the command line to run it, or use the docker-compose.yml shown here.

        After we have the certs dumped, we'll have to reload the configs from our postfix and dovecot containers, and check the certs, you can see how here.

        Aaand that should be it \ud83d\ude0a, you can check if the Traefik router works fine through Traefik's dashboard / traefik logs / accessing the setted domain through https, or / and check HTTPS, SMTP and IMAP through the commands shown on the page linked before.

        "},{"location":"post_installation/reverse-proxy/r_p/","title":"Overview","text":"

        You don't need to change the Nginx site that comes with mailcow: dockerized. mailcow: dockerized trusts the default gateway IP 172.22.1.1 as proxy.

        Make sure you change HTTP_BIND and HTTPS_BIND in mailcow.conf to a local address and set the ports accordingly, for example: 

        HTTP_BIND=127.0.0.1\nHTTP_PORT=8080\nHTTPS_BIND=127.0.0.1\nHTTPS_PORT=8443\n

        This will also change the bindings inside the Nginx container! This is important, if you decide to use a proxy within Docker.

        IMPORTANT: Do not use port 8081, 9081 or 65510!

        Recreate affected containers by running the command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"post_installation/reverse-proxy/r_p/#important-information-please-read-them-carefully","title":"Important information, please read them carefully!","text":"

        Info

        If you plan to use a reverse proxy and want to use another server name that is not MAILCOW_HOSTNAME, you need to read Adding additional server names for mailcow UI below.

        Warning

        Make sure you run generate_config.sh before you enable any site configuration examples. The script generate_config.sh copies snake-oil certificates to the correct location, so the services will not fail to start due to missing files.

        Warning

        If you enable TLS SNI (ENABLE_SSL_SNI in mailcow.conf), the certificate paths in your reverse proxy must match the correct paths in data/assets/ssl/{hostname}. The certificates will be split into data/assets/ssl/{hostname1,hostname2,etc} and therefore will not work when you copy the examples from below pointing to data/assets/ssl/cert.pem etc.

        Info

        Using the site configuration examples will forward ACME requests to mailcow and let it handle certificates itself. The downside of using mailcow as ACME client behind a reverse proxy is, that you will need to reload your webserver after acme-mailcow changed/renewed/created the certificate. You can either reload your webserver daily or write a script to watch the file for changes. On many servers logrotate will reload the webserver daily anyway.

        If you want to use a local certbot installation, you will need to change the SSL certificate parameters accordingly. Make sure you run a post-hook script when you decide to use external ACME clients. You will find an example below.

        Configure your local webserver as reverse proxy using following configuration examples:

        • Apache 2.4
        • Nginx
        • HAProxy
        • Traefik v2
        • Caddy v2
        "},{"location":"post_installation/reverse-proxy/r_p/#optional-post-hook-script-for-non-mailcow-acme-clients","title":"Optional: Post-hook script for non-mailcow ACME clients","text":"

        Using a local certbot (or any other ACME client) requires to restart some containers, you can do this with a post-hook script. Make sure you change the paths accordingly: 

        #!/bin/bash\ncp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem\ncp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem\npostfix_c=$(docker ps -qaf name=postfix-mailcow)\ndovecot_c=$(docker ps -qaf name=dovecot-mailcow)\nnginx_c=$(docker ps -qaf name=nginx-mailcow)\ndocker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n

        "},{"location":"post_installation/reverse-proxy/r_p/#adding-additional-server-names-for-mailcow-ui","title":"Adding additional server names for mailcow UI","text":"

        If you plan to use a server name that is not MAILCOW_HOSTNAME in your reverse proxy, make sure to populate that name in mailcow.conf via ADDITIONAL_SERVER_NAMES first. Names must be separated by commas and must not contain spaces. If you skip this step, mailcow may respond to your reverse proxy with an incorrect site.

        ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

        Run the following command to apply:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"third_party/borgmatic/third_party-borgmatic/","title":"Borgmatic Backup","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#introduction","title":"Introduction","text":"

        Borgmatic is a great way to run backups on your mailcow setup as it securely encrypts your data and is extremely easy to set up.

        Due to it's deduplication capabilities you can store a great number of backups without wasting large amounts of disk space. This allows you to run backups in very short intervals to ensure minimal data loss when the need arises to recover data from a backup.

        This document guides you through the process to enable continuous backups for mailcow with borgmatic. The borgmatic functionality is provided by the borgmatic Docker image. Check out the README in that repository to find out about the other options (such as push notifications) that are available. This guide only covers the basics.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#setting-up-borgmatic","title":"Setting up borgmatic","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#create-or-amend-docker-composeoverrideyml","title":"Create or amend docker-compose.override.yml","text":"

        In the mailcow-dockerized root folder create or edit docker-compose.override.yml and insert the following configuration:

        services:\n  borgmatic-mailcow:\n    image: ghcr.io/borgmatic-collective/borgmatic\n    hostname: mailcow\n    restart: always\n    dns: ${IPV4_NETWORK:-172.22.1}.254\n    volumes:\n      - vmail-vol-1:/mnt/source/vmail:ro\n      - crypt-vol-1:/mnt/source/crypt:ro\n      - redis-vol-1:/mnt/source/redis:ro\n      - rspamd-vol-1:/mnt/source/rspamd:ro\n      - postfix-vol-1:/mnt/source/postfix:ro\n      - mysql-socket-vol-1:/var/run/mysqld/\n      - borg-config-vol-1:/root/.config/borg\n      - borg-cache-vol-1:/root/.cache/borg\n      - ./data/conf/borgmatic/etc:/etc/borgmatic.d:Z\n      - ./data/conf/borgmatic/ssh:/root/.ssh:Z\n    environment:\n      - TZ=${TZ}\n      - BORG_PASSPHRASE=${BORG_PASSPHRASE}\n      - DBNAME=${DBNAME}\n      - DBUSER=${DBUSER}\n      - DBPASS=${DBPASS}\n    networks:\n      mailcow-network:\n        aliases:\n          - borgmatic\n\nvolumes:\n  borg-cache-vol-1:\n  borg-config-vol-1:\n

        Append BORG_PASSPHRASE=YouBetterPutSomethingRealGoodHere to your mailcow.conf and ensure that you change the BORG_PASSPHRASE to a secure passphrase of your choosing.

        For security reasons we mount the maildir as read-only. If you later want to restore data you will need to remove the ro flag prior to restoring the data. This is described in the section on restoring backups.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#create-dataconfborgmaticetcconfigyaml","title":"Create data/conf/borgmatic/etc/config.yaml","text":"

        Next, we need to create the borgmatic configuration. Borgmatic supports environment variable interpolation, this way we can get the correct MySQL credentials from Docker or more specifically from our mailcow.conf without exposing them in our config.

        Make sure to copy all the following lines!

        cat <<EOF > data/conf/borgmatic/etc/config.yaml\nsource_directories:\n    - /mnt/source/vmail\n    - /mnt/source/crypt\n    - /mnt/source/redis\n    - /mnt/source/rspamd\n    - /mnt/source/postfix\nrepositories:\n    - path: ssh://user@rsync.net:22/./mailcow\n      label: rsync\nexclude_patterns:\n    - '/mnt/source/postfix/public/'\n    - '/mnt/source/postfix/private/'\n    - '/mnt/source/rspamd/rspamd.sock'\n\nkeep_hourly: 24\nkeep_daily: 7\nkeep_weekly: 4\nkeep_monthly: 6\n\nmysql_databases:\n    - name: ${DBNAME}\n      username: ${DBUSER}\n      password: ${DBPASS}\n      options: --default-character-set=utf8mb4\nEOF\n

        Warning

        Starting with borgmatic 1.8.0 (released July 19th, 2023), the configuration file syntax was changed. You can check the Docker logs of the borgmatic container for deprecation warnings to see if you are affected, i.e. if your config file was generated for an older borgmatic version. In this case, you should create a new config.yaml file as described above to avoid problems with future borgmatic releases.

        This file is a minimal example for using borgmatic with an account user on the cloud storage provider rsync.net for a repository called mailcow (see repositories setting). This must be changed accordingly.

        It will backup both the maildir and MySQL database, which is all you should need to restore your mailcow setup after an incident.

        The retention settings will keep one archive for each hour of the past 24 hours, one per day of the week, one per week of the month and one per month of the past half year.

        Check the borgmatic documentation on how to use other types of repositories or configuration options. If you choose to use a local filesystem as a backup destination make sure to mount it into the container. The container defines a volume called /mnt/borg-repository for this purpose.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#create-a-crontab","title":"Create a crontab","text":"

        Create a new text file in data/conf/borgmatic/etc/crontab.txt with the following content:

        14 * * * * PATH=$PATH:/usr/local/bin /usr/local/bin/borgmatic --stats -v 0 2>&1\n

        This file expects crontab syntax. The example shown here will trigger the backup to run every hour at 14 minutes past the hour and log some nice stats at the end.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#place-ssh-keys-in-folder","title":"Place SSH keys in folder","text":"

        Place the SSH keys you intend to use for remote repository connections in data/conf/borgmatic/ssh. OpenSSH expects the usual id_rsa, id_ed25519 or similar to be in this directory. Ensure the file is chmod 600 and not world readable or OpenSSH will refuse to use the SSH key.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#bring-up-the-container","title":"Bring up the container","text":"

        For the next step we need the container to be up and running in a configured state. To do that run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"third_party/borgmatic/third_party-borgmatic/#initialize-the-repository","title":"Initialize the repository","text":"

        By now your borgmatic container is up and running, but the backups will currently fail due to the repository not being initialized.

        To initialize the repository run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n
        docker-compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n

        You will be asked you to authenticate the SSH host key of your remote repository server. See if it matches and confirm the prompt by entering yes. The repository will be initialized with the passphrase you set in the BORG_PASSPHRASE environment variable earlier.

        When using any of the repokey encryption methods the encryption key will be stored in the repository itself and not on the client, so there is no further action required in this regard. If you decide to use a keyfile instead of a repokey make sure you export the key and back it up separately. Check the Exporting Keys section for how to retrieve the key.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#restart-container","title":"Restart container","text":"

        Now that we finished configuring and initializing the repository restart the container to ensure it is in a defined state:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart borgmatic-mailcow\n
        docker-compose restart borgmatic-mailcow\n
        "},{"location":"third_party/borgmatic/third_party-borgmatic/#restoring-from-a-backup","title":"Restoring from a backup","text":"

        Restoring a backup assumes you are starting off with a fresh installation of mailcow, and you currently do not have any custom data in your maildir or your mailcow database.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#restore-maildir","title":"Restore maildir","text":"

        Warning

        Doing this will overwrite files in your maildir! Do not run this unless you actually intend to recover mail files from a backup.

        If you use SELinux in Enforcing mode

        If you are using mailcow on a host with SELinux in Enforcing mode you will have to temporarily disable it during extraction of the archive as the mailcow setup labels the vmail volume as private, belonging to the dovecot container exclusively. SELinux will (rightfully) prevent any other container, such as the borgmatic container, from writing to this volume.

        Before running a restore you must make the vmail volume writeable in docker-compose.override.yml by removing the ro flag from the volume. Then you can use the following command to restore the maildir from a backup:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n
        docker-compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n

        Alternatively you can specify any archive name from the list of archives (see Listing all available archives)

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#restore-mysql","title":"Restore MySQL","text":"

        Warning

        Running this command will delete and recreate the mailcow database! Do not run this unless you actually intend to recover the mailcow database from a backup.

        To restore the MySQL database from the latest archive use this command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borgmatic restore --archive latest\n
        docker-compose exec borgmatic-mailcow borgmatic restore --archive latest\n

        Alternatively you can specify any archive name from the list of archives (see Listing all available archives)

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#after-restoring","title":"After restoring","text":"

        After restoring you need to restart mailcow. If you disabled SELinux enforcing mode now would be a good time to re-enable it.

        To restart mailcow use the follwing command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down && docker compose up -d\n
        docker-compose down && docker-compose up -d\n

        If you use SELinux this will also trigger the re-labeling of all files in your vmail volume. Be patient, as this may take a while if you have lots of files.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#useful-commands","title":"Useful commands","text":""},{"location":"third_party/borgmatic/third_party-borgmatic/#manual-archiving-run-with-debugging-output","title":"Manual archiving run (with debugging output)","text":"docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borgmatic -v 2\n
        docker-compose exec borgmatic-mailcow borgmatic -v 2\n
        "},{"location":"third_party/borgmatic/third_party-borgmatic/#listing-all-available-archives","title":"Listing all available archives","text":"docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borgmatic list\n
        docker-compose exec borgmatic-mailcow borgmatic list\n
        "},{"location":"third_party/borgmatic/third_party-borgmatic/#break-lock","title":"Break lock","text":"

        When borg is interrupted during an archiving run it will leave behind a stale lock that needs to be cleared before any new operations can be performed:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borg break-lock\n
        docker-compose exec borgmatic-mailcow borg break-lock\n

        Now would be a good time to do a manual archiving run to ensure it can be successfully performed.

        "},{"location":"third_party/borgmatic/third_party-borgmatic/#exporting-keys","title":"Exporting keys","text":"

        When using any of the keyfile methods for encryption you MUST take care of backing up the key files yourself. The key files are generated when you initialize the repository. The repokey methods store the key file within the repository, so a manual backup isn't as essential.

        Note that in either case you also must have the passphrase to decrypt any archives.

        To fetch the keyfile run:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n
        docker-compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n

        Where user@rsync.net:mailcow is the URI to your repository.

        "},{"location":"third_party/checkmk/u_e-checkmk/","title":"CheckMK","text":"

        mailcow provides the ability to check for updates using its own update script.

        If you want to check for mailcow updates using checkmk, you can create an executable file in the local directory of the checkmk agent (typically /usr/lib/check_mk_agent/local/) with the name mailcow_update and the following content: 

        #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh --check-tags >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No newer tags available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 New tag is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/releases/latest\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

        To check for every updated code, just create the executable with the following content: 

        #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No updates available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

        If the mailcow installation directory is not /opt/, adjust this in the 2nd line.

        After that re-inventory the services for your mailcow host in checmk and a new check named mailcow_update should be selectable.

        This will run the mailcow_update everytime checkmk agent is checked, you can cache the result by placing the script in a subfolder named the number of seconds you wish to cache it. \\ /usr/lib/check_mk_agent/local/3600/ will cache the response for an 3600 seconds (1 hour).

        "},{"location":"third_party/checkmk/u_e-checkmk/#screenshots","title":"Screenshots","text":""},{"location":"third_party/checkmk/u_e-checkmk/#no-updates-available","title":"No updates available","text":"

        If there are no updates / newer tag available, OK is displayed.

        "},{"location":"third_party/checkmk/u_e-checkmk/#new-updates-available","title":"New updates available","text":"

        If updates / newer tags are available, WARN is displayed.

        If CRIT is desired instead, replace the 7th line with the following:

        echo \"2 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\n
        "},{"location":"third_party/checkmk/u_e-checkmk/#detailed-check-output","title":"Detailed check output","text":"
        • This provides a link to mailcow's GitHub commits, if updates are available.
        • Metrics are also displayed ( not only when updates are available):
        • 0 = No updates available
        • 1 = New updates available
        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/","title":"Exchange Hybrid Setup","text":"

        Using Microsoft Exchange in a hybrid setup is possible with mailcow. With this setup you can add mailboxes on your mailcow and still use Exchange Online Protection. All mailboxes setup in Exchange will receive their mails as usual, while with the hybrid approach additional Mailboxes can be setup in mailcow without any further configuration.

        This setup becomes very handy if you have enabled the Office 365 security defaults and third party applications can no longer login into your mailboxes by any of the supported methods.

        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#requirements","title":"Requirements","text":"
        • The mx Record of your domain needs to point at the Exchange mail service. Log into your Admin center and look out for the dns settings of your domain to find your personalized gateway domain. It should look like this contoso-com.mail.protection.outlook.com. Contact your domain registrant to get further information on how to change mx record.
        • The domain you want to have additional mailboxes for must be setup as internal relay domain in Exchange.
          1. Log in to your Exchange Admin Center
          2. Select the mail flow pane and click on accepted domains
          3. Select the domain and switch it from authorative to internal relay
        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#set-up-the-mailcow","title":"Set up the mailcow","text":"

        Your mailcow needs to relay all mails to your personalized Exchange Host. It is the same host address we already looked up for the mx Record.

        1. Add the domain to your mailcow
        2. Add your personalized Exchange Host address as relayhost
        3. Add your personalized Exchange Host address as forwarding host to unconditionally accepted all relayed mails from Exchange. (Admin > Configuration & Details > Configuration Dropdown > Forwarding Hosts)
        4. Go to the domain settings and select the newly added host on the Sender-dependent transports dropdown. Enable relaying by ticking the Relay this domain, Relay all recipients and the Relay non-existing mailboxes only. checkboxes

        Info

        From now on your mailcow will accept all mails relayed from Exchange. The inbound filtering and so the neural learning of your cow will no longer work. Because all mails are routed through Exchange the filtering process is handled there.

        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#set-up-connectors-in-exchange","title":"Set up Connectors in Exchange","text":"

        All mail traffic now goes through Exchange. At this point the Exchange Online Protection already filters all incoming and outgoing mails. Now we need to set up two connectors to relay incoming mails from our Exchange Service to the mailcow and another one to allow mails relayed from the mailcow to our exchange service. You can follow the official guide from Microsoft.

        Warning

        For the connector that handles mails from your mailcow to Exchange Microsoft offers two ways of authenticating it. The recommended way is to use a tls certificate configured with a subject name that matches an accepted domain in Exchange. Otherwise you need to choose authentication with the static ip address of your mailcow.

        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#validating","title":"Validating","text":"

        The easiest way to validate the hybrid setup is by sending a mail from the internet to a mailbox that only exists on the mailcow and vice versa.

        "},{"location":"third_party/exchange_onprem/third_party-exchange_onprem/#common-issues","title":"Common Issues","text":"
        • The connector validation from Exchange to your mailcow failed with 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient test@contoso.com not found by SMTP address lookup Possible Solution: Your domain is not set up as internal relay. Exchange therefore cannot find the recipient
        • Mails sent from the mailcow to a mailbox in the internet cannot be sent. Non Delivery Report with error 550 5.7.64 TenantAttribution; Relay Access Denied Possible Solution: The authentication method failed. Make sure the certificate subject matches an accepted domain in Exchange. Try authenticating by static ip instead.

        Microsoft Guide for the connector setup and additional requirements: https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#prerequisites-for-your-on-premises-email-environment

        "},{"location":"third_party/gitea/third_party-gitea/","title":"Gitea","text":"

        With Gitea' ability to authenticate over SMTP it is trivial to integrate it with mailcow. Few changes are needed:

        1. In order to create a database for gitea, connect to your shell and execute the following commands: 

        source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gitea;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gitea'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'%';\"\n

        2. Open docker-compose.override.yml and add gitea:

        services:\n\n        gitea-mailcow:\n            image: gitea/gitea:1\n            volumes:\n                - ./data/gitea:/data\n            networks:\n                mailcow-network:\n                    aliases:\n                        - gitea\n            ports:\n                - \"${GITEA_SSH_PORT:-127.0.0.1:4000}:22\"\n

        3. Create data/conf/nginx/site.gitea.custom, add: 

        location /gitea/ {\n        proxy_pass http://gitea:3000/;\n}\n

        4. Open mailcow.conf and define the binding you want gitea to use for SSH. Example:

        GITEA_SSH_PORT=127.0.0.1:4000\n

        5. Run the commands to bring up the gitea container and restart the nginx-mailcow container afterwards:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\ndocker compose restart nginx-mailcow\n
        docker-compose up -d\ndocker-compose restart nginx-mailcow\n

        6. If you forced mailcow to https, execute step 9 and restart gitea with the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart gitea-mailcow\n
        docker-compose restart gitea-mailcow\n

        Go head with step 7 (Remember to use https instead of http, https://mx.example.org/gitea/)

        7. Open http://${MAILCOW_HOSTNAME}/gitea/, for example http://mx.example.org/gitea/. For database details set mysql as database host. Use gitea as database name, gitea as database user and your_strong_password you previously definied at step 1 as database password.

        8. Once the installation is complete, login as admin and set \"settings\" -> \"authorization\" -> \"enable SMTP\". SMTP Host should be postfix with port 587, set Skip TLS Verify as we are using an unlisted SAN (\"postfix\" is most likely not part of your certificate).

        9. Create data/gitea/gitea/conf/app.ini and set following values. You can consult gitea cheat sheet for their meaning and other possible values.

        [server]\nSSH_LISTEN_PORT = 22\n# For GITEA_SSH_PORT=127.0.0.1:4000 in mailcow.conf, set:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# For MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (and default ports for HTTPS), set:\nROOT_URL = https://mx.example.org/gitea/\n

        10. Restart gitea with the following command. Your users should be able to login with mailcow managed accounts.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart gitea-mailcow\n
        docker-compose restart gitea-mailcow\n
        "},{"location":"third_party/gogs/third_party-gogs/","title":"Gogs","text":"

        With Gogs' ability to authenticate over SMTP it is trivial to integrate it with mailcow. Few changes are needed:

        1. In order to create a database for Gogs, connect to your shell and execute the following commands: 

        source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gogs;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gogs'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gogs.* TO 'gogs'@'%';\n

        2. Open docker-compose.override.yml and add Gogs:

        services:\n\n    gogs-mailcow:\n      image: gogs/gogs\n      volumes:\n        - ./data/gogs:/data\n      networks:\n        mailcow-network:\n          aliases:\n            - gogs\n      ports:\n        - \"${GOGS_SSH_PORT:-127.0.0.1:4000}:22\"\n

        3. Create data/conf/nginx/site.gogs.custom, add: 

        location /gogs/ {\n    proxy_pass http://gogs:3000/;\n}\n

        4. Open mailcow.conf and define the binding you want Gogs to use for SSH. Example:

        GOGS_SSH_PORT=127.0.0.1:4000\n

        5. Run the commands to bring up the Gogs container and restart the nginx-mailcow container afterwards:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\ndocker compose restart nginx-mailcow\n
        docker-compose up -d\ndocker-compose restart nginx-mailcow\n

        6. Open http://${MAILCOW_HOSTNAME}/gogs/, for example http://mx.example.org/gogs/. For database details set mysql as database host. Use the value gogs as database name, gogs as database user and your_strong_password you previously definied at step 1 as database password.

        7. Once the installation is complete, login as admin and set \"settings\" -> \"authorization\" -> \"enable SMTP\". SMTP Host should be postfix with port 587, set Skip TLS Verify as we are using an unlisted SAN (\"postfix\" is most likely not part of your certificate).

        8. Create data/gogs/gogs/conf/app.ini and set following values. You can consult Gogs cheat sheet for their meaning and other possible values.

        [server]\nSSH_LISTEN_PORT = 22\n# For GOGS_SSH_PORT=127.0.0.1:4000 in mailcow.conf, set:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# For MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (and default ports for HTTPS), set:\nROOT_URL = https://mx.example.org/gogs/\n

        9. Restart Gogs with the following command. Your users should be able to login with mailcow managed accounts.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart gogs-mailcow\n
        docker-compose restart gogs-mailcow\n
        "},{"location":"third_party/mailman3/third_party-mailman3/","title":"Installing mailcow and Mailman 3 based on dockerized versions","text":"

        Info

        This guide is a copy from dockerized-mailcow-mailman. Please post issues, questions and improvements in the issue tracker there.

        Warning

        mailcow is not responsible for any data loss, hardware damage or broken keyboards. This guide comes without any warranty. Make backups before starting, 'coze: No backup no pity!

        "},{"location":"third_party/mailman3/third_party-mailman3/#introduction","title":"Introduction","text":"

        This guide aims to install and configure mailcow-dockerized with docker-mailman and to provide some useful scripts. An essential condition is, to preserve mailcow and Mailman in their own installations for independent updates.

        There are some guides and projects on the internet, but they are not up to date and/or incomplete in documentation or configuration. This guide is based on the work of:

        • mailcow-mailman3-dockerized by Shadowghost
        • mailman-mailcow-integration

        After finishing this guide, mailcow-dockerized and docker-mailman will run and Apache as a reverse proxy will serve the web frontends.

        The operating system used is an Ubuntu 20.04 LTS.

        "},{"location":"third_party/mailman3/third_party-mailman3/#installation","title":"Installation","text":"

        This guide is based on different steps:

        1. DNS setup
        2. Install Apache as a reverse proxy
        3. Obtain SSL certificates with Let's Encrypt
        4. Install mailcow with Mailman integration
        5. Install Mailman
        6. \ud83c\udfc3 Run
        "},{"location":"third_party/mailman3/third_party-mailman3/#dns-setup","title":"DNS setup","text":"

        Most of the configuration is covered by mailcows DNS setup. After finishing this setup add another subdomain for Mailman, e.g. lists.example.org that points to the same server:

        # Name    Type       Value\nlists     IN A       1.2.3.4\nlists     IN AAAA    dead:beef\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#install-apache-as-a-reverse-proxy","title":"Install Apache as a reverse proxy","text":"

        Install Apache, e.g. with this guide from Digital Ocean: How To Install the Apache Web Server on Ubuntu 20.04.

        Activate certain Apache modules (as root or sudo):

        a2enmod rewrite proxy proxy_http headers ssl wsgi proxy_uwsgi http2\n

        Maybe you have to install further packages to get these modules. This PPA by Ond\u0159ej Sur\u00fd may help you.

        "},{"location":"third_party/mailman3/third_party-mailman3/#vhost-configuration","title":"vHost configuration","text":"

        Copy the mailcow.conf and the mailman.conf in the Apache conf folder sites-available (e.g. under /etc/apache2/sites-available).

        Change in mailcow.conf: - MAILCOW_HOSTNAME to your MAILCOW_HOSTNAME

        Change in mailman.conf: - MAILMAN_DOMAIN to your Mailman domain (e.g. lists.example.org)

        Don't activate the configuration, as the ssl certificates and directories are missing yet.

        "},{"location":"third_party/mailman3/third_party-mailman3/#obtain-ssl-certificates-with-lets-encrypt","title":"Obtain SSL certificates with Let's Encrypt","text":"

        Check if your DNS config is available over the internet and points to the right IP addresses, e.g. with MXToolBox:

        • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILCOW_HOSTNAME
        • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILCOW_HOSTNAME
        • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILMAN_DOMAIN
        • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILMAN_DOMAIN

        Install certbot (as root or sudo):

        apt install certbot\n

        Get the desired certificates (as root or sudo):

        certbot certonly -d MAILCOW_HOSTNAME\ncertbot certonly -d MAILMAN_DOMAIN\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#install-mailcow-with-mailman-integration","title":"Install mailcow with Mailman integration","text":""},{"location":"third_party/mailman3/third_party-mailman3/#install-mailcow","title":"Install mailcow","text":"

        Follow the mailcow installation. Omit step 5 and do not pull and start!

        "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailcow","title":"Configure mailcow","text":"

        This is also Step 4 in the official mailcow installation (nano mailcow.conf). So change to your needs and alter the following variables:

        HTTP_PORT=18080            # don't use 8080 as mailman needs it\nHTTP_BIND=127.0.0.1        #\nHTTPS_PORT=18443           # you may use 8443\nHTTPS_BIND=127.0.0.1       #\n\nSKIP_LETS_ENCRYPT=y        # reverse proxy will do the SSL termination\n\nSNAT_TO_SOURCE=1.2.3.4     # change this to your IPv4\nSNAT6_TO_SOURCE=dead:beef  # change this to your global IPv6\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#add-mailman-integration","title":"Add Mailman integration","text":"

        Create the file /opt/mailcow-dockerized/docker-compose.override.yml (e.g. with nano) and add the following lines:

        services:\n  postfix-mailcow:\n    volumes:\n      - /opt/mailman:/opt/mailman\n    networks:\n      - docker-mailman_mailman\n\nnetworks:\n  docker-mailman_mailman:\n    external: true\n
        The additional volume is used by Mailman to generate additional config files for mailcow postfix. The external network is build and used by Mailman. mailcow needs it to deliver incoming list mails to Mailman.

        Create the file /opt/mailcow-dockerized/data/conf/postfix/extra.cf (e.g. with nano) and add the following lines:

        # mailman\n\nrecipient_delimiter = +\nunknown_local_recipient_reject_code = 550\nowner_request_special = no\n\nlocal_recipient_maps =\n  regexp:/opt/mailman/core/var/data/postfix_lmtp,\n  proxy:unix:passwd.byname,\n  $alias_maps\nvirtual_mailbox_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\ntransport_maps =\n  pcre:/opt/postfix/conf/custom_transport.pcre,\n  pcre:/opt/postfix/conf/local_transport,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\nrelay_domains =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_relay_domain_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_domains\nrelay_recipient_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\n
        As we overwrite mailcow postfix configuration here, this step may break your normal mail transports. Check the original configuration files if anything changed.

        "},{"location":"third_party/mailman3/third_party-mailman3/#ssl-certificates","title":"SSL certificates","text":"

        As we proxying mailcow, we need to copy the SSL certificates into the mailcow file structure. This task will do the script renew-ssl.sh for us:

        • Copy the file to /opt/mailcow-dockerized
        • Change mailcow_HOSTNAME to your mailcow hostname
        • Make it executable (chmod a+x renew-ssl.sh)
        • Do not run it yet, as we first need Mailman

        You have to create a cronjob, so that new certificates will be copied. Execute as root or sudo:

        crontab -e\n

        To run the script every day at 5am, add:

        0   5  *   *   *     /opt/mailcow-dockerized/renew-ssl.sh\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#install-mailman","title":"Install Mailman","text":"

        Basicly follow the instructions at docker-mailman. As they are a lot, here is in a nuthshell what to do:

        As root or sudo:

        cd /opt\nmkdir -p mailman/core\nmkdir -p mailman/web\ngit clone https://github.com/maxking/docker-mailman\ncd docker-mailman\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailman","title":"Configure Mailman","text":"

        Create a long key for Hyperkitty, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this key for a moment as HYPERKITTY_KEY.

        Create a long password for the database, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this password for a moment as DBPASS.

        Create a long key for Django, e.g. with the linux command cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Save this key for a moment as DJANGO_KEY.

        Create the file /opt/docker-mailman/docker compose.override.yaml and replace HYPERKITTY_KEY, DBPASS and DJANGO_KEY with the generated values:

        services:\n  mailman-core:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - MTA=postfix\n    restart: always\n    networks:\n      - mailman\n\n  mailman-web:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - SECRET_KEY=DJANGO_KEY\n    - SERVE_FROM_DOMAIN=MAILMAN_DOMAIN # e.g. lists.example.org\n    - MAILMAN_ADMIN_USER=admin # the admin user\n    - MAILMAN_ADMIN_EMAIL=admin@example.org # the admin mail address\n    - UWSGI_STATIC_MAP=/static=/opt/mailman-web-data/static\n    restart: always\n\n  database:\n    environment:\n    - POSTGRES_PASSWORD=DBPASS\n    restart: always\n

        At mailman-web fill in correct values for SERVE_FROM_DOMAIN (e.g. lists.example.org), MAILMAN_ADMIN_USER and MAILMAN_ADMIN_EMAIL. You need the admin credentials to log into the web interface (Postorius). For setting the password for the first time use the Forgot password function in the web interface.

        About other configuration options read Mailman-web and Mailman-core documentation.

        "},{"location":"third_party/mailman3/third_party-mailman3/#configure-mailman-core-and-mailman-web","title":"Configure Mailman core and Mailman web","text":"

        Create the file /opt/mailman/core/mailman-extra.cfg with the following content. mailman@example.org should be pointing to a valid mail box or redirection.

        [mailman]\ndefault_language: de\nsite_owner: mailman@example.org\n

        Create the file /opt/mailman/web/settings_local.py with the following content. mailman@example.org should be pointing to a valid mail box or redirection.

        # locale\nLANGUAGE_CODE = 'de-de'\n\n# disable social authentication\nMAILMAN_WEB_SOCIAL_AUTH = []\n\n# change it\nDEFAULT_FROM_EMAIL = 'mailman@example.org'\n\nDEBUG = False\n
        You can change LANGUAGE_CODE and SOCIALACCOUNT_PROVIDERS to your needs.

        "},{"location":"third_party/mailman3/third_party-mailman3/#run","title":"\ud83c\udfc3 Run","text":"

        Run (as root or sudo)

        docker compose (Plugin)docker-compose (Standalone) 
        a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker compose pull\ndocker compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker compose pull\n./renew-ssl.sh\n
        a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker-compose pull\ndocker-compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker-compose pull\n./renew-ssl.sh\n

        Wait a few minutes! The containers have to create there databases and config files. This can last up to 1 minute and more.

        "},{"location":"third_party/mailman3/third_party-mailman3/#remarks","title":"Remarks","text":""},{"location":"third_party/mailman3/third_party-mailman3/#new-lists-arent-recognized-by-postfix-instantly","title":"New lists aren't recognized by postfix instantly","text":"

        When you create a new list and try to immediately send an e-mail, postfix responses with User doesn't exist, because postfix won't deliver it to Mailman yet. The configuration at /opt/mailman/core/var/data/postfix_lmtp is not instantly updated. If you need the list instantly, restart postifx manually:

        docker compose (Plugin)docker-compose (Standalone) 
        cd /opt/mailcow-dockerized\ndocker compose restart postfix-mailcow\n
        cd /opt/mailcow-dockerized\ndocker-compose restart postfix-mailcow\n
        "},{"location":"third_party/mailman3/third_party-mailman3/#update","title":"Update","text":"

        mailcow has it's own update script in /opt/mailcow-dockerized/update.sh, see the docs.

        For Mailman just fetch the newest version from the github repository.

        "},{"location":"third_party/mailman3/third_party-mailman3/#backup","title":"Backup","text":"

        mailcow has an own backup script. Read the docs for further informations.

        Mailman won't state backup instructions in the README.md. In the gitbucket of pgollor is a script that may be helpful.

        "},{"location":"third_party/mailman3/third_party-mailman3/#todo","title":"ToDo","text":""},{"location":"third_party/mailman3/third_party-mailman3/#install-script","title":"install script","text":"

        Write a script like in mailman-mailcow-integration/mailman-install.sh as many of the steps are automatable.

        1. Ask for all the configuration variables and create passwords and keys.
        2. Do a (semi-)automatic installation.
        3. Have fun!
        "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/","title":"Mailpiler Integration","text":"

        This is a simple integration of mailcow aliases and the mailbox name into mailpiler when using IMAP authentication.

        Disclaimer: This is not officially maintained nor supported by the mailcow project nor its contributors. No warranty or support is being provided, however you're free to open issues on GitHub for filing a bug or provide further ideas. GitHub repo can be found here.

        Info

        Support for domain wildcards were implemented in Piler 1.3.10 which was released on 03.01.2021. Prior versions basically do work, but after logging in you won't see emails sent from or to the domain alias. (e.g. when @example.com is an alias for admin@example.com)

        "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#the-problem-to-solve","title":"The problem to solve","text":"

        mailpiler offers the authentication based on IMAP, for example:

        $config['ENABLE_IMAP_AUTH'] = 1;\n$config['IMAP_HOST'] = 'mail.example.com';\n$config['IMAP_PORT'] =  993;\n$config['IMAP_SSL'] = true;\n
        • So when you log in using patrik@example.com, you will only see delivered emails sent from or to this specific email address.
        • When additional aliases are defined in mailcow, like team@example.com, you won't see emails sent to or from this email address even the fact you're a recipient of mails sent to this alias address.

        By hooking into the authentication process of mailpiler, we are able to get required data via the mailcow API during login. This fires API requests to the mailcow API (requiring read-only API access) to read out the aliases your email address participates and also the \"Name\" of the mailbox specified to display it on the top-right of mailpiler after login.

        Permitted email addresses can be seen in the mailpiler settings top-right after logging in.

        Info

        This is only pulled once during the authentication process. The authorized aliases and the realname are valid for the whole duration of the user session as mailpiler sets them in the session data. If user is removed from specific alias, this will only take effect after next login.

        "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#the-solution","title":"The solution","text":"

        Note: File paths might vary depending on your setup.

        "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#requirements","title":"Requirements","text":"
        • A working mailcow instance
        • A working mailpiler instance (You can find an installation guide here, check supported versions here)
        • An mailcow API key (read-only works just fine): Configuration & Details - Access - Read-Only Access. Don't forget to allow API access from your mailpiler IP.

        Warning

        As mailpiler authenticates against mailcow, our IMAP server, failed logins of users or bots might trigger a block for your mailpiler instance. Therefore you might want to consider whitelisting the IP address of the mailpiler instance within mailcow: Configuration & Details - Configuration - Fail2ban parameters - Whitelisted networks/hosts.

        "},{"location":"third_party/mailpiler/third_party-mailpiler_integration/#setup","title":"Setup","text":"

        1. Set the custom query function of mailpiler and append this to /usr/local/etc/piler/config-site.php:

          $config['MAILCOW_API_KEY'] = 'YOUR_READONLY_API_KEY';\n$config['MAILCOW_SET_REALNAME'] = true; // when not specified, then default is false\n$config['CUSTOM_EMAIL_QUERY_FUNCTION'] = 'query_mailcow_for_email_access';\ninclude('auth-mailcow.php');\n

          You can also change the mailcow hostname, if required: 

          $config['MAILCOW_HOST'] = 'mail.domain.tld'; // defaults to $config['IMAP_HOST']\n

        2. Download the PHP file with the functions from the GitHub repo:

          curl -o /usr/local/etc/piler/auth-mailcow.php https://raw.githubusercontent.com/patschi/mailpiler-mailcow-integration/master/auth-mailcow.php\n

        3. Done!

        Make sure to re-login with your IMAP credentials for changes to take effect.

        If it doesn't work, most likely something's wrong with the API query itself. Consider debugging by sending manual API requests to the API. (Tip: Open https://mail.domain.tld/api on your instance)

        "},{"location":"third_party/nextcloud/third_party-nextcloud/","title":"Nextcloud","text":""},{"location":"third_party/nextcloud/third_party-nextcloud/#manage-nextcloud-using-the-helper-script","title":"Manage Nextcloud using the helper script","text":"

        Deprecation notice

        This guide about the mailcow Nextcloud helper-script is deprecated. Until December 2024 this installationscript will be removed from mailcow and no further support will be granted. If you are using a Nextcloud installation based on this script you should migrate all your datas to a standalone Nextcloud instance (either inside Docker or natively) in the near future.

        The Authentication guide (below further) will still be intact after the script removal in December 2024.

        Nextcloud can be set up (parameter -i) and removed (parameter -p) with the helper script included with mailcow. In order to install Nextcloud simply navigate to your mailcow-dockerized root folder and run the helper script as follows:

        ./helper-scripts/nextcloud.sh -i

        In case you have forgotten the password (e.g. for admin) and can't request a new one via the password reset link on the login screen calling the helper script with -r as parameter allows you to set a new password. Only use this option if your Nextcloud isn't configured to use mailcow for authentication as described in the next section.

        In order for mailcow to generate a a certificate for the nextcloud domain you need to add \"nextcloud.domain.tld\" to ADDITIONAL_SAN in mailcow.conf and runthe following to apply:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        For more informaton refer to: Advanced SSL.

        "},{"location":"third_party/nextcloud/third_party-nextcloud/#background-jobs","title":"Background jobs","text":"

        To use the recommended setting (cron) to execute the background jobs following lines need to be added to the docker-compose.override.yml:

        services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.nextcloud-cron.schedule: \"@every 5m\"\n      ofelia.job-exec.nextcloud-cron.command: \"su www-data -s /bin/bash -c \\\"/usr/local/bin/php -f /web/nextcloud/cron.php\\\"\"\n

        In addition, a specific function must be activated for the php-fpm worker. Do this by editing the file data/conf/phpfpm/php-fpm.d/pools.conf and removing shell_exec from all items including the ,.

        After the two steps have been completed, the following command must be executed to provide the Docker image with the corresponding labels and restart the stack.

        After adding these lines the following command must be executed to update the docker image:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n

        And also the docker scheduler image must be restarted to pick up the new job definition by executing:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart ofelia-mailcow\n
        docker-compose restart ofelia-mailcow\n

        To check if the job was successfully picked up by ofelia the command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs ofelia-mailcow\n
        docker-compose logs ofelia-mailcow\n

        It should contain a line similar to New job registered \"nextcloud-cron\" - ....

        By adding these lines the background jobs will be executed every 5 minutes. To verify that the execution works correctly, the only way is to see it in the basic settings when logged in as an admin in Nextcloud. If everything is correct the first scheduled execution will change the background jobs processing setting to (X) Cron and the timestamp after Last job ran will be updated every 5 minutes.

        "},{"location":"third_party/nextcloud/third_party-nextcloud/#configure-nextcloud-to-use-mailcow-for-authentication","title":"Configure Nextcloud to use mailcow for authentication","text":"

        The following describes how set up authentication via mailcow using the OAuth2 protocol. We will only assume that you have already set up Nextcloud at cloud.example.com and that your mailcow is running at mail.example.com. It does not matter if your Nextcloud is running on a different server, you can still use mailcow for authentication.

        1. Log into mailcow as administrator.

        2. Click Configuration in the drop-down menu (top right).

        3. Then, in the \"Access\" tab, select the OAuth2 drop-down item.

        4. Scroll down and click the Add OAuth2 client button. Specify the redirect URI as https://cloud.example.com/index.php/apps/sociallogin/custom_oauth2/mailcow and click Add. Save the client ID and secret for later.

        Info

        Some installations, including those setup using the helper script of mailcow, need to remove index.php/ from the URL to get a successful redirect: https://cloud.example.com/apps/sociallogin/custom_oauth2/mailcow

        5. Log into Nextcloud as administrator.

        6. Click the button in the top right corner and select Apps. Click the search button in the toolbar, search for the Social Login plugin and click Download and enable next to it.

        7. Click the button in the top right corner and select Settings. Scroll down to the Administration section on the left and click Social login.

        8. Uncheck the following items:

        • \"Disable auto create new users\"
        • \"Allow users to connect social logins with their accounts\"
        • \"Do not prune not available user groups on login\"
        • \"Automatically create groups if they do not exists\"
        • \"Restrict login for users without mapped groups\"

        7. Check the following items:

        • \"Prevent creating an account if the email address exists in another account\"
        • \"Update user profile every login\"
        • \"Disable notify admins about new users\"

        Click the Save button.

        8. Scroll down to Custom OAuth2 and click the + button. 9. Configure the parameters as follows:

        • Internal name: mailcow
        • Title: mailcow
        • API Base URL: https://mail.example.com
        • Authorize URL: https://mail.example.com/oauth/authorize
        • Token URL: https://mail.example.com/oauth/token
        • Profile URL: https://mail.example.com/oauth/profile
        • Logout URL: (leave blank)
        • Client ID: (what you obtained in step 1)
        • Client Secret: (what you obtained in step 1)
        • Scope: profile

        Click the Save button at the very bottom of the page.

        If you have previously used Nextcloud with mailcow authentication via user_external/IMAP, you need to perform some additional steps to link your existing user accounts with OAuth2.

        1. Click the button in the top right corner and select Apps. Scroll down to the External user authentication app and click Remove next to it. 2. Run the following queries in your Nextcloud database (if you set up Nextcloud with the script from mailcow, you can use the following command to get into the container):

        docker compose (Plugin)docker-compose (Standalone) 
        source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
        source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
        INSERT INTO oc_users (uid, uid_lower) SELECT DISTINCT uid, LOWER(uid) FROM oc_users_external;\nINSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users_external;\n

        If you have previously used Nextcloud without mailcow authentication, but with the same usernames as mailcow, you can also link your existing user accounts with OAuth2.

        1. Run the following queries in your Nextcloud database (if you set up Nextcloud with the script from mailcow, you can use the following command to get into the container):

        docker compose (Plugin)docker-compose (Standalone) 
        source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
        source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
        INSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users;\n
        "},{"location":"third_party/nextcloud/third_party-nextcloud/#update","title":"Update","text":"

        The Nextcloud instance can be updated easily with the web update mechanism. In the case of larger updates, there may be further changes to be made after the update. After the Nextcloud instance has been checked, problems are shown. This can be e.g. missing indices in the DB or similar. It shows which commands have to be executed, these have to be placed in the php-fpm-mailcow container.

        As an an example run the following command to add the missing indices. docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/occ db:add-missing-indices\"

        The update can also been done by CLI with the following command:

        docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar\"

        This can also been done in an non interactive way (e.g. CRON) with this command:

        Danger

        We do not recommend this! Serios damage can be caused or the update process brakes over time. USE AT OWN RISK!!

        docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar --no-interaction\"

        "},{"location":"third_party/nextcloud/third_party-nextcloud/#debugging-troubleshooting","title":"Debugging & Troubleshooting","text":"

        It may happen that you cannot reach the Nextcloud instance from your network. This may be due to the fact that the entry of your subnet in the array 'trusted_proxies' is missing. You can make changes in the Nextcloud config.php in data/web/nextcloud/config/*.

        'trusted_proxies' =>\n  array (\n    0 => 'fd4d:6169:6c63:6f77::/64',\n    1 => '172.22.1.0/24',\n    2 => 'NewSubnet/24',\n  ),\n

        After the changes have been made, the nginx container must be restarted.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart nginx-mailcow\n
        docker-compose restart nginx-mailcow\n
        "},{"location":"third_party/portainer/third_party-portainer/","title":"Portainer","text":"

        In order to enable Portainer, the docker-compose.yml and site.conf for Nginx must be modified.

        1. Create a new file docker-compose.override.yml in the mailcow-dockerized root folder and insert the following configuration 

        services:\n    portainer-mailcow:\n      image: portainer/portainer-ce\n      volumes:\n        - /var/run/docker.sock:/var/run/docker.sock\n        - ./data/conf/portainer:/data\n      restart: always\n      dns:\n        - 172.22.1.254\n      dns_search: mailcow-network\n      networks:\n        mailcow-network:\n          aliases:\n            - portainer\n
        2a. Create data/conf/nginx/portainer.conf: 
        upstream portainer {\n  server portainer-mailcow:9000;\n}\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  '' close;\n}\n

        2b. Insert a new location to the default mailcow site by creating the file data/conf/nginx/site.portainer.custom: 

          location /portainer/ {\n    proxy_http_version 1.1;\n    proxy_set_header Host              $http_host;   # required for docker client's sake\n    proxy_set_header X-Real-IP         $remote_addr; # pass on real client's IP\n    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_read_timeout                 900;\n\n    proxy_set_header Connection \"\";\n    proxy_buffers 32 4k;\n    proxy_pass http://portainer/;\n  }\n\n  location /portainer/api/websocket/ {\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_pass http://portainer/api/websocket/;\n  }\n

        3. Apply your changes:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d && docker compose restart nginx-mailcow\n
        docker-compose up -d && docker-compose restart nginx-mailcow\n

        Now you can simply navigate to https://${MAILCOW_HOSTNAME}/portainer/ to view your Portainer container monitoring page. You\u2019ll then be prompted to specify a new password for the admin account. After specifying your password, you\u2019ll then be able to connect to the Portainer UI.

        "},{"location":"third_party/portainer/third_party-portainer/#reverse-proxy","title":"Reverse Proxy","text":"

        If you are using a reverse proxy you will have to configure it to properly forward websocket requests.

        This needs to be done for the docker console and other components to work.

        Here is an example for Apache:

        <Location /portainer/api/websocket/>\n  RewriteEngine on\n  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\n  RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\n  RewriteRule /portainer/api/websocket/(.*) ws://127.0.0.1:8080/portainer/api/websocket/$1 [P]\n</Location>\n
        "},{"location":"third_party/roundcube/third_party-roundcube/","title":"Roundcube","text":""},{"location":"third_party/roundcube/third_party-roundcube/#installing-roundcube","title":"Installing Roundcube","text":"

        Note

        Unless otherwise stated, all of the given commands are expected to be executed in the mailcow installation directory, i.e., the directory containing mailcow.conf etc. Please do not blindly execute the commands but understand what they do. None of the commands is supposed to produce an error, so if you encounter an error, fix it if necessary before continuing with the subsequent commands.

        "},{"location":"third_party/roundcube/third_party-roundcube/#note-on-composer-usage","title":"Note on composer usage","text":"

        This guide uses composer to update roundcube dependencies or install / update roundcube plugins.

        The roundcube-plugin-installer composer plugin has a design issue that can lead to composer errors when packages are upgraded or uninstalled in the composer execution.

        The error message will typically tell you that a require in autoload_real.php failed because a file could not be opened. Example:

        In autoload_real.php line 43:\n  require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory\n

        Unfortunately these occur quite frequently, but they can be worked around by updating the autoloader and re-running the failed command:

        docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o\n# Now execute the command that failed again\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#preparation","title":"Preparation","text":"

        First we load mailcow.conf so we have access to the mailcow configuration settings for the following commands.

        source mailcow.conf\n

        Download Roundcube 1.6.x (check for latest release and adapt URL) to the web directory and extract it (here rc/):

        mkdir -m 755 data/web/rc\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#optional-spellchecking","title":"Optional: Spellchecking","text":"

        If you need spell check features, create a file data/hooks/phpfpm/aspell.sh with the following content, then chmod +x data/hooks/phpfpm/aspell.sh. This installs a local spell check engine. Note, most modern web browsers have built in spell check, so you may not want/need this.

        #!/bin/bash\napk update\napk add aspell-en # or any other language\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#install-mime-type-mappings","title":"Install mime type mappings","text":"

        Download the mime.types file as it is not included in the php-fpm container.

        wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#create-roundcube-database","title":"Create roundcube database","text":"

        Create a database for roundcube in the mailcow MySQL container. This creates a new roundcube database user with a random password, which will be echoed to the shell and stored in a shell variable for use by later commands. Note that when you interrupt the process and continue in a new shell, you must set the DBROUNDCUBE shell variable manually to the password output by the following commands.

        DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)\necho Database password for user roundcube is $DBROUNDCUBE\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';\"\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#roundcube-configuration","title":"Roundcube configuration","text":"

        Create a file data/web/rc/config/config.inc.php with the following content. - The des_key option is set to a random value. It is used to temporarily store your IMAP password. - The plugins list can be adapted to your preference. I added a set of standard plugins that I consider of common usefulness and which work well together with mailcow: - The archive plugin adds an archive button that moves selected messages to a user-configurable archive folder. - The managesieve plugin provides a user-friendly interface to manage server-side mail filtering and vacation / out of office notification. - The acl plugin allows to manage access control lists on IMAP folders, including the ability to share IMAP folders to other users. - The markasjunk plugin adds buttons to mark selected messages as junk (or messages in the junk folder not as junk) and moves them to the junk folder or back to the inbox. The sieve filters included with mailcow will take care that action triggers a learn as spam/ham action in rspamd, so no further configuration of the plugin is needed. - The zipdownload plugin allows to download multiple message attachments or messages as a zip file. - If you didn't install spell check in the above step, remove spellcheck_engine parameter.

        cat <<EOCONFIG >data/web/rc/config/config.inc.php\n<?php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\n\\$config['imap_host'] = 'dovecot:143';\n\\$config['smtp_host'] = 'postfix:588';\n\\$config['smtp_user'] = '%u';\n\\$config['smtp_pass'] = '%p';\n\\$config['support_url'] = '';\n\\$config['product_name'] = 'Roundcube Webmail';\n\\$config['cipher_method'] = 'chacha20-poly1305';\n\\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc \"A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\\\]^_{|}~\" 2> /dev/null | head -c 32)';\n\\$config['plugins'] = [\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n];\n\\$config['spellcheck_engine'] = 'aspell';\n\\$config['mime_types'] = '/web/rc/config/mime.types';\n\\$config['enable_installer'] = true;\n\n\\$config['managesieve_host'] = 'dovecot:4190';\n// Enables separate management interface for vacation responses (out-of-office)\n// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section\n\\$config['managesieve_vacation'] = 1;\nEOCONFIG\n\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#initialize-database","title":"Initialize database","text":"

        Point your browser to https://myserver/rc/installer. Check that the website shows no \"NOT OK\" check results on any of the steps, some \"NOT AVAILABLE\" are expected regarding different database extensions of which we only need MySQL. Initialize the database and leave the installer. It is not necessary to update the configuration with the downloaded one, unless you made some settings in the installer you would like to take over.

        "},{"location":"third_party/roundcube/third_party-roundcube/#webserver-configuration","title":"Webserver configuration","text":"

        The roundcube directory includes some locations that we do not want to serve to web users. We add a configuration extension to nginx to only expose the public directory of roundcube.

        cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#disable-and-remove-installer","title":"Disable and remove installer","text":"

        Delete the directory data/web/rc/installer after a successful installation, and set the enable_installer option to false in data/web/rc/config/config.inc.php:

        rm -r data/web/rc/installer\nsed -i -e \"s/\\(\\$config\\['enable_installer'\\].* = \\)true/\\1false/\" data/web/rc/config/config.inc.php\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#update-roundcube-dependencies","title":"Update roundcube dependencies","text":"

        This step is not strictly necessary, but at least at the time of this writing the dependencies shipped with roundcube included versions with security vulnerabilities, so it may be a good idea to update the dependencies to the latest versions. For the same reason, it may be a good idea to run the composer update once in a while.

        cp -n data/web/rc/composer.json-dist data/web/rc/composer.json\ndocker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n

        You can also use composer audit to check for any reported security issues with the installed set of composer packages:

        docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#allow-plaintext-authentication-for-the-php-fpm-container-without-using-tls","title":"Allow plaintext authentication for the php-fpm container without using TLS","text":"

        We need to allow plaintext authentication in dovecot over unencrypted connection (inside the container network), which is per default mailcow installation only possible for the SOGo container for the very same purpose. Afterwards restart the dovecot container so the change becomes effective.

        cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nremote ${IPV4_NETWORK}.0/24 {\n  disable_plaintext_auth = no\n}\nremote ${IPV6_NETWORK} {\n  disable_plaintext_auth = no\n}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#ofelia-job-for-roundcube-housekeeping","title":"Ofelia job for roundcube housekeeping","text":"

        Roundcube needs to clean some stale information from the database every once in a while, for which we will create an ofelia job that runs the roundcube cleandb.sh script.

        To do this, add the following to docker-compose.override.yml (if you already have some adaptations for the php-fpm container, add the labels to the existing section):

        services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.roundcube_cleandb.schedule: \"@every 168h\"\n      ofelia.job-exec.roundcube_cleandb.user: \"www-data\"\n      ofelia.job-exec.roundcube_cleandb.command: \"/bin/bash -c \\\"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\\\"\"\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#optional-extra-functionality","title":"Optional extra functionality","text":""},{"location":"third_party/roundcube/third_party-roundcube/#enable-change-password-function-in-roundcube","title":"Enable change password function in Roundcube","text":"

        Changing the mailcow password from the roundcube UI is supported via the password plugin. We will configure it to use the mailcow API to update the password, which requires to enable the API first and to get the API key (read/write API access required). The API can be enabled in the mailcow admin interface, where you can also find the API key.

        Open data/web/rc/config/config.inc.php and enable the password plugin by adding it to the $config['plugins'] array, for example:

        $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n);\n

        Configure the password plugin (be sure to adapt **API_KEY** to you mailcow read/write API key):

        cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'http://nginx';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n

        Note: If you have changed the mailcow nginx configuration to redirect http requests to https (e.g., as described here), then directly talking to the nginx container via http will not work because nginx is not a hostname contained in the certificate. In such cases, set password_mailcow_api_host in the above configuration to the public URI instead:

        cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#integrate-carddav-addressbooks-in-roundcube","title":"Integrate CardDAV addressbooks in Roundcube","text":"

        Install the latest v5 version (the config below is compatible with v5 releases) using composer. Answer Y when asked if you want to activate the plugin.

        docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"roundcube/carddav:~5\"\n

        Edit the file data/web/rc/plugins/carddav/config.inc.php and insert the following content:

        cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php\n<?php\n\\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';\n\n\\$prefs['SOGo'] = [\n    'accountname'    => 'SOGo',\n    'username'       => '%u',\n    'password'       => '%p',\n    'discovery_url'  => 'http://sogo:20000/SOGo/dav/',\n    'name'           => '%N',\n    'use_categories' => true,\n    'fixed'          => ['username', 'password'],\n];\nEOCONFIG\n

        RCMCardDAV will add all addressbooks of the user on login, including subscribed addressbooks shared to the user by other users.

        If you want to remove the default addressbooks (stored in the Roundcube database), so that only the CardDAV addressbooks are accessible, append $config['address_book_type'] = ''; to the config file data/web/rc/config/config.inc.php.

        Note: RCMCardDAV uses additional database tables. After installing (or upgrading) RCMCardDAV, it is required to log in roundcube (log out first if already logged in) because the database table creation / changes are performed only during the login to roundcube.

        "},{"location":"third_party/roundcube/third_party-roundcube/#forward-the-client-network-address-to-dovecot","title":"Forward the client network address to dovecot","text":"

        Normally, the IMAP server dovecot will see the network address of the php-fpm container when roundcube interacts with the IMAP server. Using an IMAP extension and the dovecot_client_ip roundcube plugin, it is possible for roundcube to tell dovecot the client IP, so it will also show up in the logs as the remote IP. When doing this, login attempts will show in the dovecot logs like any direct client connections to dovecot, and such failed logins into roundcube will be treated in the same manner as failed direct IMAP logins, causing blocking of the client with the netfilter container or other mechanisms that may already be in place to handle bruteforce attacks on the IMAP server.

        For this, the roundcube plugin must be installed.

        docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"foorschtbar/dovecot_client_ip:~2\"\n

        Edit the file data/web/rc/config/config.inc.php and insert the following content:

        cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['dovecot_client_ip_trusted_proxies'] = ['${IPV4_NETWORK}.0/24', '${IPV6_NETWORK}'];\nEOCONFIG\n

        Furthermore, we must configure dovecot to treat the php-fpm container as part of a trusted network so it is allowed to override the client IP in the IMAP session. Note that this also enables plaintext authentication for the listed network ranges, so the explicit overridings of disable_plaintext_auth done above are not necessary when using this.

        cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nlogin_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#add-roundcube-link-to-mailcow-apps-list","title":"Add roundcube link to mailcow Apps list","text":"

        You can add Roundcube's link to the mailcow Apps list. To do this, open or create data/web/inc/vars.local.inc.php and make sure it includes the following configuration block:

        <?php\n\n$MAILCOW_APPS = [\n    [\n        'name' => 'SOGo',\n        'link' => '/SOGo/'\n    ],\n    [\n        'name' => 'Roundcube',\n        'link' => '/rc/'\n    ]\n];\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#let-admins-log-into-roundcube-without-password","title":"Let admins log into Roundcube without password","text":"

        First, install plugin dovecot_impersonate and add Roundcube as an app (see above).

        docker exec -it -w /web/rc/plugins $(docker ps -f name=php-fpm-mailcow -q) git clone https://github.com/corbosman/dovecot_impersonate.git\n

        Open data/web/rc/config/config.inc.php and enable the dovecot_impersonate plugin by adding it to the $config['plugins'] array, for example:

        $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n  'dovecot_impersonate'\n);\n

        Edit mailcow.conf and add the following:

        # Allow admins to log into Roundcube as email user (without any password)\n# Roundcube with plugin dovecot_impersonate must be installed first\n\nALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=y\n

        Edit docker-compose.override.yml and crate/extend the section for php-fpm-mailcow:

        services:\n  php-fpm-mailcow:\n    environment:\n      - ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}\n

        Edit data/web/js/site/mailbox.js and the following code after if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }

        if (ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE) {\n  item.action += '<a href=\"/rc-auth.php?login=' + encodeURIComponent(item.username) + '\" class=\"login_as btn btn-sm btn-xs-half btn-primary\" target=\"_blank\"><i class=\"bi bi-envelope-fill\"></i> Roundcube</a>';\n}\n

        Edit data/web/mailbox.php and add this line to array $template_data:

          'allow_admin_email_login_roundcube' => (preg_match(\"/^(yes|y)+$/i\", $_ENV[\"ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE\"])) ? 'true' : 'false',\n

        Edit data/web/templates/mailbox.twig and add this code to the bottom of the javascript section:

          var ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE = {{ allow_admin_email_login_roundcube }};\n

        Copy the contents of the following files from this Snippet:

        • data/web/inc/lib/RoundcubeAutoLogin.php
        • data/web/rc-auth.php
        "},{"location":"third_party/roundcube/third_party-roundcube/#finish-installation","title":"Finish installation","text":"

        Finally, restart mailcow

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#upgrading-roundcube","title":"Upgrading Roundcube","text":"

        Upgrading Roundcube is rather simple, go to the GitHub releases page for Roundcube and get the link for the \"complete.tar.gz\" file for the wanted release. Then follow the below commands and change the URL and Roundcube folder name if needed.

        # Enter a bash session of the mailcow PHP container\ndocker exec -it mailcowdockerized-php-fpm-mailcow-1 bash\n\n# Install required upgrade dependency, then upgrade Roundcube to wanted release\napk add rsync\ncd /tmp\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar xfvz -\ncd roundcubemail-1.6.9\nbin/installto.sh /web/rc\n\n# Type 'Y' and press enter to upgrade your install of Roundcube\n# Type 'N' to \"Do you want me to fix your local configuration\" if prompted\n\n# If you see \"NOTICE: Update dependencies by running php composer.phar update --no-dev\" run composer:\ncd /web/rc\ncomposer update --no-dev -o\n# If asked \"Do you trust \"roundcube/plugin-installer\" to execute code and wish to enable it now? (writes \"allow-plugins\" to composer.json) [y,n,d,?] \" hit y and continue.\n\n# Remove leftover files\nrm -rf /tmp/roundcube*\n\n# If you're going from 1.5 to 1.6 please run the config file changes below\nsed -i \"s/\\$config\\['default_host'\\].*$/\\$config\\['imap_host'\\]\\ =\\ 'dovecot:143'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['default_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['smtp_server'\\].*$/\\$config\\['smtp_host'\\]\\ =\\ 'postfix:588'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['smtp_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['managesieve_host'\\].*$/\\$config\\['managesieve_host'\\]\\ =\\ 'dovecot:4190'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['managesieve_port'\\].*$/d\" /web/rc/config/config.inc.php\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#upgrade-composer-plugins","title":"Upgrade composer plugins","text":"

        To upgrade roundcube plugins installed using composer and dependencies (e.g. RCMCardDAV plugin), you can simply run composer in the container:

        docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#upgrade-mime-type-mappings","title":"Upgrade mime type mappings","text":"

        To upgrade the mime type mappings, re-download them using the command in the installation instructions.

        "},{"location":"third_party/roundcube/third_party-roundcube/#uninstalling-roundcube","title":"Uninstalling roundcube","text":"

        For the uninstallation, it is also assumed that the commands are executed in the mailcow installation directory and that mailcow.conf has been sourced in the shell, see Preparation above.

        "},{"location":"third_party/roundcube/third_party-roundcube/#remove-the-web-directory","title":"Remove the web directory","text":"

        This deletes the roundcube installation and all plugins and dependencies that you may have installed, including those installed with composer.

        Note: This deletes also any custom configuration that you may have done in roundcube. If you want to preserve it, move it some place else instead of deleting it.

        rm -r data/web/rc\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#remove-the-database","title":"Remove the database","text":"

        Note: This clears all data stored for roundcube. If you want to preserve it, you could use mysqldump before deleting the data, or simply keep the database.

        docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP USER 'roundcube'@'%';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP DATABASE roundcubemail;\"\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#remove-any-custom-configuration-files-we-added-to-mailcow","title":"Remove any custom configuration files we added to mailcow","text":"

        To determine these, please read through the installation steps and revert what you changed there.

        "},{"location":"third_party/roundcube/third_party-roundcube/#migration-from-older-mailcow-roundcube-setup","title":"Migration from older mailcow roundcube setup","text":"

        Older versions of this instruction used the mailcow database also for roundcube, with a configured name prefix mailcow_rc1 on all roundcube tables.

        For the migration, it is also assumed that the commands are executed in the mailcow installation directory and that mailcow.conf has been sourced in the shell, see Preparation above. The commands of the different steps build on each other and must be executed in the same shell. Particularly, some steps set shell variables (most importantly the DBROUNDCUBE variable with the database password of the roundcube database user) used in later steps.

        "},{"location":"third_party/roundcube/third_party-roundcube/#create-new-roundcube-database-user-and-database","title":"Create new roundcube database user and database","text":"

        Follow the steps above to create the roundcube database user and the separate database.

        "},{"location":"third_party/roundcube/third_party-roundcube/#migrate-roundcube-data-from-mailcow-database","title":"Migrate roundcube data from mailcow database","text":"

        Before starting the database migration, we disable roundcube to avoid further changes to the roundcube database tables during the migration.

        cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation ^~ /rc/ {\n  return 503;\n}\nEOCONFIG\ndocker compose exec nginx-mailcow nginx -s reload\n

        Now we copy the roundcube data to the new database. We strip the database table prefix in the process, you may need to adjust mailcow_rc1 in case you used a different prefix. It is also possible to keep the prefix (then also keep the respective db_prefix roundcube setting). Then amend the foreign keys.

        RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"show tables like 'mailcow_rc1%';\" | tr '\\n\\r' ' ')\ndocker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c \"mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail\"\nFOREIGNKEYS=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SELECT CONCAT('ALTER TABLE \\`', TABLE_NAME, '\\` ', 'DROP FOREIGN KEY \\`', CONSTRAINT_NAME, '\\`;', 'ALTER TABLE \\`', TABLE_NAME, '\\` ', 'ADD FOREIGN KEY \\`', CONSTRAINT_NAME, '\\` (', COLUMN_NAME, ') ', 'REFERENCES \\`', REPLACE(REFERENCED_TABLE_NAME, 'mailcow_rc1', ''), '\\` (', REFERENCED_COLUMN_NAME, ');') FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = 'roundcubemail' AND REFERENCED_TABLE_NAME IS NOT NULL;\")\ndocker exec $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} roundcubemail -e \"$FOREIGNKEYS\"\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#update-roundcube-configuration","title":"Update roundcube configuration","text":"

        Run the following to remove the no longer required db_prefix option. We also enable logging of roundcube by removing the settings log_dir and temp_dir that were part of the old setup instructions.

        sed -i \"/\\$config\\['db_prefix'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['log_dir'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['temp_dir'\\].*$/d\" data/web/rc/config/config.inc.php\n

        We need to adapt the nginx configuration for roundcube to not expose the non-public folders of roundcube, specifically those containing temporary files and log files:

        cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n

        We can also update the cipher_method to a more secure one but mind that data previously encrypted by roundcube cannot be decrypted anymore afterwards. This specifically affects stored CardDAV passwords if you use RCMCardDAV and your users added custom addressbooks (the preset will be fixed automatically upon next login of the user). If you want to change the cipher_method, run:

        cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['cipher_method'] = 'chacha20-poly1305';\nEOCONFIG\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#switch-rcmcarddav-plugin-to-composer-installation-method","title":"Switch RCMCardDAV plugin to composer installation method","text":"

        This is optional but will align your installation with these instructions and enable you to upgrade RCMCardDAV using composer. This is simply done by deleting the carddav plugin from the installation and installing it using composer according to the instructions above, which include the creation of a new RCMCardDAV v5 config. In case you modified your RCMCardDAV configuration file, you may want to backup it before deleting the plugin and carry over your changes to the new configuration afterwards as well.

        To delete the carddav plugin run the following command, then re-install according to the instructions above:

        rm -r data/web/rc/plugins/carddav\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#switch-roundcube-to-new-database","title":"Switch roundcube to new database","text":"

        First adapt the roundcube configuration to use the new database. 

        sed -i \"/\\$config\\['db_dsnw'\\].*$/d\" data/web/rc/config/config.inc.php\ncat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\nEOCONFIG\n

        "},{"location":"third_party/roundcube/third_party-roundcube/#re-enable-roundcube-web-access","title":"Re-enable roundcube web access","text":"

        Execute the chown and chmod commands on sensitive roundcube directories listed in Preparation, to make sure the nginx webserver cannot access files it is not supposed to serve.

        Then re-enable web access to roundcube by replacing our temporary roundcube custom config for the one described above, and reload the nginx configuration:

        docker compose exec nginx-mailcow nginx -s reload\n
        "},{"location":"third_party/roundcube/third_party-roundcube/#other-changes","title":"Other changes","text":"

        You must also adapt the configuration of the roundcube password plugin according to this instruction, specifically if you use the password changing functionality, since the old instruction directly changed the password in the database, whereas this version of the instruction uses the mailcow API for the password change.

        Regarding other changes and additions (e.g., dovecot_client_ip plugin), you can go through the current installation instructions and adapt your configuration accordingly or perform the listed installation steps for new additions.

        Specifically, consider the following sections: - Ofelia job for roundcube housekeeping - Allow plaintext authentication in dovecot, if you adapt the roundcube configuration to contact dovecot via non-encrypted IMAP connection. - Forward the client network address to dovecot

        "},{"location":"third_party/roundcube/third_party-roundcube/#removing-roundcube-tables-from-mailcow-database","title":"Removing roundcube tables from mailcow database","text":"

        After you have verified that the migration was successful and roundcube works using the separate database, you can remove the roundcube tables from the mailcow database using the following command:

        docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \\+/,/g');\"\n
        "},{"location":"troubleshooting/debug-admin_login_sogo/","title":"Admin login to SOGo","text":"

        This is an experimental feature that allows admins and domain admins to directly log into SOGo as a mailbox user, without knowing the users password.

        For this, an additional link to SOGo is displayed in the mailbox list (mailcow UI).

        Multiple concurrent admin-logins to different mailboxes are also possible when using this feature.

        "},{"location":"troubleshooting/debug-admin_login_sogo/#enabling-the-feature","title":"Enabling the feature","text":"

        The feature is disabled by default. It can be enabled in the mailcow.conf by setting: 

        ALLOW_ADMIN_EMAIL_LOGIN=y\n
        and recreating the affected containers with

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose up -d\n
        docker-compose up -d\n
        "},{"location":"troubleshooting/debug-admin_login_sogo/#drawbacks-when-enabled","title":"Drawbacks when enabled","text":"
        • Each SOGo page-load and each Active-Sync request will cause an additional execution of an internal PHP script. This might impact load-times of SOGo / EAS. In most cases, this should not be noticeable but should be kept in mind if you face any performance issues.
        • SOGo will not display a logout link for admin-logins, to login normally one has to logout from the mailcow UI so the PHP session is destroyed.
        • Subscribing to another user's calendar or address book while logged in as admin does not work. Neither does inviting other users to calendar events. The page will reload when these things are attempted.
        "},{"location":"troubleshooting/debug-admin_login_sogo/#technical-details","title":"Technical details","text":"

        SOGoTrustProxyAuthentication option is set to YES which makes SOGo trust the x-webobjects-remote-user header.

        Dovecot will receive a random master-password which is valid for all mailboxes when used by the SOGo container.

        Clicking on the SOGo button in the mailbox list will open sogo-auth.php which checks permissions, sets session variables and redirects to the SOGo mailbox.

        Each SOGo, CardDAV, CalDAV and EAS http request will cause an additional, nginx internal auth_request call to sogo-auth.php with the following behavior:

        • If a basic_auth header is present, the script will validate the credentials in place of SOGo and provide the following headers: x-webobjects-remote-user, Authorization and x-webobjects-auth-type.

        • If no basic_auth header is present, the script will check for an active mailcow admin session for the requested email user and provide the same headers but with the dovecot master password used in the Authorization header.

        • If both fails the headers will be set empty, which makes SOGo use its standard authentication methods.

        All of these options / behaviors are disabled if the ALLOW_ADMIN_EMAIL_LOGIN is not enabled in the config.

        "},{"location":"troubleshooting/debug-attach_service/","title":"Attach to a Container","text":""},{"location":"troubleshooting/debug-attach_service/#attaching-a-container-to-your-shell","title":"Attaching a Container to your Shell","text":"

        To attach a container to your shell you can simply run

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec $Dienst_Name /bin/bash\n
        docker-compose exec $Dienst_Name /bin/bash\n
        "},{"location":"troubleshooting/debug-attach_service/#connecting-to-services","title":"Connecting to Services","text":"

        If you want to connect to a service / application directly it is always a good idea to source mailcow.conf to get all relevant variables into your environment.

        "},{"location":"troubleshooting/debug-attach_service/#mysql","title":"MySQL","text":"docker compose (Plugin)docker-compose (Standalone) 
        source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\n
        source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\n
        "},{"location":"troubleshooting/debug-attach_service/#redis","title":"Redis","text":"docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec redis-mailcow redis-cli\n
        docker-compose exec redis-mailcow redis-cli\n
        "},{"location":"troubleshooting/debug-attach_service/#service-descriptions","title":"Service Descriptions","text":"

        Here is a brief overview of what container / service does what:

        Service Name Service Descriptions unbound-mailcow Local (DNSSEC) DNS Resolver mysql-mailcow Stores SOGo's and most of mailcow's settings postfix-mailcow Receives and sends mails dovecot-mailcow User logins and sieve filter redis-mailcow Storage back-end for DKIM keys and Rspamd rspamd-mailcow Mail filtering system. Used for av handling, dkim signing, spam handling clamd-mailcow Scans attachments for viruses olefy-mailcow Scans attached office documents for macro-viruses solr-mailcow Provides full-text search in Dovecot sogo-mailcow Webmail client that handles Microsoft ActiveSync and Cal- / CardDav nginx-mailcow Nginx remote proxy that handles all mailcow related HTTP / HTTPS requests acme-mailcow Automates HTTPS (SSL/TLS) certificate deployment memcached-mailcow Internal caching system for mailcow services watchdog-mailcow Allows the monitoring of docker containers / services php-fpm-mailcow Powers the mailcow web UI netfilter-mailcow Fail2Ban like integration"},{"location":"troubleshooting/debug-common_problems/","title":"Common Problems","text":"

        Here we list common problems and possible solutions:

        "},{"location":"troubleshooting/debug-common_problems/#mail-loops-back-to-myself","title":"Mail loops back to myself","text":"

        Please check in your mailcow UI if you made the domain a backup MX:

        "},{"location":"troubleshooting/debug-common_problems/#i-can-receive-but-not-send-mails","title":"I can receive but not send mails","text":"

        There are a lot of things that could prevent you from sending mail:

        • Check if your IP address is on any blacklists. You could use dnsbl.info or any other similar service to check for your IP address.
        • There are some consumer ISP routers out there, that block mail ports for non whitelisted domains. Please check if you can reach your server on the ports 465 or 587:
        # telnet 74.125.133.27 465\nTrying 74.125.133.27...\nConnected to 74.125.133.27.\nEscape character is '^]'.\n
        "},{"location":"troubleshooting/debug-common_problems/#my-mails-are-identified-as-spam","title":"My mails are identified as Spam","text":"

        Please read our guide on DNS configuration.

        "},{"location":"troubleshooting/debug-common_problems/#docker-compose-throws-weird-errors","title":"docker compose throws weird errors","text":"

        ... like:

        • ERROR: Invalid interpolation format ...
        • AttributeError: 'NoneType' object has no attribute 'keys'.
        • ERROR: In file './docker-compose.yml' service 'version' doesn't have any configuration options.

        When you encounter one or similar messages while trying to run mailcow: dockerized please check if you have the latest version of Docker and docker compose

        "},{"location":"troubleshooting/debug-common_problems/#container-xy-is-unhealthy","title":"Container XY is unhealthy","text":"

        This error tries to tell you that one of the (health) conditions for a certain container are not met. Therefore it can't be started. This can have several reasons, the most common one is an updated git clone but old docker image or vice versa.

        A wrong configured firewall could also cause such a failure. The containers need to be able to talk to each other over the network 172.22.1.1/24.

        It might also be wrongly linked file (i.e. SSL certificate) that prevents a crucial container (nginx) from starting, so always check your logs to get an idea where your problem is coming from.

        "},{"location":"troubleshooting/debug-common_problems/#address-already-in-use","title":"Address already in use","text":"

        If you get an error message like:

        ERROR: for postfix-mailcow  Cannot start service postfix-mailcow: driver failed programming external     connectivity on endpoint mailcowdockerized_postfix-mailcow_1: Error starting userland proxy: listen tcp 0.0.0.0:25: bind: address already in use\n

        while trying to start / install mailcow: dockerized, make sure you've followed our section on the prerequisites.

        "},{"location":"troubleshooting/debug-common_problems/#xyz-cant-connect-to","title":"XYZ can't connect to ...","text":"

        Please check your local firewall! Docker and iptables-based firewalls sometimes create conflicting rules, so disable the firewall on your host to determine whether your connection issues are caused by such conflicts. If they are, you need to manually create appropriate rules in your host firewall to permit the necessary connections.

        If you experience connection problems from home, please check your ISP router's firewall too, some of them block mail traffic on the SMTP (587) or SMTPS (465) ports. It could also be, that your ISP is blocking the ports for SUBMISSION (25).

        While Linux users can chose from a variety of tools1 to check if a port is open, the Windows user has only the PowerShell command Test-NetConnection -ComputerName host -Port port available by default.

        To enable telnet on a Windows after Vista please check this guide or enter the following command in an terminal with administrator privileges:

        dism /online /Enable-Feature /FeatureName:TelnetClient\n
        "},{"location":"troubleshooting/debug-common_problems/#inotify-instance-limit-for-user-5000-uid-vmail-exceeded-see-453","title":"Inotify instance limit for user 5000 (UID vmail) exceeded (see #453)","text":"

        Docker containers use the Docker hosts inotify limits. Setting them on your Docker host will pass them to the container.

        "},{"location":"troubleshooting/debug-common_problems/#dovecot-keeps-restarting-see-2672","title":"Dovecot keeps restarting (see #2672)","text":"

        Check that you have at least the following files in data/assets/ssl:

        cert.pem\ndhparams.pem\nkey.pem\n

        If dhparams.pem is missing, you can generate it with

        openssl dhparam -out data/assets/ssl/dhparams.pem 4096\n
        "},{"location":"troubleshooting/debug-common_problems/#rspamd-reports-cannot-open-hyperscan-cache-file-varlibrspamdhs-compiled-for-a-different-platform","title":"Rspamd reports: cannot open hyperscan cache file /var/lib/rspamd/{...}.hs: compiled for a different platform","text":"

        When migrating mailcow to another system (usually with a different CPU), Rspamd may report that it cannot load some (possibly all) .hs files because they were compiled for a different platform (CPU).

        This is related to Hyperscan2, an Intel technique for precompiling regex schemas that Rspamd uses.

        This feature provides a significant performance boost and is therefore heavily embedded in Rspamd.

        To fix this bug, all .hs and .hsmp files must be deleted from the rspamd directory:

        docker compose (Plugin)docker-compose (Standalone) 
        cd MAILCOW_ROOT # Usually /opt/mailcow-dockerized\ndocker compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n
        cd MAILCOW_ROOT # Usually /opt/mailcow-dockerized\ndocker-compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n

        Restart Rspamd afterwards:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Now Rspamd recompiles the said regex maps again with Hyperscan.

        1. netcat, nmap, openssl, telnet, etc.\u00a0\u21a9

        2. Hyperscan \u21a9

        "},{"location":"troubleshooting/debug-logs/","title":"Logs","text":"

        Warning

        This section only applies for Dockers default logging driver (JSON).

        To view the logs of all mailcow: dockerized related containers, you can use the following command inside your mailcow-dockerized folder that contains your mailcow.conf.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs\n
        docker-compose logs\n

        This is usually a bit much, but you could trim the output with --tail=100 to the last 100 lines per container, or add a -f to follow the live output of all your services.

        To view the logs of a specific service you can use the following:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose logs [options] $service_name\n
        docker-compose logs [options] $service_name\n

        Info

        The available options for the previous commands are:

        • --no-color: Produce monochrome output.
        • -f: Follow the log output.
        • -t: Show timestamps.
        • --tail=\"all\": Number of lines to show from the end of the logs for each container.
        "},{"location":"troubleshooting/debug-mysql_aria/","title":"Recover crashed Aria storage engine","text":""},{"location":"troubleshooting/debug-mysql_aria/#mariadb-aria-recovery-after-crash","title":"MariaDB: Aria recovery after crash","text":"

        If your server crashed and MariaDB logs an error similar to [ERROR] mysqld: Aria recovery failed. Please run aria_chk -r on all Aria tables (*.MAI) and delete all aria_log.######## files you may want to try the following to recover the database to a healthy state:

        Start the stack and wait until mysql-mailcow begins to report a restart. Check this with the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose ps\n
        docker-compose ps\n

        Now exec the following commands:

        Stop the stack, don't run \"down\"

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose stop\n
        docker-compose stop\n

        Run a bash in the stopped container as user mysql

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n
        docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n

        cd to the SQL data directory

        cd /var/lib/mysql\n

        Run aria_chk

        aria_chk --check --force */*.MAI\n

        Delete aria log files

        rm aria_log.*\n

        Execute a complete stack restart using the following commands:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down\ndocker compose up -d\n
        docker-compose down\ndocker-compose up -d\n
        "},{"location":"troubleshooting/debug-mysql_upgrade/","title":"Manual MySQL upgrade","text":""},{"location":"troubleshooting/debug-mysql_upgrade/#run-a-manual-mysql_upgrade","title":"Run a manual mysql_upgrade","text":"

        This step is usually not necessary.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose stop mysql-mailcow watchdog-mailcow\ndocker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n
        docker-compose stop mysql-mailcow watchdog-mailcow\ndocker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n

        As soon as the SQL shell spawned, run mysql_upgrade and exit the container:

        mysql_upgrade\nexit\n
        "},{"location":"troubleshooting/debug-resend-quarantine-notifications/","title":"Resend Quarantine Notifications","text":"

        To resend a quarantine notification, enter the following command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n
        docker-compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n

        Info

        We recommend to use this command ONLY for debugging process as the notification is normally triggered automatically based on the settings set for each mailbox.

        "},{"location":"troubleshooting/debug-reset_pw/","title":"Reset Passwords (incl. SQL)","text":""},{"location":"troubleshooting/debug-reset_pw/#mailcow-admin-account","title":"mailcow Admin Account","text":"

        Resets the mailcow admin account to a random password. Older mailcow: dockerized installations may find the mailcow-reset-admin.sh script in their mailcow root directory (mailcow_path).

        cd mailcow_path\n./helper-scripts/mailcow-reset-admin.sh\n
        "},{"location":"troubleshooting/debug-reset_pw/#reset-mysql-passwords","title":"Reset MySQL Passwords","text":"

        Stop the stack by running:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose stop\n
        docker-compose stop\n

        When the containers came to a stop, run this command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
        docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
        "},{"location":"troubleshooting/debug-reset_pw/#1-find-database-name","title":"1. Find database name","text":"
        # source mailcow.conf\n# docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| mailcow_database   | <=====\n| mysql              |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
        "},{"location":"troubleshooting/debug-reset_pw/#2-reset-one-or-more-users","title":"2. Reset one or more users","text":""},{"location":"troubleshooting/debug-reset_pw/#21-maria-db-104-older-mailcow-installations","title":"2.1 Maria DB < 10.4 (older mailcow installations)","text":"

        Both \"password\" and \"authentication_string\" exist. Currently \"password\" is used, but better set both.

        MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user         |\n+--------------+\n| mailcow      | <=====\n| root         |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('gotr00t'), password = PASSWORD('gotr00t') WHERE User = 'root';\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('mookuh'), password = PASSWORD('mookuh') WHERE User = 'mailcow' AND Host = '%';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
        "},{"location":"troubleshooting/debug-reset_pw/#22-maria-db-104-current-mailcows","title":"2.2 Maria DB >= 10.4 (current mailcows)","text":"
        MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user         |\n+--------------+\n| mailcow      | <=====\n| root         |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> ALTER USER 'mailcow'@'%' IDENTIFIED BY 'mookuh';\nMariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
        "},{"location":"troubleshooting/debug-reset_pw/#remove-two-factor-authentication","title":"Remove Two-Factor Authentication","text":""},{"location":"troubleshooting/debug-reset_pw/#for-mailcow-webui","title":"For mailcow WebUI:","text":"

        This works similar to resetting a MySQL password, now we do it from the host without connecting to the MySQL CLI:

        source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
        "},{"location":"troubleshooting/debug-reset_pw/#for-sogo","title":"For SOGo:","text":"
        docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
        "},{"location":"troubleshooting/debug-reset_tls/","title":"Reset TLS certificates","text":"

        In case you encounter problems with your certificate, key or Let's Encrypt account, please try to reset the TLS assets:

        source mailcow.conf\ndocker compose down\nrm -rf data/assets/ssl\nmkdir data/assets/ssl\nopenssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl-example/key.pem -out data/assets/ssl-example/cert.pem -days 365 -subj \"/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${MAILCOW_HOSTNAME}\" -sha256 -nodes\ncp -n -d data/assets/ssl-example/*.pem data/assets/ssl/\ndocker compose up -d\n

        This will stop mailcow, source the variables we need, create a self-signed certificate and start mailcow.

        If you use Let's Encrypt you should be careful as you will create a new account and a new set of certificates. You will run into a ratelimit sooner or later.

        Please also note that previous TLSA records will be invalid.

        "},{"location":"troubleshooting/debug-rm_volumes/","title":"Remove Persistent Data","text":"

        You may want to remove a set of persistent data to resolve a conflict or to start over.

        mailcowdockerized can vary and depends on your compose project name (if it's unchanged, mailcowdockerized is the correct value). If you are unsure about volume names, run docker volume ls for a full list.

        Delete a single volume:

        docker volume rm mailcowdockerized_${VOLUME_NAME}\n
        • Remove volume mysql-vol-1 to remove all MySQL data.
        • Remove volume redis-vol-1 to remove all Redis data.
        • Remove volume vmail-vol-1 to remove all contents of /var/vmail mounted to dovecot-mailcow.
        • Remove volume rspamd-vol-1 to remove all Rspamd data.
        • Remove volume crypt-vol-1 to remove all crypto data. This will render all mails unreadable.

        Alternatively, running the following command will destroy all mailcow: dockerized volumes and delete any related containers and networks:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down -v\n
        docker-compose down -v\n
        "},{"location":"troubleshooting/debug-rspamd_memory_leaks/","title":"Advanced: Find memory leaks in Rspamd","text":"

        A quick guide to deeply analyze a malfunctioning Rspamd.

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# Add this in front of \"exec \"$@\"\":\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n
        docker-compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# Add this in front of \"exec \"$@\"\":\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n

        Restart Rspamd:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Your memory consumption will increase by a lot, it will also steadily grow, which is not related to a possible memory leak you are looking for.

        Leave the container running for a few minutes, hours or days (it should match the time you usually wait for the leak to \"happen\") and restart it:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose restart rspamd-mailcow\n
        docker-compose restart rspamd-mailcow\n

        Now enter the container by running the command:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec rspamd-mailcow bash\n
        docker-compose exec rspamd-mailcow bash\n

        Change the directory to /tmp and copy the asan Files to your desired location or upload them via termbin.com (cat /tmp/rspamd-asan.* | nc termbin.com 9999).

        "},{"location":"troubleshooting/debug/","title":"Introduction","text":"

        When a problem occurs, then always for a reason! What you want to do in such a case is:

        1. Read your logs; follow them to see what the reason for your problem is.
        2. Follow the leads given to you in your logfiles and start investigating.
        3. Restarting the troubled service or the whole stack to see if the problem persists.
        4. Read the documentation of the troubled service and search it's bugtracker for your problem.
        5. Search our issues for your problem.
        6. Create an issue over at our GitHub repository if you think your problem might be a bug or a missing feature you badly need. But please make sure, that you include all the logs and a full description to your problem. Please do not ask for support on Git.
        7. Join our Telegram community or find the official support packages at Servercow.Alternatively ask Twitter and tag us with @mailcow_email
        "},{"location":"de/","title":"Informationen & Support","text":""},{"location":"de/#mailcow-dockerized-","title":"mailcow: dockerized - + =","text":"

        Die Mailserver-Suite mit dem 'moo'

        "},{"location":"de/#was-ist-mailcow-dockerized","title":"Was ist mailcow: dockerized?","text":"

        Frage

        Mailcow, MailCow oder doch mailcow? Wie hei\u00dft das Projekt nun genau?

        Richtig: mailcow, denn mailcow ist eine eingetragene Wortmarke mit kleinem m

        mailcow: dockerized ist eine Open-Source Groupware/E-Mail Suite auf Docker Basis.

        Dabei setzt mailcow auf viele bekannte und lang bewertete Komponenten, welche im Zusammenspiel einen Rund um Sorglosen E-Mail Server ergeben.

        Jeder Container repr\u00e4sentiert eine einzelne Anwendung, die in einem \u00fcberbr\u00fcckten (Bridged) Netzwerk verbunden sind:

        • ACME Automatische Generation von Let's Encrypt Zertifikaten
        • ClamAV Antiviren Scanner (optional)
        • Dovecot IMAP/POP Server zum Abrufen der E-Mails mit integrierter Full-Text Search Engine \"Flatcurve\"
        • MariaDB Datenbank zum Speichern der Nutzer Informationen u.w.
        • Memcached Cache f\u00fcr den Webmailer SOGo
        • Netfilter Fail2ban-\u00e4hnliche Integration von @mkuron
        • Nginx Webserver f\u00fcr Komponenten des Stacks
        • Olefy Analyse von Office Dokumenten nach Viren, Makros etc.
        • PHP Programmiersprache der meisten Webbasierten mailcow Applikationen
        • Postfix MTA (Mail Transfer Agent) f\u00fcr den E-Mail-Verkehr im Internet
        • Redis Speicher f\u00fcr Spaminformationen, DKIM Schl\u00fcssel u.w.
        • Rspamd Spamfilter mit automatischem Lernen von Spammails
        • SOGo Integrierter Webmailer und Cal-/Carddav Schnittstelle
        • Solr Voll-Text-Suche f\u00fcr IMAP Verbindungen zum schnellen durchsuchen von E-Mails (Deprecated) (Optional)
        • Unbound Integrierter DNS-Server zum Verifizieren von DNSSEC u.w
        • Watchdog F\u00fcr die grundlegende \u00dcberwachung der Containerstatus innerhalb von mailcow

        Doch das Herzst\u00fcck bzw. das, was mailcow besonders macht, ist die grafische Weboberfl\u00e4che, die mailcow UI.

        Diese bietet f\u00fcr so gut wie alle Einstellungen einen Platz und erlaubt das bequeme Anlegen von neuen Domains und E-Mail-Adressen mit wenigen Klicks.

        Aber auch andere bzw. kniffligere Themen k\u00f6nnen in ihr problemlos erledigt werden:

        • DKIM und ARC Unterst\u00fctzung bzw. Generation.
        • Black- und Whitelists pro Domain und pro Benutzer
        • Spam-Score-Verwaltung pro Benutzer (Spam ablehnen, Spam markieren, Greylist)
        • Erlauben Sie Mailbox-Benutzern, tempor\u00e4re Spam-Aliase zu erstellen
        • Voranstellen von E-Mail-Tags an den Betreff oder Verschieben von E-Mails in Unterordner (pro Benutzer)
        • Mailbox-Benutzer k\u00f6nnen die TLS-Durchsetzung f\u00fcr eingehende und ausgehende Nachrichten umschalten
        • Benutzer k\u00f6nnen die Caches von SOGo ActiveSync-Ger\u00e4ten zur\u00fccksetzen
        • imapsync, um entfernte Postf\u00e4cher regelm\u00e4\u00dfig zu migrieren oder abzurufen
        • TFA: Yubikey OTP und WebAuthn USB (nur Google Chrome und Derivate), TOTP
        • Hinzuf\u00fcgen von Whitelist-Hosts zur Weiterleitung von Mails an mailcow
        • Fail2ban-\u00e4hnliche Integration
        • Quarant\u00e4ne-System
        • Antivirus-Scanning inkl. Makro-Scanning in Office-Dokumenten
        • Integrierte Basis\u00fcberwachung
        • Und weitere...

        Die mailcow Daten (wie bspw. E-Mails, Userdaten etc.) werden in Docker-Volumes aufbewahrt - geben Sie gut auf diese Volumes acht:

        • clamd-db-vol-1
        • crypt-vol-1
        • mysql-socket-vol-1
        • mysql-vol-1
        • postfix-vol-1
        • redis-vol-1
        • rspamd-vol-1
        • sogo-userdata-backup-vol-1
        • sogo-web-vol-1
        • solr-vol-1
        • vmail-index-vol-1
        • vmail-vol-1

        Achtung

        Die Mails werden komprimiert und verschl\u00fcsselt gespeichert. Das Schl\u00fcsselpaar ist in crypt-vol-1 zu finden. Bitte vergessen Sie nicht, dieses und andere Volumes zu sichern. #KeinBackupkeinMitleid

        "},{"location":"de/#unterstutzen-sie-das-mailcow-projekt","title":"Unterst\u00fctzen Sie das mailcow Projekt","text":"

        Bitte erw\u00e4gen Sie einen Supportvertrag gegen eine geringe monatliche Geb\u00fchr unter Servercow1, um die weitere Entwicklung zu unterst\u00fctzen. Wir unterst\u00fctzen Sie, w\u00e4hrend Sie uns unterst\u00fctzen. :)

        Wenn Sie super toll sind und uns ohne Vertrag unterst\u00fctzen m\u00f6chten, k\u00f6nnen Sie eine SAL (Stay-Awesome License) erhalten, die Ihre Unterst\u00fctzung best\u00e4tigt (kaufbar als flexible Einmalzahlung) bei Servercow.

        "},{"location":"de/#hilfe-gefallig","title":"Hilfe gef\u00e4llig?","text":"

        Es gibt zwei M\u00f6glichkeiten, Support f\u00fcr Ihre mailcow-Installation zu erhalten.

        "},{"location":"de/#kommerzieller-support","title":"Kommerzieller Support","text":"

        F\u00fcr professionellen und priorisierten kommerziellen Support k\u00f6nnen Sie ein Basis-Support-Abonnement unter Servercow abschlie\u00dfen. F\u00fcr kundenspezifische Anfragen oder Fragen kontaktieren Sie uns stattdessen bitte unter info@servercow.de.

        Dar\u00fcber hinaus bieten wir auch eine voll ausgestattete und verwaltete managed mailcow an. Auf diese Weise k\u00fcmmern wir uns um alles technische und Sie k\u00f6nnen Ihr ganzes Mail-Erlebnis auf eine problemlose Weise genie\u00dfen.

        "},{"location":"de/#community-support-und-chat","title":"Community Support und Chat","text":"

        Die Alternative ist unser kostenloser Community-Support auf unseren verschiedenen Kan\u00e4len unten. Bitte beachten Sie, dass dieser Support von unserer gro\u00dfartigen Community rund um mailcow betrieben wird. Diese Art von Support ist best-effort, freiwillig und es gibt keine Garantie f\u00fcr irgendetwas.

        • mailcow Community @ community.mailcow.email

        • Telegram (Support) @ t.me/mailcow

        • Telegram (Off-Topic) @ t.me/mailcowOfftopic

        Telegram Desktop-Clients sind f\u00fcr mehrere Plattformen verf\u00fcgbar. Sie k\u00f6nnen den Gruppenverlauf nach Stichworten durchsuchen.

        Nur f\u00fcr Bug Tracking, Feature Requests und Codebeitr\u00e4ge:

        • mailcow/mailcow-dockerized @ GitHub
        "},{"location":"de/#neuigkeiten-und-release-informationen","title":"Neuigkeiten und Release Informationen:","text":"

        F\u00fcr Ank\u00fcndigungen oder Release Informationen sind wir auf folgenden Plattformen vertreten:

        • mailcow @ X/Twitter

        • @doncow @ mailcow.social

        Oder alternativ auf unserem Blog:

        • mailcow.email
        "},{"location":"de/#neugierig-gleich-ausprobieren","title":"Neugierig? Gleich ausprobieren!","text":"

        Haben wir Ihr Interesse geweckt? Verschaffen Sie sich in unseren offiziellen mailcow Demos einen ersten \u00dcberblick \u00fcber die Funktionalit\u00e4ten von mailcow und Ihrer mailcow UI!

        Wir stellen zwei verschiedene Demos bereit:

        • demo.mailcow.email ist die altbekannte Demo, welche sich am Stabilen Stand der mailcow orrientiert (master Branch auf GitHub).
        • nightly-demo.mailcow.email ist die neue Nightly Demo, welche Testfunktionen beherbergt. (Also insbesondere f\u00fcr alle interessant, die keine M\u00f6glichkeit haben sich eine Testinstanz selbst zu erstellen.) (nightly Branch auf GitHub)

        Nutzen Sie diese Anmeldedaten f\u00fcr die Demos

        • Administrator: admin / moohoo
        • Dom\u00e4nen-Administrator: department / moohoo
        • Mailbox: demo@440044.xyz / moohoo

        Die Anmeldedaten f\u00fcr die Logins funktionieren bei beiden Varianten

        Immer auf dem neusten Stand

        Die Demo Instanzen erhalten die neusten Updates direkt nach Release von GitHub. Vollautomatisch, ohne Downtime!

        1. Servercow ist eine Hosting/Support Sparte der The Infrastructure Company GmbH (mailcow Maintainer)\u00a0\u21a9

        "},{"location":"de/backup_restore/b_n_r-accidental_deletion/","title":"Versehentlich gel\u00f6schte Daten wiederherstellen","text":"

        Sie haben also ein Postfach gel\u00f6scht und haben keine Sicherungskopien?

        Wenn Sie Ihren Fehler innerhalb von ein paar Stunden bemerken, k\u00f6nnen Sie die Daten des Benutzers wahrscheinlich wiederherstellen.

        "},{"location":"de/backup_restore/b_n_r-accidental_deletion/#sogo","title":"SOGo","text":"

        Wir erstellen automatisch t\u00e4gliche Backups (24 Stunden Intervall ab dem ausf\u00fchren von up -d) in /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/.

        Stellen Sie sicher, dass der Benutzer, den Sie wiederherstellen wollen, in Ihrem mailcow-Backend existiert. Legen Sie diesen neu an, falls nicht mehr existent.

        Kopieren Sie die Datei mit dem Namen des Benutzers, den Sie wiederherstellen wollen, nach __MAILCOW_DIRECTORY__/data/conf/sogo.

        1. Kopieren Sie die Sicherung: cp /var/lib/docker/volumes/mailcowdockerized_sogo-userdata-backup-vol-1/_data/restoreme@example.org __MAILCOW_DIRECTORY__/data/conf/sogo

        2. F\u00fchren Sie folgenden Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n
          docker-compose exec -u sogo sogo-mailcow sogo-tool restore -F ALL /etc/sogo restoreme@example.org\n

          F\u00fchren Sie sogo-tool ohne Parameter aus, um nach m\u00f6glichen Wiederherstellungsoptionen zu suchen.

        3. L\u00f6schen Sie die kopierte Sicherung, indem Sie rm __MAILCOW_DIRECTORY__/data/conf/sogo ausf\u00fchren

        4. Starten Sie SOGo und Memcached neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart sogo-mailcow memcached-mailcow\n
          docker-compose restart sogo-mailcow memcached-mailcow\n
        "},{"location":"de/backup_restore/b_n_r-accidental_deletion/#mail","title":"Mail","text":"

        Im Falle einer versehentlichen L\u00f6schung einer Mailbox, k\u00f6nnen Sie diese (standardm\u00e4\u00dfig) 5 Tage lang wiederherstellen. Dies h\u00e4ngt von dem MAILDIR_GC_TIME Parameter in mailcow.conf ab.

        Eine gel\u00f6schte Mailbox wird in ihrer verschl\u00fcsselten Form nach /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage kopiert.

        Der Ordner innerhalb von _garbage folgt der Struktur [timestamp]_[domain_sanitized][user_sanitized], zum Beispiel 1629109708_exampleorgtest im Falle von test@example.org, das am 1629109708 gel\u00f6scht wurde.

        Um die Mailbox wiederherzustellen, stellen Sie sicher, dass Sie tats\u00e4chlich auf die gleiche mailcow wiederherstellen, von der sie gel\u00f6scht wurde, oder Sie die gleichen Verschl\u00fcsselungsschl\u00fcssel in crypt-vol-1 verwenden.

        Stellen Sie sicher, dass der Benutzer, den Sie wiederherstellen wollen, in Ihrer mailcow existiert. Legen Sie diesen neu an, wenn der Benutzer fehlt.

        Kopieren Sie die Ordner von /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/_garbage/[timestamp]_[domain_sanitized][user_sanitized] zur\u00fcck nach /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/[domain]/[user] und synchronisieren Sie die Ordner neu und berechnen Sie die Quota (Speicherplatz) neu:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
        docker-compose exec dovecot-mailcow doveadm force-resync -u restoreme@example.net '*'\ndocker-compose exec dovecot-mailcow doveadm quota recalc -u restoreme@example.net\n
        "},{"location":"de/backup_restore/b_n_r-backup/","title":"Sicherung","text":""},{"location":"de/backup_restore/b_n_r-backup/#sicherung","title":"Sicherung","text":""},{"location":"de/backup_restore/b_n_r-backup/#anleitung","title":"Anleitung","text":"

        Sie k\u00f6nnen das mitgelieferte Skript helper-scripts/backup_and_restore.sh verwenden, um mailcow automatisch zu sichern.

        Achtung

        Bitte kopieren Sie dieses Skript nicht an einen anderen Ort.

        Um ein Backup zu starten, geben Sie \"backup\" als ersten Parameter an und entweder eine oder mehrere zu sichernde Komponenten als folgende Parameter. Sie k\u00f6nnen auch \"all\" als zweiten Parameter verwenden, um alle Komponenten zu sichern. F\u00fcgen Sie --delete-days n an, um Sicherungen zu l\u00f6schen, die \u00e4lter als n Tage sind.

        # Syntax:\n# ./helper-scripts/backup_and_restore.sh backup (vmail|crypt|redis|rspamd|postfix|mysql|all|--delete-days)\n\n# Alles sichern, Sicherungen \u00e4lter als 3 Tage l\u00f6schen\n./helper-scripts/backup_and_restore.sh backup all --delete-days 3\n\n# vmail-, crypt- und mysql-Daten sichern, Sicherungen l\u00f6schen, die \u00e4lter als 30 Tage sind\n./helper-scripts/backup_and_restore.sh backup vmail crypt mysql --delete-days 30\n\n# vmail sichern\n./helper-scripts/backup_and_restore.sh backup vmail\n
        "},{"location":"de/backup_restore/b_n_r-backup/#variablen-fur-backuprestore-skript","title":"Variablen f\u00fcr Backup/Restore Skript","text":""},{"location":"de/backup_restore/b_n_r-backup/#multithreading","title":"Multithreading","text":"

        Seit dem 2022-10 Update ist es m\u00f6glich das Skript mit Multithreading Support laufen zu lassen. Dies l\u00e4sst sich sowohl f\u00fcr Backups aber auch f\u00fcr Restores nutzen.

        Um das Backup/den Restore mit Multithreading zu starten muss THREADS als Umgebungsvariable vor dem Befehl zum starten hinzugef\u00fcgt werden.

        THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n
        Die Anzahl hinter dem = Zeichen gibt dabei dann die Thread Anzahl an. Nehmen Sie bitte immer ihre Kernanzahl -2 um mailcow selber noch genug CPU Leistung zu lassen.

        "},{"location":"de/backup_restore/b_n_r-backup/#backup-pfad","title":"Backup Pfad","text":"

        Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung fragen. Innerhalb dieses Speicherortes wird es Ordner im Format \"mailcow_DATE\" erstellen. Sie sollten diese Ordner nicht umbenennen, um den Wiederherstellungsprozess nicht zu st\u00f6ren.

        Um ein Backup unbeaufsichtigt durchzuf\u00fchren, definieren Sie MAILCOW_BACKUP_LOCATION als Umgebungsvariable, bevor Sie das Skript starten:

        MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

        Tipp

        Beide oben genannten Variablen k\u00f6nnen auch kombiniert werden! Bsp:\n```\nMAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n```\n
        "},{"location":"de/backup_restore/b_n_r-backup/#cronjob","title":"Cronjob","text":"

        Sie k\u00f6nnen das Backup-Skript regelm\u00e4\u00dfig \u00fcber einen Cronjob laufen lassen. Stellen Sie sicher, dass BACKUP_LOCATION existiert:

        PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n5 4 * * * cd /opt/mailcow-dockerized/; MAILCOW_BACKUP_LOCATION=/mnt/mailcow_backups /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n

        Standardm\u00e4\u00dfig sendet Cron das komplette Ergebnis jeder Backup-Operation per E-Mail. Wenn Sie m\u00f6chten, dass cron nur im Fehlerfall (Exit-Code ungleich Null) eine E-Mail sendet, k\u00f6nnen Sie den folgenden Ausschnitt verwenden. Die Pfade m\u00fcssen entsprechend Ihrer Einrichtung angepasst werden (dieses Skript ist ein Beitrag eines Benutzers).

        Das folgende Skript kann in /etc/cron.daily/mailcow-backup platziert werden - vergessen Sie nicht, es mit chmod +x als ausf\u00fchrbar zu markieren:

        #!/bin/sh\n\n# Backup mailcow data\n# https://docs.mailcow.email/b_n_r_backup/\n\nset -e\n\nOUT=\"$(mktemp)\"\nexport MAILCOW_BACKUP_LOCATION=\"/opt/backup\"\nSCRIPT=\"/opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh\"\nPARAMETERS=\"backup all\"\nOPTIONS=\"--delete-days 30\"\n\n# run command\nset +e\n\"${SCRIPT}\" ${PARAMETERS} ${OPTIONS} 2>&1 > \"$OUT\"\nRESULT=$?\n\nif [ $RESULT -ne 0 ]\n    then\n            echo \"${SCRIPT} ${PARAMETERS} ${OPTIONS} encounters an error:\"\n            echo \"RESULT=$RESULT\"\n            echo \"STDOUT / STDERR:\"\n            cat \"$OUT\"\nfi\n
        "},{"location":"de/backup_restore/b_n_r-backup/#backup-strategie-mit-rsync-und-mailcow-backup-skript","title":"Backup-Strategie mit rsync und mailcow Backup-Skript","text":"

        Erstellen Sie das Zielverzeichnis f\u00fcr mailcows Hilfsskript: 

        mkdir -p /external_share/backups/backup_script\n

        Cronjobs erstellen: 

        PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n25 1 * * * rsync -aH --delete /opt/mailcow-dockerized /external_share/backups/mailcow-dockerized\n40 2 * * * rsync -aH --delete /var/lib/docker/volumes /external_share/backups/var_lib_docker_volumes\n5 4 * * * cd /opt/mailcow-dockerized/; BACKUP_LOCATION=/external_share/backups/backup_script /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup mysql crypt redis --delete-days 3\n# Wenn Sie wollen, benutzen Sie das Werkzeug acl, um die Berechtigungen einiger/aller Ordner/Dateien zu sichern: getfacl -Rn /path\n

        Am Zielort (in diesem Fall /external_share/backups) m\u00f6chten Sie vielleicht Snapshot-M\u00f6glichkeiten haben (ZFS, Btrfs usw.). Machen Sie t\u00e4glich einen Snapshot und bewahren Sie ihn f\u00fcr n Tage auf, um ein konsistentes Backup zu erhalten. F\u00fchren Sie kein rsync auf eine Samba-Freigabe durch, Sie m\u00fcssen die richtigen Berechtigungen behalten!

        Zum Wiederherstellen m\u00fcssen Sie rsync einfach in umgekehrter Richtung ausf\u00fchren und Docker neu starten, um die Volumes erneut zu lesen. F\u00fchren Sie folgende Befehle aus:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose pull\ndocker compose up -d\n
        docker-compose pull\ndocker-compose up -d\n

        Wenn Sie Gl\u00fcck haben, k\u00f6nnen Redis und MariaDB die inkonsistenten Datenbanken automatisch reparieren (wenn sie inkonsistent sind). Im Falle einer besch\u00e4digten Datenbank m\u00fcssen Sie das Hilfsskript verwenden, um die inkonsistenten Elemente wiederherzustellen. Wenn die Wiederherstellung fehlschl\u00e4gt, versuchen Sie, die Sicherungen zu extrahieren und die Dateien manuell zur\u00fcck zu kopieren. Behalten Sie die Dateiberechtigungen bei!

        "},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/","title":"Mail-Verzeichnis","text":""},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/#sicherung","title":"Sicherung","text":"

        Diese Zeile sichert das vmail-Verzeichnis in eine Datei backup_vmail.tar.gz im mailcow-Root-Verzeichnis:

        docker compose (Plugin)docker-compose (Standalone) 
        cd /pfad/zu/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n
        cd /pfad/zu/mailcow-dockerized\ndocker run --rm -i -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar cvfz /backup/backup_vmail.tar.gz /vmail\n

        Sie k\u00f6nnen den Pfad \u00e4ndern, indem Sie ${PWD} (das dem aktuellen Verzeichnis entspricht) zu einem beliebigen Pfad \u00e4ndern, auf den Sie Schreibzugriff haben. Setzen Sie den Dateinamen backup_vmail.tar.gz auf einen beliebigen Namen, aber lassen Sie den Pfad so wie er ist. Beispiel: [...] tar cvfz /backup/mein_eigener_dateiname_.tar.gz

        "},{"location":"de/backup_restore/b_n_r-backup_restore-maildir/#wiederherstellen","title":"Wiederherstellen","text":"docker compose (Plugin)docker-compose (Standalone) 
        cd /pfad/zu/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
        cd /pfad/zu/mailcow-dockerized\ndocker run --rm -it -v $(docker inspect --format '{{ range .Mounts }}{{ if eq .Destination \"/var/vmail\" }}{{ .Name }}{{ end }}{{ end }}' $(docker-compose ps -q dovecot-mailcow)):/vmail -v ${PWD}:/backup debian:bullseye-slim tar xvfz /backup/backup_vmail.tar.gz\n
        "},{"location":"de/backup_restore/b_n_r-backup_restore-mysql/#sicherung","title":"Sicherung","text":"docker compose (Plugin)docker-compose (Standalone) 
        cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
        cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\nDATE=$(date +\"%Y%m%d_%H%M%S\")\ndocker-compose exec -T mysql-mailcow mysqldump --default-character-set=utf8mb4 -u${DBUSER} -p${DBPASS} ${DBNAME} > backup_${DBNAME}_${DATE}.sql\n
        "},{"location":"de/backup_restore/b_n_r-backup_restore-mysql/#wiederherstellen","title":"Wiederherstellen","text":"

        Warnung

        docker compose (Plugin)docker-compose (Standalone)

        Sie sollten den SQL-Dump ohne docker compose umleiten, um Parsing-Fehler zu vermeiden.

        Sie sollten den SQL-Dump ohne docker-compose umleiten, um Parsing-Fehler zu vermeiden.

        cd /pfad/zu/mailcow-dockerized\nsource mailcow.conf\ndocker exec -i $(docker compose ps -q mysql-mailcow) mysql -u${DBUSER} -p${DBPASS} ${DBNAME} < backup_file.sql\n
        "},{"location":"de/backup_restore/b_n_r-coldstandby/","title":"Cold-standby-Backup","text":"

        mailcow bietet eine einfache M\u00f6glichkeit, eine konsistente Kopie von sich selbst zu erstellen, die per rsync an einen entfernten Ort ohne Ausfallzeit \u00fcbertragen werden kann.

        Dies kann auch verwendet werden, um Ihre mailcow auf einen neuen Server zu \u00fcbertragen.

        "},{"location":"de/backup_restore/b_n_r-coldstandby/#das-sollten-sie-wissen","title":"Das sollten Sie wissen","text":"

        Das bereitgestellte Skript funktioniert auf Standardinstallationen.

        Es kann versagen, wenn Sie nicht unterst\u00fctzte Volume Overrides verwenden. Wir unterst\u00fctzen das nicht und wir werden keine Hacks einbauen, die das unterst\u00fctzen. Bitte erstellen und pflegen Sie einen Fork, wenn Sie Ihre \u00c4nderungen beibehalten wollen.

        Das Skript wird die gleichen Pfade wie Ihre Standard-mailcow-Installation verwenden. Das ist das mailcow-Basisverzeichnis - f\u00fcr die meisten Nutzer /opt/mailcow-dockerized - sowie die Mountpoints.

        Um die Pfade Ihrer Quellvolumes zu finden, verwenden wir docker inspect und lesen das Zielverzeichnis jedes Volumes, das mit Ihrem mailcow compose Projekt verbunden ist. Das bedeutet, dass wir auch Volumes \u00fcbertragen, die Sie in einer Override-Datei hinzugef\u00fcgt haben. Lokale Bind-Mounts k\u00f6nnen funktionieren, m\u00fcssen aber nicht.

        Das Skript verwendet rsync mit dem --delete Flag. Das Ziel wird eine exakte Kopie der Quelle sein.

        mariabackup wird verwendet, um eine konsistente Kopie des SQL-Datenverzeichnisses zu erstellen.

        Nach dem Rsync der Daten f\u00fchren wir folgenden Befehl aus (anhand der gesetzten docker compose Version in der mailcow.conf) und entfernen alte Image-Tags aus dem Ziel:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose pull\n
        docker-compose pull\n

        Ihre Quelle wird zu keinem Zeitpunkt ver\u00e4ndert.

        Sie sollten sicherstellen, dass Sie die gleiche /etc/docker/daemon.json auf dem entfernten Ziel verwenden.

        Sie sollten keine Festplatten-Snapshots (z. B. \u00fcber ZFS, LVM usw.) auf dem Ziel ausf\u00fchren, w\u00e4hrend dieses Skript ausgef\u00fchrt wird.

        Die Versionierung ist nicht Teil dieses Skripts, wir verlassen uns auf das Ziel (Snapshots oder Backups). Sie k\u00f6nnen daf\u00fcr auch jedes andere Tool verwenden.

        "},{"location":"de/backup_restore/b_n_r-coldstandby/#vorbereiten","title":"Vorbereiten","text":"

        Sie ben\u00f6tigen ein SSH-f\u00e4higes Ziel und eine Schl\u00fcsseldatei, um sich mit diesem Ziel zu verbinden. Der Schl\u00fcssel sollte nicht durch ein Passwort gesch\u00fctzt sein, damit das Skript unbeaufsichtigt arbeiten kann.

        In Ihrem mailcow-Basisverzeichnis, z.B. /opt/mailcow-dockerized, finden Sie eine Datei create_cold_standby.sh.

        Bearbeiten Sie diese Datei und \u00e4ndern Sie die exportierten Variablen:

        export REMOTE_SSH_KEY=/pfad/zum/keyfile\nexport REMOTE_SSH_PORT=22\nexport REMOTE_SSH_HOST=mailcow-backup.host.name\n

        Der Schl\u00fcssel muss im Besitz von root sein und darf nur von diesem gelesen werden k\u00f6nnen.

        Sowohl die Quelle als auch das Ziel ben\u00f6tigen rsync >= v3.1.0. Das Ziel muss \u00fcber Docker und docker compose v2 verf\u00fcgen.

        Das Skript wird Fehler automatisch erkennen und sich beenden.

        Sie k\u00f6nnen die Verbindung testen, indem Sie ssh mailcow-backup.host.name -p22 -i /path/to/keyfile ausf\u00fchren.

        Wichtig f\u00fcr den Wechsel auf eine andere Architektur

        Wenn Sie planen mit dem Cold Standby Skript eine Migration von x86 auf ARM64 bzw. umgekehrt zu machen, lassen Sie das Skript einfach normal laufen. Das Skript wird automatisch erkennen, ob es unterschiede zwischen der Quelle und dem Ziel im Bezug auf die Architektur gibt und sich dementsprechend verhalten und betroffene Volumes im Sync auslassen.

        Dies hat den Hintergrund, dass Rspamd Regexp Eintr\u00e4ge von unseren Konfigurationen auf die entsprechende Plattform kompiliert und bei einem Plattform Wechsel diese Cache Dateien nicht gelesen werden k\u00f6nnen. Rspamd w\u00fcrde daraufhin abst\u00fcrzen und eine sinnvolle Nutzung mailcow's damit nicht erm\u00f6glichen. Deswegen wird das rspamd-vol-1 (Rspamd Volume) im Cold Standby ausgelassen.

        Keine Sorge! Rspamd wird trotzdem nach der Migration korrekt funktionieren, da diese Cache Dateien selbstst\u00e4ndig f\u00fcr die neue Plattform generiert werden.

        "},{"location":"de/backup_restore/b_n_r-coldstandby/#backup-und-aktualisierung-des-cold-standby","title":"Backup und Aktualisierung des Cold-Standby","text":"

        Starten Sie das erste Backup, dies kann je nach Verbindung eine Weile dauern:

        bash /opt/mailcow-dockerized/create_cold_standby.sh\n

        Das war einfach, nicht wahr?

        Das Aktualisieren des Cold-Standby ist genauso einfach:

        bash /opt/mailcow-dockerized/create_cold_standby.sh\n

        Es ist derselbe Befehl.

        "},{"location":"de/backup_restore/b_n_r-coldstandby/#automatisierte-backups-mit-cron","title":"Automatisierte Backups mit cron","text":"

        Stellen Sie zun\u00e4chst sicher, dass der cron Dienst aktiviert ist und l\u00e4uft:

        systemctl enable cron.service && systemctl start cron.service\n

        Um die Backups auf dem Cold-Standby-Server zu automatisieren, k\u00f6nnen Sie einen Cron-Job verwenden. Um die Cron-Jobs f\u00fcr den Root-Benutzer zu bearbeiten, f\u00fchren Sie aus:

        crontab -e\n

        F\u00fcgen Sie die folgenden Zeilen hinzu, um den Cold-Standby-Server t\u00e4glich um 03:00 Uhr zu synchronisieren. In diesem Beispiel werden Fehler der letzten Ausf\u00fchrung in einer Datei protokolliert.

        PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\n\n0 3 * * * bash /opt/mailcow-dockerized/create_cold_standby.sh 2> /var/log/mailcow-coldstandby-sync.log\n

        Wenn korrekt gespeichert, sollte der Cron-Job durch folgende Eingabe angezeigt werden:

        crontab -l\n
        "},{"location":"de/backup_restore/b_n_r-restore/","title":"Wiederherstellung","text":""},{"location":"de/backup_restore/b_n_r-restore/#wiederherstellung","title":"Wiederherstellung","text":""},{"location":"de/backup_restore/b_n_r-restore/#variablen-fur-backuprestore-skript","title":"Variablen f\u00fcr Backup/Restore Skript","text":""},{"location":"de/backup_restore/b_n_r-restore/#multithreading","title":"Multithreading","text":"

        Seit dem 2022-10 Update ist es m\u00f6glich das Skript mit Multithreading Support laufen zu lassen. Dies l\u00e4sst sich sowohl f\u00fcr Backups aber auch f\u00fcr Restores nutzen.

        Um das Backup/den Restore mit Multithreading zu starten muss THREADS als Umgebungsvariable vor dem Befehl zum starten hinzugef\u00fcgt werden.

        THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n
        Die Anzahl hinter dem = Zeichen gibt dabei dann die Thread Anzahl an. Nehmen Sie bitte immer ihre Kernanzahl -2 um mailcow selber noch genug CPU Leistung zu lassen.

        "},{"location":"de/backup_restore/b_n_r-restore/#backup-pfad","title":"Backup Pfad","text":"

        Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung fragen. Innerhalb dieses Speicherortes wird es Ordner im Format \"mailcow_DATE\" erstellen. Sie sollten diese Ordner nicht umbenennen, um den Wiederherstellungsprozess nicht zu st\u00f6ren.

        Um ein Backup unbeaufsichtigt durchzuf\u00fchren, definieren Sie MAILCOW_BACKUP_LOCATION als Umgebungsvariable, bevor Sie das Skript starten:

        MAILCOW_BACKUP_LOCATION=/opt/backup /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh backup all\n

        Tipp

        Beide oben genannten Variablen k\u00f6nnen auch kombiniert werden! Bsp: 

        MAILCOW_BACKUP_LOCATION=/opt/backup THREADS=14 /opt/mailcow-dockerized/helper-scripts/backup_and_restore.sh restore\n

        "},{"location":"de/backup_restore/b_n_r-restore/#wiederherstellung-der-daten","title":"Wiederherstellung der Daten","text":"

        Achtung

        Bitte kopieren Sie dieses Skript nicht an einen anderen Ort.

        Wichtig

        Um ein Backup auf ein neues System wiederherzustellen muss mailcow initialisiert sein und gestartet sein! Installieren Sie also mailcow nach der Anleitung neu und warten Sie mit der Wiederherstellung so lange, bis mailcow in einem leeren Zustand l\u00e4uft.

        Achtung f\u00fcr \u00e4ltere Installationen

        Bitte schauen Sie VOR der Wiederherstellung Ihres mailcow Systemes auf einen neuen Server und einem sauberen mailcow-dockerized Ordner, ob in Ihrer mailcow.conf der Wert MAILDIR_SUB gesetzt ist. Falls dieser nicht gesetzt ist, so setzen Sie diesen auch bitte in Ihrer neuen mailcow nicht, bzw. entfernen diesen, da sonst KEINE E-Mails angezeigt werden. Dovecot l\u00e4dt E-Mails aus dem besagtem Unterordner des Maildir Volumes unter $DOCKER_VOLUME_PFAD/mailcowdockerized_vmail-vol-1 und bei \u00c4nderung im Vergleich zum Ursprungszustand sind dort keine Mails vorhanden.

        Um eine Wiederherstellung durchzuf\u00fchren, starten Sie mailcow, verwenden Sie das Skript mit \"restore\" als ersten Parameter.

        # Syntax:\n# ./helper-scripts/backup_and_restore.sh restore\n

        Das Skript wird Sie nach einem Speicherort f\u00fcr die Sicherung der mailcow_DATE-Ordner fragen:

        Backup location (absolute path, starting with /): /opt/backup\n

        Anschlie\u00dfend werden alle verf\u00fcgbaren Backups in dem angegebenen Ordner (in unserem Beispiel /opt/backup) angezeigt:

        Found project name mailcowdockerized\n[ 1 ] - /opt/backup/mailcow-2023-12-11-13-27-14/\n[ 2 ] - /opt/backup/mailcow-2023-12-11-14-02-06/\n

        Nun k\u00f6nnen Sie die Nummer Ihres Backups angeben, welches Sie Wiederherstellen wollen, in diesem Beispiel die 2:

        Select a restore point: 2\n

        Das Skript wird nun alle gesicherten Komponenten Anzeigen, die Sie wiederherstellen k\u00f6nnen, in unserem Fall haben wir beim Backup Prozess all also Alles gew\u00e4hlt, dementsprechend taucht das hier nun auf:

        [ 0 ] - all\n[ 1 ] - Crypt data\n[ 2 ] - Rspamd data\n[ 3 ] - Mail directory (/var/vmail)\n[ 4 ] - Redis DB\n[ 5 ] - Postfix data\n[ 6 ] - SQL DB\n

        Auch hier w\u00e4hlen wir nun wieder die Komponente aus, die wir wiederherstellen wollen. Option 0 stellt ALLES wieder her.

        Wenn Sie auf eine andere Architektur wiederherstellen wollen...

        Sollten Sie das Backup auf einer anderen Architektur bspw. x86 gemacht haben und wollen dieses Backup nun auf ARM64 wiederherstellen, so wird das Backup von Rspamd als inkompatibel angezeigt und ist nicht einzeln anw\u00e4hlbar. Bei der Wiederherstellung mit Aufruf der Taste 0 wird die Wiederherstellung von Rspamd ebenfalls \u00fcbersprungen.

        Beispiel f\u00fcr inkompatibles Rspamd Backup im Auswahl Men\u00fc:

        [...]\n[ NaN ] - Rspamd data (incompatible Arch, cannot restore it)\n[...]\n

        Nun wird mailcow die von Ihnen ausgew\u00e4hlten Sicherungen wiederherstellen. Bitte beachten Sie, dass je nach Gr\u00f6\u00dfe der Sicherungen die Wiederherstellung eine gewisse Zeit in Anspruch nehmen kann.

        "},{"location":"de/client/client-android/","title":"Android","text":"
        1. \u00d6ffnen Sie die App Email.
        2. Wenn dies Ihr erstes E-Mail-Konto ist, tippen Sie auf Konto hinzuf\u00fcgen; wenn nicht, tippen Sie auf Mehr und Einstellungen und dann Konto hinzuf\u00fcgen.
        3. W\u00e4hlen Sie Microsoft Exchange ActiveSync.
        4. Geben Sie Ihre E-Mail Adresse () und Ihr Passwort ein.
        5. Tippen Sie auf Anmelden.
        "},{"location":"de/client/client-apple/#methode-1-konfigurationsprofil","title":"Methode 1: Konfigurationsprofil","text":"

        E-Mail, Kontakte und Kalender k\u00f6nnen auf Apple-Ger\u00e4ten automatisch konfiguriert werden, indem ein Konfigurationsprofil installiert wird. Um ein solches Profil herunterzuladen, m\u00fcssen Sie sich mit dem gew\u00fcnschten E-Mail-Konto in der mailcow UI anmelden.

        "},{"location":"de/client/client-apple/#methode-11-imap-und-smtp","title":"Methode 1.1: IMAP und SMTP","text":"

        Diese Methode konfiguriert IMAP und SMTP f\u00fcr den Zugriff auf ein E-Mail-Konto.

        1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_emailmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
        2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
          • Anleitung f\u00fcr macOS
          • Anleitung f\u00fcr iOS
        3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen. Wenn Sie dazu aufgefordert werden, geben Sie das Passwort Ihres E-Mail-Kontos ein.
        "},{"location":"de/client/client-apple/#methode-12-imap-smtp-und-calcarddav","title":"Methode 1.2: IMAP, SMTP und Cal/CardDAV","text":"

        Diese Methode konfiguriert neben dem E-Mail-Konto zus\u00e4tzlich CardDAV (Adressbuch) und CalDAV (Kalender).

        1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.phpmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
        2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
          • Anleitung f\u00fcr macOS
          • Anleitung f\u00fcr iOS
        3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen. Wenn Sie dazu aufgefordert werden, geben Sie das Passwort Ihres E-Mail-Kontos ein.
        "},{"location":"de/client/client-apple/#methode-13-imap-und-smtp-mit-app-passwort","title":"Methode 1.3: IMAP und SMTP mit App-Passwort","text":"

        Diese Methode konfiguriert IMAP und SMTP f\u00fcr den Zugriff auf ein E-Mail-Konto. Es wird ein neues App-Passwort erzeugt und in das Profil eingef\u00fcgt, damit bei der Einrichtung kein Passwort eingegeben werden muss. Geben Sie das Profil nicht weiter, da es einen vollst\u00e4ndigen Zugriff auf Ihr Postfach erm\u00f6glicht.

        1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?only_email&app_passwordmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
        2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
          • Anleitung f\u00fcr macOS
          • Anleitung f\u00fcr iOS
        3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen.
        "},{"location":"de/client/client-apple/#methode-14-imap-smtp-und-calcarddav-mit-app-passwort","title":"Methode 1.4: IMAP, SMTP und Cal/CardDAV mit App-Passwort","text":"

        Diese Methode konfiguriert neben dem E-Mail-Konto zus\u00e4tzlich CardDAV (Adressbuch) und CalDAV (Kalender). Es wird ein neues App-Passwort erzeugt und in das Profil eingef\u00fcgt, damit bei der Einrichtung kein Passwort eingegeben werden muss. Geben Sie das Profil nicht weiter, da es einen vollst\u00e4ndigen Zugriff auf Ihr Postfach erm\u00f6glicht.

        1. \u00d6ffnen Sie https://${MAILCOW_HOSTNAME}/mobileconfig.php?app_passwordmailcow.mobileconfig um ein individuelles Konfigurationsprofil herunterzuladen.
        2. \u00d6ffnen Sie das Profil auf Ihrem Mac, iPhone oder iPad und folgen Sie der Anleitung von Apple f\u00fcr Ihre Betriebssystemversion, um das Profil zu installieren:
          • Anleitung f\u00fcr macOS
          • Anleitung f\u00fcr iOS
        3. Da das Profil nicht digital signiert ist, m\u00fcssen Sie den entsprechenden Hinweis bei der Installation best\u00e4tigen.
        "},{"location":"de/client/client-apple/#methode-2-exchange-activesync-emulation","title":"Methode 2: Exchange ActiveSync-Emulation","text":"

        Unter iOS/iPadOS wird auch Exchange ActiveSync als Alternative zum obigen Verfahren unterst\u00fctzt. Es hat den Vorteil, dass es Push-E-Mail unterst\u00fctzt (d. h. Sie werden sofort \u00fcber eingehende Nachrichten benachrichtigt), hat aber einige Einschr\u00e4nkungen, z. B. unterst\u00fctzt es nicht mehr als drei E-Mail-Adressen pro Kontakt in Ihrem Adressbuch. Befolgen Sie die folgenden Schritte, wenn Sie stattdessen Exchange verwenden m\u00f6chten.

        1. Folgen Sie der Anleitung von Apple f\u00fcr Ihre Version von iOS/iPadOS und w\u00e4hlen Sie Microsoft Exchange als E-Mail-Dienst.
        2. Geben Sie Ihre E-Mail Adresse () ein und tippen Sie auf Weiter.
        3. W\u00e4hlen Sie Manuell konfigurieren bei der Frage, ob die E-Mail-Adresse an Microsoft gesendet werden soll.
        4. Geben Sie Ihr Passwort ein und tippen Sie erneut auf Weiter. Wenn die 2-Faktor-Authentifizierung aktiviert ist, m\u00fcssen Sie ein App-Password anstelle Ihres normalen Passwortes benutzen.
        5. Tippen Sie abschlie\u00dfend auf Speichern.
        "},{"location":"de/client/client-emclient/","title":"eM Client","text":"
        1. Starten Sie eM Client.
        2. Wenn Sie eM Client zum ersten Mal starten, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
        3. Gehen Sie oben auf Men\u00fc, w\u00e4hlen Sie Tools und Konten.
        4. Geben Sie Ihre E-Mail Adresse ein () und klicken Sie auf Jetzt starten.
        5. Geben Sie Ihr Passwort ein und klicken Sie auf Weiter.
        6. Geben Sie Ihren Namen ein () und klicken Sie auf Weiter.
        7. Klicken Sie auf Fertigstellen.
        "},{"location":"de/client/client-kontact/","title":"KDE Kontact","text":"
        1. Starten Sie Kontact.
        2. Wenn Sie Kontact oder KMail zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
        3. Gehen Sie zu Mail in der Seitenleiste. Gehen Sie zum Men\u00fc Tools und w\u00e4hlen Sie Account Wizard.
        4. Geben Sie Ihren Namen (), E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
        5. Klicken Sie auf Konto erstellen. Wenn Sie dazu aufgefordert werden, geben Sie Ihr Passwort erneut ein und klicken Sie auf OK.
        6. Schlie\u00dfen Sie das Fenster, indem Sie auf Beenden klicken.
        7. Gehen Sie zu Kalender in der Seitenleiste.
        8. Gehen Sie zum Men\u00fc Einstellungen und w\u00e4hlen Sie Konfigurieren Sie KOrganizer.
        9. Gehen Sie zur Registerkarte Kalender und klicken Sie auf die Schaltfl\u00e4che Hinzuf\u00fcgen.
        10. W\u00e4hlen Sie DAV-Groupware-Ressource und klicken Sie auf OK.
        11. Geben Sie Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
        12. W\u00e4hlen Sie ScalableOGo aus dem Dropdown-Men\u00fc und klicken Sie auf Weiter.
        13. Geben Sie den mailcow Hostname in das Feld Host ein und klicken Sie auf Weiter.
        14. Klicken Sie auf Verbindung testen und dann auf Fertigstellen. Klicken Sie abschlie\u00dfend zweimal auf OK.

        Sobald Sie Kontact eingerichtet haben, k\u00f6nnen Sie KMail, KOrganizer und KAddressBook auch einzeln verwenden.

        "},{"location":"de/client/client-manual/","title":"Manuelle Konfiguration","text":"

        Diese Anweisungen gelten nur f\u00fcr unver\u00e4nderte Portbindungen!

        "},{"location":"de/client/client-manual/#e-mail","title":"E-Mail","text":"Dienst Verschl\u00fcsselung Host Port IMAP STARTTLS mailcow hostname 143 IMAPS SSL mailcow hostname 993 POP3 STARTTLS mailcow hostname 110 POP3S SSL mailcow hostname 995 SMTP STARTTLS mailcow hostname 587 SMTPS SSL mailcow hostname 465

        Bitte verwenden Sie \"plain\" als Authentifizierungsmechanismus. Entgegen der Annahme werden keine Passw\u00f6rter im Klartext \u00fcbertragen, da ohne TLS keine Authentifizierung stattfinden darf.

        "},{"location":"de/client/client-manual/#kontakte-und-kalender","title":"Kontakte und Kalender","text":"

        SOGos Standard-URLs f\u00fcr Kalender (CalDAV) und Kontakte (CardDAV):

        1. CalDAV https://mail.example.com/SOGo/dav/user@example.com/Calendar/personal/https:///SOGo/dav//Calendar/personal/

        2. CardDAV https://mail.example.com/SOGo/dav/user@example.com/Contacts/personal/https:///SOGo/dav//Contacts/personal/

        Einige Anwendungen verlangen m\u00f6glicherweise die Verwendung von https://mail.example.com/SOGo/dav/https:///SOGo/dav/ oder den vollst\u00e4ndigen Pfad zu Ihrem Kalender, der in SOGo gefunden und kopiert werden kann.

        "},{"location":"de/client/client-outlook/","title":"Microsoft Outlook","text":"
        1. Downloaden und installieren Sie Outlook CalDav Synchronizer.
        2. Starten Sie Outlook.
        3. Wenn Sie Outlook zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 5 fort.
        4. Gehen Sie zum Men\u00fc Datei und klicken Sie auf Konto hinzuf\u00fcgen.
        5. Geben Sie Ihren Namen (), Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
        6. Klicken Sie auf Finish.
        7. Gehen Sie zur Multifunktionsleiste CalDav Synchronizer und klicken Sie auf Synchronisationsprofile.
        8. Klicken Sie auf die zweite Schaltfl\u00e4che oben (Mehrere Profile hinzuf\u00fcgen), w\u00e4hlen Sie Sogo und klicken Sie auf Ok.
        9. Klicken Sie auf die Schaltfl\u00e4che IMAP/POP3-Kontoeinstellungen abrufen.
        10. Klicken Sie auf Ressourcen erkennen und Outlook-Ordnern zuweisen.
        11. W\u00e4hlen Sie im Fenster Ressource ausw\u00e4hlen Ihren Hauptkalender (in der Regel Pers\u00f6nlicher Kalender), klicken Sie auf die Schaltfl\u00e4che ..., weisen Sie ihn dem Ordner Kalender zu, und klicken Sie auf OK. Gehen Sie zu den Registerkarten Adressb\u00fccher und Aufgaben und wiederholen Sie den Vorgang entsprechend. Weisen Sie nicht mehreren Kalendern, Adressb\u00fcchern oder Aufgabenlisten zu!
        12. Schlie\u00dfen Sie alle Fenster mit den Tasten OK.
        "},{"location":"de/client/client-outlook/#outlook-2016-oder-hoher-von-office-365-unter-windows","title":"Outlook 2016 oder h\u00f6her von Office 365 unter Windows","text":"

        Dies gilt nur, wenn Ihr Serveradministrator EAS f\u00fcr Outlook nicht deaktiviert hat. Wenn es deaktiviert ist, folgen Sie bitte stattdessen der Anleitung f\u00fcr Outlook 2007.

        Outlook 2016 hat ein Problem mit der automatischen Erkennung. Nur Outlook von Office 365 ist betroffen. Wenn Sie Outlook aus einer anderen Quelle installiert haben, folgen Sie bitte der Anleitung f\u00fcr Outlook 2013 oder h\u00f6her.

        F\u00fcr EAS m\u00fcssen Sie den alten Assistenten verwenden, indem Sie C:\\Program Files (x86)\\Microsoft Office\\root\\Office16\\OLCFG.EXE starten. Wenn diese Anwendung ge\u00f6ffnet wird, k\u00f6nnen Sie mit Schritt 4 der Anleitung f\u00fcr Outlook 2013 unten fortfahren.

        Wenn die Anwendung nicht ge\u00f6ffnet wird, k\u00f6nnen Sie den Assistenten zum Erstellen eines neuen Kontos vollst\u00e4ndig deaktivieren und die nachstehende Anleitung f\u00fcr Outlook 2013 befolgen.

        "},{"location":"de/client/client-outlook/#outlook-2007-oder-hoher-auf-windows-kalenderkontakte-via-caldav-synchronizer","title":"Outlook 2007 oder h\u00f6her auf Windows (Kalender/Kontakte via CalDav Synchronizer)","text":""},{"location":"de/client/client-outlook/#outlook-2013-oder-hoher-unter-windows-active-sync-nicht-empfohlen","title":"Outlook 2013 oder h\u00f6her unter Windows (Active Sync - nicht empfohlen)","text":"

        Dies gilt nur, wenn Ihr Serveradministrator EAS f\u00fcr Outlook nicht deaktiviert hat. Wenn es deaktiviert ist, folgen Sie bitte stattdessen der Anleitung f\u00fcr Outlook 2007.

        1. Starten Sie Outlook.
        2. Wenn Sie Outlook zum ersten Mal gestartet haben, werden Sie aufgefordert, Ihr Konto einzurichten. Fahren Sie mit Schritt 4 fort.
        3. \u00d6ffnen Sie das Men\u00fc Datei und klicken Sie auf Konto hinzuf\u00fcgen.
        4. Geben Sie Ihren Namen (), Ihre E-Mail Adresse () und Ihr Passwort ein. Klicken Sie auf Weiter.
        5. Wenn Sie dazu aufgefordert werden, geben Sie Ihr Passwort erneut ein, markieren Sie Meine Anmeldedaten speichern und klicken Sie auf OK.
        6. Klicken Sie auf die Schaltfl\u00e4che Zulassen.
        7. Klicken Sie auf Fertigstellen.
        "},{"location":"de/client/client-outlook/#outlook-2011-oder-hoher-unter-macos","title":"Outlook 2011 oder h\u00f6her unter macOS","text":"

        Die Mac-Version von Outlook synchronisiert keine Kalender und Kontakte und wird daher nicht unterst\u00fctzt.

        "},{"location":"de/client/client-thunderbird/","title":"Mozilla Thunderbird","text":"
        1. \u00d6ffnen Sie Thunderbird.
        2. Wenn Sie Thunderbird zum ersten Mal \u00f6ffnen, werden Sie gefragt, ob Sie eine neue E-Mail-Adresse einrichten m\u00f6chten. Klicken Sie auf \u00dcberspringen und eine bereits vorhandene E-Mail-Adresse verwenden und gehen Sie zum Schritt 4.
        3. Klicken Sie auf das Men\u00fc Datei und w\u00e4hlen Sie Neu, Bestehendes Mail-Konto....
        4. Geben Sie Ihren Namen (), Ihre E-Mail-Adresse () und Ihr Passwort ein. Stellen Sie sicher, dass die Option Passwort merken aktiviert ist und klicken Sie auf Weiter.
        5. Sobald die Konfiguration automatisch erkannt wurde, stellen Sie sicher, dass IMAP ausgew\u00e4hlt ist und klicken Sie auf Fertig.
        6. Um Ihre Kontakte vom Server zu verwenden, klicken Sie auf den Pfeil neben \"Adressb\u00fccher\" und auf die Schaltfl\u00e4che Verbinden f\u00fcr jedes Adressbuch, das Sie verwenden m\u00f6chten.
        7. Um Ihre Kalender vom Server zu verwenden, klicken Sie auf den Pfeil neben \"Kalender\" und dann auf die Schaltfl\u00e4che Verbinden f\u00fcr jeden Kalender, den Sie verwenden m\u00f6chten.
        8. (Optional) Wenn Sie alle Unterordner synchronisieren m\u00f6chten, gehen Sie zum Men\u00fc Kontoeinstellungen und w\u00e4hlen Sie Server-Einstellungen. Klicken Sie im Tab Server-Einstellungen auf die Schaltfl\u00e4che Erweitert. In dem Fenster Erweiterte Kontoeinstellungen deaktivieren Sie das Kontrollk\u00e4stchen \"Nur abonnierte Ordner anzeigen\". Klicken Sie auf OK, um die \u00c4nderungen zu speichern.
        9. Klicken Sie auf Beenden, um das Fenster \"Konto-Einrichtung\" zu schlie\u00dfen.
        "},{"location":"de/client/client-windows/","title":"Windows Mail","text":"

        Windows 8 und h\u00f6her unterst\u00fctzen E-Mail, Kontakte und Kalender \u00fcber Exchange ActiveSync.

        1. \u00d6ffnen Sie die App Mail.
        2. Wenn Sie Mail noch nicht verwendet haben, k\u00f6nnen Sie im Hauptfenster auf Konto hinzuf\u00fcgen klicken. Fahren Sie mit Schritt 4 fort.
        3. Klicken Sie auf Konten in der Seitenleiste links und dann auf Konto hinzuf\u00fcgen ganz rechts.
        4. W\u00e4hlen Sie Exchange.
        5. Geben Sie Ihre E-Mail Adresse () ein und klicken Sie auf Weiter..
        6. Geben Sie Ihr Passwort ein und klicken Sie auf Anmelden.

        Sobald Sie die Mail-App eingerichtet haben, k\u00f6nnen Sie auch die Apps \"Kontakte\" und \"Kalender\" verwenden.

        "},{"location":"de/client/client/","title":"\u00dcbersicht","text":"

        mailcow unterst\u00fctzt eine Vielzahl von E-Mail-Clients, sowohl auf Desktop-Computern als auch auf Smartphones. Im Folgenden finden Sie eine Reihe von Konfigurationsanleitungen, die erkl\u00e4ren, wie Sie Ihr mailcow-Konto konfigurieren k\u00f6nnen.

        Tipp

        Wenn Sie auf diese Seite zugreifen, indem Sie sich bei Ihrem mailcow-Server anmelden und auf den Link \"Konfigurationsanleitungen f\u00fcr E-Mail-Clients und Smartphones anzeigen\" klicken, werden alle Anleitungen mit Ihrer E-Mail-Adresse und Ihrem Servernamen personalisiert.

        Erfolgreich

        Da Sie diese Seite aufgerufen haben, nachdem Sie sich in Ihren mailcow-Server eingeloggt haben, wurden alle Anleitungen mit Ihrer E-Mail-Adresse und Ihrem Servernamen personalisiert.
        • Android
        • Apple iOS / macOS
        • eM Client
        • KDE Kontact / KMail
        • Microsoft Outlook
        • Mozilla Thunderbird
        • Windows Mail
        • Manual configuration
        "},{"location":"de/getstarted/install/","title":"mailcow Installieren","text":"

        \u00dcberall gleich

        Die Installation ist auf x86 und ARM64 exakt identisch!

        "},{"location":"de/getstarted/install/#docker-und-docker-compose-installation","title":"Docker und Docker Compose Installation","text":"

        Sie ben\u00f6tigen Docker (eine Version >= 24.0.0 ist erforderlich) und Docker Compose (eine Version >= 2.0 ist erforderlich).

        Erfahren Sie, wie Sie Docker und Docker Compose installieren.

        Schnelle Installation f\u00fcr die meisten Betriebssysteme:

        "},{"location":"de/getstarted/install/#docker","title":"Docker","text":"

        curl -sSL https://get.docker.com/ | CHANNEL=stable sh\n# Nachdem der Installationsprozess abgeschlossen ist, m\u00fcssen Sie eventuell den Dienst aktivieren und sicherstellen, dass er gestartet ist (z. B. CentOS 7)\nsystemctl enable --now docker\n
        Bitte verwenden Sie die neueste verf\u00fcgbare Docker-Engine und nicht die Engine, die mit Ihrem Distros-Repository ausgeliefert wird.

        "},{"location":"de/getstarted/install/#docker-compose","title":"docker compose","text":"

        Achtung

        mailcow ben\u00f6tigt eine Version von Docker Compose >= v2. Sollte die Installation von Docker \u00fcber das obenstehende Skript erfolgt sein wird das Docker Compose Plugin bereits automatisch in einer Version >=2.0 installiert. Ist die mailcow Installation \u00e4lter oder Docker wurde auf einem anderen Weg installiert, muss das Compose Plugin bzw. die Standalone Version von Docker manuell installiert werden.

        "},{"location":"de/getstarted/install/#installation-via-paketmanager-plugin","title":"Installation via Paketmanager (Plugin)","text":"

        Hinweis

        Diese Vorgehensweise mit den Paketquellen ist nur dann m\u00f6glich, wenn das Docker Repository eingebunden wurde. Dies kann entweder durch die Anleitung oben (siehe Docker) oder durch eine manuelle Einbindung passieren.

        Auf Debian/Ubuntu Systemen: 

        apt update\napt install docker-compose-plugin\n

        Auf Centos 7 Systemen: 

        yum update\nyum install docker-compose-plugin\n

        Achtung

        Die Syntax der Docker Compose Befehle lautet docker compose bei der Plugin Variante von Docker Compose!!

        "},{"location":"de/getstarted/install/#installation-via-script-standalone","title":"Installation via Script (Standalone)","text":"

        Hinweis

        Diese Installation ist die alt bekannte Weise. Sie installiert Docker Compose als Standalone Programm und ist nicht auf die Art und weise der Docker Installation angewiesen.

        LATEST=$(curl -Ls -w %{url_effective} -o /dev/null https://github.com/docker/compose/releases/latest) && LATEST=${LATEST##*/} && curl -L https://github.com/docker/compose/releases/download/$LATEST/docker-compose-$(uname -s)-$(uname -m) > /usr/local/bin/docker-compose\nchmod +x /usr/local/bin/docker-compose\n

        Achtung

        Die Syntax der Docker Compose Befehle lautet docker-compose bei der Standalone Variante von Docker Compose!!

        "},{"location":"de/getstarted/install/#selinux-besonderheiten-prufen","title":"SELinux Besonderheiten pr\u00fcfen","text":"

        Auf SELinux-aktivierten Systemen, z.B. CentOS 7:

        • Pr\u00fcfen Sie, ob das Paket \"container-selinux\" auf Ihrem System vorhanden ist:
        rpm -qa | grep container-selinux\n

        Wenn der obige Befehl eine leere oder keine Ausgabe liefert, sollten Sie es \u00fcber Ihren Paketmanager installieren.

        • Pr\u00fcfen Sie, ob Docker SELinux-Unterst\u00fctzung aktiviert hat:
        docker info | grep selinux\n

        Wenn der obige Befehl eine leere oder keine Ausgabe liefert, erstellen oder bearbeiten Sie /etc/docker/daemon.json und f\u00fcgen Sie \"selinux-enabled\": true hinzu. Beispielhafter Inhalt der Datei:

        {\n  \"selinux-enabled\": true\n}\n

        Starten Sie den Docker-Daemon neu und \u00fcberpr\u00fcfen Sie, ob SELinux nun aktiviert ist.

        Dieser Schritt ist erforderlich, um sicherzustellen, dass die mailcows-Volumes richtig gekennzeichnet sind, wie in der Compose-Datei angegeben. Wenn Sie daran interessiert sind, wie das funktioniert, k\u00f6nnen Sie sich die Readme-Datei von https://github.com/containers/container-selinux ansehen, die auf viele n\u00fctzliche Informationen zu diesem Thema verweist.

        "},{"location":"de/getstarted/install/#mailcow-installieren","title":"mailcow Installieren","text":"

        Klonen Sie den Master-Zweig des Repositorys und stellen Sie sicher, dass Ihre umask gleich 0022 ist. Bitte klonen Sie das Repository als root-Benutzer und kontrollieren Sie auch den Stack als root. Wir werden die Attribute - wenn n\u00f6tig - \u00e4ndern, w\u00e4hrend wir die Container automatisch bereitstellen und sicherstellen, dass alles gesichert ist. Das update.sh-Skript muss daher ebenfalls als root ausgef\u00fchrt werden. Es kann notwendig sein, den Besitzer und andere Attribute von Dateien zu \u00e4ndern, auf die Sie sonst keinen Zugriff haben. Wir geben die Berechtigungen f\u00fcr jede exponierte Anwendung auf und f\u00fchren einen exponierten Dienst nicht als root aus! Wenn Sie den Docker-Daemon als Nicht-Root-Benutzer steuern, erhalten Sie keine zus\u00e4tzliche Sicherheit. Der unprivilegierte Benutzer wird die Container ebenfalls als root spawnen. Das Verhalten des Stacks ist identisch.

        $ su\n# umask\n0022 # <- \u00dcberpr\u00fcfen, dass es 0022 ist\n# cd /opt\n# git clone https://github.com/mailcow/mailcow-dockerized\n# cd mailcow-dockerized\n
        "},{"location":"de/getstarted/install/#mailcow-initialisieren","title":"mailcow Initialisieren","text":"

        Erzeugen Sie eine Konfigurationsdatei. Verwenden Sie einen FQDN (host.domain.tld) als Hostname, wenn Sie gefragt werden. 

        ./generate_config.sh\n

        \u00c4ndern Sie die Konfiguration, wenn Sie wollen oder m\u00fcssen. 

        nano mailcow.conf\n
        Wenn Sie planen, einen Reverse Proxy zu verwenden, k\u00f6nnen Sie zum Beispiel HTTPS an 127.0.0.1 auf Port 8443 und HTTP an 127.0.0.1 auf Port 8080 binden.

        M\u00f6glicherweise m\u00fcssen Sie einen vorinstallierten MTA stoppen, der Port 25/tcp blockiert. Siehe dieses Kapitel, um zu erfahren, wie man Postfix rekonfiguriert, um nach einer erfolgreichen Installation neben mailcow laufen zu lassen.

        Einige Updates modifizieren mailcow.conf und f\u00fcgen neue Parameter hinzu. Es ist schwer, in der Dokumentation den \u00dcberblick zu behalten. Bitte \u00fcberpr\u00fcfen Sie deren Beschreibung und fragen Sie, wenn Sie unsicher sind, in den bekannten Kan\u00e4len nach Rat.

        "},{"location":"de/getstarted/install/#problembehandlungen","title":"Problembehandlungen","text":""},{"location":"de/getstarted/install/#benutzer-mit-einer-mtu-ungleich-1500-zb-openstack","title":"Benutzer mit einer MTU ungleich 1500 (z.B. OpenStack)","text":"

        Wenn Sie auf Probleme und seltsame Ph\u00e4nomene sto\u00dfen, \u00fcberpr\u00fcfen Sie bitte Ihre MTU.

        Bearbeiten Sie docker-compose.yml und \u00e4ndern Sie die Netzwerkeinstellungen entsprechend Ihrer MTU. F\u00fcgen Sie den neuen Parameter driver_opts wie folgt hinzu: 

        networks:\n  mailcow-network:\n    ...\n    driver_opts:\n      com.docker.network.driver.mtu: 1450\n    ...\n

        "},{"location":"de/getstarted/install/#benutzer-ohne-ein-ipv6-aktiviertes-netzwerk-auf-ihrem-hostsystem","title":"Benutzer ohne ein IPv6-aktiviertes Netzwerk auf ihrem Hostsystem","text":"

        Schalten Sie IPv6 bitte nicht ab, auch wenn es Ihnen nicht gef\u00e4llt. IPv6 ist die Zukunft und sollte nicht ignoriert werden.

        Sollten Sie jedoch kein IPv6-f\u00e4higes Netzwerk auf Ihrem Host haben und Sie sich nicht um ein besseres Internet k\u00fcmmern wollen (hehe), ist es empfehlenswert, IPv6 f\u00fcr das mailcow-Netzwerk zu deaktivieren, um unvorhergesehene Probleme zu vermeiden.

        "},{"location":"de/getstarted/install/#mailcow-starten","title":"mailcow starten","text":"

        Laden Sie die Images herunter und f\u00fchren Sie die Compose-Datei aus. Der Parameter -d wird ihre mailcow dann im Hintergrund starten:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose pull\ndocker compose up -d\n
        docker-compose pull\ndocker-compose up -d\n

        Geschafft!

        Sie k\u00f6nnen nun auf https://${MAILCOW_HOSTNAME} mit den Standard-Zugangsdaten admin + Passwort moohoo zugreifen.

        Info

        Wenn Sie mailcow nicht hinter einem Reverse Proxy verwenden, sollten Sie alle HTTP-Anfragen auf HTTPS umleiten.

        Die Datenbank wird sofort initialisiert, nachdem eine Verbindung zu MySQL hergestellt werden kann.

        Ihre Daten bleiben in mehreren Docker-Volumes erhalten, die nicht gel\u00f6scht werden, wenn Sie Container neu erstellen oder l\u00f6schen. F\u00fchren Sie docker volume ls aus, um eine Liste aller Volumes zu sehen. Sie k\u00f6nnen docker compose down sicher ausf\u00fchren, ohne persistente Daten zu entfernen.

        "},{"location":"de/getstarted/prerequisite-dns/","title":"DNS Einstellungen","text":"

        Nachstehend finden Sie eine Liste von empfohlenen DNS-Eintr\u00e4gen. Einige sind f\u00fcr einen Mailserver obligatorisch (A, MX), andere werden empfohlen, um eine gute Reputation aufzubauen (TXT/SPF) oder f\u00fcr die automatische Konfiguration von Mailclients verwendet (SRV).

        "},{"location":"de/getstarted/prerequisite-dns/#referenzen","title":"Referenzen","text":"
        • Ein guter Artikel, der alle relevanten Themen abdeckt: \"3 DNS Records Every Email Marketer Must Know\"
        • Ein weiterer guter Artikel, aber mit Zimbra als Beispielplattform: \"Best Practices on Email Protection: SPF, DKIM and DMARC\"
        • Eine ausf\u00fchrliche Diskussion \u00fcber SPF, DKIM und DMARC: \"Wie Sie Spam beseitigen und Ihren Namen mit DMARC sch\u00fctzen\"
        • Ein ausf\u00fchrlicher Leitfaden zum Verst\u00e4ndnis von DMARC: \"Entmystifizierung von DMARC: Ein Leitfaden zur Verhinderung von E-Mail-Spoofing\"
        "},{"location":"de/getstarted/prerequisite-dns/#reverse-dns-ihrer-ip-adresse","title":"Reverse DNS Ihrer IP-Adresse","text":"

        Stellen Sie sicher, dass der PTR-Eintrag Ihrer IP-Adresse mit dem FQDN Ihres mailcow-Hosts \u00fcbereinstimmt: ${MAILCOW_HOSTNAME} 1. Dieser Eintrag wird normalerweise bei dem Provider gesetzt, von dem Sie die IP-Adresse (Server) gemietet haben. Bitte beachten Sie, dies sowohl f\u00fcr Ihre IPv4 als auch Ihre IPv6 Adressen (falls verwendet) sicherzustellen!

        "},{"location":"de/getstarted/prerequisite-dns/#die-minimale-dns-konfiguration","title":"Die minimale DNS-Konfiguration","text":"

        Dieses Beispiel zeigt Ihnen eine Reihe von Eintr\u00e4gen f\u00fcr eine von mailcow verwaltete Domain. Jede Domain, die zu mailcow hinzugef\u00fcgt wird, ben\u00f6tigt mindestens diesen Satz an Eintr\u00e4gen, um korrekt zu funktionieren.

        # Name Typ Wert\nmail IN A 1.2.3.4\nautodiscover IN CNAME mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\nautoconfig IN CNAME mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n@ IN MX 10 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n

        Hinweis: Der mail DNS-Eintrag, der die Subdomain an die angegebene IP-Adresse bindet, muss nur f\u00fcr die Domain gesetzt werden, auf der mailcow l\u00e4uft und die f\u00fcr den Zugriff auf das Webinterface verwendet wird. F\u00fcr jede andere von mailcow verwaltete Domain leitet der MX-Eintrag den Datenverkehr entsprechend weiter.

        "},{"location":"de/getstarted/prerequisite-dns/#dkim-spf-und-dmarc","title":"DKIM, SPF und DMARC","text":"

        Im folgenden Beispiel f\u00fcr eine DNS-Zonendatei wird ein einfacher SPF TXT-Eintrag verwendet, um nur DIESEM Server (dem MX) zu erlauben, E-Mails f\u00fcr Ihre Dom\u00e4ne zu senden. Jeder andere Server ist nicht zugelassen, kann es aber tun (\"~all\"). Weitere Informationen finden Sie im SPF-Projekt.

        # Name Typ Wert\n@ IN TXT \"v=spf1 mx a -all\"\n

        Es wird dringend empfohlen, einen DKIM TXT-Eintrag in Ihrer mailcow UI zu erstellen und den entsprechenden TXT-Eintrag in Ihren DNS-Eintr\u00e4gen zu setzen. Bitte lesen Sie OpenDKIM f\u00fcr weitere Informationen.

        # Name Typ Wert\ndkim._domainkey IN TXT \"v=DKIM1; k=rsa; t=s; s=email; p=...\"\n

        Der letzte Schritt, um sich selbst und andere zu sch\u00fctzen, ist die Implementierung eines DMARC TXT-Datensatzes, zum Beispiel mit Hilfe des DMARC-Assistenten (check).

        # Name Typ Wert\n_dmarc IN TXT \"v=DMARC1; p=reject; rua=mailto:mailauth-reports@example.org\"\n
        "},{"location":"de/getstarted/prerequisite-dns/#die-erweiterte-dns-konfiguration","title":"Die erweiterte DNS-Konfiguration","text":"

        SRV-Eintr\u00e4ge geben den/die Server f\u00fcr ein bestimmtes Protokoll in Ihrer Dom\u00e4ne an. Wenn Sie einen Dienst explizit als nicht bereitgestellt ank\u00fcndigen wollen, geben Sie \".\" als Zieladresse an (statt \"mail.example.org.\"). Bitte beachten Sie RFC 2782.

        # Name Typ Priorit\u00e4t Gewicht Port Wert\n_autodiscover._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_caldavs._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_caldavs._tcp IN TXT \"path=/SOGo/dav/\"\n_carddavs._tcp IN SRV 0 1 443 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_carddavs._tcp IN TXT \"path=/SOGo/dav/\"\n_imap._tcp IN SRV 0 1 143 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_imaps._tcp IN SRV 0 1 993 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_pop3._tcp IN SRV 0 1 110 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_pop3s._tcp IN SRV 0 1 995 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_sieve._tcp IN SRV 0 1 4190 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_smtps._tcp IN SRV 0 1 465 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_submission._tcp IN SRV 0 1 587 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n_submissions._tcp IN SRV 0 1 465 mail.example.org. (Ihr ${MAILCOW_HOSTNAME})\n
        "},{"location":"de/getstarted/prerequisite-dns/#testen","title":"Testen","text":"

        Hier finden Sie einige Tools, mit denen Sie Ihre DNS-Konfiguration \u00fcberpr\u00fcfen k\u00f6nnen:

        • MX Toolbox (DNS, SMTP, RBL)
        • port25.com (DKIM, SPF)
        • Mail-Tester (DKIM, DMARC, SPF)
        • DMARC-Analysator (DMARC, SPF)
        • MultiRBL.valli.org (DNSBL, RBL, FCrDNS)
        "},{"location":"de/getstarted/prerequisite-dns/#verschiedenes","title":"Verschiedenes","text":""},{"location":"de/getstarted/prerequisite-dns/#optionale-dmarc-statistiken","title":"Optionale DMARC-Statistiken","text":"

        Wenn Sie an Statistiken interessiert sind, k\u00f6nnen Sie sich zus\u00e4tzlich bei einem der vielen unten aufgef\u00fchrten DMARC-Statistikdienste anmelden - oder Ihre eigene Statistik selbst hosten.

        Tipp

        Es ist zu bedenken, dass wenn Sie DMARC-Statistik-Berichte an Ihren mailcow-Server anfordern und Ihr mailcow-Server nicht korrekt f\u00fcr den Empfang dieser Berichte konfiguriert ist, Sie m\u00f6glicherweise keine genauen und vollst\u00e4ndigen Ergebnisse erhalten. Bitte erw\u00e4gen Sie die Verwendung einer alternativen E-Mail-Domain f\u00fcr den Empfang von DMARC-Berichten.

        Es ist erw\u00e4hnenswert, dass die folgenden Vorschl\u00e4ge keine umfassende Liste aller verf\u00fcgbaren Dienste und Tools sind, sondern nur eine kleine Auswahl der vielen M\u00f6glichkeiten.

        • Postmaster Tool
        • parsedmarc (selbst gehostet)
        • Fraudmarc
        • Postmark
        • Dmarcian

        Tipp

        Diese Dienste stellen Ihnen m\u00f6glicherweise einen TXT-Eintrag zur Verf\u00fcgung, den Sie in Ihre DNS-Eintr\u00e4ge einf\u00fcgen m\u00fcssen, so wie es der Anbieter vorschreibt. Bitte stellen Sie sicher, dass Sie die Dokumentation des Anbieters des von Ihnen gew\u00e4hlten Dienstes lesen, da dieser Prozess variieren kann.

        "},{"location":"de/getstarted/prerequisite-dns/#e-mail-test-fur-spf-dkim-und-dmarc","title":"E-Mail-Test f\u00fcr SPF, DKIM und DMARC:","text":"

        Um eine rudiment\u00e4re E-Mail-Authentifizierungspr\u00fcfung durchzuf\u00fchren, senden Sie eine E-Mail an check-auth at verifier.port25.com und warten Sie auf eine Antwort. Sie werden einen Bericht \u00e4hnlich dem folgenden finden:

        ==========================================================\nZusammenfassung der Ergebnisse\n==========================================================\nSPF-Pr\u00fcfung: bestanden\n\"iprev\"-Pr\u00fcfung: bestanden\nDKIM-Pr\u00fcfung: bestanden\nDKIM-Pr\u00fcfung: bestanden\nSpamAssassin-Pr\u00fcfung: ham\n\n==========================================================\nEinzelheiten:\n==========================================================\n....\n

        Der vollst\u00e4ndige Bericht enth\u00e4lt weitere technische Details.

        "},{"location":"de/getstarted/prerequisite-dns/#fully-qualified-domain-name-fqdn","title":"Fully Qualified Domain Name (FQDN)","text":"

        1. Ein Fully Qualified Domain Name (FQDN) ist der vollst\u00e4ndige (absolute) Dom\u00e4nenname f\u00fcr einen bestimmten Computer oder Host im Internet. Der FQDN besteht aus mindestens drei Teilen, die durch einen Punkt getrennt sind: dem Hostnamen, dem Dom\u00e4nennamen und der Top Level Domain (kurz TLD). Im Beispiel mx.mailcow.email w\u00e4re der Hostname mx, der Domainname mailcow und die TLD email.\u00a0\u21a9

        "},{"location":"de/getstarted/prerequisite-system/","title":"Systemvoraussetzungen","text":"

        Bevor Sie mailcow: dockerized ausf\u00fchren, sollten Sie einige Voraussetzungen \u00fcberpr\u00fcfen:

        Achtung

        Versuchen Sie nicht, mailcow auf einem Synology/QNAP-Ger\u00e4t (jedes NAS), OpenVZ, LXC oder anderen Container-Plattformen zu installieren. KVM, ESX, Hyper-V und andere vollst\u00e4ndige Virtualisierungsplattformen werden unterst\u00fctzt.

        Info

        • mailcow: dockerized erfordert, dass einige Ports f\u00fcr eingehende Verbindungen offen sind, also stellen Sie sicher, dass Ihre Firewall diese nicht blockiert.
        • Stellen Sie sicher, dass keine andere Anwendung die Konfiguration von mailcow st\u00f6rt, wie z.B. ein anderer Maildienst
        • Ein korrektes DNS-Setup ist entscheidend f\u00fcr jedes gute Mailserver-Setup, also stellen Sie bitte sicher, dass Sie zumindest die basics abgedeckt haben, bevor Sie beginnen!
        • Stellen Sie sicher, dass Ihr System ein korrektes Datum und eine korrekte Zeiteinstellung hat. Dies ist entscheidend f\u00fcr verschiedene Komponenten wie die Zwei-Faktor-TOTP-Authentifizierung.
        "},{"location":"de/getstarted/prerequisite-system/#minimale-systemressourcen","title":"Minimale Systemressourcen","text":"

        Bitte stellen Sie sicher, dass Ihr System mindestens \u00fcber die folgenden Ressourcen verf\u00fcgt:

        Ressource Minimale Anforderung CPU 1 GHz RAM Minimum 6 GiB + 1 GiB Swap (Standardkonfiguration) Festplatte 20 GiB (ohne Emails) Architektur x86_64, ARM64

        Nicht unterst\u00fctzt

        OpenVZ, Virtuozzo und LXC

        ClamAV und Solr k\u00f6nnen sehr viel Arbeitspeicher verbrauchen. Sie k\u00f6nnen diese in der mailcow.conf durch die Einstellungen SKIP_CLAMD=y und SKIP_SOLR=y jedoch auch deaktivieren.

        Info

        Wir sind uns bewusst, dass ein reiner MTA auf 128 MiB RAM laufen kann. mailcow ist eine ausgewachsene und gebrauchsfertige Groupware mit vielen Extras, die das Leben einfacher machen. Diese kommt mit einem Webserver, Webmailer, ActiveSync (MS), Antivirus, Antispam, Indexierung (Solr), Dokumentenscanner (Oletools), SQL (MariaDB), Cache (Redis), MDA, MTA, verschiedenen Webdiensten etc.

        Ein einzelner SOGo-Worker kann ~350 MiB RAM belegen, bevor er geleert wird. Je mehr ActiveSync-Verbindungen Sie verwenden m\u00f6chten, desto mehr RAM wird ben\u00f6tigt. In der Standardkonfiguration werden 20 Arbeiter erzeugt.

        "},{"location":"de/getstarted/prerequisite-system/#beispiele-fur-die-ram-planung","title":"Beispiele f\u00fcr die RAM Planung","text":"

        Ein Unternehmen mit 15 Smartphones (EAS aktiviert) und etwa 50 gleichzeitigen IMAP-Verbindungen sollte 16 GiB RAM einplanen.

        6 GiB RAM + 1 GiB Swap sind f\u00fcr die meisten privaten Installationen ausreichend, w\u00e4hrend 8 GiB RAM f\u00fcr ~5 bis 10 Benutzer empfohlen werden.

        Im Rahmen unseres Supports k\u00f6nnen wir Ihnen bei der korrekten Planung Ihres Setups helfen.

        "},{"location":"de/getstarted/prerequisite-system/#unterstutzte-betriebssysteme","title":"Unterst\u00fctzte Betriebssysteme","text":"

        Wichtig

        mailcow nutzt Docker als Basis. Aufgrund von diversen technischen Unterschieden innerhalb der einzelnen Systeme unterst\u00fctzen wir nicht alle Systeme, wo theoretisch Docker drauf l\u00e4uft!

        Die folgende Tabelle enth\u00e4lt alle von uns offiziell unterst\u00fctzten und getesteten Betriebssysteme (Stand Dezember 2024):

        Betriebssystem Kompatibilit\u00e4t Alpine 3.16 und \u00e4lter \u26a0\ufe0f Debian 11, 12 \u2705 Ubuntu 20.04 - 24.04 \u2705 Alma Linux 8, 9 \u2705 Rocky Linux 9 \u2705

        Legende

        \u2705 = Funktioniert out of the box anhand der Anleitung. \u26a0\ufe0f = Erfordert einige manuelle Anpassungen, sonst aber nutzbar. \u274c = Generell NICHT Kompatibel. \u2754 = Ausstehend.

        Achtung

        Andere (nicht genannte Betriebssysteme) k\u00f6nnen auch funktionieren, sind jedoch nicht offiziell getestet worden.

        "},{"location":"de/getstarted/prerequisite-system/#firewall-ports","title":"Firewall & Ports","text":"

        Bitte \u00fcberpr\u00fcfen Sie, ob alle Standard-Ports von mailcow offen sind und nicht von anderen Anwendungen genutzt werden:

        ss -tlpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n# oder:\nnetstat -tulpn | grep -E -w '25|80|110|143|443|465|587|993|995|4190'\n

        Vorsicht

        Es gibt einige Probleme mit dem Betrieb von mailcow auf einem Firewalld/ufw aktivierten System. Sie sollten es deaktivieren (wenn m\u00f6glich) und stattdessen Ihren Regelsatz in die DOCKER-USER-Kette verschieben, die nicht durch einen Neustart des Docker-Dienstes gel\u00f6scht wird. Siehe diese (blog.donnex.net) oder diese (unrouted.io) Anleitung f\u00fcr Informationen dar\u00fcber, wie man iptables-persistent mit der DOCKER-USER Kette benutzt. Da mailcow im Docker-Modus l\u00e4uft, haben INPUT-Regeln keinen Effekt auf die Beschr\u00e4nkung des Zugriffs auf mailcow. Verwenden Sie stattdessen die FORWARD-Kette.

        Wenn dieser Befehl irgendwelche Ergebnisse liefert, entfernen oder stoppen Sie bitte die Anwendung, die auf diesem Port l\u00e4uft. Sie k\u00f6nnen mailcows Ports auch \u00fcber die Konfigurationsdatei mailcow.conf anpassen.

        "},{"location":"de/getstarted/prerequisite-system/#eingehende-ports","title":"Eingehende Ports","text":"

        Wenn Sie eine Firewall vor mailcow haben, stellen Sie bitte sicher, dass diese Ports f\u00fcr eingehende Verbindungen offen sind:

        Dienst Protokoll Port Container Variable Postfix SMTP TCP 25 postfix-mailcow ${SMTP_PORT} Postfix SMTPS TCP 465 postfix-mailcow ${SMTPS_PORT} Postfix Submission TCP 587 postfix-mailcow ${SUBMISSION_PORT} Dovecot IMAP TCP 143 dovecot-mailcow ${IMAP_PORT} Dovecot IMAPS TCP 993 dovecot-mailcow ${IMAPS_PORT} Dovecot POP3 TCP 110 dovecot-mailcow ${POP_PORT} Dovecot POP3S TCP 995 dovecot-mailcow ${POPS_PORT} Dovecot ManageSieve TCP 4190 dovecot-mailcow ${SIEVE_PORT} HTTP(S) TCP 80/443 nginx-mailcow ${HTTP_PORT} / ${HTTPS_PORT}

        Um einen Dienst an eine IP-Adresse zu binden, k\u00f6nnen Sie die IP-Adresse wie folgt voranstellen: SMTP_PORT=1.2.3.4:25

        Wichtig: Sie k\u00f6nnen keine IP:PORT-Bindungen in HTTP_PORT und HTTPS_PORT verwenden. Bitte verwenden Sie stattdessen HTTP_PORT=1234 und HTTP_BIND=1.2.3.4.

        "},{"location":"de/getstarted/prerequisite-system/#ausgehende-portshosts","title":"Ausgehende Ports/Hosts","text":"

        F\u00fcr die Nutzung von mailcow werden einige ausgehende Verbindungen ben\u00f6tigt. Stellen Sie sicher, dass mailcow mit folgenden Hosts oder auf folgenden Ports nach au\u00dfen kommunizieren kann:

        Dienst Protokoll Port Ziel Grund Clamd TCP 873 rsync.sanesecurity.net Download ClamAV Signaturen (Prebundled in mailcow) Dovecot TCP 443 spamassassin.heinlein-support.de Herunterladen von Spamassasin Regeln, die Rspamd verarbeitet, Download erfolgt \u00fcber Dovecot mailcow Prozesse TCP 80/443 github.com Download von mailcow Updates (Code Basiert) mailcow Prozesse TCP 443 hub.docker.com Download von Docker Images (direkt von Docker Hub) mailcow Prozesse TCP 443 asn-check.mailcow.email API Abfrage auf Pr\u00fcfung BAD ASN (f\u00fcr Spamhaus Free Blocklists) mailcow Prozesse TCP 80 ip4.mailcow.email & ip6.mailcow.email Ermittelung der eigenen \u00f6ffentlichen IP Adresse zur Anzeige in UI (optional) Postfix TCP 25, 465 Beliebig / Any Ausgehende Verbindung MTA Rspamd TCP 80 fuzzy.mailcow.email Download von Bad Subject Regex Maps (Trainiert von Servercow) Rspamd TCP 443 bazaar.abuse.ch Download von Mailware MD5 Pr\u00fcfsummen zur Erkennung von Rspamd Rspamd TCP 443 urlhaus.abuse.ch Download von Malware Downloads Links zur Erkennung in Rspamd Rspamd UDP 11445 fuzzy.mailcow.email Anbindung an Globalen mailcow Fuzzy (Trainiert von Servercow + Community) Rspamd UDP 11335 fuzzy1.rspamd.com & fuzzy2.rspamd.com Anbindung an Globalen Rspamd Fuzzy (Trainiert vom Rspamd Team) Unbound TCP & UDP 53 Beliebig / Any DNS Aufl\u00f6sung f\u00fcr mailcow Stack (Zur Validierung von DNSSEC und Abruf von Spamlistinformationen)"},{"location":"de/getstarted/prerequisite-system/#wichtig-fur-hetzner-firewalls","title":"Wichtig f\u00fcr Hetzner Firewalls","text":"

        Ich zitiere https://github.com/chermsen \u00fcber https://github.com/mailcow/mailcow-dockerized/issues/497#issuecomment-469847380 (DANKE!):

        F\u00fcr alle, die mit der Hetzner-Firewall zu k\u00e4mpfen haben:

        Port 53 ist in diesem Fall f\u00fcr die Firewall-Konfiguration unwichtig. Laut Dokumentation verwendet unbound den Portbereich 1024-65535 f\u00fcr ausgehende Anfragen. Da es sich bei der Hetzner Robot Firewall um eine statische Firewall handelt (jedes eingehende Paket wird isoliert gepr\u00fcft) - m\u00fcssen die folgenden Regeln angewendet werden:

        F\u00fcr TCP 

        SRC-IP: ---\nDST-IP: ---\nSRC-Port: ---\nDST-Port: 1024-65535\nProtokoll: tcp\nTCP-Flags: ack\nAktion:      Akzeptieren\n

        F\u00fcr UDP 

        SRC-IP: ---\nDST-IP: ---\nSRC-Port: ---\nDST-Port: 1024-65535\nProtokoll: udp\nAktion:      Akzeptieren\n

        Wenn man einen restriktiveren Portbereich anwenden will, muss man zuerst die Konfiguration von unbound \u00e4ndern (nach der Installation):

        {mailcow-dockerized}/data/conf/unbound/unbound.conf: 

        outgoing-port-avoid: 0-32767\n

        Nun k\u00f6nnen die Firewall-Regeln wie folgt angepasst werden:

        [...]\nDST Port: 32768-65535\n[...]\n
        "},{"location":"de/getstarted/prerequisite-system/#datum-und-uhrzeit","title":"Datum und Uhrzeit","text":"

        Um sicherzustellen, dass Sie das richtige Datum und die richtige Zeit auf Ihrem System eingestellt haben, \u00fcberpr\u00fcfen Sie bitte die Ausgabe von timedatectl status:

        $ timedatectl status\n      Lokale Zeit: Sat 2017-05-06 02:12:33 CEST\n  Weltzeit: Sa 2017-05-06 00:12:33 UTC\n        RTC-Zeit: Sa 2017-05-06 00:12:32\n       Zeitzone: Europa/Berlin (MESZ, +0200)\n     NTP aktiviert: ja\nNTP synchronisiert: ja\n RTC in lokaler TZ: nein\n      Sommerzeit aktiv: ja\n Letzte DST-\u00c4nderung: Sommerzeit begann am\n                  Sonne 2017-03-26 01:59:59 MEZ\n                  So 2017-03-26 03:00:00 MESZ\n N\u00e4chste Sommerzeit\u00e4nderung: Die Sommerzeit endet (die Uhr springt eine Stunde r\u00fcckw\u00e4rts) am\n                  Sun 2017-10-29 02:59:59 MESZ\n                  Sun 2017-10-29 02:00:00 MEZ\n

        Die Zeilen NTP aktiviert: ja und NTP synchronisiert: ja zeigen an, ob Sie NTP aktiviert haben und ob es synchronisiert ist.

        Um NTP zu aktivieren, m\u00fcssen Sie den Befehl timedatectl set-ntp true ausf\u00fchren. Sie m\u00fcssen auch Ihre /etc/systemd/timesyncd.conf bearbeiten:

        # vim /etc/systemd/timesyncd.conf\n[Zeit]\nNTP=0.pool.ntp.org 1.pool.ntp.org 2.pool.ntp.org 3.pool.ntp.org\n
        "},{"location":"de/getstarted/prerequisite-system/#hetzner-cloud-und-wahrscheinlich-andere","title":"Hetzner Cloud (und wahrscheinlich andere)","text":"

        Pr\u00fcfen Sie /etc/network/interfaces.d/50-cloud-init.cfg und \u00e4ndern Sie die IPv6-Schnittstelle von eth0:0 auf eth0:

        # Falsch:\nauto eth0:0\niface eth0:0 inet6 static\n# Richtig:\nauto eth0\niface eth0 inet6 static\n

        Starten Sie die Schnittstelle neu, um die Einstellungen zu \u00fcbernehmen. Sie k\u00f6nnen au\u00dferdem die cloud-init Netzwerk\u00e4nderungen deaktivieren.

        "},{"location":"de/getstarted/prerequisite-system/#mtu","title":"MTU","text":"

        Besonders relevant f\u00fcr OpenStack-Benutzer: \u00dcberpr\u00fcfen Sie Ihre MTU und setzen Sie sie entsprechend in docker-compose.yml. Siehe Problebehandlungen in unseren Installationsanleitungen.

        "},{"location":"de/maintenance/deinstall/","title":"Deinstallation","text":"

        Um mailcow: dockerized mit all seinen Volumes, Images und Containern zu entfernen, tun Sie dies:

        docker compose (Plugin)docker-compose (Standalone) 
        docker compose down -v --rmi all --remove-orphans\n
        docker-compose down -v --rmi all --remove-orphans\n

        Info

        • -v Entfernt benannte Volumes, die im Abschnitt volumes der Compose-Datei deklariert sind, und anonyme Volumes, die an Container angeh\u00e4ngt sind.
        • --rmi Images entfernen. Der Typ muss einer der folgenden sein: all: Entfernt alle Images, die von einem beliebigen Dienst verwendet werden. local: Entfernt nur Bilder, die kein benutzerdefiniertes Tag haben, das durch das Feld \"image\" gesetzt wurde.
        • --remove-orphans Entfernt Container f\u00fcr Dienste, die nicht in der Compose-Datei definiert sind.
        • Standardm\u00e4\u00dfig entfernt docker compose down nur derzeit aktive Container und Netzwerke, die in der Datei docker-compose.yml definiert sind.
          • "},{"location":"de/maintenance/migration/","title":"Migration","text":"

          Warnung

          Diese Anleitung geht davon aus, dass Sie beabsichtigen, einen bestehenden mailcow-Server (Quelle) auf einen brandneuen, leeren Server (Ziel) zu migrieren. Sie k\u00fcmmert sich nicht um die Erhaltung bestehender Daten auf dem Zielserver und l\u00f6scht alles innerhalb von /var/lib/docker/volumes und somit alle Docker-Volumes, die Sie bereits eingerichtet haben.

          Tip

          Alternativ k\u00f6nnen Sie das Skript ./helper-scripts/backup_and_restore.sh verwenden, um ein vollst\u00e4ndiges Backup auf der Quellmaschine zu erstellen, dann installieren Sie mailcow auf der Zielmaschine wie gewohnt, kopieren Sie Ihre mailcow.conf und verwenden Sie das gleiche Skript, um Ihr Backup auf der Zielmaschine wiederherzustellen.

          1. Befolgen Sie die Installationsanleitung von Docker und Compose.

          2. Stoppen Sie Docker und stellen Sie sicher, dass Docker gestoppt wurde: 

          systemctl stop docker.service\nsystemctl status docker.service\n

          3. F\u00fchren Sie die folgenden Befehle auf dem Quellcomputer aus (achten Sie darauf, die abschlie\u00dfenden Schr\u00e4gstriche im ersten Pfadparameter wie unten gezeigt hinzuzuf\u00fcgen!) - WARNUNG: Dieser Befehl l\u00f6scht alles, was bereits unter /var/lib/docker/volumes auf dem Zielrechner existiert:

          Innerhalb der selben ArchitekturAuf andere Architektur 
          rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n
          rsync -aHhP --numeric-ids --delete /opt/mailcow-dockerized/ root@target-machine.example.com:/opt/mailcow-dockerized\nrsync -aHhP --numeric-ids --delete --exclude '*rspamd-vol-1' /var/lib/docker/volumes/ root@target-machine.example.com:/var/lib/docker/volumes\n

          Achtung

          Bitte befolgen Sie die Anweisungen f\u00fcr den jeweiligen Anwendungsfall, da bei einer Migration auf eine andere Architektur das Volume rspamd-vol-1 ausgelassen werden muss, da es inkompatible Hyperscan-Cache-Dateien enth\u00e4lt, die bei einem Plattformwechsel zu Abst\u00fcrzen mit anschlie\u00dfendem Nichtstart von Rspamd f\u00fchren.

          Die Hyperscan-Cache-Dateien werden bei einem Neustart von Rspamd automatisch regeneriert, wenn diese nicht existieren.

          4. Schalten Sie mailcow ab und stoppen Sie Docker auf dem Quellrechner.

          docker compose (Plugin)docker-compose (Standalone) 
          cd /opt/mailcow-dockerized\ndocker compose down\nsystemctl stop docker.service\n
          cd /opt/mailcow-dockerized\ndocker-compose down\nsystemctl stop docker.service\n

          5. Wiederholen Sie Schritt 3 mit denselben Befehlen. Dies wird viel schneller gehen als beim ersten Mal, da nun nur noch die Differenzen \u00fcbertragen werden.

          6. Wechseln Sie auf den Zielrechner und starten Sie Docker. 

          systemctl start docker.service\n

          7. Ziehen Sie nun die mailcow Docker-Images auf den Zielrechner.

          docker compose (Plugin)docker-compose (Standalone) 
          cd /opt/mailcow-dockerized\ndocker compose pull\n
          cd /opt/mailcow-dockerized\ndocker-compose pull\n

          8. Starten Sie den gesamten mailcow-Stack und alles sollte fertig sein!

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          9. Zum Schluss \u00e4ndern Sie Ihre DNS-Einstellungen so, dass sie auf den Zielserver zeigen. Pr\u00fcfen und \u00e4ndern Sie gegebenenfalls die SNAT_TO_SOURCE Variable in der mailcow.conf im mailcow-dockerized Ordner, da andernfalls SOGo nicht richtig funktioniert, wenn die ausgehende IP eine andere ist.

          "},{"location":"de/maintenance/update/#mailcow-automatisch-updaten","title":"mailcow automatisch Updaten","text":"

          Ein Update-Skript in Ihrem mailcow-dockerized Verzeichnis k\u00fcmmert sich um Updates.

          F\u00fchren sie das Update-Skript aus: 

          ./update.sh\n

          Wenn es n\u00f6tig ist, wird es Sie fragen, wie Sie fortfahren m\u00f6chten. Merge-Fehler werden gemeldet. Einige kleinere Konflikte werden automatisch korrigiert (zugunsten des mailcow-dockerized repository code).

          "},{"location":"de/maintenance/update/#optionen","title":"Optionen","text":"
          # Optionen k\u00f6nnen kombiniert werden\n\n# - Pr\u00fcft auf Updates und zeigt \u00c4nderungen an\n./update.sh --check\n\n# - Starten Sie mailcow nicht, nachdem Sie ein Update durchgef\u00fchrt haben\n./update.sh --skip-start\n\n# - \u00dcberspringt den ICMP Check auf die \u00f6ffentlichen DNS Resolver (Bitte nur nutzen, wenn keinerlei ICMP Verbindungen von und zur mailcow erlaubt sind)\n./update.sh --skip-ping-check\n\n# - Wechselt die Update Quellen der mailcow auf nightly (unstabile) Inhalte.\nNUR ZUM TESTEN VERWENDEN!! KEIN PRODUKTIV BETRIEB!!!\n./update.sh --nightly\n\n# - Wechselt die Update Quellen der mailcow auf stable (stabile) Inhalte (standard).\n./update.sh --stable\n\n# - Erzwinge Update (unbeaufsichtigt, aber nicht unterst\u00fctzt, Benutzung auf eigenes Risiko)\n./update.sh --force\n\n# - Garbage Collector ausf\u00fchren, um alte Image-Tags zu bereinigen und beenden\n./update.sh --gc\n\n# - Update mit der Merge-Strategie-Option \"ours\" statt \"theirs\"\n# Dies wird **Konflikte** beim Zusammenf\u00fchren zugunsten Ihrer lokalen \u00c4nderungen l\u00f6sen und sollte vermieden werden. Lokale \u00c4nderungen werden immer beibehalten, es sei denn, wir haben auch die Datei XY ge\u00e4ndert.\n./update.sh --ours\n\n# - Nicht aktualisieren, nur holen von Docker Images\n./update.sh --prefetch\n
          "},{"location":"de/maintenance/update/#ich-habe-vergessen-was-ich-vor-dem-ausfuhren-von-updatesh-geandert-habe","title":"Ich habe vergessen, was ich vor dem Ausf\u00fchren von update.sh ge\u00e4ndert habe.","text":"

          Siehe git log --pretty=oneline | grep -i \"before update\", Sie werden eine Ausgabe \u00e4hnlich dieser haben:

          22cd00b5e28893ef9ddef3c2b5436453cc5223ab Before update on 2020-09-28_19_25_45\ndacd4fb9b51e9e1c8a37d84485b92ffaf6c59353 Before update on 2020-08-07_13_31_31\n

          F\u00fchren Sie git diff 22cd00b5e28893ef9ddef3c2b5436453cc5223ab aus, um zu sehen, was sich ge\u00e4ndert hat.

          "},{"location":"de/maintenance/update/#kann-ich-ein-rollback-durchfuhren","title":"Kann ich ein Rollback durchf\u00fchren?","text":"

          Ja.

          Siehe das obige Thema, anstelle eines Diffs f\u00fchren Sie checkout aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker compose pull\ndocker compose up -d\n
          docker-compose down\n# Ersetzen Sie die Commit-ID 22cd00b5e28893ef9ddef3c2b5436453cc5223ab durch Ihre ID\ngit checkout 22cd00b5e28893ef9ddef3c2b5436453cc5223ab\ndocker-compose pull\ndocker-compose up -d\n
          "},{"location":"de/maintenance/update/#hooks","title":"Hooks","text":"

          Sie k\u00f6nnen sich in den Update-Mechanismus einklinken, indem Sie Skripte namens pre_commit_hook.sh und post_commit_hook.sh zu Ihrem mailcows-Root-Verzeichnis hinzuf\u00fcgen. Siehe hier f\u00fcr weitere Details.

          "},{"location":"de/maintenance/update/#update-zyklus","title":"Update-Zyklus","text":"
          • Wir planen in jedem Monat ein neues Hauptupdate zu ver\u00f6ffentlichen.
          • Die Updates sind wie folgt nummeriert: JJJJ-MM (Beispiel: 2022-05).
          • Fehlerkorrekturen eines Hauptupdates werden bei uns als \"Revisionen\" wie a,b,c (Beispiele: 2022-05a, 2022-05b usw.) erscheinen.
          "},{"location":"de/maintenance/update/#update-varianten","title":"Update-Varianten","text":"

          stable (stabile Updates): Diese Updates sind f\u00fcr den Produktivbetrieb geeignet. Sie erscheinen in einem Zyklus von mindest 1x im Monat.

          nightly (instabile Updates): Diese Updates sind NICHT f\u00fcr den Produktivbetrieb geeignet und dienen lediglich dem Testen. Die nightly Updates sind den stabilen Updates vorraus, da in diesen neue und auch umfangreichere Funktionen getestet werden bevor diese f\u00fcr alle User Live gehen.

          "},{"location":"de/maintenance/update/#nightly-updates-beziehen","title":"Nightly Updates beziehen","text":""},{"location":"de/maintenance/update/#infos-zu-den-nightly-updates","title":"Infos zu den Nightly Updates","text":"

          Seit dem 2022-08 Update gibt es die M\u00f6glichkeit die Update quellen zu \u00e4ndern. Bisher diente der master Branch auf GitHub als einzige (offizieller) Update Quelle. Mit dem August 2022 Update gibt es aber nun noch den Nightly Branch welcher instabile und gr\u00f6\u00dfere \u00c4nderungen zum testen und Feedback geben enth\u00e4lt.

          Dabei bekommt der Nightly Branch immer dann neue Updates, wenn irgendetwas am mailcow Projekt fertig gemacht wurde was in die neue Hauptversion reinkommt.

          Neben den offensichtlichen neuerungen welche sowieso im n\u00e4chsten Major Update enthalten sein werden enth\u00e4lt er ebenfalls erstmal exklusive Features welche eine l\u00e4ngere Testzeit brauchen (bspw. das UI Update auf Bootstrap 5).

          "},{"location":"de/maintenance/update/#wie-bekomme-ich-nightly-updates","title":"Wie bekomme ich Nightly Updates?","text":"

          Der Vorgang ist relativ simpel. Mit dem 2022-08 Update (ein Update auf die Version voraussgesetzt) ist es m\u00f6glich die update.sh mit dem Parameter --nightly zu starten.

          Achtung

          Bitte machen Sie vorher ein Backup oder folgen Sie dem Abschnitt Best Practice Nightly Update bevor Sie auf die Nightly Builds von mailcow wechseln. Wir sind f\u00fcr keinerlei Datenverluste/korruptionen verantwortlich, also arbeiten Sie mit bedacht!

          Das Skript wird nun den Branch wechseln mit git checkout nightly d.h. es wird auch wieder nach den IPv6 Einstellungen fragen. Das ist aber normal.

          Sollte alles problemlos geklappt haben (wof\u00fcr wir ja auch vorsichtshalber ein Backup vorher gemacht haben) sollte nun in der mailcow UI unten rechts die aktuelle Versionsnummer samt Datumsstempel abgebildet sein:

          "},{"location":"de/maintenance/update/#best-practice-nightly-update","title":"Best Practice Nightly Update","text":"

          Info

          Wir empfehlen die Benutzung des Nightly Updates nur dann, wenn Ihr eine weitere Maschine oder VM besitzt und diese NICHT Produktiv nutzt.

          1. Das Cold-Standby Skript nutzen um die Maschine vor dem Schwenk auf die Nightly Builds auf ein anderes System zu kopieren.
          2. Das update.sh Skript auf der neuen Maschine mit dem Parameter --nightly ausf\u00fchren und best\u00e4tigen.
          3. Die Nightly Updates auf der sekund\u00e4ren Maschine erleben/testen.
          "},{"location":"de/manual-guides/u_e-80_to_443/","title":"HTTP auf HTTPS umleiten","text":"

          Seit dem 28. Februar 2017 wird mailcow mit aktivierten Ports 80 und 443 geliefert.

          Verwenden Sie die untenstehende Konfiguration nicht f\u00fcr Reverse-Proxy-Setups, bitte lesen Sie dazu unsere Reverse-Proxy-Anleitung, die einen Redirect von HTTP zu HTTPS beinhaltet.

          \u00d6ffne mailcow.conf und setze HTTP_BIND= - falls nicht bereits gesetzt.

          Erstellen Sie eine neue Datei data/conf/nginx/redirect.conf und f\u00fcgen Sie die folgende Serverkonfiguration in die Datei ein:

          server {\n  root /web;\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  include /etc/nginx/conf.d/server_name.active;\n  if ( $request_uri ~* \"%0A|%0D\" ) { return 403; }\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n  location / {\n    return 301 https://$host$uri$is_args$args;\n  }\n}\n

          Falls Sie den Parameter HTTP_BIND ge\u00e4ndert haben, erstellen Sie den Container neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker compose up -d\n

          Andernfalls starten Sie Nginx neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart\n
          docker compose restart\n
          "},{"location":"de/manual-guides/u_e-autodiscover_config/","title":"Autodiscover / Autoconfig","text":"

          Sie brauchen diese Datei nicht zu \u00e4ndern oder zu erstellen, autodiscover funktioniert sofort. Diese Anleitung ist nur f\u00fcr Anpassungen des Autodiscover- oder Autokonfigurationsprozesses gedacht.

          Neuere Outlook-Clients (insbesondere solche, die mit O365 ausgeliefert werden) f\u00fchren keine automatische Erkennung von E-Mail-Profilen durch. Denken Sie daran, dass ActiveSync NICHT mit einem Desktop-Client verwendet werden sollte.

          \u00d6ffnen/erstellen Sie data/web/inc/vars.local.inc.php und f\u00fcgen Sie Ihre \u00c4nderungen in das Konfigurationsfeld ein.

          Die \u00c4nderungen werden mit \"$autodiscover_config\" in data/web/inc/vars.inc.php zusammengef\u00fchrt):

          <?php\n$autodiscover_config = array(\n  // General autodiscover service type: \"activesync\" or \"imap\"\n  // emClient uses autodiscover, but does not support ActiveSync. mailcow excludes emClient from ActiveSync.\n  'autodiscoverType' => 'activesync',\n  // If autodiscoverType => activesync, also use ActiveSync (EAS) for Outlook desktop clients (>= Outlook 2013 on Windows)\n  // Outlook for Mac does not support ActiveSync\n  'useEASforOutlook' => 'yes',\n  // Please don't use STARTTLS-enabled service ports in the \"port\" variable.\n  // The autodiscover service will always point to SMTPS and IMAPS (TLS-wrapped services).\n  // The autoconfig service will additionally announce the STARTTLS-enabled ports, specified in the \"tlsport\" variable.\n  'imap' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('IMAPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('IMAP_PORT'))),\n  ),\n  'pop3' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('POPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('POP_PORT'))),\n  ),\n  'smtp' => array(\n    'server' => $mailcow_hostname,\n    'port' => array_pop(explode(':', getenv('SMTPS_PORT'))),\n    'tlsport' => array_pop(explode(':', getenv('SUBMISSION_PORT'))),\n  ),\n  'activesync' => array(\n    'url' => 'https://'.$mailcow_hostname.($https_port == 443 ? '' : ':'.$https_port).'/Microsoft-Server-ActiveSync',\n  ),\n  'caldav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n  'carddav' => array(\n    'server' => $mailcow_hostname,\n    'port' => $https_port,\n  ),\n);\n

          Um immer IMAP und SMTP anstelle von EAS zu verwenden, setzen Sie 'autodiscoverType' => 'imap'.

          Deaktivieren Sie ActiveSync f\u00fcr Outlook-Desktop-Clients, indem Sie \"useEASforOutlook\" auf \"no\" setzen.

          "},{"location":"de/manual-guides/u_e-reeanble-weak-protocols/","title":"TLS 1.0 und TLS 1.1 wieder aktivieren","text":"

          Am 12. Februar 2020 haben wir die veralteten Protokolle TLS 1.0 und 1.1 in Dovecot (POP3, POP3S, IMAP, IMAPS) und Postfix (SMTPS, SUBMISSION) deaktiviert.

          Mit dem Juni 2024 Patch (2024-06) wurde auch TLS 1.0 und TLS 1.1 f\u00fcr unauthentifizierte Mails \u00fcber SMTP auf Port 25/tcp deaktiviert, da die meisten modernen und gut konfigurierten E-Mail-Server im Internet mittlerweile bessere Verschl\u00fcsselungen als TLS 1.0/1.1 nutzen.

          Wie kann man schwache Protokolle wieder aktivieren, falls erforderlich?

          Bearbeiten Sie data/conf/postfix/extra.cf:

          # F\u00fcr SMTPS/Submission\nsubmission_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\nsmtps_smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3\n\n# F\u00fcr SMTP (via STARTTLS)\nsmtp_tls_protocols = !SSLv2, !SSLv3\nsmtpd_tls_protocols = !SSLv2, !SSLv3\n

          Bearbeiten Sie data/conf/dovecot/extra.conf:

          ssl_min_protocol = TLSv1\n

          Starten Sie die betroffenen Dienste neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart postfix-mailcow dovecot-mailcow\n
          docker-compose restart postfix-mailcow dovecot-mailcow\n

          Tipp: Sie k\u00f6nnen TLS 1.2 in Windows 7 aktivieren.

          "},{"location":"de/manual-guides/u_e-update-hooks/","title":"Skripte vor und nach Aktualisierungen ausf\u00fchren","text":"

          Es ist m\u00f6glich, Pre- und Post-Update-Hooks zum update.sh Skript hinzuzuf\u00fcgen, das Ihre gesamte mailcow-Installation aktualisiert.

          Um dies zu tun, f\u00fcgen Sie einfach das entsprechende Bash-Skript in Ihr mailcow-Root-Verzeichnis ein:

          • pre_update_hook.sh f\u00fcr Befehle, die vor dem Update laufen sollen
          • post_update_hook.sh f\u00fcr Befehle, die nach dem Update ausgef\u00fchrt werden sollen

          Beachten Sie, dass pre_update_hook.sh jedes Mal ausgef\u00fchrt wird, wenn Sie update.sh aufrufen, und post_update_hook.sh wird nur ausgef\u00fchrt, wenn die Aktualisierung erfolgreich war und das Skript nicht erneut ausgef\u00fchrt werden muss.

          Die Skripte werden von der Bash ausgef\u00fchrt, ein Interpreter (z.B. #!/bin/bash) sowie ein Execute Permission Flag (\"+x\") sind nicht erforderlich.

          "},{"location":"de/manual-guides/u_e-why_unbound/","title":"Warum unbound?","text":"

          F\u00fcr DNS-Blacklist-Lookups und DNSSEC.

          Die meisten Systeme verwenden entweder einen \u00f6ffentlichen oder einen lokalen DNS-Aufl\u00f6ser mit Zwischenspeicher. Das ist eine sehr schlechte Idee, wenn es darum geht, Spam mit DNS-basierten Blackhole-Listen (DNSBL) oder \u00e4hnlichen Techniken zu filtern. Die meisten, wenn nicht alle Anbieter wenden eine Ratenbegrenzung an, die auf dem DNS-Resolver basiert, der f\u00fcr die Abfrage ihres Dienstes verwendet wird. Wenn Sie einen \u00f6ffentlichen Resolver wie Google 4x8, OpenDNS oder einen anderen gemeinsam genutzten DNS-Resolver wie den Ihres Internetanbieters verwenden, werden Sie diese Grenze sehr bald erreichen.

          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/","title":"Weitere Datenbanken","text":""},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#weitere-datenbanken-fur-clamav","title":"Weitere Datenbanken f\u00fcr ClamAV","text":"

          Die Standard ClamAV Datenbanken haben keine hohe Trefferquote, k\u00f6nnen aber durch kostenlose und kostenpflichtige Datenbanken erweitert werden.

          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#liste-von-bekannten-kostenfreien-datenbanken-stand-april-2022","title":"Liste von bekannten (kostenfreien) Datenbanken | Stand April 2022","text":"
          • SecurityInfo - kostenlose ClamAV DBs f\u00fcr Testzwecke. Registrierung der IP Adresse des Servers erforderlich (dann nutzbar f\u00fcr besagte IP).
          • InterServer - kostenlose ClamAV DBs. F\u00fcr E-Mail Zwecke eher ungeeignet.
          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#securiteinfo-datenbank-aktivieren","title":"SecuriteInfo Datenbank aktivieren","text":""},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#arbeiten-im-clamav","title":"Arbeiten im ClamAV","text":"
          1. Kostenfreien Account auf https://www.securiteinfo.com/clients/customers/signup erstellen.
          2. Sie erhalten eine E-Mail um Ihren Account zu aktivieren gefolgt von einer E-Mail mit Ihrem Login Namen.
          3. Loggen Sie sich ein und navigieren Sie zu Ihrem Account https://www.securiteinfo.com/clients/customers/account
          4. Klicken Sie auf den 'Setup' Reiter.
          5. Sie brauchen your_id von den Downloadlinks. Diese sind pro User individuell.

          6. F\u00fcgen Sie diese wie folgt in die data/conf/clamav/freshclam.conf ein und ersetzen Sie den your_id Teil mit Ihrer ID: 

            DatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfo.ign2\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/javascript.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/spam_marketing.ndb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfohtml.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfoascii.hdb\nDatabaseCustomURL https://www.securiteinfo.com/get/signatures/your_id/securiteinfopdf.hdb\n

          7. Bei den kostenlosen SecuriteInfo Datenbanken ist die Download-Geschwindigkeit auf 300 kB/s begrenzt. \u00c4ndern Sie in data/conf/clamav/freshclam.conf den Standardwert ReceiveTimeout 20 auf ReceiveTimeout 90 (Zeitangabe in Sekunden), da ansonsten einige der Datenbank-Downloads aufgrund ihrer Gr\u00f6\u00dfe abbrechen k\u00f6nnen.

          8. Passen Sie data/conf/clamav/clamd.conf mit den folgenden Einstellungen an: 

            DetectPUA yes\nExcludePUA PUA.Win.Packer\nExcludePUA PUA.Win.Trojan.Packed\nExcludePUA PUA.Win.Trojan.Molebox\nExcludePUA PUA.Win.Packer.Upx\nExcludePUA PUA.Doc.Packed\nMaxScanSize 150M\nMaxFileSize 100M\nMaxRecursion 40\nMaxEmbeddedPE 100M\nMaxHTMLNormalize 50M\nMaxScriptNormalize 50M\nMaxZipTypeRcg 50M\n

          9. Starten Sie den ClamAV Container neu:
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart clamd-mailcow\n
          docker-compose restart clamd-mailcow\n

          Bitte beachten Sie:

          • Sie k\u00f6nnen ExcludePUA und IncludePUA in der clamd.conf nicht gleichzeitig nutzen! Kommentieren Sie bitte IncludePUA aus, sollte es nicht auskommentiert sein.
          • Die Liste der Datenbanken genutzt in diesem Beispiel sollten f\u00fcr die meisten F\u00e4lle passen. SecuriteInfo bietet jedoch noch andere Datenbanken an. Bitte schauen Sie sich das SecuriteInfo FAQ f\u00fcr weitere Informationen an.
          • Mit den neu eingestellten Datenbanken (und den Standard Datenbanken) ClamAV verbraucht ClamAV etwa 1,3 GB RAM des Servers.
          • Sollten Sie message_size_limit in Postfix ver\u00e4ndert haben m\u00fcssen Sie die MaxSize Einstellung in ClamAV auf den selben Wert eintragen.
          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#arbeiten-im-rspamd","title":"Arbeiten im Rspamd","text":"

          Achtung

          mailcow mit der Version >= 2023-07 wird ben\u00f6tigt, damit die folgende Anleitung funktioniert, da sie die vordefinierten Scores f\u00fcr SecuriteInfo-Signaturen enth\u00e4lt!

          Nun haben Sie zwar die ClamAV-Signaturen hinzugef\u00fcgt, werden aber feststellen, dass Rspamd diese nicht korrekt verwendet bzw. ALLES gnadenlos als VIRUS abstempelt.

          Wir k\u00f6nnen Rspamd aber mit ein wenig Handarbeit z\u00e4hmen, so dass er nicht v\u00f6llig aus dem Ruder l\u00e4uft.

          Dazu gehen wir wie folgt vor:

          1. F\u00fcgen Sie folgendes in data/conf/rspamd/local.d/antivirus.conf ein:
          patterns {\n  # Extra Signatures (Securite) Not shipped with mailcow.\n  CLAM_SECI_SPAM = \"^SecuriteInfo\\.com\\.Spam.*\";\n  CLAM_SECI_JPG = \"^SecuriteInfo\\.com\\.JPG.*\";\n  CLAM_SECI_PDF = \"^SecuriteInfo\\.com\\.PDF.*\";\n  CLAM_SECI_HTML = \"^SecuriteInfo\\.com\\.HTML.*\";\n  CLAM_SECI_JS = \"^SecuriteInfo\\.com\\.JS.*\";\n}\n
          1. Starten Sie den Rspamd neu:
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Nun wird Rspamd die von uns angegebene Gewichtung f\u00fcr die einzelnen Signaturen anwenden, anstatt alles mit einem Wert von 2000 als VIRUS zu markieren und damit abzulehnen.

          Info

          Sie k\u00f6nnen die Gewichtungen jederzeit \u00e4ndern:

          data/conf/rspamd/local.d/composites.conf

          Auch die zu registrierenden Strings des ClamAV k\u00f6nnen Sie manuell einstellen/anpassen.

          Nutzen Sie dazu einfach das gerade eben vorgegebene Schema in der antivirus.conf des Rspamd.

          Achtung

          Bitte beachten Sie, dass die Dateien antivirus.conf und composites.conf durch ein mailcow-Update \u00fcberschrieben werden k\u00f6nnen.

          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-additional_dbs/#interserver-datenbanken-aktivieren","title":"InterServer Datenbanken aktivieren","text":"
          1. F\u00fcgen Sie folgendes in data/conf/clamav/freshclam.conf ein: 
            DatabaseCustomURL http://sigs.interserver.net/interserver256.hdb\nDatabaseCustomURL http://sigs.interserver.net/interservertopline.db\nDatabaseCustomURL http://sigs.interserver.net/shell.ldb\nDatabaseCustomURL http://sigs.interserver.net/whitelist.fp\n
          2. Starten Sie den ClamAV Container neu:
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart clamd-mailcow\n
          docker-compose restart clamd-mailcow\n
          "},{"location":"de/manual-guides/ClamAV/u_e-clamav-whitelist/#whitelist-fur-bestimmte-clamav-signaturen","title":"Whitelist f\u00fcr bestimmte ClamAV-Signaturen","text":"

          Es kann vorkommen, dass legitime (saubere) Mails von ClamAV blockiert werden (Rspamd markiert die Mail mit VIRUS_FOUND). So werden beispielsweise interaktive PDF-Formularanh\u00e4nge standardm\u00e4\u00dfig blockiert, da der eingebettete Javascript-Code f\u00fcr sch\u00e4dliche Zwecke verwendet werden k\u00f6nnte. \u00dcberpr\u00fcfen Sie dies anhand der clamd-Protokolle, z.B.:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs clamd-mailcow | grep \"FOUND\"\n
          docker-compose logs clamd-mailcow | grep \"FOUND\"\n

          Diese Zeile best\u00e4tigt, dass ein solcher identifiziert wurde:

          clamd-mailcow_1 | Sat Sep 28 07:43:24 2019 -> instream(local): PUA.Pdf.Trojan.EmbeddedJavaScript-1(e887d2ac324ce90750768b86b63d0749:363325) FOUND\n

          Um diese spezielle Signatur auf die Whitelist zu setzen (und den Versand dieses Dateityps im Anhang zu erm\u00f6glichen), f\u00fcgen Sie sie der ClamAV-Signatur-Whitelist-Datei hinzu:

          echo 'PUA.Pdf.Trojan.EmbeddedJavaScript-1' >> data/conf/clamav/whitelist.ign2\n

          Dann starten Sie den clamd-mailcow Service Container in der mailcow UI oder mit docker compose neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart clamd-mailcow\n
          docker-compose restart clamd-mailcow\n

          Bereinigen Sie zwischengespeicherte ClamAV-Ergebnisse in Redis:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
          docker-compose exec redis-mailcow /bin/sh\n/data # redis-cli KEYS rs_cl* | xargs redis-cli DEL\n/data # exit\n
          "},{"location":"de/manual-guides/Docker/u_e-docker-cust_dockerfiles/","title":"Dockerfiles anpassen","text":"

          Sie m\u00fcssen die Override-Datei mit den entsprechenden Build-Tags in den mailcow: dockerized Root-Ordner (d.h. /opt/mailcow-dockerized) kopieren: 

          cp helper-scripts/docker-compose.override.yml.d/BUILD_FLAGS/docker-compose.override.yml docker-compose.override.yml\n

          Nehmen Sie Ihre \u00c4nderungen in data/Dockerfiles/$service vor und erstellen Sie das Image lokal: 

          docker build data/Dockerfiles/$service -t mailcow/$service:$tag\n
          (Ohne pers\u00f6nlichen :$tag wird automatisch :latest verwendet.)

          Nun muss dieser gerade erstellte Container in docker-compose.override.yml aktiviert werden, z.B.: 

          $service-mailcow:\n    build: ./data/Dockerfiles/$service\n    image: mailcow/$service:$tag\n

          Abschliessend m\u00fcssen die ge\u00e4nderten Container automatisch neu erstellt werden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-any_acl/","title":"Aktivierung von \"any\" ACL-Einstellungen","text":"

          Am 17. August haben wir die M\u00f6glichkeit, mit \"jedem\" oder \"allen authentifizierten Benutzern\" zu teilen, standardm\u00e4\u00dfig deaktiviert.

          Diese Funktion kann wieder aktiviert werden, indem ACL_ANYONE auf allow in mailcow.conf gesetzt wird:

          ACL_ANYONE=allow\n

          Wenden Sie die \u00c4nderungen an, indem Sie den Docker Stack neustarten mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-catchall_vacation/","title":"Urlaubsantworten f\u00fcr Catchall-Adressen","text":"

          Der Dovecot-Parameter sieve_vacation_dont_check_recipient - der in mailcow-Konfigurationen vor dem 21. Juli 2021 standardm\u00e4\u00dfig auf yes gesetzt war - erlaubt Urlaubsantworten auch dann, wenn eine Mail an nicht existierende Mailboxen wie Catch-All-Adressen gesendet wird.

          Wir haben uns entschlossen, diesen Parameter wieder auf no zu setzen und dem Benutzer zu erlauben, die Empf\u00e4ngeradresse zu spezifizieren, die eine Urlaubsantwort ausl\u00f6st. Die ausl\u00f6senden Empf\u00e4nger k\u00f6nnen auch in SOGos Autoresponder-Funktion konfiguriert werden.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/","title":"L\u00f6schen der Mails eines Benutzers","text":"

          Wenn Sie alte Mails aus den Ordnern .Junk oder .Trash l\u00f6schen wollen oder vielleicht alle gelesenen Mails, die \u00e4lter als eine bestimmte Zeitspanne sind, k\u00f6nnen Sie das dovecot-Tool doveadm man doveadm-expunge verwenden.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#der-manuelle-weg","title":"Der manuelle Weg","text":"

          Dann wollen wir mal loslegen:

          L\u00f6schen Sie die Mails eines Benutzers im Junk-Ordner, die gelesen und \u00e4lter als 4 Stunden sind

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n
          docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'Junk' SEEN not SINCE 4h\n

          L\u00f6sche alle Mails des Benutzers im Junk-Ordner, die \u00e4lter als 7 Tage sind

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n
          docker-compose exec dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 7d\n

          L\u00f6scht alle Mails (aller Benutzer) in allen Ordnern, die \u00e4lter als 52 Wochen sind (internes Datum der Mail, nicht das Datum, an dem sie auf dem System gespeichert wurde => before statt savedbefore). N\u00fctzlich zum L\u00f6schen sehr alter Mails in allen Benutzern und Ordnern (daher besonders n\u00fctzlich f\u00fcr GDPR-Compliance).

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n
          docker-compose exec dovecot-mailcow doveadm expunge -A mailbox % before 52w\n

          L\u00f6schen von Mails in einem benutzerdefinierten Ordner innerhalb des Posteingangs eines Benutzers, die nicht gekennzeichnet und \u00e4lter als 2 Wochen sind

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n
          docker-compose exec dovecot-mailcow doveadm expunge -u 'mailbox@example.com' mailbox 'INBOX/custom-folder' not FLAGGED not SINCE 2w\n

          Info

          F\u00fcr m\u00f6gliche Zeitspannen oder SearchQuery schauen Sie bitte in man doveadm-search-query

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#job-scheduler","title":"Job-Scheduler","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#uber-das-host-system-cron","title":"\u00fcber das Host-System cron","text":"

          Wenn Sie eine solche Aufgabe automatisieren wollen, k\u00f6nnen Sie einen Cron-Job auf Ihrem Rechner erstellen, der ein Skript wie das folgende aufruft:

          docker compose (Plugin)docker-compose (Standalone) 
          #!/bin/bash\n# Pfad zu mailcow-dockerized, z.B. /opt/mailcow-dockerized\ncd /pfad/zu/ihrer/mailcow-dockerized\n\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n
          #!/bin/bash\n# Pfad zu mailcow-dockerized, z.B. /opt/mailcow-dockerized\ncd /pfad/zu/ihrer/mailcow-dockerized\n\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' savedbefore 2w\ndocker-compose exec -T dovecot-mailcow doveadm expunge -A mailbox 'Junk' SEEN not SINCE 12h\n[...]\n

          Um einen Cronjob zu erstellen, k\u00f6nnen Sie crontab -e ausf\u00fchren und etwas wie das Folgende einf\u00fcgen, um ein Skript auszuf\u00fchren:

          # Jeden Tag um 04:00 Uhr morgens ausf\u00fchren.\n0 4 * * * /pfad/zu/ihr/expunge_mailboxes.sh\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-expunge/#uber-docker-job-scheduler","title":"\u00fcber Docker Job Scheduler","text":"

          Um dies mit einem Docker-Job-Scheduler zu archivieren, verwenden Sie diese docker-compose.override.yml mit Ihrer mailcow: 

          services:\n\n  dovecot-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.dovecot-expunge-trash.schedule: \"0 0 4 * * *\"\n      ofelia.job-exec.dovecot-expunge-trash.command: \"doveadm expunge -A mailbox 'Junk' savedbefore 2w\"\n      ofelia.job-exec.dovecot-expunge-trash.tty: \"false\"\n

          Wir f\u00fcgen unserem Dovecot-Container ein paar Labels hinzu, um den Job-Scheduler zu aktivieren und ihm in einem Cron-kompatiblen Scheduling-Format mitzuteilen, wann er laufen soll. Hinweis: Ofelia verwendet das Scheduling-Format der Cron-Implementierung von Go, die mit einem Eintrag f\u00fcr Sekunden statt f\u00fcr Minuten beginnt.

          Diese docker-compose.override.yml l\u00f6scht jeden Tag um 4 Uhr morgens alle Mails, die \u00e4lter als 2 Wochen sind, aus dem Ordner \"Junk\". Um zu sehen, ob alles richtig gelaufen ist, k\u00f6nnen Sie nicht nur in Ihrer Mailbox nachsehen, sondern auch im Docker-Log von Ofelia, ob es etwa so aussieht:

          common.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Started - doveadm expunge -A mailbox 'Junk' savedbefore 2w,\ncommon.go:124 \u25b6 NOTICE [Job \"dovecot-expunge-trash\" (8759567efa66)] Finished in \"285.032291ms\", failed: false, skipped: false, error: none,\n

          Wenn der Vorgang fehlgeschlagen ist, wird dies angegeben und die Ausgabe von doveadm im Protokoll aufgef\u00fchrt, um Ihnen die Fehlersuche zu erleichtern.

          Falls Sie weitere Jobs hinzuf\u00fcgen wollen, stellen Sie sicher, dass Sie den \"dovecot-expunge-trash\"-Teil nach \"ofelia.job-exec.\" in etwas anderes \u00e4ndern, er definiert den Namen des Jobs. Die Syntax der Labels finden Sie unter mcuadros/ofelia.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-extra_conf/","title":"Anpassen/Erweitern von dovecot.conf","text":"

          Erstellen Sie eine Datei data/conf/dovecot/extra.conf - falls nicht vorhanden - und f\u00fcgen Sie Ihren zus\u00e4tzlichen Inhalt hier ein.

          Starten Sie dovecot-mailcow neu, um Ihre \u00c4nderungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart dovecot-mailcow\n
          docker-compose restart dovecot-mailcow\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/","title":"Volltext Suche (FTS)","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-solr-deprecated","title":"FTS Solr (Deprecated)","text":"

          Achtung

          Solr wird nur noch bis Dezember 2024 unterst\u00fctzt und anschlie\u00dfend aus mailcow entfernt und mit Flatcurve ersetzt.

          Solr wird f\u00fcr Setups mit Speicher >= 3,5 GiB verwendet, um eine Volltextsuche in Dovecot zu erm\u00f6glichen.

          Bitte beachten Sie, dass Anwendungen wie Solr vielleicht von Zeit zu Zeit gewartet werden m\u00fcssen.

          Au\u00dferdem verbraucht Solr eine Menge RAM, abh\u00e4ngig von der Nutzung Ihres Servers. Bitte vermeiden Sie es auf Maschinen mit weniger als 3 GiB RAM.

          Die Standard-Heap-Gr\u00f6\u00dfe (1024 M) ist in mailcow.conf definiert.

          Da wir in Docker laufen und unsere Container mit dem \"restart: always\" Flag erstellen, wird eine OOM-Situation zumindest nur einen Neustart des Containers ausl\u00f6sen.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-flatcurve-experimentell-seit-2024-06","title":"FTS Flatcurve (Experimentell seit 2024-06)","text":"

          Flatcurve wird in naher Zukunft die bisherige FTS Engine Solr abl\u00f6sen, damit eine Volltextsuche auch auf leistungsschw\u00e4cheren Systemen besser funktioniert.

          Beginnend mit dem Juni 2024 Update wurde eine experimentelle Unterst\u00fctzung f\u00fcr Flatcurve als Volltextsuche eingebaut, welche sich in der experimentellen Phase ausschlie\u00dflich \u00fcber eine mailcow.conf-Variable aktivieren l\u00e4sst.

          Hinweis

          mailcow gibt in der \u00dcbergangszeit die Konfiguration f\u00fcr die FTS Engine innerhalb Dovecots vor und \u00fcberschreibt etwaige eigene \u00c4nderungen (wenn nicht explizit in der extra.conf definiert). Dies wird aber mit dem Full Release der Engine innerhalb mailcows nicht mehr der Fall sein.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#aktivierung-der-experimentellen-flatcurve-nutzung","title":"Aktivierung der experimentellen Flatcurve-Nutzung","text":"

          Die Aktivierung ist simpel und erfordert nur zwei kleine Handgriffe:

          1. mailcow.conf bearbeiten und folgenden Wert erg\u00e4nzen:

            FLATCURVE_EXPERIMENTAL=y\n

          2. mailcow neu starten:

            docker compose (Plugin)docker-compose (Standalone) 
            docker compose up -d\n
            docker-compose up -d\n

          mailcow wird nun Flatcurve als FTS Backend nutzen.

          Anders als bei Solr ist f\u00fcr Flatcurve kein weiteres Docker-Volume notwendig. Flatcurve speichert seine FTS-Datenbanken in dem vmail-index-Volume und f\u00fchrt zu einer \u00e4hnlichen Ordnerstruktur wie:

          /var/vmail_index/tester@develcow.de/.INBOX/\n\u251c\u2500\u2500 dovecot.index\n\u251c\u2500\u2500 dovecot.index.cache\n\u251c\u2500\u2500 dovecot.index.log\n\u2514\u2500\u2500 fts-flatcurve\n    \u2514\u2500\u2500 index.814\n        \u251c\u2500\u2500 flintlock\n        \u251c\u2500\u2500 iamglass\n        \u251c\u2500\u2500 postlist.glass\n        \u2514\u2500\u2500 termlist.glass\n

          Jeder Unterordner im IMAP-Server erh\u00e4lt so analog einen eigenen fts-flatcurve-Ordner mit den jeweiligen Indizes der Mails des Ordners.

          Hinweis

          Der Solr-Container bleibt in der \u00dcbergangszeit (voraussichtlich bis Dezember 2024) noch immer erhalten, um einen flie\u00dfenden \u00dcbergang zu erm\u00f6glichen.

          Achtung

          Sollten Sie sich f\u00fcr den Wechsel der FTS Engine entscheiden, ist eine komplette Reindexierung vonn\u00f6ten, da die beiden Systeme nicht untereinander kompatibel sind. Weiter unten erfahren Sie, wie Sie eine Reindexierung ansto\u00dfen k\u00f6nnen.

          Wir empfehlen allerdings, diese Reindexierung nur unter Aufsicht durchzuf\u00fchren, da trotz niedriger Systemanforderungen eine \u00fcberm\u00e4\u00dfige Systemauslastung nicht ausgeschlossen werden kann!

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-bezogene-dovecot-befehle","title":"FTS-bezogene Dovecot-Befehle","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-auf-fehler-uberprufen-und-ggfs-reparieren","title":"FTS-Datenbank auf Fehler \u00fcberpr\u00fcfen und ggfs. reparieren","text":"docker compose (Plugin)docker-compose (Standalone) 
          # Einzelbenutzer\ndocker compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# alle Benutzer\ndocker compose exec dovecot-mailcow doveadm fts rescan -A\n
          # Einzelbenutzer\ndocker-compose exec dovecot-mailcow doveadm fts rescan -u user@domain\n# alle Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts rescan -A\n

          Dovecot Wiki: \"Scannt, welche Mails im Volltextsuchindex vorhanden sind und vergleicht diese mit den tats\u00e4chlich in den Postf\u00e4chern vorhandenen Mails. Dies entfernt Mails aus dem Index, die bereits gel\u00f6scht wurden und stellt sicher, dass der n\u00e4chste doveadm-Index alle fehlenden Mails (falls vorhanden) indiziert.\"

          Dies indiziert nicht eine Mailbox neu. Es repariert im Grunde einen gegebenen Index.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-neu-indizieren-reindex","title":"FTS-Datenbank neu indizieren (Reindex)","text":"

          Wenn Sie die Daten sofort neu indizieren wollen, k\u00f6nnen Sie den folgenden Befehl ausf\u00fchren, wobei * auch eine Postfachmaske wie 'Sent' sein kann. Sie m\u00fcssen diese Befehle nicht ausf\u00fchren, aber es wird die Dinge ein wenig beschleunigen:

          docker compose (Plugin)docker-compose (Standalone) 
          # einzelner Benutzer\ndocker compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# alle Benutzer, aber offensichtlich langsamer und gef\u00e4hrlicher\ndocker compose exec dovecot-mailcow doveadm index -A '*'\n
          # einzelner Benutzer\ndocker-compose exec dovecot-mailcow doveadm index -u user@domain '*'\n# alle Benutzer, aber offensichtlich langsamer und gef\u00e4hrlicher\ndocker-compose exec dovecot-mailcow doveadm index -A '*'\n

          Hinweis

          Die Indizierung wird einige Zeit in Anspruch nehmen.

          Es besteht, je nach FTS Engine, die M\u00f6glichkeit einer \u00fcberm\u00e4\u00dfig starken Systemnutzung, bis hin zu Systemabst\u00fcrzen in seltenen F\u00e4llen. \u00dcberwachen Sie also den Indizierungsprozess und Ihre Systemauslastung wachsam!

          Da die Neuindizierung teilweise etwas fragil und gerade im Bezug auf Systemressourcen sensibel reagieren kann, haben wir sie nicht in die mailcow UI integriert.

          Sie m\u00fcssen sich manuell via CLI um eventuelle Fehler beim Re-Indizieren einer Mailbox k\u00fcmmern.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-fts/#fts-datenbank-loschen","title":"FTS-Datenbank l\u00f6schen","text":"

          mailcow wird die Indexdaten eines Benutzers automatisch l\u00f6schen, wenn die entsprechende Mailbox gel\u00f6scht wird.

          Alternativ kann der Index f\u00fcr Flatcurve via CLI manuell gel\u00f6scht werden:

          docker compose (Plugin)docker-compose (Standalone) 
          # einzelner Benutzer\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# alle Benutzer\ndocker compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
          # einzelner Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -u user@domain '*'\n# alle Benutzer\ndocker-compose exec dovecot-mailcow doveadm fts-flatcurve remove -A '*'\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-harden_ciphers/","title":"Ciphers verst\u00e4rken","text":"

          Wenn Sie die Standard-Cipher und TLS-Versionen, die in Dovecot akzeptiert werden, entsprechend der aktuellen Version auf st\u00e4rkere Einstellungen \u00e4ndern m\u00f6chten, k\u00f6nnen Sie Folgendes zu Dovecots extra.conf hinzuf\u00fcgen:

          ssl_min_protocol = TLSv1.2\nssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305\n

          Falls Sie auch die Cipher f\u00fcr Postfix anpassen wollen finden Sie hier eine entsprechende Anleitung.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/","title":"\u00c4ndern des IMAP-IDLE-Intervalls","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#was-ist-das-idle-intervall","title":"Was ist das IDLE-Intervall?","text":"

          Standardm\u00e4\u00dfig sendet Dovecot eine \"Ich bin noch da\"-Benachrichtigung an jeden Client, der eine offene Verbindung mit Dovecot hat, um Mails so schnell wie m\u00f6glich zu erhalten, ohne sie manuell abzufragen (IMAP PUSH). Diese Benachrichtigung wird durch die Einstellung imap_idle_notify_interval gesteuert, die standardm\u00e4\u00dfig auf 2 Minuten eingestellt ist.

          Ein kurzes Intervall f\u00fchrt dazu, dass der Client viele Nachrichten f\u00fcr diese Verbindung erh\u00e4lt, was f\u00fcr mobile Ger\u00e4te schlecht ist, da jedes Mal, wenn das Ger\u00e4t diese Nachricht erh\u00e4lt, die Mailing-App aufwachen muss. Dies kann zu einer unn\u00f6tigen Entladung der Batterie f\u00fchren.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#bearbeiten-sie-den-wert","title":"Bearbeiten Sie den Wert","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#konfiguration-andern","title":"Konfiguration \u00e4ndern","text":"

          Erstellen Sie eine neue Datei data/conf/dovecot/extra.conf (oder bearbeiten Sie sie, falls sie bereits existiert). F\u00fcgen Sie die Einstellung ein, gefolgt von dem neuen Wert. Um zum Beispiel das Intervall auf 5 Minuten zu setzen, k\u00f6nnen Sie Folgendes eingeben:

          imap_idle_notify_interval = 5 mins\n

          29 Minuten ist der maximale Wert, den der entsprechende RFC erlaubt.

          Warnung

          Dies ist keine Standardeinstellung in mailcow, da wir nicht wissen, wie diese Einstellung das Verhalten anderer Clients ver\u00e4ndert. Seien Sie vorsichtig, wenn Sie dies \u00e4ndern und ein anderes Verhalten beobachten.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-idle_interval/#dovecot-neu-laden","title":"Dovecot neu laden","text":"

          Nun laden Sie Dovecot neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow dovecot reload\n
          docker-compose exec dovecot-mailcow dovecot reload\n

          Info

          Sie k\u00f6nnen den Wert dieser Einstellung \u00fcberpr\u00fcfen mit

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n
          docker-compose exec dovecot-mailcow dovecot -a | grep \"imap_idle_notify_interval\"\n

          Wenn Sie den Wert nicht ge\u00e4ndert haben, sollte er auf 2m stehen. Wenn Sie ihn ge\u00e4ndert haben, sollten Sie den neuen Wert sehen.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/","title":"Verz\u00f6gertes L\u00f6schen (Dovecot Plugin)","text":"

          Vorsicht

          Diese Anleitung befindet sich noch in Arbeit, Fehler k\u00f6nnen passieren! Nutzen Sie diese Funktion mit Bedacht!

          Hinweis

          Diese Funktion ist ab mailcow-Versionen 2024-11 kompatibel. \u00c4ltere Versionen sind theoretisch ebenfalls in der Lage, die Funktion zu nutzen. Aufgrund interner \u00c4nderungen ist die Implementierung jedoch schwieriger und wird hier nicht weiter beschrieben, da nicht unterst\u00fczt.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#vorwort","title":"Vorwort","text":"

          Dovecot unterst\u00fctzt seit geraumer Zeit eine Funktion namens Lazy Expunge, welche es dem Serveradministrator erm\u00f6glicht, gel\u00f6schte E-Mails eines Benutzerkontos nach der eigentlichen L\u00f6schung zur\u00fcckzuhalten.

          mailcow besitzt eine \u00e4hnliche Funktion, die jedoch f\u00fcr Benutzer nicht so leicht zug\u00e4nglich ist (siehe Versehentlich gel\u00f6schte Daten wiederherstellen (Mail)) und eher als Fallback-Methode f\u00fcr Administratoren dient.

          Mit der Dovecot-Option k\u00f6nnen Benutzer selbst als gel\u00f6scht markierte E-Mails einsehen und wiederherstellen, bevor diese dann automatisch vom Dovecot-Server gel\u00f6scht werden.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-lazy_expunge/#einrichtung","title":"Einrichtung","text":"

          1. Bearbeiten Sie die extra.conf im Dovecot-Konfigurationsordner (in der Regel unter MAILCOW_ROOT/data/conf/dovecot) mit folgendem Inhalt: 

            plugin {\n    # Kopiere alle gel\u00f6schten Mails in die .EXPUNGED Mailbox\n    lazy_expunge = .EXPUNGED\n\n    # Als gel\u00f6scht markierte Mails von der Quota ausschlie\u00dfen\n    quota_rule = .EXPUNGED:ignore\n}\n\n# Definiert die .EXPUNGED Mailbox\nnamespace inbox {\n    mailbox .EXPUNGED {\n        # Definiert, wie lange Mails in diesem Ordner bleiben sollen, bevor sie gel\u00f6scht werden. \n        # Zeit wird definiert nach: https://doc.dovecot.org/2.3/settings/types/#time\n        autoexpunge = 7days\n        # Definiert, wie viele Mails maximal in der EXPUNGED Mailbox gehalten werden sollen, bevor diese geleert wird\n        autoexpunge_max_mails = 100000\n    }\n}\n

          2. Starten Sie den Dovecot-Container neu:

            docker compose (Plugin)docker-compose (Standalone) 
            docker compose restart dovecot-mailcow\n
            docker-compose restart dovecot-mailcow\n

          3. Nun sollte, wenn der Papierkorb geleert wird, ein neuer Ordner mit dem Namen .EXPUNGED erscheinen. In diesem Ordner sind die E-Mails enthalten, die gem\u00e4\u00df der in Schritt 1 definierten Regeln nach einer gewissen Zeit automatisch vom Server gel\u00f6scht werden.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-mail-crypt/","title":"Mail crypt","text":"

          Achtung

          Die Mails werden komprimiert (lz4) und verschl\u00fcsselt gespeichert. Das Schl\u00fcsselpaar ist in crypt-vol-1 zu finden.

          Wenn Sie vorhandene maildir-Dateien entschl\u00fcsseln/verschl\u00fcsseln wollen, k\u00f6nnen Sie das folgende Skript auf eigene Gefahr verwenden:

          Wechseln Sie in den Dovecot Container, indem Sie folgenden Befehl im mailcow-dockerized Verzeichnis ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow /bin/bash\n
          docker-compose exec dovecot-mailcow /bin/bash\n
          # Entschl\u00fcsseln Sie /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") == \"CRYPTED\" ]]; then\ndoveadm fs get compress lz4:1:crypt:private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" > \"/tmp/$(basename \"$file\")\"\n  if [[ -s \"/tmp/$(basename \"$file\")\" ]]; then\n    chmod 600 \"/tmp/$(basename \"$file\")\"\n    chown 5000:5000 \"/tmp/$(basename \"$file\")\"\n    mv \"/tmp/$(basename \"$file\")\" \"$file\"\n  else\n    rm \"/tmp/$(basename \"$file\")\"\n  fi\nfi\ndone\n\n\n# Verschl\u00fcsseln von /var/vmail\nfind /var/vmail/ -type f -regextype egrep -regex '.*S=.*W=.*' | while read -r file; do\nif [[ $(head -c7 \"$file\") != \"CRYPTED\" ]]; then\ndoveadm fs put crypt private_key_path=/mail_crypt/ecprivkey.pem:public_key_path=/mail_crypt/ecpubkey.pem:posix:prefix=/ \\\n  \"$file\" \"$file\"\n  chmod 600 \"$file\"\n  chown 5000:5000 \"$file\"\nfi\ndone\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/","title":"Weitere Beispiele mit DOVEADM","text":"

          Hier ist nur eine unsortierte Liste von n\u00fctzlichen doveadm-Befehlen, die n\u00fctzlich sein k\u00f6nnten.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/#doveadm-quota","title":"doveadm quota","text":"

          Die Befehle quota get und quota recalc1 werden verwendet, um die Quota-Nutzung des aktuellen Benutzers anzuzeigen oder neu zu berechnen. Die angezeigten Werte sind in Kilobytes.

          Um den aktuellen Quota-Status f\u00fcr einen Benutzer / eine Mailbox aufzulisten, tun Sie folgendes:

          doveadm quota get -u 'mailbox@example.org'\n

          Um den Quota-Speicherwert f\u00fcr alle Benutzer aufzulisten, tun Sie folgendes:

          doveadm quota get -A |grep \"STORAGE\"\n

          Berechnen Sie die Quota-Nutzung eines einzelnen Benutzers neu:

          doveadm quota recalc -u 'mailbox@example.org'\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-more/#doveadm-search","title":"doveadm search","text":"

          Der Befehl doveadm search2 wird verwendet, um Nachrichten zu finden, die Ihrer Anfrage entsprechen. Er kann den Benutzernamen, die Mailbox-GUID / -UID und die Nachrichten-GUIDs / -UIDs zur\u00fcckgeben.

          Um die Anzahl der Nachrichten im .Trash Ordner eines Benutzers zu sehen:

          doveadm search -A mailbox 'Trash' | awk '{print $1}' | sort | uniq -c\n

          Alle Nachrichten im Postfach eines Benutzers anzeigen, die \u00e4lter als 90 Tage sind:

          doveadm search -u 'mailbox@example.org' mailbox 'INBOX' savedbefore 90d\n

          Zeige alle Nachrichten in beliebigen Ordnern, die \u00e4lter sind als 30 Tage f\u00fcr mailbox@example.org:

          doveadm search -u 'mailbox@example.org' mailbox \"*\" savedbefore 30d\n

          1. https://wiki.dovecot.org/Tools/Doveadm/Quota \u21a9

          2. https://wiki.dovecot.org/Tools/Doveadm/Search \u21a9

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-performance/","title":"Performance Optimierungen","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-performance/#maildir_very_dirty_syncs","title":"maildir_very_dirty_syncs","text":"

          Dovecot's maildir_very_dirty_syncs Option ist seit mailcow Release 2023-05 standardm\u00e4\u00dfig aktiviert. Diese Option kann die Leistung von Postf\u00e4chern, die sehr gro\u00dfe Ordner (\u00fcber 100.000 E-Mails) enthalten, erheblich verbessern.

          Mit dieser Option wird vermieden, dass beim Laden einer E-Mail das gesamte cur-Verzeichnis erneut durchsucht wird. Wenn diese Option deaktiviert ist, geht Dovecot auf Nummer sicher und durchsucht das gesamte cur-Verzeichnis (vergleichbar mit dem Ausf\u00fchren eines ls), um zu pr\u00fcfen, ob diese bestimmte E-Mail ber\u00fchrt (umbenannt, etc.) wurde, indem es nach allen Dateien sucht, deren Namen die richtige ID enthalten. Dies ist sehr langsam, wenn das Verzeichnis gro\u00df ist, selbst auf Dateisystemen, die f\u00fcr solche Anwendungsf\u00e4lle optimiert sind (wie ext4 mit aktiviertem dir_index) auf schnellen SSD-Laufwerken.

          Diese Option ist sicher, solange Sie Dateien unter cur nicht manuell anfassen (da Dovecot die \u00c4nderungen dann m\u00f6glicherweise nicht bemerkt). Auch wenn diese Option aktiviert ist, wird Dovecot \u00c4nderungen bemerken, wenn die mtime (last modified time) der Datei ge\u00e4ndert wurde, aber ansonsten wird das Verzeichnis nicht gescannt und es wird einfach angenommen, dass der Index aktuell ist. Dies entspricht im Wesentlichen dem, was sdbox/mdbox tun, und mit dieser Option k\u00f6nnen Sie einen Teil der Leistungssteigerung erhalten, die mit sdbox/mdbox einhergehen w\u00fcrde, w\u00e4hrend Sie weiterhin maildir verwenden.

          Diese Option ist bei einer Standard-mailcow-Installation sicher zu verwenden. Wenn Sie jedoch Tools von Drittanbietern verwenden, die manuell Dateien direkt im Maildir modifizieren (anstatt \u00fcber IMAP), m\u00f6chten Sie diese Option vielleicht deaktivieren. Um diese Option zu deaktivieren, erstellen Sie eine data/conf/dovecot/extra.conf Datei und f\u00fcgen Sie diese Einstellung hinzu:

          maildir_very_dirty_syncs=no\n

          Achtung

          Bitte nutzen Sie f\u00fcr eigene Anpassungen IMMER, die oben erw\u00e4hnte extra.conf, da \u00c4nderungen, welche in der normalen dovecot.conf ge\u00e4ndert werden m\u00f6glicherweise nach einem Update vom GitHub Quellcode \u00fcberschrieben werden.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-public_folder/","title":"\u00d6ffentliche Ordner","text":"

          Erstellen Sie einen neuen \u00f6ffentlichen Namespace \"Public\" und eine Mailbox \"Develcow\" innerhalb dieses Namespaces:

          Bearbeiten oder erstellen Sie data/conf/dovecot/extra.conf, f\u00fcgen Sie hinzu:

          namespace {\n  type = public\n  separator = /\n  prefix = Public/\n  location = maildir:/var/vmail/public:INDEXPVT=~/public\n  subscriptions = yes\n  mailbox \"Develcow\" {\n    auto = subscribe\n  }\n}\n

          :INDEXPVT=~/public kann weggelassen werden, wenn die Flags, die pro Benutzer gesehen werden, nicht gew\u00fcnscht sind.

          Die neue Mailbox im \u00f6ffentlichen Namensraum wird von den Benutzern automatisch abonniert.

          Um allen authentifizierten Benutzern vollen Zugriff auf das neue Postfach (nicht auf den gesamten Namespace) zu gew\u00e4hren, f\u00fchren Sie aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n
          docker-compose exec dovecot-mailcow doveadm acl set -A \"Public/Develcow\" \"authenticated\" lookup read write write-seen write-deleted insert post delete expunge create\n

          Passen Sie den Befehl an Ihre Bed\u00fcrfnisse an, wenn Sie detailliertere Rechte pro Benutzer vergeben m\u00f6chten (verwenden Sie z.B. -u user@domain anstelle von -A).

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-public_folder/#erlaube-authentifizierten-benutzern-den-zugriff-auf-den-gesamten-offentlichen-namespace","title":"Erlaube authentifizierten Benutzern den Zugriff auf den gesamten \u00f6ffentlichen Namespace","text":"

          Um allen authentifizierten Benutzern vollen Zugriff auf den gesamten \u00f6ffentlichen Namespace und seine Unterordner zu gew\u00e4hren, erstellen Sie eine neue Datei dovecot-acl im Namespace-Stammverzeichnis:

          \u00d6ffnen/bearbeiten/erstellen Sie /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data/public/dovecot-acl (passen Sie den Pfad entsprechend an), um die globale ACL-Datei mit dem folgenden Inhalt zu erstellen:

          authenticated kxeilprwts\n

          kxeilprwts\" ist gleichbedeutend mit \"lookup read write write-seen write-deleted insert post delete expunge create\".

          Sie k\u00f6nnen doveadm acl set -u user@domain \"Public/Develcow\" user=user@domain lookup read verwenden, um den Zugriff f\u00fcr einen einzelnen Benutzer zu beschr\u00e4nken. Sie k\u00f6nnen es auch umdrehen und den Zugriff f\u00fcr alle Benutzer auf \"lr\" beschr\u00e4nken und nur einigen Benutzern vollen Zugriff gew\u00e4hren.

          Siehe Dovecot ACL f\u00fcr weitere Informationen \u00fcber ACL.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-static_master/","title":"Statischer Hauptbenutzer","text":"

          Zuf\u00e4llige Master-Benutzernamen und Passw\u00f6rter werden automatisch bei jedem Neustart von dovecot-mailcow erstellt.

          Das wird empfohlen und sollte nicht ge\u00e4ndert werden.

          Wenn der Benutzer trotzdem statisch sein soll, geben Sie bitte zwei Variablen in mailcow.conf an.

          Beide Parameter d\u00fcrfen nicht leer sein!

          DOVECOT_MASTER_USER=mymasteruser\nDOVECOT_MASTER_PASS=mysecretpass\n

          F\u00fchren Sie folgenden Befehl aus, um Ihre \u00c4nderungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Der statische Master-Benutzername wird zu DOVECOT_MASTER_USER@mailcow.local erweitert.

          Um sich als test@example.org anzumelden, w\u00fcrde dies test@example.org*mymasteruser@mailcow.local mit dem oben angegebenen Passwort entsprechen.

          Eine Anmeldung bei SOGo ist mit diesem Benutzernamen nicht m\u00f6glich. F\u00fcr Admins steht eine Click-to-Login-Funktion f\u00fcr SOGo zur Verf\u00fcgung, wie [hier] beschrieben (https://docs.mailcow.email/debug-admin_login_sogo/) Es wird kein Hauptbenutzer ben\u00f6tigt.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/","title":"Maildir verschieben (vmail)","text":""},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#der-neue-weg","title":"Der \"neue\" Weg","text":"

          Warnung

          Neuere Docker-Versionen scheinen sich \u00fcber bestehende Volumes zu beschweren. Man kann dies vor\u00fcbergehend beheben, indem man das bestehende Volume entfernt und mailcow mit der Override-Datei startet. Aber es scheint nach einem Neustart problematisch zu sein (muss best\u00e4tigt werden).

          Ein einfacher, schmutziger, aber stabiler Workaround ist es, mailcow zu stoppen, /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data zu entfernen und einen neuen Link zu Ihrem entfernten Dateisystem zu erstellen, zum Beispiel:

          mv /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data_backup\nln -s /mnt/volume-xy/vmail_data /var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\n

          Starten Sie anschlie\u00dfend mailcow.

          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#der-alte-weg","title":"Der \"alte\" Weg","text":"

          Wenn man einen anderen Ordner f\u00fcr das vmail-Volume verwenden m\u00f6chte, kann man eine docker-compose.override.yml Datei erstellen und den folgenden Inhalt hinzuf\u00fcgen:

          volumes:\n  vmail-vol-1:\n    driver_opts:\n      type: none\n      device: /data/mailcow/vmail   \n      o: bind\n
          "},{"location":"de/manual-guides/Dovecot/u_e-dovecot-vmail-volume/#verschieben-eines-bestehenden-vmail-ordners","title":"Verschieben eines bestehenden vmail-Ordners:","text":"
          • Finden Sie den aktuellen vmail-Ordner anhand seines \"Mountpoint\"-Attributs: docker volume inspect mailcowdockerized_vmail-vol-1
          [\n    {\n        \"CreatedAt\": \"2019-06-16T22:08:34+02:00\",\n        \"Driver\": \"local\",\n        \"Labels\": {\n            \"com.docker.compose.project\": \"mailcowdockerized\",\n            \"com.docker.compose.version\": \"1.23.2\",\n            \"com.docker.compose.volume\": \"vmail-vol-1\"\n        },\n        \"Mountpoint\": \"/var/lib/docker/volumes/mailcowdockerized_vmail-vol-1/_data\",\n        \"Name\": \"mailcowdockerized_vmail-vol-1\",\n        \"Options\": null,\n        \"Scope\": \"local\"\n    }\n]\n
          • Kopieren Sie den Inhalt des Mountpoint-Ordners an den neuen Speicherort (z.B. /data/mailcow/vmail) mit cp -a, rsync -a oder einem \u00e4hnlichen, nicht strikten Kopierbefehl
          • Stoppen Sie mailcow durch Ausf\u00fchren des kommenden Befehls aus Ihrem mailcow-Stammverzeichnis (z.B. /opt/mailcow-dockerized):
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\n
          docker-compose down    \n
          • Erstellen Sie die Datei docker-compose.override.yml, bearbeiten Sie den Ger\u00e4tepfad entsprechend
          • L\u00f6schen Sie den aktuellen vmail-Ordner: docker volume rm mailcowdockerized_vmail-vol-1
          • Starten Sie mailcow durch Ausf\u00fchren des folgenden Befehls aus Ihrem mailcow-Stammverzeichnis (z.B. /opt/mailcow-dockerized):
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/","title":"Benutzerdefinierte Seiten","text":""},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#ssl","title":"SSL","text":"

          Bitte lesen Sie Erweitertes SSL und \u00fcberpr\u00fcfen Sie explizit ADDITIONAL_SERVER_NAMES f\u00fcr die SSL-Konfiguration.

          Bitte f\u00fcgen Sie ADDITIONAL_SERVER_NAMES nicht hinzu, wenn Sie planen, einen anderen Web-Root zu verwenden.

          "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#neue-website","title":"Neue Website","text":"

          Um persistente (\u00fcber Updates) Sites zu erstellen, die von mailcow: dockerized gehostet werden, muss eine neue Site-Konfiguration in data/conf/nginx/ platziert werden:

          Eine gute Vorlage, um damit zu beginnen:

          nano data/conf/nginx/my_custom_site.conf\n
          server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  # Location: data/web\n  root /web;\n  # Location: data/web/mysite.com\n  #root /web/mysite.com\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name mysite.example.org;\n  server_tokens off;\n\n  # This allows acme to be validated even with a different web root\n  location ^~ /.well-known/acme-challenge/ {\n    default_type \"text/plain\";\n    rewrite /.well-known/acme-challenge/(.*) /$1 break;\n    root /web/.well-known/acme-challenge/;\n  }\n\n  if ($scheme = http) {\n    return 301 https://$server_name$request_uri;\n  }\n}\n
          "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#neue-website-mit-proxy-zu-einem-entfernten-location","title":"Neue Website mit Proxy zu einem entfernten Location","text":"

          Ein weiteres Beispiel mit einer Reverse-Proxy-Konfiguration:

          nano data/conf/nginx/my_custom_site.conf\n
          server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  ssl_protocols TLSv1.2 TLSv1.3;\n  ssl_prefer_server_ciphers on;\n  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;\n  ssl_ecdh_curve X25519:X448:secp384r1:secp256k1;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_timeout 1d;\n  ssl_session_tickets off;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name example.domain.tld;\n  server_tokens off;\n\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  if ($scheme = http) {\n    return 301 https://$host$request_uri;\n  }\n\n  location / {\n    proxy_pass http://service:3000/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  }\n}\n
          "},{"location":"de/manual-guides/Nginx/u_e-nginx_custom/#konfig-erweiterung-in-mailcows-nginx","title":"Konfig-Erweiterung in mailcows Nginx","text":"

          Der Dateiname, der f\u00fcr eine neue Site verwendet wird, ist nicht wichtig, solange der Dateiname eine .conf-Erweiterung tr\u00e4gt.

          Es ist auch m\u00f6glich, die Konfiguration der Standarddatei site.conf Datei zu erweitern:

          nano data/conf/nginx/site.my_content.custom\n

          Dieser Dateiname muss keine \".conf\"-Erweiterung haben, sondern folgt dem Muster site.*.custom, wobei * ein eigener Name ist.

          Wenn PHP in eine benutzerdefinierte Site eingebunden werden soll, verwenden Sie bitte den PHP-FPM-Listener auf phpfpm:9002 oder erstellen Sie einen neuen Listener in data/conf/phpfpm/php-fpm.d/pools.conf.

          Starten Sie Nginx neu (und PHP-FPM, falls ein neuer Listener erstellt wurde):

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart nginx-mailcow\ndocker compose restart php-fpm-mailcow\n
          docker-compose restart nginx-mailcow\ndocker-compose restart php-fpm-mailcow\n
          "},{"location":"de/manual-guides/Nginx/u_e-nginx_webmail-site/","title":"Subdom\u00e4ne webmail.example.org erstellen","text":"

          WICHTIG: Diese Anleitung gilt nur f\u00fcr Konfigurationen, bei denen SNI nicht aktiviert ist. Wenn SNI aktiviert ist, muss der Zertifikatspfad angepasst werden. Etwas wie ssl_certificate,key /etc/ssl/mail/webmail.example.org/cert.pem,key.pem; wird gen\u00fcgen. Aber: Das Zertifikat sollte zuerst bezogen werden und erst wenn das Zertifikat existiert, sollte eine Site Config erstellt werden. Nginx wird nicht starten, wenn es das Zertifikat und den Schl\u00fcssel nicht finden kann.

          Um eine Subdomain webmail.example.org zu erstellen und sie auf SOGo umzuleiten, m\u00fcssen Sie eine neue Nginx-Site erstellen. Achten Sie dabei auf \"CHANGE_TO_MAILCOW_HOSTNAME\"!

          nano data/conf/nginx/webmail.conf

          server {\n  ssl_certificate /etc/ssl/mail/cert.pem;\n  ssl_certificate_key /etc/ssl/mail/key.pem;\n  index index.php index.html;\n  client_max_body_size 0;\n  root /web;\n  include /etc/nginx/conf.d/listen_plain.active;\n  include /etc/nginx/conf.d/listen_ssl.active;\n  server_name webmail.example.org;\n  server_tokens off;\n  location ^~ /.well-known/acme-challenge/ {\n    allow all;\n    default_type \"text/plain\";\n  }\n\n  location / {\n    return 301 https://CHANGE_TO_MAILCOW_HOSTNAME/SOGo;\n  }\n}\n

          Speichern Sie und starten Sie Nginx neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart nginx-mailcow\n
          docker-compose restart nginx-mailcow\n

          \u00d6ffnen Sie nun mailcow.conf und suchen Sie ADDITIONAL_SAN. F\u00fcgen Sie webmail.example.org zu diesem Array hinzu, verwenden Sie keine Anf\u00fchrungszeichen!

          ADDITIONAL_SAN=webmail.example.org\n

          F\u00fchren Sie den Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Siehe \"acme-mailcow\" und \"nginx-mailcow\" Logs, wenn etwas fehlschl\u00e4gt

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-attachment_size/","title":"Maximale Nachrichtengr\u00f6\u00dfe (Gr\u00f6\u00dfe des Anhangs)","text":"

          \u00d6ffnen Sie data/conf/postfix/extra.cf und setzen Sie das message_size_limit entsprechend in Bytes. Siehe main.cf f\u00fcr den Standardwert.

          Sie m\u00fcssen auch die Nachrichtengr\u00f6\u00dfe in den Konfigurationen von Rspamd und Clamav anpassen:

          • in data/conf/rspamd/local.d/options.inc f\u00fcgen Sie den max_message Parameter entsprechend den im Postfix gesetzten Wert hinzu. Ziehen Sie die Rspamd Docs f\u00fcr den Standardwert zu rate.
          • in data/conf/rspamd/local.d/external_services.conf \u00e4ndern Sie den Wert max_size Parameter f\u00fcr oletools
          • in data/conf/rspamd/local.d/antivirus.conf \u00e4ndern Sie den Wert max_size Parameter f\u00fcr clamav
          • in data/conf/clamav/clamd.conf \u00e4ndern Sie den Wert MaxScanSize und MaxFileSize auf dieselbe Gr\u00f6\u00dfe wie in der Postfix extra.cf

          Starten Sie Postfix, Rspamd and Clamav neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
          docker-compose restart postfix-mailcow rspamd-mailcow clamd-mailcow\n
          "},{"location":"de/manual-guides/Postfix/u_e-postfix-custom_transport/","title":"Benutzerdefinierte Transportmaps","text":"

          F\u00fcr Transport maps, die nicht in mailcow UI konfiguriert werden, verwenden Sie bitte data/conf/postfix/custom_transport.pcre, um zu verhindern, dass bestehende Maps oder Einstellungen durch Updates \u00fcberschrieben werden.

          In den meisten F\u00e4llen ist die Verwendung dieser Datei nicht notwendig. Bitte vergewissern Sie sich, dass mailcow UI nicht in der Lage ist, den gew\u00fcnschten Datenverkehr richtig zu routen, bevor Sie diese Datei verwenden.

          Die Datei ben\u00f6tigt g\u00fcltigen PCRE-Inhalt und kann Postfix zerst\u00f6ren, wenn sie falsch konfiguriert ist.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/","title":"\u00dcberpr\u00fcfung der Absenderadressen deaktivieren","text":""},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/#neue-anleitung","title":"Neue Anleitung","text":"

          Bearbeiten Sie ein Postfach und w\u00e4hlen Sie \"Senden als * zulassen\".

          Aus historischen Gr\u00fcnden haben wir die alte und veraltete Anleitung unten beibehalten:

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-disable_sender_verification/#veraltete-anleitung-nicht-fur-neuere-mailcows-verwenden","title":"Veraltete Anleitung (NICHT F\u00dcR NEUERE MAILCOWS VERWENDEN!)","text":"

          Diese Option ist keine Best-Practice und sollte nur verwendet werden, wenn es keine andere M\u00f6glichkeit gibt, das zu erreichen, was Sie erreichen wollen.

          Erstellen Sie einfach eine Datei data/conf/postfix/check_sasl_access und tragen Sie den folgenden Inhalt ein. Dieser Benutzer muss in Ihrer Installation existieren und muss sich vor dem Versenden von Mails authentifizieren. 

          user-to-allow-everything@example.com OK\n

          \u00d6ffnen Sie data/conf/postfix/main.cf und suchen Sie smtpd_sender_restrictions. F\u00fcgen Sie check_sasl_access hash:/opt/postfix/conf/check_sasl_access wie folgt ein: 

          smtpd_sender_restrictions = check_sasl_access hash:/opt/postfix/conf/check_sasl_access reject_authenticated_sender_login_mismatch [...]\n

          Postmap auf check_sasl_access ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n
          docker-compose exec postfix-mailcow postmap /opt/postfix/conf/check_sasl_access\n

          Starten Sie den Postfix-Container neu.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-extra_cf/","title":"main.cf anpassen/erweitern","text":"

          Bitte erstellen Sie eine neue Datei data/conf/postfix/extra.cf f\u00fcr \u00dcberschreibungen oder zus\u00e4tzliche Inhalte zur main.cf.

          Postfix wird sich einmal nach dem Start von postfix-mailcow \u00fcber doppelte Werte beschweren, dies ist beabsichtigt.

          Syslog-ng wurde so konfiguriert, dass es diese Warnungen ausblendet, w\u00e4hrend Postfix l\u00e4uft, um die Log-Dateien nicht jedes Mal mit unn\u00f6tigen Informationen zu spammen, wenn ein Dienst benutzt wird.

          Starten Sie postfix-mailcow neu, um Ihre \u00c4nderungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart postfix-mailcow\n
          docker-compose restart postfix-mailcow\n
          "},{"location":"de/manual-guides/Postfix/u_e-postfix-harden_ciphers/","title":"Ciphers verst\u00e4rken","text":"

          Wenn Sie die Standard-Cipher und TLS-Versionen, die in Postfix akzeptiert werden, entsprechend der aktuellen Version auf st\u00e4rkere Einstellungen \u00e4ndern m\u00f6chten, k\u00f6nnen Sie Folgendes zu Postfix extra.cf hinzuf\u00fcgen:

          tls_high_cipherlist = ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256\ntls_preempt_cipherlist = yes\n\nsmtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtp_tls_ciphers = high\nsmtp_tls_mandatory_ciphers = high\n\nsmtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1\nsmtpd_tls_ciphers = high\nsmtpd_tls_mandatory_ciphers = high\n

          Eine solche Konfiguration wird die aktuellen (2024-10-21) Konfigurationspr\u00fcfungen bei Diensten wie Internet.nl bestehen.

          Falls Sie auch die Cipher f\u00fcr Dovecot anpassen wollen finden Sie hier eine entsprechende Anleitung.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-pflogsumm/","title":"Statistik mit pflogsumm","text":"

          Um pflogsumm mit dem Standard-Logging-Treiber zu verwenden, m\u00fcssen wir postfix-mailcow \u00fcber docker logs abfragen und die Ausgabe zu pflogsumm leiten:

          docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | pflogsumm\n

          Die obige Log-Ausgabe ist auf die letzten 24 Stunden beschr\u00e4nkt.

          Es ist auch m\u00f6glich, einen t\u00e4glichen pflogsumm-Bericht \u00fcber cron zu erstellen. Erstellen Sie die Datei /etc/cron.d/pflogsumm mit dem folgenden Inhalt:

          SHELL=/bin/bash\n59 23 * * * root docker logs --since 24h $(docker ps -qf name=postfix-mailcow) | /usr/sbin/pflogsumm -d today | mail -s \"Postfix Report of $(date)\" postmaster@example.net\n

          Um zu funktionieren muss ein lokaler Postfix auf dem Server installiert werden, welcher an den Postfix der mailcow relayed.

          Frage

          Genauere Informationen lassen sich unter Sektion Post-Installationsaufgaben -> Lokaler MTA auf Dockerhost finden.

          Basierend auf den Postfix-Logs der letzten 24 Stunden sendet dieses Beispiel dann jeden Tag um 23:59:00 Uhr einen pflogsumm-Bericht an postmaster@example.net.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-postscreen_whitelist/","title":"IP in Postscreen auf die Whitelist setzen","text":"

          IPs k\u00f6nnen in der Datei data/conf/postfix/custom_postscreen_whitelist.cidr aus dem Postscreen und damit auch aus den RBL-Pr\u00fcfungen entfernt werden.

          Postscreen f\u00fchrt mehrere Pr\u00fcfungen durch, um b\u00f6sartige Absender zu identifizieren. In den meisten F\u00e4llen m\u00f6chten Sie eine IP-Adresse auf die Whitelist setzen, um sie von der Suche nach einer Blacklist auszuschlie\u00dfen.

          Das Format der Datei ist wie folgt

          CIDR ACTION

          Dabei steht CIDR f\u00fcr eine einzelne IP-Adresse oder einen IP-Bereich in CIDR-Notation und action entweder f\u00fcr \"permit\" oder \"reject\".

          Beispiel:

          # Regeln werden in der angegebenen Reihenfolge ausgewertet.\n# Blacklist 192.168.* au\u00dfer 192.168.0.1.\n192.168.0.1 permit\n192.168.0.0/16 reject\n

          Die Datei wird spontan neu geladen, ein Neustart von Postfix ist nicht erforderlich.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/","title":"Relayhosts","text":"

          Seit dem 12. September 2018 k\u00f6nnen Sie Relayhosts als Admin \u00fcber die mailcow UI einrichten.

          Dies ist n\u00fctzlich, wenn Sie ausgehende E-Mails f\u00fcr eine bestimmte Domain an einen Drittanbieter-Spamfilter oder einen Dienst wie Mailgun oder Sendgrid weiterleiten m\u00f6chten. Dies ist auch bekannt als ein smarthost. Falls nicht, \u00fcberpr\u00fcfen Sie den Fehler und beheben Sie ihn.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#einen-neuen-relayhost-hinzufugen","title":"Einen neuen Relayhost hinzuf\u00fcgen","text":"

          Gehen Sie auf die Registerkarte \"Routing\" im Abschnitt \"Konfiguration und Details\" der mailcow UI. Hier sehen Sie eine Liste der derzeit eingerichteten Relayhosts.

          Bl\u00e4ttern Sie zum Abschnitt \"Absenderabh\u00e4ngigen Transport hinzuf\u00fcgen\".

          F\u00fcgen Sie unter Host den Host hinzu, an den Sie weiterleiten m\u00f6chten. Beispiel: Wenn Sie Mailgun zum Senden von E-Mails anstelle Ihrer Server-IP verwenden m\u00f6chten, geben Sie smtp.mailgun.org ein.

          Wenn der Relay-Host zur Authentifizierung einen Benutzernamen und ein Passwort ben\u00f6tigt, geben Sie diese in die entsprechenden Felder ein. Beachten Sie, dass die Anmeldedaten im Klartext gespeichert werden.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#testen-sie-einen-relayhost","title":"Testen Sie einen Relayhost","text":"

          Um zu testen, ob die Verbindung zum Host funktioniert, klicken Sie in der Liste der Relayhosts auf Test und geben Sie eine Von:-Adresse ein. F\u00fchren Sie dann den Test aus.

          Sie sehen dann die Ergebnisse der SMTP-\u00dcbertragung. Wenn alles klappt, sollten Sie Folgendes sehen: SERVER -> CLIENT: 250 2.0.0 Ok: queued as A093B401D4 als eine der letzten Zeilen.

          Ist dies nicht der Fall, \u00fcberpr\u00fcfen Sie den angegebenen Fehler und beheben Sie ihn.

          Hinweis: Einige Hosts, insbesondere solche, die keine Authentifizierung verlangen, verweigern Verbindungen von Servern, die nicht zuvor in ihr System aufgenommen wurden. Lesen Sie unbedingt die Dokumentation des Relayhosts, um sicherzustellen, dass Sie Ihre Domain und/oder die Server-IP zu ihrem System hinzugef\u00fcgt haben.

          Tipp: Sie k\u00f6nnen die standardm\u00e4\u00dfige Von:-Adresse, die der Test verwendet, von null@mailcow.email auf eine beliebige E-Mail-Adresse \u00e4ndern, indem Sie die Variable $RELAY_TO in der Datei vars.inc.php unter /opt/mailcow-dockerized/data/web/inc \u00e4ndern. Auf diese Weise k\u00f6nnen Sie \u00fcberpr\u00fcfen, ob das Relay funktioniert hat, indem Sie das Zielpostfach \u00fcberpr\u00fcfen.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-relayhost/#relayhost-fur-eine-domain-festlegen","title":"Relayhost f\u00fcr eine Domain festlegen","text":"

          Wechseln Sie auf die Registerkarte \"Domains\" im Abschnitt \"E-Mail-Setup\" der mailcow UI.

          Bearbeiten Sie die gew\u00fcnschte Domain.

          W\u00e4hlen Sie den neu hinzugef\u00fcgten Host in der Dropdown-Liste \"Absenderabh\u00e4ngige Transporte\" aus und speichern Sie die \u00c4nderungen.

          Senden Sie eine E-Mail von einer Mailbox auf dieser Domain und Sie sollten in den Protokollen sehen, dass Postfix die Nachricht an den Relayhost weiterleitet.

          "},{"location":"de/manual-guides/Postfix/u_e-postfix-unauthenticated-relaying/","title":"Unauthentifiziertes Relaying","text":"

          Standardm\u00e4\u00dfig betrachtet mailcow's Postfix alle Netzwerke als nicht vertrauensw\u00fcrdig, ausgenommen seine eigenen IPV4_NETWORK und IPV6_NETWORK Bereiche, die in mailcow.conf festgelegt sind. Obwohl dies in den meisten F\u00e4llen vern\u00fcnftig ist, kann es Umst\u00e4nde geben, unter denen Sie einen Host oder ein Subnetz als unauthentifizierten Relayer hinzuf\u00fcgen m\u00f6chten.

          Standardm\u00e4\u00dfig verwendet mailcow mynetworks_style = subnet um interne Subnetze zu bestimmen und l\u00e4sst mynetworks unkonfiguriert.

          Wenn Sie sich entscheiden, mynetworks selbst\u00e4ndig in der extra.conf von Postfix zu setzen, ignoriert Postfix die mynetworks_style Einstellung. Das bedeutet, dass Sie die von mailcow intern benutzen IPv4- und IPv6-Adressen (in der mailcow.conf angegeben als IPV4_NETWORK bzw. IPV6_NETWORK), sowie die Loopback-Subnetze manuell hinzuf\u00fcgen m\u00fcssen!

          Erl\u00e4uterung

          Die Einstellung mynetworks erlaubt es eingetragenen Hosts bzw. Subnets OHNE Authentifizierung E-Mails an den Postfix MTA zu schicken. Insbesondere dann praktisch, wenn bspw. Monitoring E-Mails von Linux Servern im selben Netzwerk ohne extra Authentifizierung verschickt werden sollen.

          Achtung

          Eine falsche Einstellung von mynetworks erlaubt es Ihrem Server, als offenes Relay verwendet zu werden. Wenn dies missbraucht wird, beeintr\u00e4chtigt dies Ihre F\u00e4higkeit, E-Mails zu versenden, und es kann einige Zeit dauern, bis dies abgeklungen ist.

          Beispiel

          Als Beispiel nehmen wir das Subnetz 192.168.2.0/24, welches wir unauthentifiziert Relayen lassen wollen.

          Bearbeiten Sie data/conf/postfix/extra.cf:

          mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 [fe80::]/10 172.22.1.0/24 [fd4d:6169:6c63:6f77::]/64 192.168.2.0/24\n

          Bearbeiten Sie zus\u00e4tzlich noch data/conf/rspamd/local.d/options.inc:

          local_addrs = [127.0.0.0/8, ::ffff:127.0.0.0/104, ::1/128, fe80::/10, 172.22.1.0/24, fd4d:6169:6c63:6f77::/64, 192.168.2.0/24];\n

          Vorsicht

          Die Subnetze vor unserem angehangenen Beispiel Subnetz M\u00dcSSEN vor oder nach den eigens eingetragenen Werten stehen, da sonst einige mailcow Komponenten wie bspw. der Watchdog oder einige Sieve Filter (wie bspw. Abwesenheitsagenten) nicht funktionieren und Fehler beim Betriebsablauf entstehen.

          F\u00fchren Sie nach Ihren \u00c4nderungen folgenden Befehl aus aus, um Ihre neuen Einstellungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart postfix-mailcow rspamd-mailcow\n
          docker-compose restart postfix-mailcow rspamd-mailcow\n

          Gut zu wissen!

          IPv6 Adressen M\u00dcSSEN in diesem Fall mit [] (Eckigen Klammern) als mynetworks Parameter eingetragen werden, da diese sonst nicht verarbeitet werden k\u00f6nnen.

          Info

          Weitere Informationen \u00fcber mynetworks finden Sie in der Postfix-Dokumentation.

          "},{"location":"de/manual-guides/Redis/u_e-redis/","title":"Redis","text":"

          Redis wird als Key-Value-Speicher f\u00fcr die Einstellungen und Daten von rspamd und (einige von) mailcow verwendet. Wenn Sie mit Redis nicht vertraut sind, lesen Sie bitte die Einf\u00fchrung in Redis und besuchen Sie gegebenenfalls diese wunderbare Anleitung, um zu erfahren, wie man Redis benutzt.

          "},{"location":"de/manual-guides/Redis/u_e-redis/#client","title":"Client","text":"

          Um sich mit dem redis cli zu verbinden, f\u00fchren Sie aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow redis-cli\n
          docker-compose exec redis-mailcow redis-cli\n
          "},{"location":"de/manual-guides/Redis/u_e-redis/#fehlersuche","title":"Fehlersuche","text":"

          Hier sind einige n\u00fctzliche Befehle f\u00fcr den redis-cli zur Fehlersuche:

          "},{"location":"de/manual-guides/Redis/u_e-redis/#monitor","title":"MONITOR","text":"

          \u00dcberwacht alle vom Server empfangenen Anfragen in Echtzeit:

          docker compose (Plugin)docker-compose (Standalone) 
          #docker compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
          #docker-compose exec redis-mailcow redis-cli\n127.0.0.1:6379> monitor\nOK\n1494077286.401963 [0 172.22.1.253:41228] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n1494077288.292970 [0 172.22.1.253:41229] \"SMEMBERS\" \"BAYES_SPAM_keys\"\n[...]\n
          "},{"location":"de/manual-guides/Redis/u_e-redis/#schlussel-keys","title":"SCHL\u00dcSSEL (Keys)","text":"

          Ermittelt alle Schl\u00fcssel, die dem Muster entsprechen:

          KEYS *\n
          "},{"location":"de/manual-guides/Redis/u_e-redis/#ping","title":"PING","text":"

          Testen Sie eine Verbindung:

          127.0.0.1:6379> PING\nPONG\n

          Wenn Sie mehr wissen wollen, hier ist ein Cheat-Sheet.

          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-add-additional-modules/","title":"Weitere Module hinzuf\u00fcgen","text":"

          Laden Sie das Modul herunter und speichern Sie es in folgenden Pfad ab: data/conf/rspamd/plugins.d/.

          Danach m\u00fcssen Sie die Konfigurationsparameter des Modules in data/conf/rspamd/rspamd.conf.local hinzuf\u00fcgen. Falls das Modul my_plugin.lua hei\u00dft, sollte die Datei wie folgt aussehen:

          # rspamd.conf.local\nmy_plugin {\n    some_setting = \"some value\";\n}\n

          Falls Ihr Modul keine zus\u00e4tzlichen Konfigurationen ben\u00f6tigt, reicht es aus einen leeren Konfigurationsblock hinzuzuf\u00fcgen. Wie im folgenden Beispiel zu sehen:

          # rspamd.conf.local\nmy_plugin { }\n

          Falls Sie keinen Konfigurationsblock hinzuf\u00fcgen, dann wird das Modul automatisch deaktiviert und im Logfile des rspamd-mailcow Containers sehen Sie folgende Nachricht:

          mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: lua module my_plugin is enabled but has not been configured\nmailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:01:32 #1(main) <sh6j9z>; cfg; rspamd_config_is_module_enabled: my_plugin disabling unconfigured lua module\n

          Falls Sie das Modul erfolgreich konfiguiert haben, dann sollte das Logfile des rspamd-mailcow Containers wie folgt aussehen:

          mailcowdockerized-rspamd-mailcow-1  | 2023-05-20 14:04:50 #1(main) <8ayxpf>; cfg; rspamd_init_lua_filters: init lua module my_plugin from /etc/rspamd/plugins.d//my_plugin.lua; digest: 5cb88961e5\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/","title":"Anpassungen","text":""},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#spamfilter-schwellenwerte-global","title":"Spamfilter-Schwellenwerte (global)","text":"

          Jeder Benutzer kann seine Spam-Bewertung individuell \u00e4ndern.

          Um eine neue serverweite Grenze zu definieren, editieren Sie data/conf/rspamd/local.d/actions.conf:

          reject = 15;\nadd_header = 8;\ngreylist = 7;\n

          Speichern Sie die Datei und starten Sie \"rspamd-mailcow\" neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Achtung

          Bestehende Einstellungen der Benutzer werden nicht \u00fcberschrieben!

          Um benutzerdefinierte Schwellenwerte zur\u00fcckzusetzen, f\u00fchren Sie aus:

          docker compose (Plugin)docker-compose (Standalone) 
          source mailcow.conf\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# oder:\ndocker compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
          source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel';\"\n# oder:\ndocker-compose exec mysql-mailcow mysql -umailcow -p$DBPASS mailcow -e \"delete from filterconf where option = 'highspamlevel' or option = 'lowspamlevel' and object = 'only-this-mailbox@example.org';\"\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#benutzerdefinierte-ablehnungsnachrichten","title":"Benutzerdefinierte Ablehnungsnachrichten","text":"

          Die Standard-Spam-Reject-Meldung kann durch Hinzuf\u00fcgen einer neuen Datei data/conf/rspamd/override.d/worker-proxy.custom.inc mit dem folgenden Inhalt ge\u00e4ndert werden:

          reject_message = \"Meine eigene Ablehnungsnachricht\";\n

          Speichern Sie die Datei und starten Sie Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          W\u00e4hrend das oben genannte f\u00fcr abgelehnte Mails mit einem hohen Spam-Score funktioniert, ignorieren Prefilter-Aktionen diese Einstellung. F\u00fcr diese muss das Multimap-Modul in Rspamd angepasst werden:

          1. Finden Sie das Prefilet-Reject-Symbol, f\u00fcr das Sie die Nachricht \u00e4ndern wollen, f\u00fchren Sie dazu aus: grep -R \"SYMBOL_WELCHES_ANGEPASST_WERDEN_SOLL\" /opt/mailcow-dockerized/data/conf/rspamd/

          2. F\u00fcgen Sie Ihre eigene Nachricht als neue Zeile hinzu:

            GLOBAL_RCPT_BL {\nTyp = \"rcpt\";\nmap = \"${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map\";\nregexp = true;\nprefilter = true;\naction = \"reject\";\nmessage = \"Der Versand von E-Mails an diesen Empf\u00e4nger ist durch postmaster@your.domain verboten\";\n}\n

          3. Speichern Sie die Datei und starten Sie Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-tweaks/#e-mails-verwerfen-discard-anstatt-zuruckzuweisen-reject","title":"E-Mails verwerfen (discard) anstatt zur\u00fcckzuweisen (reject)","text":"

          Wenn Sie eine Nachricht stillschweigend verwerfen wollen, erstellen oder bearbeiten Sie die Datei data/conf/rspamd/override.d/worker-proxy.custom.inc und f\u00fcgen Sie den folgenden Inhalt hinzu:

          discard_on_reject = true;\n

          Starten Sie Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/","title":"Mit Spamdaten Arbeiten","text":""},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#spam-ham-lernen","title":"Spam & Ham lernen","text":"

          Rspamd lernt, ob es sich um Spam oder Ham handelt, wenn Sie eine Nachricht in oder aus dem Junk-Ordner in ein anderes Postfach als den Papierkorb verschieben. Dies wird durch die Verwendung des Sieve-Plugins \"sieve_imapsieve\" und Parser-Skripte erreicht.

          Rspamd liest auch automatisch Mails, wenn eine hohe oder niedrige Punktzahl erkannt wird (siehe https://rspamd.com/doc/configuration/statistic.html#autolearning). Wir haben das Plugin so konfiguriert, dass es ein vern\u00fcnftiges Verh\u00e4ltnis zwischen Spam- und Ham-Learnings beibeh\u00e4lt.

          Die Bayes-Statistiken werden in Redis als Schl\u00fcssel BAYES_HAM und BAYES_SPAM gespeichert.

          Neben Bayes wird ein lokaler Fuzzy-Speicher verwendet, um wiederkehrende Muster in Texten oder Bildern zu lernen, die auf Ham oder Spam hinweisen.

          Sie k\u00f6nnen auch die Web-UI von Rspamd verwenden, um Ham und/oder Spam zu lernen oder bestimmte Einstellungen von Rspamd anzupassen.

          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#spam-oder-ham-aus-bestehendem-verzeichnis-lernen","title":"Spam oder Ham aus bestehendem Verzeichnis lernen","text":"

          Sie k\u00f6nnen einen Einzeiler verwenden, um Mails im Klartextformat (unkomprimiert) zu lernen:

          docker compose (Plugin)docker-compose (Standalone) 
          # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n
          # Ham\nfor file in /my/folder/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_ham < $file; done\n# Spam\nfor file in /my/folder/.Junk/cur/*; do docker exec -i $(docker-compose ps -q rspamd-mailcow) rspamc learn_spam < $file; done\n

          Erw\u00e4gen Sie, einen lokalen Ordner als neues Volume an rspamd-mailcow in docker-compose.yml anzuh\u00e4ngen und die gegebenen Dateien innerhalb des Containers zu lernen. Dies kann als Workaround verwendet werden, um komprimierte Daten mit zcat zu parsen. Beispiel:

          for file in /data/old_mail/.Junk/cur/*; do rspamc learn_spam < zcat $file; done\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#gelernte-daten-zurucksetzen-bayes-neural","title":"Gelernte Daten zur\u00fccksetzen (Bayes, Neural)","text":"

          Sie m\u00fcssen die Schl\u00fcssel in Redis l\u00f6schen, um die gelernten Daten zur\u00fcckzusetzen, also erstellen Sie zuerst eine Kopie Ihrer Redis-Datenbank:

          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#kopie-der-redis-datenbank","title":"Kopie der Redis Datenbank","text":"
          # Es ist besser, Redis zu stoppen, bevor Sie die Datei kopieren.\ncp /var/lib/docker/volumes/mailcowdockerized_redis-vol-1/_data/dump.rdb /root/\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#bayes-daten-zurucksetzen","title":"Bayes-Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
          docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern BAYES_* | xargs redis-cli del'\ndocker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern RS* | xargs redis-cli del'\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#neurale-daten-zurucksetzen","title":"Neurale Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
          docker-compose exec redis-mailcow sh -c 'redis-cli --scan --pattern rn_* | xargs redis-cli del'\n
          "},{"location":"de/manual-guides/Rspamd/u-e-rspamd-work-with-spamdata/#fuzzy-daten-zurucksetzen","title":"Fuzzy-Daten zur\u00fccksetzen","text":"docker compose (Plugin)docker-compose (Standalone) 
          # Wir m\u00fcssen zuerst die redis-cli aufrufen:\ndocker compose exec redis-mailcow redis-cli\n# In redis-cli geben wir nun ein:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n
          # Wir m\u00fcssen zuerst die redis-cli aufrufen:\ndocker-compose exec redis-mailcow redis-cli\n# In redis-cli geben wir nun ein:\n127.0.0.1:6379> EVAL \"for i, name in ipairs(redis.call('KEYS', ARGV[1])) do redis.call('DEL', name); end\" 0 fuzzy*\n

          Info

          Wenn redis-cli sich dar\u00fcber beschwert... 

          (error) ERR wrong number of arguments for 'del' command\n
          ...,dass das Schl\u00fcsselmuster nicht gefunden wurde und somit keine Daten zum L\u00f6schen vorhanden sind - ist dies in Ordnung.

          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-disable-greylisting/","title":"Greylisting deaktivieren","text":"

          Hinweis

          In dieser Anleitung gehen wir von dem standard mailcow Pfad (/opt/mailcow-dockerized) aus. Der Pfad in Ihrer Installation kann m\u00f6glicherweise variieren!

          Nur Nachrichten mit einem h\u00f6heren Rspamd Score werden Greylisted (soft rejected).

          Wir selbst empfehlen NICHT das Greylisting zu deaktivieren.

          Falls Sie einen validen Grund daf\u00fcr sehen, dass Greylisting zu deaktivieren, k\u00f6nnen Sie dies serverweit durch das Editieren der greylist.conf deaktivieren:

          /opt/mailcow-dockerized/data/conf/rspamd/local.d/greylist.conf

          F\u00fcgen Sie die Zeile hinzu:

          enabled = false;\n

          Speichern Sie die Datei und starten Sie \"rspamd-mailcow\" neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Das Greylisting ist nun serverweit deaktiviert!

          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/","title":"Allgemeine Einstellungen","text":"

          Rspamd wird f\u00fcr die AV-Verarbeitung, DKIM-Signierung und SPAM-Verarbeitung verwendet. Es ist ein leistungsf\u00e4higes und schnelles Filtersystem. F\u00fcr eine ausf\u00fchrlichere Dokumentation \u00fcber Rspamd besuchen Sie bitte die [Rspamd Dokumentation] (https://rspamd.com/doc/index.html).

          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#ui-zugang","title":"UI Zugang","text":"

          Rspamd bietet eine umfangreiche WebUI, welche jeder mailcow: dockerized Installation beiliegt.

          Diese ist mit einem Login versehen, welcher w\u00e4hrend der initialen Installation auf ein zuf\u00e4lliges Passwort gesetzt wird um den Zugang dritter zu verweigern.

          Damit Sie sich in die Rspamd UI einloggen k\u00f6nnen m\u00fcssen Sie zun\u00e4chst ein eigenes Passwort f\u00fcr die Rspamd Oberfl\u00e4che setzen.

          Dies tun Sie wie folgt:

          1. Loggen Sie sich als Administrator in ihrer mailcow UI ein.
          2. Wechseln Sie auf den Reiter (oben links) System Konfiguration und dort den Unterreiter: Zugang Rspamd UI.
          3. \u00c4ndern Sie hier das Rspamd UI Passwort, bzw. legen Sie eines fest.
          4. Gehen Sie in einem Browser zu https://${MAILCOW_HOSTNAME}/rspamd und melden Sie sich an!

          Weitere Konfigurationsoptionen und Dokumentation zur WebUI finden Sie hier: https://rspamd.com/webui/

          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#cli-werkzeuge","title":"CLI-Werkzeuge","text":"

          Rspamd bietet eine vielzahl von Befehlen, welche via CLI benutzt werden k\u00f6nnen.

          Geben Sie folgende Befehle ein, um einen \u00dcberblick auf diese zu erhalten:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow rspamc --help\ndocker compose exec rspamd-mailcow rspamadm --help\n
          docker-compose exec rspamd-mailcow rspamc --help\ndocker-compose exec rspamd-mailcow rspamadm --help\n
          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#speicherung-der-historie-erhohen","title":"Speicherung der Historie erh\u00f6hen","text":"

          Standardm\u00e4\u00dfig speichert Rspamd 1000 Elemente in der Historie.

          Die Historie wird komprimiert gespeichert.

          Es wird empfohlen, hier keinen unverh\u00e4ltnism\u00e4\u00dfig hohen Wert zu verwenden, probieren Sie etwas in der Gr\u00f6\u00dfenordnung von 5000 oder 10000 und sehen Sie, wie Ihr Server damit umgeht:

          Bearbeiten Sie data/conf/rspamd/local.d/history_redis.conf:

          nrows = 1000; # \u00c4ndern Sie diesen Wert\n

          Starten Sie anschlie\u00dfend Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n
          "},{"location":"de/manual-guides/Rspamd/u_e-rspamd-general/#losche-alle-ratelimit-schlussel","title":"L\u00f6sche alle Ratelimit-Schl\u00fcssel","text":"

          Wenn Sie die mailcow UI nicht verwenden wollen und stattdessen alle Schl\u00fcssel in der Redis-Datenbank l\u00f6schen wollen, k\u00f6nnen Sie redis-cli f\u00fcr diese Aufgabe verwenden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow sh\n# Unlink (verf\u00fcgbar in Redis >=4.) l\u00f6scht im Hintergrund\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n
          docker-compose exec redis-mailcow sh\n# Unlink (verf\u00fcgbar in Redis >=4.) l\u00f6scht im Hintergrund\nredis-cli --scan --pattern RL* | xargs redis-cli unlink\n

          Starten Sie Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/","title":"SOGo","text":"

          SOGo wird verwendet, um \u00fcber einen Webbrowser auf Ihre Mails zuzugreifen und Ihre Kontakte oder Kalender hinzuzuf\u00fcgen und zu teilen. F\u00fcr eine ausf\u00fchrlichere Dokumentation zu SOGo besuchen Sie bitte die Dokumentation von SOGo.

          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#benutzerdefiniertes-sogo-thema-css-anwenden","title":"Benutzerdefiniertes SOGo-Thema (CSS) anwenden","text":"

          mailcow-Builds nach dem 28. Januar 2021 k\u00f6nnen das CSS-Thema von SOGo \u00e4ndern, indem sie data/conf/sogo/custom-theme.js bearbeiten. Bitte schauen Sie sich die AngularJS Material intro und documentation sowie die material style guideline an, um zu erfahren, wie das funktioniert.

          Sie k\u00f6nnen die mitgelieferte custom-theme.js als Beispiel verwenden, indem Sie die Kommentare entfernen. Nachdem Sie data/conf/sogo/custom-theme.js modifiziert und \u00c4nderungen an Ihrem neuen SOGo-Theme vorgenommen haben, m\u00fcssen Sie

          1. Bearbeiten Sie data/conf/sogo/sogo.conf und f\u00fcgen Sie SOGoUIxDebugEnabled = YES; ein.

          2. SOGo und Memcached Container neu starten, indem man folgenden Befehl ausf\u00fchrt:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow sogo-mailcow\n
          docker-compose restart memcached-mailcow sogo-mailcow\n

          3. SOGo im Browser \u00f6ffnen

          4. \u00f6ffnen Sie die Entwicklerkonsole des Browsers, normalerweise ist die Tastenkombination F12

          5. nur wenn Sie Firefox benutzen: schreiben Sie mit der Hand in die Entwicklerkonsole allow pasting und dr\u00fccken Sie Enter

          6. f\u00fcgen Sie den Java-Script-Schnipsel in die Entwicklungskonsole ein: 

          copy([].slice.call(document.styleSheets)\n  .map(e => e.ownerNode)\n  .filter(e => e.hasAttribute('md-theme-style'))\n  .map(e => e.textInhalt)\n  .join('\\n')\n)\n
          7. \u00d6ffnen Sie den Texteditor und f\u00fcgen Sie die Daten aus der Zwischenablage ein (Strg+V), Sie sollten ein minimiertes CSS erhalten, speichern Sie es

          8. kopieren Sie die CSS-Datei auf den mailcow-Server data/conf/sogo/custom-theme.css

          9. editiere data/conf/sogo/sogo.conf und setze SOGoUIxDebugEnabled = NO;

          10. Anh\u00e4ngen/Erstellen von docker-compose.override.yml mit: 

          services:\n  sogo-mailcow:\n    volumes:\n      - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n
          11. F\u00fchren Sie folgenden Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          12. Neustarten des memcached Containers mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow\n
          docker-compose restart memcached-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#zurucksetzen-auf-das-sogo-standardthema","title":"Zur\u00fccksetzen auf das SOGo Standardthema","text":"
          1. checken Sie data/conf/sogo/custom-theme.js aus, indem Sie git fetch ; git checkout origin/master data/conf/sogo/custom-theme.js data/conf/sogo/custom-theme.js ausf\u00fchren
          2. Suchen Sie in data/conf/sogo/custom-theme.js: 
            // Neue Paletten auf das Standardthema anwenden, einige Farbt\u00f6ne neu zuordnen\n    $mdThemingProvider.theme('default')\n      .primaryPalette('green-cow', {\n        'default': '400', // Hintergrundfarbe der oberen Symbolleisten\n        hue-1': '400',\n        'hue-2': '600', // Hintergrundfarbe der Seitenleiste\n        'hue-3': 'A700'\n      })\n      .accentPalette('green', {\n        'default': '600', // Hintergrundfarbe der Fab-Schaltfl\u00e4chen und des Anmeldebildschirms\n        hue-1': '300', // Hintergrundfarbe der Symbolleiste der mittleren Liste\n        hue-2': '300', // Hervorhebungsfarbe f\u00fcr ausgew\u00e4hlte Nachrichten und den aktuellen Tageskalender\n        hue-3': 'A700'\n      })\n      .backgroundPalette('frost-grey');\n
            und ersetzen Sie es durch: 
                $mdThemingProvider.theme('default');\n
          3. Entfernen Sie aus docker-compose.override.yml Volume Mount in sogo-mailcow: 
            - ./data/conf/sogo/custom-theme.css:/usr/lib/GNUstep/SOGo/WebServerResources/css/theme-default.css:z\n
          4. F\u00fchren Sie folgenden Befehl aus:
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          1. Starten Sie memcached neu mit:
          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow\n
          docker-compose restart memcached-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#favicon-andern","title":"Favicon \u00e4ndern","text":"

          mailcow-Builds nach dem 31. Januar 2021 k\u00f6nnen SOGo's Favicon \u00e4ndern, indem sie data/conf/sogo/custom-favicon.ico f\u00fcr SOGo und data/web/favicon.png f\u00fcr mailcow UI ersetzen.

          Anmerkung: Sie k\u00f6nnen .png Favicons f\u00fcr SOGo verwenden, indem Sie sie in custom-favicon.ico umbenennen. F\u00fcr beide, SOGo und mailcow UI Favicons, m\u00fcssen Sie eine der Standardgr\u00f6\u00dfen verwenden: 16x16, 32x32, 64x64, 128x128 und 256x256. Nachdem Sie diese Datei ersetzt haben, m\u00fcssen Sie SOGo und Memcached Container neu starten, indem Sie folgenden Befehl ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow sogo-mailcow\n
          docker-compose restart memcached-mailcow sogo-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#logo-andern","title":"Logo \u00e4ndern","text":"

          mailcow-Builds nach dem 21. Dezember 2018 k\u00f6nnen das SOGo-Logo \u00e4ndern, indem sie die Datei data/conf/sogo/sogo-full.svg ersetzen oder erstellen (falls sie fehlt). Nachdem Sie diese Datei ersetzt haben, m\u00fcssen Sie SOGo und Memcached Container neu starten, indem Sie folgendes ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow sogo-mailcow\n
          docker-compose restart memcached-mailcow sogo-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#domains-verbinden-untereinander-sichtbar-machen","title":"Domains verbinden (untereinander sichtbar machen)","text":"

          Domains sind normalerweise voneinander isoliert.

          Sie k\u00f6nnen das \u00e4ndern, indem Sie data/conf/sogo/sogo.conf modifizieren:

          Suche... 

             // SOGoDomainsVisibility = (\n    // (domain1.tld, domain5.tld),\n    // (domain3.tld, domain2.tld)\n    // );\n
          ...und ersetzen Sie diese durch - zum Beispiel:

              SOGoDomainsVisibility = (\n      (beispiel.org, beispiel.com, beispiel.net)\n    );\n

          SOGo neu starten:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart sogo-mailcow\n
          docker-compose restart sogo-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#aktivieren-der-passwortanderung-in-sogo","title":"Aktivieren der Passwort\u00e4nderung in SOGo","text":"

          Die M\u00f6glichkeit ihr Passwort in SOGo zu \u00e4ndern wurde standardm\u00e4\u00dfig deaktiviert, da:

          • es nicht die Passwortrichtlinien der mailcow UI beachten kann.
          • es nicht funktioniert, wenn ein User sich direkt in SOGo angemeldet hat (\u00fcber die mailcow UI) In Webmail einloggen (Auth Proxy)

          Sollten Sie diese Funktion dennoch aktiviert haben wollen bearbeiten Sie einfach data/conf/sogo/sogo.conf und \u00e4ndern SOGoPasswordChangeEnabled zu YES. Bitte hier keine anderen Parameter au\u00dfer YES oder NO verwenden.

          Anschlie\u00dfend SOGo neustarten:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart memcached-mailcow sogo-mailcow\n
          docker-compose restart memcached-mailcow sogo-mailcow\n
          "},{"location":"de/manual-guides/SOGo/u_e-sogo/#totp-zurucksetzen-totp-deaktivieren","title":"TOTP zur\u00fccksetzen / TOTP deaktivieren","text":"

          F\u00fchren Sie folgenden Befehl aus dem mailcow Verzeichnis aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
          docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoTOTPEnabled '{\"SOGoTOTPEnabled\":0}'\n
          "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/","title":"Verwendung eines externen DNS-Dienstes","text":"

          Wenn Sie einen externen DNS-Dienst verwenden wollen oder m\u00fcssen, k\u00f6nnen Sie entweder einen Forwarder in Unbound einstellen oder eine Override-Datei kopieren, um externe DNS-Server zu definieren:

          Warnung

          Bitte verwenden Sie keinen \u00f6ffentlichen Resolver, wie wir es im obigen Beispiel getan haben. Viele - wenn nicht sogar alle - Blacklist-Lookups werden mit \u00f6ffentlichen Resolvern fehlschlagen, da der Blacklist-Server Grenzen hat, wie viele Anfragen von einer IP gestellt werden k\u00f6nnen und \u00f6ffentliche Resolver diese Grenzen normalerweise erreichen. Wichtig: Nur DNSSEC-validierende DNS-Dienste werden funktionieren.

          "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/#methode-a-unbound","title":"Methode A, Unbound","text":"

          Bearbeiten Sie data/conf/unbound/unbound.conf und f\u00fcgen Sie die folgenden Parameter hinzu:

          forward-zone:\n  name: \".\"\n  forward-addr: 8.8.8.8 # VERWENDEN SIE KEINE \u00d6FFENTLICHEN DNS-SERVER - NUR EIN BEISPIEL\n  forward-addr: 8.8.4.4 # VERWENDET KEINE \u00d6FFENTLICHEN DNS-SERVER - NUR EIN BEISPIEL\n

          Unbound neu starten:

          docker compose (Plugin)docker-compose (Standalone) 
            docker compose restart unbound-mailcow\n
            docker-compose restart unbound-mailcow\n
          "},{"location":"de/manual-guides/Unbound/u_e-unbound-fwd/#methode-b-uberschreiben-der-datei","title":"Methode B, \u00dcberschreiben der Datei","text":"
          cd /opt/mailcow-dockerized\ncp helper-scripts/docker-compose.override.yml.d/EXTERNAL_DNS/docker-compose.override.yml .\n

          Bearbeiten Sie docker-compose.override.yml und passen Sie die IP an.

          Stoppen und starten Sie bitte im Anschluss noch den Docker Stack:

          docker compose (Plugin)docker-compose (Standalone) 
            docker compose down\n  docker compose up -d\n
            docker-compose down\n  docker-compose up -d\n
          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/","title":"Thresholds","text":"

          Watchdog verwendet Standardwerte f\u00fcr alle in docker-compose.yml definierten Thresholde.

          Die Standardwerte sind f\u00fcr die meisten Konfigurationen geeignet. Beispiel: 

          - NGINX_THRESHOLD=${NGINX_THRESHOLD:-5}\n- UNBOUND_THRESHOLD=${UNBOUND_THRESHOLD:-5}\n- REDIS_THRESHOLD=${REDIS_THRESHOLD:-5}\n- MYSQL_THRESHOLD=${MYSQL_THRESHOLD:-5}\n- MYSQL_REPLICATION_THRESHOLD=${MYSQL_REPLICATION_THRESHOLD:-1}\n- SOGO_THRESHOLD=${SOGO_THRESHOLD:-3}\n- POSTFIX_THRESHOLD=${POSTFIX_THRESHOLD:-8}\n- CLAMD_THRESHOLD=${CLAMD_THRESHOLD:-15}\n- DOVECOT_THRESHOLD=${DOVECOT_THRESHOLD:-12}\n- DOVECOT_REPL_THRESHOLD=${DOVECOT_REPL_THRESHOLD:-20}\n- PHPFPM_THRESHOLD=${PHPFPM_THRESHOLD:-5}\n- RATELIMIT_THRESHOLD=${RATELIMIT_THRESHOLD:-1}\n- FAIL2BAN_THRESHOLD=${FAIL2BAN_THRESHOLD:-1}\n- ACME_THRESHOLD=${ACME_THRESHOLD:-1}\n- RSPAMD_THRESHOLD=${RSPAMD_THRESHOLD:-5}\n- OLEFY_THRESHOLD=${OLEFY_THRESHOLD:-5}\n- MAILQ_THRESHOLD=${MAILQ_THRESHOLD:-20}\n- MAILQ_CRIT=${MAILQ_CRIT:-30}\n

          Um sie anzupassen, f\u00fcgen Sie einfach die notwendigen Threshold Variablen (z.B. MAILQ_THRESHOLD=10) zu mailcow.conf hinzu und f\u00fchren Sie den folgenden Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#threshold-beschreibungen","title":"Threshold Beschreibungen","text":""},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#nginx_threshold","title":"NGINX_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu Nginx auf Port 8081 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#unbound_threshold","title":"UNBOUND_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn Unbound externe Dom\u00e4nen/DNSSEC nicht aufl\u00f6sen/\u00fcberpr\u00fcfen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#redis_threshold","title":"REDIS_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn der Watchdog keine Verbindung zu Redis auf Port 6379 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_threshold","title":"MYSQL_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn watchdog keine Verbindung zu MySQL herstellen kann oder eine Tabelle nicht abfragen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mysql_replication_threshold","title":"MYSQL_REPLICATION_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn die MySQL-Replikation fehlschl\u00e4gt.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#sogo_threshold","title":"SOGO_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn der Watchdog keine Verbindung zu SOGo auf Port 20000 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#postfix_threshold","title":"POSTFIX_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn watchdog keine Testmail \u00fcber Port 589 senden kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#clamd_threshold","title":"CLAMD_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu Clamd herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_threshold","title":"DOVECOT_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn watchdog bei verschiedenen Tests mit dem Dovecot-Container fehlschl\u00e4gt. Der Container wird automatisch neu gestartet, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#dovecot_repl_threshold","title":"DOVECOT_REPL_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn die Dovecot-Replikation fehlschl\u00e4gt.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#phpfpm_threshold","title":"PHPFPM_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn Watchdog keine Verbindung zu PHP-FPM auf Port 9001/9002 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#ratelimit_threshold","title":"RATELIMIT_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn ein Ratelimit erreicht wurde.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#fail2ban_threshold","title":"FAIL2BAN_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn ein fail2ban eine IP gesperrt hat.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#acme_threshold","title":"ACME_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn etwas mit dem acme-mailcow-Container nicht in Ordnung ist. Sie k\u00f6nnen dessen Logs \u00fcberpr\u00fcfen.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#rspamd_threshold","title":"RSPAMD_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn Watchdog bei verschiedenen Tests mit dem Rspamd-Container fehlschl\u00e4gt und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht wurde.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#olefy_threshold","title":"OLEFY_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn watchdog keine Verbindung zu olefy auf Port 10005 herstellen kann und startet den Container automatisch neu, wenn Probleme gefunden wurden und der Threshold erreicht ist.

          "},{"location":"de/manual-guides/Watchdog/u_e-watchdog-thresholds/#mailq_crit-und-mailq_threshold","title":"MAILQ_CRIT und MAILQ_THRESHOLD","text":"

          Benachrichtigt Administratoren, wenn die Anzahl der E-Mails in der Postfix-Warteschlange gr\u00f6\u00dfer ist als MAILQ_CRIT f\u00fcr einen Zeitraum von MAILQ_THRESHOLD * (60\u00b130) Sekunden.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-bl_wl/","title":"Blacklist / Whitelist","text":"

          Um einen Eintrag zu Ihrer domain-weiten Filtertabelle hinzuzuf\u00fcgen oder zu bearbeiten, loggen Sie sich als (Domain-)Administrator in Ihre mailcow UI ein und wechseln Sie zu: Konfiguration > E-Mail-Setup > Domains > (Domain) Bearbeiten > Spamfilter.

          Info

          Seien Sie sich bewusst, dass ein Benutzer diese Einstellung \u00fcberschreiben kann, indem er seine eigene Black- und Whitelist setzt!

          Es ist auch eine globale Filtertabelle in Konfiguration > Server-Konfiguration > Globale Filter-Maps verf\u00fcgbar, um einen server-weiten (also domain\u00fcbergreifenden) Filter f\u00fcr ein oder mehrere Regex-Maps zu konfigurieren (Todo: Screenshots).

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-config/","title":"Konfiguration","text":"

          Mehrere Konfigurationsparameter der mailcow-Benutzeroberfl\u00e4che k\u00f6nnen ge\u00e4ndert werden, indem eine Datei data/web/inc/vars.local.inc.php erstellt wird, die die Standardeinstellungen in data/web/inc/vars.inc.php \u00fcberschreibt.

          Die lokale Konfigurationsdatei ist \u00fcber Updates von mailcow hinweg best\u00e4ndig. Versuchen Sie nicht, die Werte in data/web/inc/vars.inc.php zu \u00e4ndern, sondern verwenden Sie diese als Vorlage f\u00fcr die lokale \u00dcberschreibung.

          mailcow UI Konfigurationsparameter k\u00f6nnen verwendet werden, um...

          • ...die Standardsprache zu \u00e4ndern1
          • ...das Standard-Bootstrap-Theme zu \u00e4ndern
          • ...eine Passwort-Komplexit\u00e4ts-Regex zu setzen
          • ...die Sichtbarkeit des privaten DKIM-Schl\u00fcssels aktivieren
          • ...eine Gr\u00f6\u00dfe f\u00fcr den Paginierungsausl\u00f6ser festlegen
          • ...Standard-Postfach-Attribute festlegen
          • ...Sitzungs-Lebensdauern \u00e4ndern
          • ...feste App-Men\u00fcs erstellen (die nicht in der mailcow UI ge\u00e4ndert werden k\u00f6nnen)
          • ...ein Standard \"To\"-Feld f\u00fcr Relayhost-Tests einstellen
          • ...ein Timeout f\u00fcr Docker API Anfragen setzen
          • ...IP-Anonymisierung umschalten

          1. Um SOGos Standardsprache zu \u00e4ndern, m\u00fcssen Sie data/conf/sogo/sogo.conf bearbeiten und \"English\" durch Ihre bevorzugte Sprache ersetzen.\u00a0\u21a9

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-css/","title":"CSS-\u00dcberschreibungen","text":"

          F\u00fcr benutzerdefinierte \u00dcberschreibungen bestimmter Elemente \u00fcber CSS, verwenden Sie die data/web/css/build/0081-custom-mailcow.css Datei.

          Die Datei wird von der Verfolgung (via Git) ausgeschlossen und bleibt bei Aktualisierungen erhalten.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#wie-wird-uv-in-mailcow-gehandhabt","title":"Wie wird UV in mailcow gehandhabt?","text":"

          Das UV-Flag (wie in \"user verification\") erzwingt, dass WebAuthn den Benutzer verifiziert, bevor es den Zugriff auf den Schl\u00fcssel erlaubt (denken Sie an eine PIN). Wir erzwingen keine UV, um Logins \u00fcber iOS und NFC (YubiKey) zu erm\u00f6glichen.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#login-und-schlussel-verarbeitung","title":"Login und Schl\u00fcssel-Verarbeitung","text":"

          mailcow verwendet Client-seitige Schl\u00fcsselverarbeitung. Wir bitten den Authentifikator (d.h. YubiKey), die Registrierung in seinem Speicher zu speichern.

          Ein Benutzer muss keinen Benutzernamen eingeben. Die verf\u00fcgbaren Anmeldedaten - falls vorhanden - werden dem Nutzer angezeigt, wenn er den \"Schl\u00fcssel-Login\" \u00fcber das mailcow UI Login ausw\u00e4hlt.

          Beim Aufruf des Login-Prozesses werden dem Authentifikator keine Credential-IDs \u00fcbergeben. Dies wird ihn dazu zwingen, die Anmeldeinformationen in seinem eigenen Speicher zu suchen.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/#wer-kann-webauthn-benutzen-um-sich-bei-mailcow-anzumelden","title":"Wer kann WebAuthn benutzen, um sich bei mailcow anzumelden?","text":"

          Ab heute sind nur Administratoren und Domain-Administratoren in der Lage, WebAuthn/FIDO2 einzurichten.

          Sie wollen WebAuthn/Fido als 2FA verwenden? Schauen Sie sich das hier an: Zwei-Faktoren-Authentifizierung

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/","title":"Passwort vergessen Funktion","text":"

          Hinweis

          F\u00fcr dieses Feature ist eine mailcow Installation ab Version 2024-08 erforderlich!

          Der aktuell installierte Patchstand kann in mailcow Versionen seit 2022 innerhalb der UI eingesehen werden.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#vorwort","title":"Vorwort","text":"

          Danke!

          Diese Funktionalit\u00e4t wurde von der Jugendstiftung Baden-W\u00fcrttemberg im Rahmen eines Sponsored Developments im August 2024 in mailcow integriert.

          Vielen Dank f\u00fcr das Sponsoring dieses Features!

          Mit der Passwort-vergessen-Funktion ist es Mailbox-Nutzern m\u00f6glich, durch die Angabe einer Backup-E-Mail-Adresse, sich einen Link zur Zur\u00fccksetzung ihres Passwortes schicken zu lassen und dieses dann zur\u00fcckzusetzen.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#voraussetzungen","title":"Voraussetzungen","text":"

          Damit dieses Feature f\u00fcr einen Benutzer aktiviert und nutzbar ist, sind folgende Dinge zu beachten:

          1. Der mailcow Administrator muss eine Absender E-Mail und einen Betreff (siehe unten) eingestellt haben. Die Absender E-Mail muss nicht als Mailbox existieren, die Domain allerdings muss auf mailcow komplett eingerichtet sein, so dass mit dieser das Senden und vor allem die Zustellung von E-Mails sichergestellt ist.
          2. Der Mailbox-Benutzer muss eine Backup-E-Mail in seinen Optionen hinterlegt haben. Dies kann der User selber tun (wenn die dazugeh\u00f6rige ACL nicht deaktiviert ist) oder der Administrator.
          3. Die Backup-E-Mail sollte eine andere E-Mail sein, als die des Mailkontos, f\u00fcr welches das Passwort zur\u00fcckgesetzt werden soll.
          4. Ebenfalls muss diese Backup-E-Mail externe E-Mails empfangen d\u00fcrfen und sollte (wenn m\u00f6glich) bei einem anderen Anbieter liegen und nicht direkt auf dem mailcow-Server sein. (Dieser Punkt ist allerdings optional und dient nur als Empfehlung).
          5. Der Nutzer muss Zugriff auf das Postfach der Backup-E-Mail haben, da die Links nur eine begrenzte Zeit g\u00fcltig sind.
          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#einstellungsmoglichkeiten-in-der-mailcow-ui","title":"Einstellungsm\u00f6glichkeiten in der mailcow UI","text":""},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#mailbox-einstellungen","title":"Mailbox-Einstellungen","text":"

          Durch dieses Feature wird ein neues Feld in den Mailbox-Optionen hinzugef\u00fcgt:

          Achtung

          Zur Erinnerung: Dieses Feld MUSS ausgef\u00fcllt sein, damit der Benutzer sein Passwort zur\u00fccksetzen kann! Sollte es nicht gesetzt sein, ist es ihm nicht m\u00f6glich, sein Passwort zur\u00fcckzusetzen!

          F\u00fcr Administratoren gibt es eine neue ACL, die entweder pro Mailbox im Nachhinein oder auch als Vorlage f\u00fcr Mailboxen gesetzt werden kann: Verwalten der E-Mail zur Passwortwiederherstellung erlauben:

          Hinweis

          Wenn ein Benutzer bereits eine Backup-E-Mail gesetzt hat, aber der Admin ihm diese ACL entzieht, so kann er trotzdem sein Passwort zur\u00fccksetzen, da die Backup-E-Mail weiterhin im System existiert. Die ACL verbietet dadurch also nicht automatisch die M\u00f6glichkeit, das Passwort zur\u00fcckzusetzen, wenn es eine E-Mail gibt!

          Um dies zu erreichen, muss zus\u00e4tzlich noch die Backup-E-Mail f\u00fcr den Benutzer von einem Administrator entfernt werden.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#server-einstellungen","title":"Server-Einstellungen","text":"

          Der mailcow-Administrator kann (\u00e4hnlich wie die Quota- und Quarant\u00e4ne-Mails) auch f\u00fcr die Passwort-vergessen-E-Mails das Template bearbeiten, wie die Mails dann verschickt werden sollen. Standardm\u00e4\u00dfig ist das Template immer auf Englisch.

          Dieses kann unter dem Reiter: System -> Konfiguration -> Einstellungen -> Passwort-Einstellungen erreicht werden:

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-forgot_password/#versteckte-einstellungen-nicht-in-der-mailcow-ui","title":"Versteckte Einstellungen (nicht in der mailcow UI)","text":"

          Standardm\u00e4\u00dfig kann jeder Nutzer maximal 3 Passwort-Reset-Tokens anfordern, die dann standardm\u00e4\u00dfig 15 Minuten g\u00fcltig sind.

          Server-Administratoren k\u00f6nnen die Ablaufzeit sowie die maximalen Tokens pro Nutzer allerdings konfigurieren.

          Daf\u00fcr muss (falls noch nicht vorhanden) eine Datei namens vars.local.inc.php in dem Ordner MAILCOW_ROOT/data/web/inc angelegt werden.

          Diese muss dann mindestens Folgendes enthalten:

          <?php\n\n// Maximum number of password reset tokens that can be generated at once per user\n$PW_RESET_TOKEN_LIMIT = 3; // Zahl hier ab\u00e4ndern auf einen anderen Wert\n\n// Maximum time in minutes a password reset token is valid\n$PW_RESET_TOKEN_LIFETIME = 15; // Zahl hier ab\u00e4ndern auf einen anderen Wert. Wert in Minuten\n

          Die Datei wird automatisch eingelesen, es ist kein Neustart von mailcow oder einem der Container erforderlich!

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-ban-einstellungen-andern","title":"Netfilter Ban-Einstellungen \u00e4ndern","text":"

          Um die Netfilter Ban-Einstellungen zu \u00e4ndern navigieren Sie zu dem Men\u00fc Punkt: Konfiguration -> Server-Konfiguration -> Konfiguration -> Fail2ban-Parameter.

          Sie sollten dann dieses Fenster sehen:

          Hier k\u00f6nnen Sie verschiedene Optionen f\u00fcr die Banns selbst festlegen. Zum Beispiel die max. Ban-Zeit oder die max. Versuche bevor ein Ban ausgef\u00fchrt wird.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-regex-andern","title":"Netfilter Regex \u00e4ndern","text":"

          Achtung

          Folgender Bereich erfordert zumindest grundlegende Regex kenntnisse. Sollten Sie sich nicht sicher sein, was Sie dort tun, k\u00f6nnen wir Ihnen nur von der Umkonfiguration abraten.

          Sie k\u00f6nnen neben den Sperreinstellungen ebenfalls definieren, was genau aus den Logs der mailcow Container verwendet werden soll um einen m\u00f6glichen Angreifer zu sperren.

          Daf\u00fcr m\u00fcssen Sie das Regex Feld erst einmal aufklappen, was dann in etwa so aussieht:

          Dort k\u00f6nnen Sie nun verschiedenste neue Filter-Regeln anlegen.

          Hinweis

          Mit weiterschreitenden Updates ist es m\u00f6glich, dass neue Netfilter Regex Regeln dazu kommen oder entfernt werden. Sollte das der Fall sein empfiehlt es sich mit einem Klick auf Zur\u00fccksetzen auf Standard die Netfilter Regex Regeln neu laden zu lassen.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-netfilter/#netfilter-entscheidungen-via-url-als-quelle-fur-firewall-blockregeln-bereitstellen","title":"Netfilter Entscheidungen via URL als Quelle f\u00fcr Firewall Blockregeln bereitstellen","text":"

          Hinweis

          Die Option ist jedoch standardm\u00e4\u00dfig deaktiviert und muss erst von Ihnen aktiviert werden.

          Seit dem 2023-12 Update bietet mailcow die M\u00f6glichkeit die Netfilter Entscheidungen als externer Endpoint zu exportieren um die Daten daraus in einem externen Firewall System einbinden zu k\u00f6nnen, Quasi als Blocklisten Quelle.

          Was bringt mir diese Funktion?

          Mit dieser Funktionalit\u00e4t k\u00f6nnen Sie die von Netfilter als gesperrt Markierten IPs an einen Endpunkt weitergeben, welcher diese IPs dann verarbeiten kann. Bspw. eine OPNsense Firewall kann diese Liste dynamisch reinladen.

          Schauen wir uns doch mal diese Einstellungen dazu an:

          Um die generelle Funktion zu aktivieren muss der Haken bei Fail2Ban extern verwalten gesetzt werden.

          Sobald dies getan ist kann die URL (Punkt 2) kopiert werden und in den jeweiligen Endpunkt eingesetzt werden.

          Wichtig

          Die URL kann bei bedarf regeneriert werden. Daf\u00fcr auf das Symbol neben Kopieren Neuladen Symbol klicken.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/","title":"Templates f\u00fcr Benachrichtigungen","text":"

          mailcow verwendet f\u00fcr die Benachrichtigungs-Mails die Template-Engine Jinja. Durch Platzhalter k\u00f6nnen mit diesen Templates dynamische Inhalte erzeugt werden, indem bei der Ausf\u00fchrung diese Platzhalter mit \u00fcbergeben Variablen ersetzt werden. Eine Doku zur Entwicklung von Jinja Templates findet sich hier.

          F\u00fcr die Templates der Benachrichtungs-Emails k\u00f6nnen die folgenden Variablen verwendet werden:

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quarantane-template","title":"Quarant\u00e4ne Template","text":"

          Die bereitgestellten Variablen k\u00f6nnen auch auf GitHub aus dem Script dovecot/quarantine_notify.py entnommen werden.

          Info

          Das Template f\u00fcr die Qarant\u00e4ne Mails kann man als Administrator in der Benutzeroberfl\u00e4che in den globalen Quarant\u00e4ne-Einstellungen bearbeiten und dort ebenso das Standard Template wiederherstellen. Code Beispiele kann man dem Standard Template entnehmen. Es kann auch auf GitHub eingesehen werden.

          Name Inhalt username E-Mail Adresse des Mailbox Benutzers counter Anzahl der Nachrichten in der Quarant\u00e4ne, \u00fcber die in dieser Mail benachrichtigt wird hostname Name der Mailcow Instanz (Siehe auch die Umgebungsvariable MAILCOW_HOSTNAME) quarantine_acl Einstellung der Quarant\u00e4ne ACL des Benutzers (Berechtigung zur Bearbeitung von Mails in der Quarant\u00e4ne) meta Array/Liste aller Nachrichten/Eintr\u00e4ge in der Quarant\u00e4ne, \u00fcber die benachrichtigt wird meta.qhash Hashwert des Quarant\u00e4ne Eintrags (Bspw f\u00fcr Direktlink zur Nachricht in der Quarant\u00e4ne) meta.id ID des Quarant\u00e4ne Eintrags meta.subject Titel der E-Mail des Quarant\u00e4ne Eintrags meta.score Spam Score der E-Mail des Quarant\u00e4ne Eintrags meta.sender Absender Adresse der E-Mail des Quarant\u00e4ne Eintrags meta.created Datum der Erstellung des Quarant\u00e4ne Eintrags, bzw Empfang der E-Mail meta.action Aktion des Spamfilters (Verschoben in Spam-Ordner oder in die Quarant\u00e4ne)"},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-notification-templates/#quota-template","title":"Quota Template","text":"

          Die bereitgestellten Variablen k\u00f6nnen auch auf GitHub aus dem Script dovecot/quota_notify.py entnommen werden.

          Info

          Das Template f\u00fcr die Quota Mails kann man als Administrator in der Benutzeroberfl\u00e4che in den Quota-Einstellungen bearbeiten und dort ebenso das Standard Template wiederherstellen. Code Beispiele kann man dem Standard Template entnehmen. Es kann auch auf GitHub eingesehen werden.

          Name Inhalt username E-Mail Adresse des Mailbox Benutzers percent Prozentualer Anteil des belegten Speicherplatzes der Mailbox"},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-pushover/","title":"Pushover","text":"

          Info

          Pushover macht es einfach, Echtzeit-Benachrichtigungen auf Ihrem Android, iPhone, iPad und Desktop zu erhalten

          Sie k\u00f6nnen Pushover verwenden, um eine Push-Benachrichtigung \u00fcber jede E-Mail zu erhalten, die Sie f\u00fcr jede Mailbox erhalten, in der Sie diese Funktion aktiviert haben.

          1. \u00d6ffnen Sie als Administrator die Einstellungen Ihres Postfachs und scrollen Sie nach unten zu den Pushover-Einstellungen

          2. Registrieren Sie sich bei Pushover

          3. Geben Sie Ihren \"Benutzerschl\u00fcssel\" in das Feld \"Benutzer-/Gruppenschl\u00fcssel\" in den Einstellungen Ihres Postfachs ein

          4. Erstellen Sie eine Anwendung, um das API-Token/den API-Schl\u00fcssel zu erhalten, das/den Sie ebenfalls in Ihre Postfacheinstellungen eintragen m\u00fcssen.

          5. Optional k\u00f6nnen Sie den Titel/Text der Benachrichtigung bearbeiten und bestimmte Absender-E-Mail-Adressen festlegen, bei denen eine Push-Benachrichtigung ausgel\u00f6st wird

          6. Speichern Sie alles und \u00fcberpr\u00fcfen Sie dann Ihre Anmeldedaten.

          Wenn alles erledigt ist, k\u00f6nnen Sie testen, ob Sie eine E-Mail senden k\u00f6nnen, und Sie erhalten eine Push-Nachricht auf Ihrem Telefon

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-spamalias/","title":"Tempor\u00e4re E-Mail-Aliase","text":"

          Diese tempor\u00e4ren E-Mail-Aliasnamen werden meist dort verwendet, wo wir eine E-Mail-Adresse angeben m\u00fcssen, aber keine weitere E-Mails w\u00fcnschen. Sie werden auch Spam-Alias genannt.

          Um ein tempor\u00e4res E-Mail-Alias zu erstellen, zu l\u00f6schen oder zu erweitern, m\u00fcssen Sie sich in mailcow's UI als Mailbox-Nutzer anmelden und zum Reiter Tempor\u00e4re E-Mail-Aliase navigieren:

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-spamfilter/","title":"Spamfilter","text":"

          Ein Mailbox-Nutzer kann den Spam-Filter und die Black-/Whitelist-Einstellungen f\u00fcr seine Mailbox individuell anpassen, indem er zum Reiter Spam-Filter in der mailcow-Benutzeroberfl\u00e4che navigiert.

          Info

          F\u00fcr globale Einstellungen Ihres Spamfilters lesen Sie bitte unseren Abschnitt \u00fcber Rspamd. F\u00fcr eine domainweite Black- und Whitelist lesen Sie bitte unsere Anleitung zu Black / Whitelist

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/","title":"Sub-Adressierung","text":"

          Mailbox-Nutzer k\u00f6nnen ihre Mailadresse wie in \"me+facebook@example.org\" markieren. Sie k\u00f6nnen die Tag-Behandlung im mailcow UI Panel (f\u00fcr den Benutzer) unter Mailbox > Einstellungen kontrollieren.

          Sub-Adressierung (RFC 5233) oder Plus-Adressierung auch als Tagging bekannt (nicht zu verwechseln mit Tags)

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-sub_addressing/#verfugbare-aktionen","title":"Verf\u00fcgbare Aktionen","text":"

          1. Diese Nachricht in einen Unterordner \"facebook\" verschieben (wird in Kleinbuchstaben erstellt, falls nicht vorhanden)

          2. Den Tag dem Betreff voranstellen: \"[facebook] Betreff\"

          Bitte beachten Sie: Gro\u00dfgeschriebene Tags werden in Kleinbuchstaben umgewandelt, mit Ausnahme des ersten Buchstabens. Wenn Sie den Tag so lassen wollen, wie er ist, wenden Sie bitte den folgenden Diff an und starten Sie mailcow neu: 

          diff --git a/data/conf/dovecot/global_sieve_after b/data/conf/dovecot/global_sieve_after\nindex e047136e..933c4137 100644\n--- a/data/conf/dovecot/global_sieve_after\n+++ b/data/conf/dovecot/global_sieve_after\n@@ -15,7 +15,7 @@ if allof (\n   envelope :detail :matches \"to\" \"*\",\n   header :contains \"X-Moo-Tag\" \"YES\"\n   ) {\n-  set :lower :upperfirst \"tag\" \"${1}\";\n+  set \"tag\" \"${1}\";\n   if mailboxexists \"INBOX/${1}\" {\n     fileinto \"INBOX/${1}\";\n   } else {\n

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/","title":"Tags (f\u00fcr Domains und Mailboxen)","text":"

          Hinweis

          Um diese Funktion nutzen zu k\u00f6nnen ist das Update 2022-05 (oder h\u00f6her) erforderlich! Sollten Sie das Update nicht installiert haben, denken Sie bitte \u00fcber ein Update nach. F\u00fcr weitere Informationen bez\u00fcglich dem Update Prozess schauen Sie hier.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wofur-wurden-die-tags-implementiert","title":"Wof\u00fcr wurden die Tags implementiert?","text":"

          Mit den Tags ist es deutlich einfacher gezielt nach Domains bzw. Mailboxen zu suchen (wenn diese einen Tag haben).

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wo-lassen-sich-die-tags-finden","title":"Wo lassen sich die Tags finden?","text":"

          Die Tags befinden sich in der Domain/Mailbox Sektion der mailcow UI. Um sie zu sehen, klicken Sie einfach auf das kleine Plus-Symbol auf der linken Seite Ihrer Domain/Mailbox (das folgende Bild zeigt das Domain-Ribbon-Men\u00fc):

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wie-kann-ich-ein-tag-hinzufugenentfernen","title":"Wie kann ich ein Tag hinzuf\u00fcgen/entfernen?","text":"

          Sie k\u00f6nnen bei der Erstellung einer neuen Domain/eines neuen Postfachs einfach ein Tag hinzuf\u00fcgen/entfernen. Sie k\u00f6nnen sie auch hinzuf\u00fcgen/entfernen, wenn Sie Ihre gew\u00fcnschte Domain/Mailbox bearbeiten.

          Es sieht \u00e4hnlich aus wie hier (das folgende Bild zeigt den Bereich zur Bearbeitung der Dom\u00e4ne):

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tags/#wie-kann-ich-nach-einem-tag-suchen","title":"Wie kann ich nach einem Tag suchen?","text":"

          Geben Sie einfach den Tag-Namen in die Suchleiste im Bereich Domain/Postfach ein und warten Sie, bis der Vorgang abgeschlossen ist.

          Sie k\u00f6nnen sogar angeben, ob Sie nur nach Tags suchen m\u00f6chten.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/","title":"Zwei-Faktor Authentifizierung","text":"

          Bislang sind drei Methoden f\u00fcr die Zwei-Faktor-Authentifizierung implementiert: WebAuthn (ersetzt seit Februar 2022 U2F), Yubi OTP und TOTP

          • Damit WebAuthn funktioniert, ben\u00f6tigen Sie eine verschl\u00fcsselte Verbindung zum Server (HTTPS) sowie einen FIDO-Sicherheitsschl\u00fcssel.
          • Sowohl WebAuthn als auch Yubi OTP funktionieren gut mit dem fantastischen Yubikey.
          • W\u00e4hrend Yubi OTP eine aktive Internetverbindung und eine API ID + Schl\u00fcssel ben\u00f6tigt, funktioniert WebAuthn mit jedem Fido Security Key, kann aber nur verwendet werden, wenn der Zugriff auf mailcow \u00fcber HTTPS erfolgt.
          • WebAuthn und Yubi OTP unterst\u00fctzen mehrere Schl\u00fcssel pro Nutzer.
          • Als dritte TFA-Methode verwendet mailcow TOTP: zeitbasierte Einmal-Passw\u00f6rter. Diese Passw\u00f6rter k\u00f6nnen mit Apps wie \"Google Authenticator\" generiert werden, nachdem zun\u00e4chst ein QR-Code gescannt oder das gegebene Geheimnis manuell eingegeben wurde.

          Als Administrator k\u00f6nnen Sie den TFA-Login eines Domain-Administrators vor\u00fcbergehend deaktivieren, bis dieser sich erfolgreich eingeloggt hat.

          Der f\u00fcr die Anmeldung verwendete Schl\u00fcssel wird in gr\u00fcner Farbe angezeigt, w\u00e4hrend andere Schl\u00fcssel grau bleiben.

          Informationen zum Entfernen von 2FA finden Sie hier.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#yubi-otp","title":"Yubi OTP","text":"

          Die Yubi API ID und der Schl\u00fcssel werden mit der Yubico Cloud API abgeglichen. Bei der Einrichtung von TFA werden Sie nach Ihrem pers\u00f6nlichen API-Konto f\u00fcr diesen Schl\u00fcssel gefragt. Die API-ID, der API-Schl\u00fcssel und die ersten 12 Zeichen (Ihre YubiKeys ID in modhex) werden in der MySQL-Tabelle als Geheimnis gespeichert.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#beispiel-einrichtung","title":"Beispiel-Einrichtung","text":"

          Als erstes muss der YubiKey f\u00fcr die Verwendung als OTP-Generator konfiguriert werden. Laden Sie dazu den YubiKey Manager von der Yubico Website herunter: hier

          Im Folgenden konfigurieren Sie den YubiKey f\u00fcr OTP. \u00dcber den Men\u00fcpunkt Anwendungen -> OTP und einem Klick auf den Konfigurieren Button. W\u00e4hlen Sie im folgenden Men\u00fc Credential Type -> Yubico OTP und klicken Sie auf Next.

          Setzen Sie ein H\u00e4kchen in die Checkbox Use serial, generieren Sie eine Private ID und einen Secret key \u00fcber die Schaltfl\u00e4chen. Damit der YubiKey sp\u00e4ter validiert werden kann, muss auch das H\u00e4kchen in der Upload Checkbox gesetzt werden und klicken Sie dann auf Finish.

          Nun \u00f6ffnet sich ein neues Browserfenster, in dem Sie unten im Formular ein OTP Ihres YubiKey eingeben m\u00fcssen (auf das Feld klicken und dann auf Ihren YubiKey tippen). Best\u00e4tigen Sie das Captcha und laden Sie die Daten auf den Yubico-Server hoch, indem Sie auf 'Hochladen' klicken. Die Verarbeitung der Daten wird einen Moment dauern.

          Nachdem die Generierung erfolgreich war, werden Ihnen eine Client ID und ein Secret key angezeigt, notieren Sie sich diese Informationen an einem sicheren Ort.

          Nun k\u00f6nnen Sie Yubico OTP-Authentifizierung aus dem Dropdown-Men\u00fc in der mailcow UI auf der Startseite unter Zugang -> Zwei-Faktor-Authentifizierung ausw\u00e4hlen. In dem sich nun \u00f6ffnenden Dialog k\u00f6nnen Sie einen Namen f\u00fcr diesen YubiKey eingeben und die zuvor notierte Client ID sowie den Secret key in die vorgesehenen Felder eintragen. Geben Sie schlie\u00dflich Ihr aktuelles Kontopasswort ein und ber\u00fchren Sie nach Auswahl des Feldes Touch Yubikey die Schaltfl\u00e4che Ihres YubiKey.

          Herzlichen Gl\u00fcckwunsch! Sie k\u00f6nnen sich nun mit Ihrem YubiKey in die mailcow UI einloggen!

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#webauthn-u2f-ersatz","title":"WebAuthn (U2F, Ersatz)","text":"

          Warnung

          Seit Februar 2022 hat Google Chrome die Unterst\u00fctzung f\u00fcr U2F aufgegeben und die Verwendung von WebAuthn standardisiert. Die WebAuthn API (der Ersatz f\u00fcr U2F) ist seit dem 21. Januar 2022 Teil von mailcow, wenn Sie also den Key \u00fcber Februar 2022 hinaus nutzen wollen, sollten Sie ein Update mit der update.sh in Betracht ziehen.

          Um WebAuthn zu nutzen, muss der Browser diesen Standard unterst\u00fctzen:

          • Edge (>=18)
          • Firefox (>=60)
          • Chrome (>=67)
          • Safari (>=13)
          • Opera (>=54)

          Die folgenden mobilen Browser unterst\u00fctzen diesen Authentifizierungstyp:

          • Safari auf iOS (>=14.5)
          • Android-Browser (>=97)
          • Opera Mobil (>=64)
          • Chrome f\u00fcr Android (>=97)

          Quellen: caniuse.com, blog.mozilla.org

          WebAuthn funktioniert auch ohne Internetverbindung.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#was-passiert-mit-meinem-registrierten-fido-security-key-nach-dem-update-von-u2f-auf-webauthn","title":"Was passiert mit meinem registrierten Fido Security Key nach dem Update von U2F auf WebAuthn?","text":"

          Warnung

          Mit dem neuen U2F-Ersatz (WebAuthn) m\u00fcssen Sie Ihren Fido Security Key neu registrieren, zum Gl\u00fcck ist WebAuthn abw\u00e4rtskompatibel und unterst\u00fctzt das U2F-Protokoll.

          Im Idealfall sollten Sie beim n\u00e4chsten Einloggen (mit dem Schl\u00fcssel) ein Textfeld erhalten, das besagt, dass Ihr Fido Security Key aufgrund des Updates auf WebAuthn entfernt und als 2-Faktor-Authentifikator gel\u00f6scht wurde.

          Aber keine Sorge! Sie k\u00f6nnen Ihren bestehenden Schl\u00fcssel einfach neu registrieren und ihn wie gewohnt verwenden. Sie werden wahrscheinlich nicht einmal einen Unterschied bemerken, au\u00dfer dass Ihr Browser die U2F-Deaktivierungsmeldung nicht mehr anzeigt.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#deaktivieren-inoffizieller-unterstutzter-fido-security-keys","title":"Deaktivieren inoffizieller unterst\u00fctzter Fido Security Keys","text":"

          Mit WebAuthn gibt es die M\u00f6glichkeit, nur offizielle Fido Security Keys zu verwenden (von den gro\u00dfen Marken wie: Yubico, Apple, Nitro, Google, Huawei, Microsoft, usw.) zu verwenden.

          Dies dient in erster Linie der Sicherheit, da es Administratoren erm\u00f6glicht, sicherzustellen, dass nur offizielle Hardware in ihrer Umgebung verwendet werden kann.

          Um diese Funktion zu aktivieren, \u00e4ndern Sie den Wert WEBAUTHN_ONLY_TRUSTED_VENDORS in mailcow.conf von n auf y und starten Sie die betroffenen Container mit dem folgenden Befehl neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Die mailcow wird nun die Vendor-Zertifikate verwenden, die sich in Ihrem mailcow-Verzeichnis unter data/web/inc/lib/WebAuthn/rootCertificates befinden.

          Beispiel

          Wenn Sie die offiziellen Hersteller-Ger\u00e4te nur auf Apple beschr\u00e4nken wollen, brauchen Sie nur das Apple Hersteller-Zertifikat im data/web/inc/lib/WebAuthn/rootCertificates. Nachdem Sie alle anderen Zertifikate gel\u00f6scht haben, k\u00f6nnen Sie WebAuthn 2FA nur noch mit Apple-Ger\u00e4ten aktivieren.

          Das ist f\u00fcr jeden Hersteller gleich, also w\u00e4hlen Sie aus, was Ihnen gef\u00e4llt (wenn Sie wollen).

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#eigene-zertifikate-fur-webauthn-verwenden","title":"Eigene Zertifikate f\u00fcr WebAuthn verwenden","text":"

          Wenn Sie ein g\u00fcltiges Zertifikat vom Hersteller eines Schl\u00fcssels haben, k\u00f6nnen Sie es auch zu ihrer mailcow hinzuf\u00fcgen!

          Kopieren Sie einfach das Zertifikat in den data/web/inc/lib/WebAuthn/rootCertificates Ordner und starten Sie Ihre mailcow neu.

          Nun sollten Sie in der Lage sein, auch dieses Ger\u00e4t zu registrieren, obwohl die \u00dcberpr\u00fcfung f\u00fcr die Herstellerzertifikate aktiviert ist, da Sie das Zertifikat manuell hinzugef\u00fcgt haben.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#ist-es-gefahrlich-den-vendor-check-deaktiviert-zu-lassen","title":"Ist es gef\u00e4hrlich, den Vendor Check deaktiviert zu lassen?","text":"

          Nein, das ist es nicht! Diese Herstellerzertifikate werden nur zur \u00dcberpr\u00fcfung der Originalhardware verwendet, nicht zur Absicherung des Registrierungsprozesses.

          Wie Sie in diesen Artikeln lesen k\u00f6nnen, hat die Deaktivierung nichts mit der Software-Sicherheit zu tun:

          • https://developers.yubico.com/U2F/Attestation_and_Metadata/
          • https://medium.com/webauthnworks/webauthn-fido2-demystifying-attestation-and-mds-efc3b3cb3651
          • https://medium.com/webauthnworks/sorting-fido-ctap-webauthn-terminology-7d32067c0b01

          Letztendlich ist es aber nat\u00fcrlich Ihre Entscheidung, ob Sie dieses H\u00e4kchen deaktiviert oder aktiviert lassen.

          "},{"location":"de/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/#totp","title":"TOTP","text":"

          Die bekannteste TFA-Methode, die meist mit einem Smartphone verwendet wird.

          Um die TOTP-Methode einzurichten, loggen Sie sich in die Admin UI ein und w\u00e4hlen Sie Time-based OTP (TOTP) aus der Liste.

          Nun \u00f6ffnet sich ein Modal, in dem Sie einen Namen f\u00fcr Ihr 2FA-\"Ger\u00e4t\" (Beispiel: John Deer's Smartphone) und das Passwort des betroffenen Admin-Kontos (mit dem Sie derzeit eingeloggt sind) eingeben m\u00fcssen.

          Sie haben zwei verschiedene Methoden, um TOTP f\u00fcr Ihr Konto zu registrieren: 1. Scannen Sie den QR-Code mit Ihrer Authenticator App auf einem Smartphone oder Tablet. 2. Verwenden Sie den TOTP-Code (unter dem QR-Code) in Ihrem TOTP-Programm oder Ihrer App (wenn Sie keinen QR-Code scannen k\u00f6nnen).

          Nachdem Sie den QR- oder TOTP-Code in der TOTP-App/dem TOTP-Programm Ihrer Wahl registriert haben, m\u00fcssen Sie nur noch den nun generierten TOTP-Token (in der App/dem Programm) als Best\u00e4tigung in der mailcow UI eingeben, um die TOTP 2FA endg\u00fcltig zu aktivieren, ansonsten wird sie nicht aktiviert, obwohl der TOTP-Token bereits in Ihrer App/ Ihrem Programm generiert wurde.

          "},{"location":"de/models/model-acl/","title":"ACL","text":"

          Die Bearbeitung eines Dom\u00e4nenadministrators oder eines Mailboxbenutzers erm\u00f6glicht es, Einschr\u00e4nkungen f\u00fcr dieses Konto festzulegen.

          Wichtig: Bei sich \u00fcberschneidenden Modulen wie Synchronisierungsauftr\u00e4gen, auf die sowohl Dom\u00e4nenadministratoren als auch Mailbox-Benutzer Zugriff erhalten k\u00f6nnen, werden die Rechte des Dom\u00e4nenadministrators geerbt, wenn man sich als Mailbox-Benutzer anmeldet.

          Einige Beispiele:

          1.

          • Ein Dom\u00e4nenadministrator hat keinen Zugriff auf Synchronisierungsauftr\u00e4ge, kann sich aber als Mailbox-Benutzer anmelden
          • Wenn er sich als Mailbox-Benutzer anmeldet, erh\u00e4lt er keinen Zugriff auf Synchronisierungsauftr\u00e4ge, auch wenn der betreffende Mailbox-Benutzer bei der direkten Anmeldung Zugriff hat.

          2.

          • Ein Dom\u00e4nenadministrator hat Zugriff auf Synchronisierungsauftr\u00e4ge und kann sich als Postfachbenutzer anmelden
          • Der Mailbox-Benutzer, als der er sich anzumelden versucht, hat keinen Zugang zu Synchronisierungsauftr\u00e4gen
          • Der Dom\u00e4nenadministrator, der nun als Mailbox-Benutzer angemeldet ist, erbt die Berechtigung des Mailbox-Benutzers und kann auf Synchronisierungsauftr\u00e4ge zugreifen.

          3.

          • Ein Dom\u00e4nenadministrator meldet sich als Mailbox-Benutzer an
          • Jede Berechtigung, die nicht in der ACL eines Dom\u00e4nenadministrators vorhanden ist, wird automatisch gew\u00e4hrt (Beispiel: zeitlich begrenzter Alias, TLS-Richtlinie usw.)
          "},{"location":"de/models/model-passwd/","title":"Passwort-Hashing","text":""},{"location":"de/models/model-passwd/#vollstandig-unterstutzte-hashing-methoden","title":"Vollst\u00e4ndig unterst\u00fctzte Hashing-Methoden","text":"

          Die aktuellste Version von mailcow unterst\u00fctzt die folgenden Hashing-Methoden vollst\u00e4ndig. Die Standard-Hashing-Methode ist fett geschrieben:

          • BLF-CRYPT
          • SSHA
          • SSHA256
          • SSHA512

          Die obigen Methoden k\u00f6nnen in mailcow.conf als MAILCOW_PASS_SCHEME Wert verwendet werden.

          "},{"location":"de/models/model-passwd/#nur-lese-hashing-methoden","title":"Nur-Lese-Hashing-Methoden","text":"

          Die folgenden Methoden werden nur lesend unterst\u00fctzt. Wenn Sie planen, SOGo zu benutzen (wie standardm\u00e4\u00dfig), ben\u00f6tigen Sie eine SOGo-kompatible Hash-Methode. Bitte beachten Sie den Hinweis am Ende dieser Seite, wie Sie die Ansicht bei Bedarf aktualisieren k\u00f6nnen. Wenn SOGo deaktiviert ist, k\u00f6nnen alle unten aufgef\u00fchrten Hashing-Methoden von mailcow und Dovecot gelesen werden.

          • ARGON2I (SOGo kompatibel)
          • ARGON2ID (SOGo kompatibel)
          • CLEAR
          • CLEARTEXT
          • CRYPT (SOGo-kompatibel)
          • DES-CRYPT
          • LDAP-MD5 (SOGo-kompatibel)
          • MD5 (SOGo-kompatibel)
          • MD5-CRYPT (SOGo-kompatibel)
          • PBKDF2 (SOGo-kompatibel)
          • PLAIN (SOGo-kompatibel)
          • PLAIN-MD4
          • PLAIN-MD5
          • PLAIN-TRUNC
          • SHA (SOGo-kompatibel)
          • SHA1 (SOGo-kompatibel)
          • SHA256 (SOGo-kompatibel)
          • SHA256-CRYPT (SOGo-kompatibel)
          • SHA512 (SOGo-kompatibel)
          • SHA512-CRYPT (SOGo-kompatibel)
          • SMD5 (SOGo kompatibel)

          Das bedeutet, mailcow ist in der Lage, Nutzer mit einem Hash wie {MD5}1a1dc91c907325c69271ddf0c944bc72 aus der Datenbank zu verifizieren.

          Der Wert von MAILCOW_PASS_SCHEME wird immer verwendet, um neue Passw\u00f6rter zu verschl\u00fcsseln.

          Ich habe die Passwort-Hashes in der SQL-Tabelle \"Mailbox\" ge\u00e4ndert und kann mich nicht anmelden.

          Eine \"Ansicht\" muss aktualisiert werden. Sie k\u00f6nnen dies durch einen Neustart von sogo-mailcow ausl\u00f6sen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart sogo-mailcow\n
          docker-compose restart sogo-mailcow\n
          "},{"location":"de/models/model-sender_rcv/","title":"Sender- und Empf\u00e4ngermodell","text":"

          Wenn eine Mailbox erstellt wird, kann ein Benutzer Mails von seiner eigenen Mailboxadresse senden und empfangen.

          Die Mailbox me@example.org wird erstellt. example.org ist eine prim\u00e4re Dom\u00e4ne.\nHinweis: Eine Mailbox kann nicht in einer Alias-Dom\u00e4ne erstellt werden.\n\nme@example.org ist nur als me@example.org bekannt.\nme@example.org darf als me@example.org senden.\n

          Wir k\u00f6nnen eine Alias-Dom\u00e4ne f\u00fcr example.org hinzuf\u00fcgen:

          Die Alias-Dom\u00e4ne alias.com wird hinzugef\u00fcgt und der prim\u00e4ren Dom\u00e4ne example.org zugewiesen.\nme@example.org ist nun als me@example.org und me@alias.com bekannt.\nme@example.org darf nun als me@example.org und me@alias.com senden.\n

          Wir k\u00f6nnen Aliase f\u00fcr eine Mailbox hinzuf\u00fcgen, um Mails von dieser neuen Adresse zu empfangen und zu senden.

          Es ist wichtig zu wissen, dass Sie nicht in der Lage sind, Mails f\u00fcr my-alias@my-alias-domain.tld zu empfangen. Sie m\u00fcssen diesen speziellen Alias erstellen.

          me@example.org wird der Alias alias@example.org zugewiesen.\nme@example.org ist jetzt bekannt als me@example.org, me@alias.com, alias@example.org\n\nme@example.org ist NICHT als alias@alias.com bekannt.\n

          Bitte beachten Sie, dass dies nicht f\u00fcr \"catch-all\"-Aliasnamen gilt:

          Die Alias-Dom\u00e4ne alias.com wird hinzugef\u00fcgt und der prim\u00e4ren Dom\u00e4ne example.org zugewiesen\nme@example.org wird der Catch-all-Alias @example.org zugewiesen\nme@example.org ist weiterhin nur als me@example.org bekannt, was die einzige verf\u00fcgbare send-as Option ist.\n\nJede an alias.com gesendete E-Mail wird mit dem Catch-All-Alias f\u00fcr example.org \u00fcbereinstimmen.\n

          Administratoren und Dom\u00e4nenadministratoren k\u00f6nnen Postf\u00e4cher bearbeiten, um bestimmten Benutzern zu erlauben, als andere Postfachbenutzer zu senden (sie zu \"delegieren\").

          Sie k\u00f6nnen zwischen Mailbox-Benutzern w\u00e4hlen oder die Absenderpr\u00fcfung f\u00fcr Dom\u00e4nen komplett deaktivieren.

          "},{"location":"de/models/model-sender_rcv/#sogo-mail-von-adressen","title":"SOGo \"Mail von\"-Adressen","text":"

          Mailbox-Benutzer k\u00f6nnen nat\u00fcrlich ihre eigene Mailbox-Adresse ausw\u00e4hlen, sowie alle Alias-Adressen und Aliase, die \u00fcber Alias-Dom\u00e4nen existieren.

          Wenn Sie einen anderen existierenden Mailbox-Benutzer als Ihre \"Mail von\"-Adresse ausw\u00e4hlen wollen, muss dieser Benutzer Ihnen den Zugriff \u00fcber SOGo delegieren (siehe SOGo-Dokumentation). Au\u00dferdem muss ein mailcow (Domain) Administrator Ihnen den Zugang wie oben beschrieben gew\u00e4hren.

          "},{"location":"de/post_installation/firststeps-authorize_watchdog_and_bounces/","title":"Authorisieren der Watchdog und Bounce Mails","text":"

          mailcow verwendet MAILCOW_HOSTNAME als Absenderdomain, um Watchdog-Benachrichtigungen zu senden und Bounce-E-Mails zu erstellen.

          1. WATCHDOG_NOTIFY_EMAIL sollte auf externe Empf\u00e4nger verweisen, die von einem anderen Mailserver verwaltet werden. Dies ist sehr wichtig, da der Watchdog \u00fcber Systemausf\u00e4lle informiert, und im Falle eines solchen Ausfalls w\u00e4re Ihre Instanz m\u00f6glicherweise nicht in der Lage, diese Benachrichtigung zu empfangen oder anzuzeigen.

          2. Da der Watchdog so konzipiert ist, dass er in allen Situationen funktioniert, einschlie\u00dflich F\u00e4llen, in denen Postfix, Rspamd oder Redis nicht funktionieren, senden wir E-Mails direkt \u00fcber den Watchdog-Container an den Empf\u00e4nger-MX, ohne DKIM-Signierung.

          Um Watchdog-Benachrichtigungen und Bounces ordnungsgem\u00e4\u00df an externe Mailserver zu senden, m\u00fcssen Sie SPF und DMARC f\u00fcr MAILCOW_HOSTNAME konfigurieren (ersetzen Sie mail.example.com und die IPs entsprechend Ihrer Konfiguration):

          _dmarc.mail.example.com IN TXT \"v=DMARC1; p=reject\"\nmail.example.com IN TXT \"v=spf1 ip4:192.0.2.146/32 ip6:2001:db8::1/128 -all\"\n

          Hinweis

          Wenn Sie m\u00f6chten, k\u00f6nnen Sie dieses SPF sp\u00e4ter als Include f\u00fcr andere Domains verwenden, wie zum Beispiel:

          example.com IN TXT \"v=spf1 include:mail.example.com -all\"\n
          "},{"location":"de/post_installation/firststeps-disable_ipv6/","title":"IPv6 deaktivieren","text":"

          ACHTUNG

          Bei Installationen, welche eine Docker Version zwischen 25.0.0 und 25.0.2 (zum \u00fcberpr\u00fcfen nutzt docker version) verwenden hat sich das Verhalten der IPv6-Adressen Allokation durch einen Bug ver\u00e4ndert. Ein simples enable_ipv6: false reicht damit NICHT mehr aus, um IPv6 komplett im Stack zu deaktivieren. Dies war ein Bug im Docker Daemon, welcher mit Version 25.0.3 gefixt wurde.

          Dies wird NUR empfohlen, wenn Sie kein IPv6-f\u00e4higes Netzwerk auf Ihrem Host haben!

          Wenn Sie es wirklich brauchen, k\u00f6nnen Sie die Verwendung von IPv6 in der Compose-Datei deaktivieren. Zus\u00e4tzlich k\u00f6nnen Sie auch den Start des Containers \"ipv6nat-mailcow\" deaktivieren, da er nicht ben\u00f6tigt wird, wenn Sie IPv6 nicht verwenden.

          Anstatt die Datei docker-compose.yml direkt zu bearbeiten, ist es besser, eine Override-Datei zu erstellen zu erstellen und Ihre \u00c4nderungen am Dienst dort zu implementieren. Leider scheint dies im Moment nur f\u00fcr Dienste zu funktionieren, nicht f\u00fcr Netzwerkeinstellungen.

          Um IPv6 im mailcow-Netzwerk zu deaktivieren, \u00f6ffnen Sie docker-compose.yml mit Ihrem bevorzugten Texteditor und suchen Sie nach dem Netzwerk-Abschnitt (er befindet sich am Ende der Datei).

          1. \u00c4ndern Sie docker-compose.yml

          \u00c4ndern Sie enable_ipv6: true in enable_ipv6: false:

          networks:\n  mailcow-network:\n    [...]\n    enable_ipv6: true # <<< auf false setzen\n    ipam:\n      driver: default\n      config:\n        - subnet: ${IPV4_NETWORK:-172.22.1}.0/24\n    [...]\n

          2. ipv6nat-mailcow deaktivieren

          Um den ipv6nat-mailcow Container ebenfalls zu deaktivieren, gehen Sie in Ihr mailcow Verzeichnis und erstellen Sie eine neue Datei namens \"docker-compose.override.yml\":

          HINWEIS: Wenn Sie bereits eine Override-Datei haben, erstellen Sie diese nat\u00fcrlich nicht neu, sondern f\u00fcgen Sie die untenstehenden Zeilen entsprechend in Ihre bestehende Datei ein!

          # cd /opt/mailcow-dockerized\n# touch docker-compose.override.yml\n

          \u00d6ffnen Sie die Datei in Ihrem bevorzugten Texteditor und tragen Sie folgendes ein:

          services:\n\n    ipv6nat-mailcow:\n      image: bash:latest\n      restart: \"no\"\n      entrypoint: [\"echo\", \"ipv6nat disabled in compose.override.yml\"]\n

          Damit diese \u00c4nderungen wirksam werden, m\u00fcssen Sie den Stack vollst\u00e4ndig stoppen und dann neu starten, damit Container und Netzwerke neu erstellt werden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n

          3. Deaktivieren Sie IPv6 in unbound-mailcow

          Bearbeiten Sie data/conf/unbound/unbound.conf und setzen Sie do-ip6 auf \"no\":

          Server:\n  [...]\n  do-ip6: no\n  [...]\n

          unbound neu starten:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart unbound-mailcow\n
          docker-compose restart unbound-mailcow\n

          4. Deaktivieren Sie IPv6 in postfix-mailcow

          Erstellen Sie data/conf/postfix/extra.cf und setzen Sie smtp_address_preference auf ipv4:

          smtp_address_preference = ipv4\ninet_protocols = ipv4\n

          Starten Sie Postfix neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart postfix-mailcow\n
          docker-compose restart postfix-mailcow\n

          5. Wenn im Docker Daemon IPv6 komplett deaktiviert ist:

          Folgende NGINX, Dovecot und Php-fpm Konfigurationsdateien anpassen

          sed -i '/::/d' data/conf/nginx/templates/listen*\nsed -i '/::/d' data/conf/nginx/dynmaps.conf\nsed -i 's/,\\[::\\]//g' data/conf/dovecot/dovecot.conf\nsed -i 's/\\[::\\]://g' data/conf/phpfpm/php-fpm.d/pools.conf\n
          "},{"location":"de/post_installation/firststeps-dmarc_reporting/","title":"DMARC Reporting","text":"

          Die DMARC-Berichterstattung erfolgt \u00fcber das Rspamd DMARC-Modul.

          Die Rspamd-Dokumentation finden Sie hier: https://rspamd.com/doc/modules/dmarc.html

          Wichtig:

          1. \u00c4ndern Sie example.com, mail.example.com und Example so, dass sie Ihrer Einrichtung entsprechen

          2. Die DMARC-Berichterstattung erfordert zus\u00e4tzliche Aufmerksamkeit, insbesondere in den ersten Tagen

          3. Alle empfangenden Domains, die auf mailcow gehostet werden, senden von einer Reporting-Domain. Es wird empfohlen, die \u00fcbergeordnete Domain Ihres MAILCOW_HOSTNAME zu verwenden:

            • Wenn Ihr MAILCOW_HOSTNAME mail.example.com ist, \u00e4ndern Sie die folgende Konfiguration in domain = \"example.com\";
            • Setzen Sie email gleich, z.B. email = \"noreply-dmarc@example.com\";

          4. Es ist optional, aber empfohlen, einen E-Mail-Benutzer noreply-dmarc in mailcow zu erstellen, um Bounces zu behandeln.

          "},{"location":"de/post_installation/firststeps-dmarc_reporting/#aktivieren-sie-dmarc-berichterstattung","title":"Aktivieren Sie DMARC-Berichterstattung","text":"

          Erstellen Sie die Datei data/conf/rspamd/local.d/dmarc.conf und setzen Sie den folgenden Inhalt:

          reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    domain = 'example.com';\n    org_name = 'Example';\n    helo = 'rspamd';\n    smtp = 'postfix';\n    smtp_port = 25;\n    from_name = 'Example DMARC Report';\n    msgid_from = 'rspamd.mail.example.com';\n    max_entries = 2k;\n    keys_expire = 2d;\n}\n

          Erstellen oder \u00e4ndern Sie docker-compose.override.yml im mailcow-dockerized Basisverzeichnis:

          services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"@every 24h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

          Starten Sie den mailcow Stack mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-dmarc_reporting/#senden-sie-eine-kopie-der-berichte-an-sich-selbst","title":"Senden Sie eine Kopie der Berichte an sich selbst","text":"

          Um eine versteckte Kopie der von Rspamd erzeugten Berichte zu erhalten, k\u00f6nnen Sie eine bcc_addrs Liste im reporting Konfigurationsabschnitt von data/conf/rspamd/local.d/dmarc.conf setzen:

          reporting {\n    enabled = true;\n    email = 'noreply-dmarc@example.com';\n    bcc_addrs = [\"noreply-dmarc@example.com\", \"parsedmarc@example.com\"];\n[...]\n

          Rspamd l\u00e4dt \u00c4nderungen in Echtzeit, so dass Sie den Container zu diesem Zeitpunkt nicht neu starten m\u00fcssen.

          Dies kann n\u00fctzlich sein, wenn Sie...

          • ...\u00fcberpr\u00fcfen wollen, ob Ihre DMARC-Berichte korrekt und authentifiziert gesendet werden.
          • ...Ihre eigenen Berichte analysieren wollen, um Statistiken zu erhalten, z.B. um sie mit ParseDMARC oder anderen Analysesystemen zu verwenden.
          "},{"location":"de/post_installation/firststeps-dmarc_reporting/#fehlersuche","title":"Fehlersuche","text":"

          Pr\u00fcfen Sie, wann der Berichtsplan zuletzt ausgef\u00fchrt wurde:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n
          docker-compose exec rspamd-mailcow date -r /var/lib/rspamd/dmarc_reports_last_log\n

          Sehen Sie sich die letzte Berichtsausgabe an:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n
          docker-compose exec rspamd-mailcow cat /var/lib/rspamd/dmarc_reports_last_log\n

          Manuelles Ausl\u00f6sen eines DMARC-Berichts:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow rspamadm dmarc_report\n
          docker-compose exec rspamd-mailcow rspamadm dmarc_report\n

          Best\u00e4tigen Sie, dass Rspamd Daten in Redis aufgezeichnet hat: \u00c4ndern Sie 20220428 in Ihr gew\u00fcnschtes Datum zum \u00fcberpr\u00fcfen.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n
          docker-compose exec redis-mailcow redis-cli SMEMBERS \"dmarc_idx;20220428\"\n

          Nehmen Sie eine der Zeilen aus der Ausgabe, die Sie interessiert, und fordern Sie sie an, z. B.:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
          docker-compose exec redis-mailcow redis-cli ZRANGE \"dmarc_rpt;microsoft.com;mailto:d@rua.agari.com;20220428\" 0 49\n
          "},{"location":"de/post_installation/firststeps-dmarc_reporting/#andern-sie-die-haufigkeit-der-dmarc-berichte","title":"\u00c4ndern Sie die H\u00e4ufigkeit der DMARC-Berichte","text":"

          Im obigen Beispiel werden die Berichte einmal alle 24 Stunden sowie f\u00fcr den gestrigen Tag versendet. Dies ist f\u00fcr die meisten Konfigurationen ausreichend.

          Wenn Sie ein gro\u00dfes E-Mail-Aufkommen haben und die DMARC-Berichterstattung mehr als einmal am Tag durchf\u00fchren wollen, m\u00fcssen Sie einen zweiten Zeitplan erstellen und ihn mit dmarc_report $(date '+%Y%m%d') ausf\u00fchren, um den aktuellen Tag zu verarbeiten. Sie m\u00fcssen sicherstellen, dass der erste Lauf an jedem Tag auch den letzten Bericht vom Vortag verarbeitet, also muss er zweimal gestartet werden, einmal mit $(date --date yesterday '+%Y%m%d') um 0 5 0 * * * (00:05 AM) und dann mit $(date '+%Y%m%d') mit dem gew\u00fcnschten Intervall.

          Der Ofelia-Zeitplan hat die gleiche Implementierung wie cron in Go, die unterst\u00fctzte Syntax ist beschrieben in cron Documentation

          Um den Zeitplan zu \u00e4ndern:

          1. docker-compose.override.yml bearbeiten: 

            services:\n  rspamd-mailcow:\n    environment:\n      - MASTER=${MASTER:-y}\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.schedule: \"0 5 0 * * *\"\n      ofelia.job-exec.rspamd_dmarc_reporting_yesterday.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date --date yesterday '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.schedule: \"@every 12h\"\n      ofelia.job-exec.rspamd_dmarc_reporting_today.command: \"/bin/bash -c \\\"[[ $${MASTER} == y ]] && /usr/bin/rspamadm dmarc_report $(date '+%Y%m%d') > /var/lib/rspamd/dmarc_reports_last_log 2>&1 || exit 0\\\"\"\n  ofelia-mailcow:\n    depends_on:\n      - rspamd-mailcow\n

          2. Starten Sie die betroffenen Container neu:

            docker compose (Plugin)docker-compose (Standalone) 
            docker compose up -d\n
            docker-compose up -d\n

          3. F\u00fchren Sie einen Neustart nur von Ofelia aus:

            docker compose (Plugin)docker-compose (Standalone) 
            docker compose restart ofelia-mailcow\n
            docker-compose restart ofelia-mailcow\n
          "},{"location":"de/post_installation/firststeps-dmarc_reporting/#dmarc-berichterstattung-deaktivieren","title":"DMARC-Berichterstattung deaktivieren","text":"

          Zum Deaktivieren der Berichterstattung:

          1. Setzen Sie enabled auf false in data/conf/rspamd/local.d/dmarc.conf.

          2. Machen Sie \u00c4nderungen in docker-compose.override.yml an rspamd-mailcow und ofelia-mailcow r\u00fcckg\u00e4ngig

          3. Starten Sie die betroffenen Container neu:

            docker compose (Plugin)docker-compose (Standalone) 
            docker compose up -d\n
            docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ip_bindings/","title":"IP-Bindings","text":"

          Warnung

          Das \u00c4ndern der Bindung hat keinen Einfluss auf Source-NAT. Siehe SNAT f\u00fcr die erforderlichen Schritte.

          "},{"location":"de/post_installation/firststeps-ip_bindings/#ipv4-binding","title":"IPv4-Binding","text":"

          Um eine oder mehrere IPv4-Bind(ings) anzupassen, \u00f6ffne mailcow.conf und editiere eine, mehrere oder alle Variablen nach deinen Bed\u00fcrfnissen:

          # Aus technischen Gr\u00fcnden unterscheiden sich die http-Bindungen ein wenig von anderen Service-Bindungen.\n# Sie werden die folgenden Variablen finden, getrennt durch eine Bindungsadresse und deren Port:\n# Beispiel: HTTP_BIND=1.2.3.4\n\nHTTP_PORT=80\nHTTP_BIND=\nHTTPS_PORT=443\nHTTPS_BIND=\n\n# Andere Dienste werden nach folgendem Format gebunden:\n# SMTP_PORT=1.2.3.4:25 bindet SMTP an die IP 1.2.3.4 auf Port 25\n# Wichtig! Durch die Angabe einer IPv4-Adresse werden alle IPv6-Bindungen seit Docker 20.x \u00fcbersprungen.\n# doveadm, SQL sowie Solr sind nur an lokale Ports gebunden, bitte \u00e4ndern Sie das nicht, es sei denn, Sie wissen, was Sie tun.\n\nSMTP_PORT=25\nSMTPS_PORT=465\nSUBMISSION_PORT=587\nIMAP_PORT=143\nIMAPS_PORT=993\nPOP_PORT=110\nPOPS_PORT=995\nSIEVE_PORT=4190\nDOVEADM_PORT=127.0.0.1:19991\nSQL_PORT=127.0.0.1:13306\nSOLR_PORT=127.0.0.1:18983\n

          Um Ihre \u00c4nderungen zu \u00fcbernehmen, f\u00fchren Sie folgende Befehle aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ip_bindings/#ipv6-binding","title":"IPv6-Binding","text":"

          Das \u00c4ndern von IPv6-Bindings ist anders als bei IPv4. Auch dies hat einen technischen Hintergrund.

          Eine docker-compose.override.yml Datei wird verwendet, anstatt die docker-compose.yml Datei direkt zu bearbeiten. Dies geschieht, um die Aktualisierbarkeit zu erhalten, da die Datei docker-compose.yml regelm\u00e4\u00dfig aktualisiert wird und Ihre \u00c4nderungen h\u00f6chstwahrscheinlich \u00fcberschrieben werden.

          Bearbeiten Sie die Datei \"docker-compose.override.yml\" und erstellen Sie sie mit dem folgenden Inhalt. Ihr Inhalt wird mit der produktiven Datei \"docker-compose.yml\" zusammengef\u00fchrt.

          Es wird eine beispielhafte IPv6 2001:db8:dead:beef::123 in [] angegeben. Das erste Suffix :PORT1 definiert den externen Port, w\u00e4hrend das zweite Suffix :PORT2 zu dem entsprechenden Port innerhalb des Containers f\u00fchrt und nicht ver\u00e4ndert werden darf.

          services:\n\n    dovecot-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:143:143'\n        - '[2001:db8:dead:beef::123]:993:993'\n        - '[2001:db8:dead:beef::123]:110:110'\n        - '[2001:db8:dead:beef::123]:995:995'\n        - '[2001:db8:dead:beef::123]:4190:4190'\n\n    postfix-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:25:25'\n        - '[2001:db8:dead:beef::123]:465:465'\n        - '[2001:db8:dead:beef::123]:587:587'\n\n    nginx-mailcow:\n      ports:\n        - '[2001:db8:dead:beef::123]:80:80'\n        - '[2001:db8:dead:beef::123]:443:443'\n

          Um Ihre \u00c4nderungen zu \u00fcbernehmen, f\u00fchren Sie folgendes aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-local_mta/","title":"Lokaler MTA auf Docker-Host","text":"

          Die einfachste M\u00f6glichkeit w\u00e4re, den Listener an Port 25/tcp zu deaktivieren.

          Postfix-Benutzer deaktivieren den Listener, indem sie die folgende Zeile (beginnend mit smtp oder 25) in /etc/postfix/master.cf auskommentieren: 

          #smtp      inet  n       -       -       -       -       smtpd\n

          Au\u00dferdem, um \u00fcber eine Dockerized mailcow weiterzuleiten, sollten Sie 172.22.1.1 als Relayhost hinzuf\u00fcgen und das Docker-Interface aus \"inet_interfaces\" entfernen:

          postconf -e 'relayhost = 172.22.1.1'\npostconf -e \"mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128\"\npostconf -e \"inet_interfaces = loopback-only\"\npostconf -e \"relay_transport = relay\"\npostconf -e \"default_transport = smtp\"\n

          Jetzt ist es wichtig, dass Sie nicht denselben FQDN in myhostname haben, den Sie f\u00fcr Ihre mailcow verwenden. Pr\u00fcfen Sie Ihre lokale (nicht-Docker) Postfix' main.cf auf myhostname und setzen Sie ihn auf etwas anderes, zum Beispiel local.my.fqdn.tld.

          \"172.22.1.1\" ist das von mailcow erstellte Netzwerk-Gateway in Docker. Das Relaying \u00fcber diese Schnittstelle ist notwendig (anstatt - zum Beispiel - direkt \u00fcber ${MAILCOW_HOSTNAME}), um \u00fcber ein bekanntes internes Netzwerk weiterzuleiten.

          Starten Sie Postfix neu, nachdem Sie Ihre \u00c4nderungen vorgenommen haben.

          "},{"location":"de/post_installation/firststeps-logging/","title":"Logging","text":"

          Das Logging in mailcow: dockerized besteht aus mehreren Stufen, ist aber immerhin wesentlich flexibler und einfacher in einen Logging-Daemon zu integrieren als bisher.

          In Docker schreibt die containerisierte Anwendung (PID 1) ihre Ausgabe auf stdout. F\u00fcr echte Ein-Anwendungs-Container funktioniert das sehr gut. F\u00fchren Sie folgenden Befehl aus, um mehr zu erfahren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs --help\n
          docker-compose logs --help\n

          Einige Container protokollieren oder streamen an mehrere Ziele.

          Kein Container wird persistente Logs in sich behalten. Container sind fl\u00fcchtige Objekte!

          Am Ende wird jede Zeile der Logs den Docker-Daemon erreichen - ungefiltert.

          Der Standard-Logging-Treiber ist \"json \".

          "},{"location":"de/post_installation/firststeps-logging/#gefilterte-logs","title":"Gefilterte Logs","text":"

          Einige Logs werden gefiltert und in Redis-Schl\u00fcssel geschrieben, aber auch in einen Redis-Kanal gestreamt.

          Der Redis-Kanal wird verwendet, um Protokolle mit fehlgeschlagenen Authentifizierungsversuchen zu streamen, die von netfilter-mailcow gelesen werden.

          Die Redis-Schl\u00fcssel sind persistent und halten 10000 Zeilen von Logs f\u00fcr die Web-UI.

          Dieser Mechanismus macht es m\u00f6glich, jeden beliebigen Docker-Logging-Treiber zu verwenden, ohne die ohne die F\u00e4higkeit zu verlieren, Logs von der UI zu lesen oder verd\u00e4chtige Clients mit netfilter-mailcow zu sperren.

          Redis-Schl\u00fcssel enthalten nur Logs von Anwendungen und filtern Systemmeldungen heraus (man denke an Cron etc.).

          "},{"location":"de/post_installation/firststeps-logging/#logging-treiber","title":"Logging-Treiber","text":""},{"location":"de/post_installation/firststeps-logging/#uber-docker-composeoverrideyml","title":"\u00dcber docker-compose.override.yml","text":"

          Hier ist die gute Nachricht: Da Docker einige gro\u00dfartige Logging-Treiber hat, k\u00f6nnen Sie mailcow: dockerized mit Leichtigkeit in Ihre bestehende Logging-Umgebung integrieren.

          Erstellen Sie eine docker-compose.override.yml und f\u00fcgen Sie zum Beispiel diesen Block hinzu, um das \"gelf\" Logging-Plugin f\u00fcr postfix-mailcow zu verwenden:

          services:\n  postfix-mailcow: # oder ein anderer\n    logging:\n      driver: \"gelf\"\n      options:\n        gelf-address: \"udp://graylog:12201\"\n

          Ein weiteres Beispiel f\u00fcr Syslog:

          services:\n\n  postfix-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  dovecot-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n\n  rspamd-mailcow: # oder ein anderer\n    logging:\n      driver: \"syslog\"\n      options:\n        syslog-address: \"udp://127.0.0.1:514\"\n        syslog-facility: \"local3\"\n
          "},{"location":"de/post_installation/firststeps-logging/#nur-fur-rsyslog","title":"Nur f\u00fcr rsyslog:","text":"

          Stellen Sie sicher, dass folgende Zeilen in /etc/rsyslog.conf nicht auskommentiert sind:

          # provides UDP syslog reception\nmodule(load=\"imudp\")\ninput(type=\"imudp\" port=\"514\")\n

          Um Eing\u00e4nge von local3 in /var/log/mailcow.log zu leiten und danach die Verarbeitung zu stoppen, erstellen Sie die Datei /etc/rsyslog.d/docker.conf:

          local3.*        /var/log/mailcow.log\n& stop\n

          Starten Sie rsyslog danach neu.

          "},{"location":"de/post_installation/firststeps-logging/#uber-daemonjson-global","title":"\u00dcber daemon.json (global)","text":"

          Wenn Sie den Logging-Treiber global \u00e4ndern wollen, editieren Sie die Konfigurationsdatei des Docker-Daemons /etc/docker/daemon.json und starten Sie den Docker-Dienst neu:

          {\n[...]\n  \"log-driver\": \"gelf\",\n  \"log-opts\": {\n    \"gelf-address\": \"udp://graylog:12201\"\n  }\n[...]\n}\n

          F\u00fcr Syslog:

          {\n[...]\n  \"log-driver\": \"syslog\",\n  \"log-opts\": {\n    \"syslog-address\": \"udp://1.2.3.4:514\"\n  }\n[...]\n}\n

          Starten Sie den Docker-Daemon neu und f\u00fchren Sie die folgenden Befehle aus, um die Container mit dem neuen Protokollierungstreiber neu zu erstellen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-logging/#log-rotation","title":"Log rotation","text":"

          Da diese Logs sehr gro\u00df werden k\u00f6nnen, ist es eine gute Idee logrotate zu nutzen, um Logs nach einer gewissen Zeit zu komprimieren und zu l\u00f6schen.

          Erstellen Sie die Datei /etc/logrotate.d/mailcow mit folgendem Inhalt:

          /var/log/mailcow.log {\n        rotate 7\n        daily\n        compress\n        delaycompress\n        missingok\n        notifempty\n        create 660 root root\n}\n

          Mit dieser Konfiguration wird logrotate t\u00e4glich ausgef\u00fchrt und es werden maximal 7 Archive gespeichert.

          Um die Logdatei w\u00f6chentlich oder monatlich zu rotieren, muss daily durch weekly oder respektive monthly ersetzt werden.

          Um mehr Archive zu speichern, muss die Nummer hinter rotate angepasst werden.

          Danach kann logrotate neu gestartet werden.

          "},{"location":"de/post_installation/firststeps-snat/","title":"SNAT","text":"

          SNAT wird verwendet, um die Quelladresse der von mailcow gesendeten Pakete zu \u00e4ndern. Es kann verwendet werden, um die ausgehende IP-Adresse auf Systemen mit mehreren IP-Adressen zu \u00e4ndern.

          \u00d6ffnen Sie mailcow.conf, setzen Sie einen oder beide der folgenden Parameter:

          # Benutze diese IPv4 f\u00fcr ausgehende Verbindungen (SNAT)\nSNAT_TO_SOURCE=1.2.3.4\n\n# Benutze dieses IPv6 f\u00fcr ausgehende Verbindungen (SNAT)\nSNAT6_TO_SOURCE=dead:beef\n

          F\u00fchren Sie folgendes aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Die Werte werden von netfilter-mailcow gelesen. netfilter-mailcow stellt sicher, dass die Post-Routing-Regeln auf Position 1 in der Netfilter-Tabelle stehen. Es l\u00f6scht sie automatisch und legt sie neu an, wenn sie an einer anderen Position als 1 gefunden werden.

          \u00dcberpr\u00fcfen Sie die Ausgabe mit hilfe des folgendem Befehles um sicherzustellen, dass die SNAT-Einstellungen angewendet wurden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs --tail=200 netfilter-mailcow\n
          docker-compose logs --tail=200 netfilter-mailcow\n
          "},{"location":"de/post_installation/firststeps-ssl/","title":"Erweitertes SSL","text":""},{"location":"de/post_installation/firststeps-ssl/#lets-encrypt-wird-mitgeliefert","title":"Let's Encrypt (wird mitgeliefert)","text":"

          Der \"acme-mailcow\" Container wird versuchen, ein LE-Zertifikat f\u00fcr ${MAILCOW_HOSTNAME}, autodiscover.ADDED_MAIL_DOMAIN und autoconfig.ADDED_MAIL_DOMAIN zu erhalten.

          Warnung

          mailcow muss auf Port 80 verf\u00fcgbar sein, damit der acme-Client funktioniert. Unsere Reverse Proxy Beispielkonfigurationen decken das ab. Sie k\u00f6nnen auch jeden externen ACME-Client (z.B. certbot) verwenden, um Zertifikate zu erhalten, aber Sie m\u00fcssen sicherstellen, dass sie an den richtigen Ort kopiert werden und ein Post-Hook die betroffenen Container neu l\u00e4dt. Weitere Informationen finden Sie in der Reverse Proxy-Dokumentation.

          Standardm\u00e4\u00dfig, d.h. 0 Domains sind zu mailcow hinzugef\u00fcgt, wird es versuchen, ein Zertifikat f\u00fcr ${MAILCOW_HOSTNAME} zu erhalten.

          F\u00fcr jede hinzugef\u00fcgte Domain wird versucht, autodiscover.ADDED_MAIL_DOMAIN und autoconfig.ADDED_MAIL_DOMAIN in die IPv6-Adresse oder - falls IPv6 in der Domain nicht konfiguriert ist - in die IPv4-Adresse aufzul\u00f6sen. Wenn dies gelingt, wird ein Name als SAN zur Zertifikatsanforderung hinzugef\u00fcgt.

          Nur Namen, die validiert werden k\u00f6nnen, werden als SAN hinzugef\u00fcgt.

          F\u00fcr jede Domain, die Sie entfernen, wird das Zertifikat verschoben und ein neues Zertifikat angefordert. Es ist nicht m\u00f6glich, Domains in einem Zertifikat zu behalten, wenn wir nicht in der Lage sind, die Challenge f\u00fcr diese zu validieren.

          Wenn Sie den ACME-Client neu starten wollen, verwenden Sie den folgenden Befehl:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart acme-mailcow\n
          docker-compose restart acme-mailcow\n

          \u00dcberwachen Sie die Logs mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs --tail=200 -f acme-mailcow\n
          docker-compose logs --tail=200 -f acme-mailcow\n
          "},{"location":"de/post_installation/firststeps-ssl/#zusatzliche-domain-namen","title":"Zus\u00e4tzliche Domain-Namen","text":"

          Bearbeiten Sie \"mailcow.conf\" und f\u00fcgen Sie einen Parameter ADDITIONAL_SAN wie folgt hinzu:

          Verwenden Sie keine Anf\u00fchrungszeichen (\") und keine Leerzeichen zwischen den Namen!

          ADDITIONAL_SAN=smtp.*,cert1.example.com,cert2.example.org,whatever.*\n

          Jeder Name wird anhand seiner IPv6-Adresse oder - wenn IPv6 in Ihrer Dom\u00e4ne nicht konfiguriert ist - anhand seiner IPv4-Adresse \u00fcberpr\u00fcft.

          Ein Wildcard-Name wie smtp.* wird versuchen, ein smtp.DOMAIN_NAME SAN f\u00fcr jede zu mailcow hinzugef\u00fcgte Domain zu erhalten.

          F\u00fchren Sie den folgenden Befehl aus, um betroffene Container automatisch neu zu erstellen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Info

          Die Verwendung anderer Namen als MAILCOW_HOSTNAME f\u00fcr den Zugriff auf das mailcow UI kann weitere Konfiguration erfordern.

          Wenn Sie planen, einen anderen Servernamen als MAILCOW_HOSTNAME f\u00fcr den Zugriff auf die mailcow UI zu verwenden (z.B. durch Hinzuf\u00fcgen von mail.* zu ADDITIONAL_SAN), stellen Sie sicher, dass Sie diesen Namen in mailcow.conf \u00fcber ADDITIONAL_SERVER_NAMES eintragen. Die Namen m\u00fcssen durch Kommas getrennt sein und d\u00fcrfen keine Leerzeichen enthalten. Wenn Sie diesen Schritt auslassen, kann mailcow mit einer falschen Seite antworten.

          ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

          F\u00fchren Sie den folgenden Befehl aus, um es anzuwenden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#erneuerung-erzwingen","title":"Erneuerung erzwingen","text":"

          Um eine Erneuerung zu erzwingen, m\u00fcssen Sie eine Datei namens force_renew erstellen und den acme-mailcow Container neu starten:

          docker compose (Plugin)docker-compose (Standalone) 
          cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker compose restart acme-mailcow\n# Pr\u00fcfen Sie nun die Logs auf eine Erneuerung\ndocker compose logs --tail=200 -f acme-mailcow\n
          cd /opt/mailcow-dockerized\ntouch data/assets/ssl/force_renew\ndocker-compose restart acme-mailcow\n# Pr\u00fcfen Sie nun die Logs auf eine Erneuerung\ndocker-compose logs --tail=200 -f acme-mailcow\n

          Die Datei wird automatisch gel\u00f6scht.

          "},{"location":"de/post_installation/firststeps-ssl/#validierungsfehler-und-wie-man-die-validierung-uberspringt","title":"Validierungsfehler und wie man die Validierung \u00fcberspringt","text":"

          Sie k\u00f6nnen die IP-\u00dcberpr\u00fcfung \u00fcberspringen, indem Sie SKIP_IP_CHECK=y in mailcow.conf setzen (keine Anf\u00fchrungszeichen). Seien Sie gewarnt, dass eine Fehlkonfiguration dazu f\u00fchrt, dass Sie von Let's Encrypt eingeschr\u00e4nkt werden! Dies ist vor allem f\u00fcr Multi-IP-Setups n\u00fctzlich, bei denen der IP-Check die falsche Quell-IP-Adresse zur\u00fcckgeben w\u00fcrde. Aufgrund der Verwendung von dynamischen IPs f\u00fcr acme-mailcow ist Source-NAT bei Neustarts nicht konsistent.

          Wenn Sie Probleme mit der \"HTTP-Validierung\" haben, aber Ihre IP-Adressbest\u00e4tigung erfolgreich ist, verwenden Sie h\u00f6chstwahrscheinlich firewalld, ufw oder eine andere Firewall, die Verbindungen von br-mailcow zu Ihrem externen Interface verbietet. Sowohl firewalld als auch ufw lassen dies standardm\u00e4\u00dfig nicht zu. Es reicht oft nicht aus, diese Firewall-Dienste einfach zu stoppen. Sie m\u00fcssen mailcow stoppen, den Firewall-Dienst stoppen, die Chains flushen und Docker neu starten.

          Sie k\u00f6nnen diese Validierungsmethode auch \u00fcberspringen, indem Sie SKIP_HTTP_VERIFICATION=y in \"mailcow.conf\" setzen. Seien Sie gewarnt, dass dies nicht zu empfehlen ist. In den meisten F\u00e4llen wird die HTTP-\u00dcberpr\u00fcfung \u00fcbersprungen, um unbekannte NAT-Reflection-Probleme zu umgehen, die durch das Ignorieren dieser spezifischen Netzwerk-Fehlkonfiguration nicht gel\u00f6st werden. Wenn Sie Probleme haben, TLSA-Eintr\u00e4ge in der DNS-\u00dcbersicht innerhalb von mailcow zu generieren, haben Sie h\u00f6chstwahrscheinlich Probleme mit NAT-Reflexion, die Sie beheben sollten.

          Wenn Sie einen SKIP_* Parameter ge\u00e4ndert haben, f\u00fchren Sie den folgenden Befehl aus, um die \u00c4nderungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#deaktivieren-sie-lets-encrypt","title":"Deaktivieren Sie Let's Encrypt","text":""},{"location":"de/post_installation/firststeps-ssl/#deaktivieren-sie-lets-encrypt-vollstandig","title":"Deaktivieren Sie Let's Encrypt vollst\u00e4ndig","text":"

          Setzen Sie SKIP_LETS_ENCRYPT=y in \"mailcow.conf\" und erstellen Sie \"acme-mailcow\" neu, mit dem folgenden Befehl:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#alle-namen-auer-mailcow_hostname-uberspringen","title":"Alle Namen au\u00dfer ${MAILCOW_HOSTNAME} \u00fcberspringen","text":"

          F\u00fcgen Sie ONLY_MAILCOW_HOSTNAME=y zu \"mailcow.conf\" hinzu und erstellen Sie \"acme-mailcow\" neu, mit dem folgenden Befehl:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#das-lets-encrypt-subjectaltname-limit-von-100-domains","title":"Das Let's Encrypt subjectAltName-Limit von 100 Domains","text":"

          Let's Encrypt hat derzeit ein Limit von 100 Domainnamen pro Zertifikat.

          Standardm\u00e4\u00dfig erstellt \"acme-mailcow\" ein einzelnes SAN-Zertifikat f\u00fcr alle validierten Domains (siehe den ersten Abschnitt und Zus\u00e4tzliche Domainnamen). Dies bietet beste Kompatibilit\u00e4t, bedeutet aber, dass das Let's Encrypt-Limit \u00fcberschritten wird, wenn Sie zu viele Domains zu einer einzelnen mailcow-Installation hinzuf\u00fcgen.

          Um dies zu l\u00f6sen, k\u00f6nnen Sie ENABLE_SSL_SNI so konfigurieren, dass es generiert wird:

          • Ein Hauptserver-Zertifikat mit MAILCOW_HOSTNAME und allen voll qualifizierten Domainnamen in der ADDITIONAL_SAN Konfiguration
          • Ein zus\u00e4tzliches Zertifikat f\u00fcr jede in der Datenbank gefundene Domain mit autodiscover., autoconfig. und jeder anderen in diesem Format konfigurierten ADDITIONAL_SAN (subdomain.*).
          • Begrenzungen: Ein Zertifikatsname ADDITIONAL_SAN=test.example.com wird als SAN zum Hauptzertifikat hinzugef\u00fcgt. Ein separates Zertifikat/Schl\u00fcsselpaar wird f\u00fcr dieses Format nicht erzeugt.

          Postfix, Dovecot und Nginx werden dann diese Zertifikate mit SNI bedienen.

          Setzen Sie ENABLE_SSL_SNI=y in \"mailcow.conf\" und erstellen Sie \"acme-mailcow\" mit dem folgenden Befehl neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Warnung

          Nicht alle Clients unterst\u00fctzen SNI, siehe Dovecot Dokumentation oder Wikipedia. Sie sollten sicherstellen, dass diese Clients den MAILCOW_HOSTNAME f\u00fcr sichere Verbindungen verwenden, wenn Sie diese Funktion aktivieren.

          Hier ist ein Beispiel:

          • MAILCOW_HOSTNAME=server.email.tld
          • ADDITIONAL_SAN=webmail.email.tld,mail.*
          • mailcow E-Mail-Dom\u00e4nen: \"domain1.tld\" und \"domain2.tld\"

          Die folgenden Zertifikate werden generiert:

          • server.email.tld, webmail.email.tld -> dies ist das Standard-Zertifikat, alle Clients k\u00f6nnen sich mit diesen Domains verbinden
          • mail.domain1.tld, autoconfig.domain1.tld, autodiscover.domain1.tld -> individuelles Zertifikat f\u00fcr domain1.tld, kann von Clients ohne SNI-Unterst\u00fctzung nicht verwendet werden
          • mail.domain2.tld, autoconfig.domain2.tld, autodiscover.domain2.tld -> individuelles Zertifikat f\u00fcr domain2.tld, kann von Clients ohne SNI-Unterst\u00fctzung nicht verwendet werden
          "},{"location":"de/post_installation/firststeps-ssl/#ein-eigenes-zertifikat-verwenden","title":"Ein eigenes Zertifikat verwenden","text":"

          Stellen Sie sicher, dass Sie mailcows internen LE-Client deaktivieren (siehe oben).

          Um Ihre eigenen Zertifikate zu verwenden, speichern Sie einfach das kombinierte Zertifikat (mit dem Zertifikat und der zwischengeschalteten CA/CA, falls vorhanden) unter data/assets/ssl/cert.pem und den entsprechenden Schl\u00fcssel unter data/assets/ssl/key.pem.

          WICHTIG: Verwenden Sie keine symbolischen Links! Stellen Sie sicher, dass Sie die Zertifikate kopieren und sie nicht mit data/assets/ssl verkn\u00fcpfen.

          Starten Sie die betroffenen Dienste anschlie\u00dfend neu:

          docker restart $(docker ps -qaf name=postfix-mailcow)\ndocker restart $(docker ps -qaf name=nginx-mailcow)\ndocker restart $(docker ps -qaf name=dovecot-mailcow)\n

          Siehe Post-Hook-Skript f\u00fcr Nicht-mailcow-ACME-Clients f\u00fcr ein vollst\u00e4ndiges Beispielskript.

          "},{"location":"de/post_installation/firststeps-ssl/#test-gegen-das-acme-verzeichnis","title":"Test gegen das ACME-Verzeichnis","text":"

          Bearbeiten Sie mailcow.conf und f\u00fcgen Sie LE_STAGING=y hinzu.

          F\u00fchren Sie den folgenden Befehl aus, um Ihre \u00c4nderungen zu aktivieren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#benutzerdefinierte-verzeichnis-url","title":"Benutzerdefinierte Verzeichnis-URL","text":"

          Editieren Sie mailcow.conf und f\u00fcgen Sie die entsprechende Verzeichnis-URL in die neue Variable DIRECTORY_URL ein:

          DIRECTORY_URL=https://acme-custom-v9000.api.letsencrypt.org/directory\n

          Sie k\u00f6nnen LE_STAGING nicht mit DIRECTORY_URL verwenden. Wenn beide gesetzt sind, wird nur LE_STAGING verwendet.

          F\u00fchren Sie den folgenden Befehl aus, um Ihre \u00c4nderungen zu aktivieren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/firststeps-ssl/#caa-eintrage-mit-dem-accounturi-parameter","title":"CAA-Eintr\u00e4ge mit dem accounturi-Parameter","text":"

          Let's Encrypt erm\u00f6glicht es, mithilfe des accounturi-Paramaters in CAA-Eintr\u00e4gen die Zertifikatsausstellung auf spezifische Account-IDs zu beschr\u00e4nken. Sie k\u00f6nnen das Helper-Skript generate_caa_record.py verwenden, um einen CAA-Eintrag mit accounturi zu erstellen, welchen Sie dann bei Ihrem DNS-Anbieter eintragen k\u00f6nnen:

          ./helper-scripts/generate_caa_record.py --account-key data/assets/ssl/acme/account.pem --contact mailto:ihre_acme_email@beispiel.de\n
          "},{"location":"de/post_installation/firststeps-ssl/#uberprufen-sie-ihre-konfiguration","title":"\u00dcberpr\u00fcfen Sie Ihre Konfiguration","text":"

          F\u00fchren Sie den folgenden Befehl aus, um herauszufinden, warum eine Validierung fehlschl\u00e4gt:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs --tail=200 acme-mailcow\n
          docker-compose logs --tail=200 acme-mailcow\n

          Um zu \u00fcberpr\u00fcfen, ob nginx das richtige Zertifikat verwendet, benutzen Sie einfach einen Browser Ihrer Wahl und \u00fcberpr\u00fcfen Sie das angezeigte Zertifikat.

          Um das von Postfix, Dovecot und Nginx verwendete Zertifikat zu \u00fcberpr\u00fcfen, verwenden wir openssl:

          # Verbindung \u00fcber SMTP STARTTLS (587)\nopenssl s_client -starttls smtp -connect MAILCOW_HOSTNAME:587 | openssl x509 -noout -text\n# Verbindung \u00fcber SMTP (465)\nopenssl s_client -connect MAILCOW_HOSTNAME:465 | openssl x509 -noout -text\n\n# Verbindung \u00fcber IMAP STARTTLS (143)\nopenssl s_client -starttls imap -connect MAILCOW_HOSTNAME:143 | openssl x509 -noout -text\n# Verbindung \u00fcber IMAP (993)\nopenssl s_client -connect MAILCOW_HOSTNAME:993 | openssl x509 -noout -text\n\n# Verbindung \u00fcber HTTPS (443)\nopenssl s_client -connect MAILCOW_HOSTNAME:443 | openssl x509 -noout -text\n

          Um die von openssl zur\u00fcckgegebenen Verfallsdaten gegen MAILCOW_HOSTNAME zu validieren, k\u00f6nnen Sie unser Hilfsskript verwenden:

          cd /opt/mailcow-dockerized\nbash helper-scripts/expiry-dates.sh\n
          "},{"location":"de/post_installation/firststeps-sync_jobs_migration/","title":"Migration mit Sync Jobs","text":"

          Sync-Auftr\u00e4ge werden verwendet, um bestehende E-Mails von einem externen IMAP-Server oder innerhalb von mailcow's bestehenden Mailboxen zu kopieren oder zu verschieben.

          Info

          Abh\u00e4ngig von der ACL Ihrer Mailbox haben Sie m\u00f6glicherweise nicht die M\u00f6glichkeit, einen Sync-Job hinzuzuf\u00fcgen. Bitte kontaktieren Sie in diesem Fall Ihren Domain-Administrator.

          "},{"location":"de/post_installation/firststeps-sync_jobs_migration/#einrichten-eines-sync-jobs","title":"Einrichten eines Sync-Jobs","text":"

          1. Erstellen Sie unter dem Punkt \"Konfiguration > E-Mail-Setup\" oder \"Benutzereinstellungen\" einen neuen Synchronisierungsauftrag.

          2. Wenn Sie ein Administrator sind, w\u00e4hlen Sie den Benutzernamen der nachgelagerten mailcow-Mailbox im Dropdown-Men\u00fc \"Benutzername\".

          3. F\u00fcllen Sie die Felder \"Host\" und \"Port\" mit den entsprechenden korrekten Werten des vorgelagerten IMAP-Servers aus.

          4. Geben Sie in den Feldern \"Benutzername\" und \"Passwort\" die korrekten Zugangsdaten des vorgelagerten IMAP-Servers ein.

          5. W\u00e4hlen Sie die \"Verschl\u00fcsselungsmethode\". Wenn der vorgelagerte IMAP-Server Port 143 verwendet, ist es wahrscheinlich, dass die Verschl\u00fcsselungsmethode TLS und SSL f\u00fcr Port 993 ist. Sie k\u00f6nnen auch PLAIN-Authentifizierung verwenden, aber davon wird dringend abgeraten.

          6. Alle anderen Felder k\u00f6nnen Sie so lassen, wie sie sind, oder sie nach Belieben \u00e4ndern.

          7. Vergewissern Sie sich, dass Sie \"Aktiv\" ankreuzen und klicken Sie auf \"Hinzuf\u00fcgen\".

          Info

          Sobald Sie fertig sind, melden Sie sich in der Mailbox an und \u00fcberpr\u00fcfen Sie, ob alle E-Mails korrekt importiert wurden. Wenn alles gut geht, werden alle Ihre E-Mails in Ihrem neuen Postfach landen. Vergessen Sie nicht, den Synchronisierungsauftrag zu l\u00f6schen oder zu deaktivieren, nachdem er verwendet wurde.

          "},{"location":"de/post_installation/reverse-proxy/r_p-apache24/","title":"Apache 2.4","text":"

          Wichtig

          Lesen Sie zuerst die \u00dcbersicht.

          Erforderliche Module: 

          a2enmod rewrite proxy proxy_http headers ssl\n

          Let's Encrypt wird unserem Rewrite folgen, Zertifikatsanfragen in mailcow werden problemlos funktionieren.

          Die hervorgehobenen Zeilen m\u00fcssen beachtet werden.

          <VirtualHost *:80>\n  ServerName ZU MAILCOW HOSTNAMEN \u00c4NDERN\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n  RewriteEngine on\n\n  RewriteCond %{HTTPS} off\n  RewriteRule ^/?(.*) https://%{HTTP_HOST}/$1 [R=301,L]\n\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"http\"\n</VirtualHost>\n<VirtualHost *:443>\n  ServerName ZU MAILCOW HOSTNAMEN \u00c4NDERN\n  ServerAlias autodiscover.*\n  ServerAlias autoconfig.*\n\n  # You should proxy to a plain HTTP session to offload SSL processing\n  ProxyPass /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync connectiontimeout=4000\n  ProxyPassReverse /Microsoft-Server-ActiveSync http://127.0.0.1:8080/Microsoft-Server-ActiveSync\n  ProxyPass / http://127.0.0.1:8080/\n  ProxyPassReverse / http://127.0.0.1:8080/\n  ProxyPreserveHost On\n  ProxyAddHeaders On\n  RequestHeader set X-Forwarded-Proto \"https\"\n\n  SSLCertificateFile MAILCOW_ORDNER/data/assets/ssl/cert.pem\n  SSLCertificateKeyFile MAILCOW_ORDNER/data/assets/ssl/key.pem\n\n  # Wenn Sie einen HTTPS-Host als Proxy verwenden m\u00f6chten:\n  #SSLProxyEngine On\n\n  # Wenn Sie einen Proxy f\u00fcr einen nicht vertrauensw\u00fcrdigen HTTPS-Host einrichten wollen:\n  #SSLProxyVerify none\n  #SSLProxyCheckPeerCN off\n  #SSLProxyCheckPeerName off\n  #SSLProxyCheckPeerExpire off\n</VirtualHost>\n
          "},{"location":"de/post_installation/reverse-proxy/r_p-caddy2/","title":"Caddy v2 (von der Community unterst\u00fctzt)","text":"

          Wichtig

          Lesen Sie zuerst die \u00dcbersicht.

          Warnung

          Dies ist ein nicht unterst\u00fctzter Communitybeitrag. Korrekturen sind immer erw\u00fcnscht!

          Die Konfiguration von Caddy mit mailcow ist sehr simpel.

          In der Caddyfile muss einfach nur ein Bereich f\u00fcr den E-Mailserver angelegt werden.

          Bspw:

          MAILCOW_HOSTNAME autodiscover.MAILCOW_HOSTNAME autoconfig.MAILCOW_HOSTNAME {\n        log {\n                output file /var/log/caddy/MAILCOW_HOSTNAME.log {\n                        roll_disabled\n                        roll_size 512M\n                        roll_uncompressed\n                        roll_local_time\n                        roll_keep 3\n                        roll_keep_for 48h\n                }\n        }\n\n        reverse_proxy 127.0.0.1:HTTP_BIND\n}\n

          Dies erlaubt es Caddy automatisch die Zertifikate zu erstellen und den Traffic f\u00fcr diese erw\u00e4hnten Domains anzunehmen und an mailcow weiterzuleiten.

          Wichtig: Der ACME Client der mailcow muss deaktiviert sein, da es sonst zu Fehlern seitens mailcow kommt.

          Da Caddy sich direkt selbst um die Zertifikate k\u00fcmmert, k\u00f6nnen wir mit dem folgenden Skript die Caddy generierten Zertifikate in die mailcow inkludieren:

          #!/bin/bash\nMAILCOW_HOSTNAME=your.domain.tld\nCADDY_CERTS_DIR=/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory\nMD5SUM_CURRENT_CERT=($(md5sum /opt/mailcow-dockerized/data/assets/ssl/cert.pem))\nMD5SUM_NEW_CERT=($(md5sum $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt))\n\nif [ $MD5SUM_CURRENT_CERT != $MD5SUM_NEW_CERT ]; then\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/key.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.crt /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/cert.pem\n        cp $CADDY_CERTS_DIR/$MAILCOW_HOSTNAME/$MAILCOW_HOSTNAME.key /opt/mailcow-dockerized/data/assets/ssl/$MAILCOW_HOSTNAME/key.pem\n        postfix_c=$(docker ps -qaf name=postfix-mailcow)\n        dovecot_c=$(docker ps -qaf name=dovecot-mailcow)\n        nginx_c=$(docker ps -qaf name=nginx-mailcow)\n        docker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n\nelse\n        echo \"Certs not copied from Caddy (Not needed)\"\nfi\n

          Achtung

          Der Zertifikatspfad von Caddy variiert je nach Installationsart. Bei diesem Installationsbeispiel wurde Caddy mithilfe des Caddy Repos (weitere Informationen hier) installiert. Um den Caddy Zertifikatspfad auf Ihrem System herauszufinden, gen\u00fcgt ein find / -name \"certificates\".

          Dieses Skript k\u00f6nnte dann als Cronjob jede Stunde aufgerufen werden:

          0 * * * * /bin/bash /path/to/script/deploy-certs.sh  >/dev/null 2>&1\n
          "},{"location":"de/post_installation/reverse-proxy/r_p-haproxy/","title":"HAProxy (von der Community unterst\u00fctzt)","text":"

          Wichtig

          Lesen Sie zuerst die \u00dcbersicht.

          Warnung

          Dies ist ein nicht unterst\u00fctzter Community Beitrag. Korrekturen sind immer erw\u00fcnscht!

          Dieses Beispiel leitet den gesamten HTTP-Verkehr zu HTTPS um, au\u00dfer f\u00fcr den eingebauten ACME-Client von mailcow. Wenn Sie den eingebauten ACME-Client nicht verwenden m\u00f6chten, \u00e4ndern Sie bitte die Konfiguration selbst.

          frontend https-in\n  bind :::80 v4v6\n  bind :::443 v4v6 ssl crt mailcow.pem\n\n  acl mailcow_acme path -i -m beg /.well-known/\n\n  redirect scheme https unless { ssl_fc || mailcow_acme }\n\n  default_backend mailcow\n\nbackend mailcow\n  option forwardfor\n  http-request set-header X-Forwarded-Proto https if { ssl_fc }\n  http-request set-header X-Forwarded-Proto http if !{ ssl_fc }\n  server mailcow 127.0.0.1:8080 check\n
          "},{"location":"de/post_installation/reverse-proxy/r_p-nginx/","title":"Nginx","text":"

          Wichtig

          Lesen Sie zuerst die \u00dcbersicht.

          Let's Encrypt folgt unserem Rewrite, Zertifikatsanfragen funktionieren problemlos.

          Achten Sie auf die hervorgehobenen Zeilen.

          server {\n  listen 80 default_server;\n  listen [::]:80 default_server;\n  server_name ZU MAILCOW HOSTNAMEN \u00c4NDERN autodiscover.* autoconfig.*;\n  return 301 https://$host$request_uri;\n}\nserver {\n  listen 443 ssl http2;\n  listen [::]:443 ssl http2;\n  server_name ZU MAILCOW HOSTNAMEN \u00c4NDERN autodiscover.* autoconfig.*;\n\n  ssl_certificate MAILCOW_PATH/data/assets/ssl/cert.pem;\n  ssl_certificate_key MAILCOW_PATH/data/assets/ssl/key.pem;\n  ssl_session_timeout 1d;\n  ssl_session_cache shared:SSL:50m;\n  ssl_session_tickets off;\n\n  # Siehe https://ssl-config.mozilla.org/#server=nginx f\u00fcr die neuesten Empfehlungen zu ssl-Einstellungen\n  # Ein Beispiel f\u00fcr eine Konfiguration ist unten angegeben\n  ssl_protocols TLSv1.2;\n  ssl_ciphers HIGH:!aNULL:!MD5:!SHA1:!kRSA;\n  ssl_prefer_server_ciphers off;\n\n  location /Microsoft-Server-ActiveSync {\n    proxy_pass http://127.0.0.1:8080/Microsoft-Server-ActiveSync;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_connect_timeout 75;\n    proxy_send_timeout 3650;\n    proxy_read_timeout 3650;\n    proxy_buffers 64 512k; # Seit dem 2022-04 Update n\u00f6tig f\u00fcr SOGo\n    client_body_buffer_size 512k;\n    client_max_body_size 0;\n  }\n\n  location / {\n    proxy_pass http://127.0.0.1:8080/;\n    proxy_set_header Host $http_host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    client_max_body_size 0;\n  # Die folgenden Proxy-Buffer m\u00fcssen gesetzt werden, wenn Sie SOGo nach dem Update 2022-04 (April 2022) verwenden wollen\n  # Andernfalls wird ein Login wie folgt fehlschlagen: https://github.com/mailcow/mailcow-dockerized/issues/4537\n    proxy_buffer_size 128k;\n    proxy_buffers 64 512k;\n    proxy_busy_buffers_size 512k;\n  }\n}\n
          "},{"location":"de/post_installation/reverse-proxy/r_p-traefik2/","title":"Traefik v2 (von der Community unterst\u00fctzt)","text":"

          Wichtig

          Lesen Sie zuerst die \u00dcbersicht.

          Warnung

          Dies ist ein nicht unterst\u00fctzter Community Beitrag. Korrekturen sind immer erw\u00fcnscht!

          Wichtig: Diese Konfiguration deckt nur das \"Reverseproxing\" des Webpanels (nginx-mailcow) unter Verwendung von Traefik v2 ab. Wenn Sie auch die Mail-Dienste wie dovecot, postfix... reproxen wollen, m\u00fcssen Sie die folgende Konfiguration an jeden Container anpassen und einen EntryPoint in Ihrer traefik.toml oder traefik.yml (je nachdem, welche Konfiguration Sie verwenden) f\u00fcr jeden Port erstellen.

          In diesem Abschnitt gehen wir davon aus, dass Sie Ihren Traefik 2 [certificatesresolvers] in Ihrer Traefik-Konfigurationsdatei richtig konfiguriert haben und auch acme verwenden. Das folgende Beispiel verwendet Lets Encrypt, aber Sie k\u00f6nnen es gerne auf Ihren eigenen Zertifikatsresolver \u00e4ndern. Eine grundlegende Traefik 2 toml-Konfigurationsdatei mit allen oben genannten Elementen, die f\u00fcr dieses Beispiel verwendet werden kann, finden Sie hier traefik.toml, falls Sie eine solche Datei ben\u00f6tigen oder einen Hinweis, wie Sie Ihre Konfiguration anpassen k\u00f6nnen.

          Zuallererst werden wir den acme-mailcow-Container deaktivieren, da wir die von traefik bereitgestellten Zertifikate verwenden werden. Dazu m\u00fcssen wir SKIP_LETS_ENCRYPT=y in unserer mailcow.conf setzen und den folgenden Befehl ausf\u00fchren, um die \u00c4nderungen zu \u00fcbernehmen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Dann erstellen wir eine docker-compose.override.yml Datei, um die Hauptdatei docker-compose.yml zu \u00fcberschreiben, die sich im mailcow-Stammverzeichnis befindet. 

          services:\n    nginx-mailcow:\n      networks:\n        # Traefiks Netzwerk hinzuf\u00fcgen\n        web:\n      labels:\n        - traefik.enable=true\n        # Erstellt einen Router namens \"moo\" f\u00fcr den Container und richtet eine Regel ein, um den Container mit einer bestimmten Regel zu verkn\u00fcpfen,\n        # in diesem Fall eine Host-Regel mit unserer MAILCOW_HOSTNAME-Variable.\n        - traefik.http.routers.moo.rule=Host(`${MAILCOW_HOSTNAME}`)\n        # Aktiviert tls \u00fcber den zuvor erstellten Router.\n        - traefik.http.routers.moo.tls=true\n        # Gibt an, welche Art von Cert-Resolver wir verwenden werden, in diesem Fall le (Lets Encrypt).\n        - traefik.http.routers.moo.tls.certresolver=le\n        # Erzeugt einen Dienst namens \"moo\" f\u00fcr den Container und gibt an, welchen internen Port des Containers\n        # Traefik die eingehenden Daten weiterleiten soll.\n        - traefik.http.services.moo.loadbalancer.server.port=${HTTP_PORT}\n        # Gibt an, welchen Eingangspunkt (externer Port) traefik f\u00fcr diesen Container abh\u00f6ren soll.\n        # Websecure ist Port 443, siehe die Datei traefik.toml wie oben.\n        - traefik.http.routers.moo.entrypoints=websecure\n        # Stellen Sie sicher, dass traefik das Web-Netzwerk verwendet, nicht das mailcowdockerized_mailcow-network\n        - traefik.docker.network=traefik_web\n\n    certdumper:\n        image: ghcr.io/kereis/traefik-certs-dumper\n        command: --restart-containers ${COMPOSE_PROJECT_NAME}-postfix-mailcow-1,${COMPOSE_PROJECT_NAME}-nginx-mailcow-1,${COMPOSE_PROJECT_NAME}-dovecot-mailcow-1\n        network_mode: none\n        volumes:\n          # Binden Sie das Volume, das Traefiks `acme.json' Datei enth\u00e4lt, ein\n          - acme:/traefik:ro\n          # SSL-Ordner von mailcow einh\u00e4ngen\n          - ./data/assets/ssl/:/output:rw\n          # Binden Sie den Docker Socket ein, damit traefik-certs-dumper die Container neu starten kann\n          - /var/run/docker.sock:/var/run/docker.sock:ro\n        restart: always\n        environment:\n          # \u00c4ndern Sie dies nur, wenn Sie eine andere Domain f\u00fcr mailcows Web-Frontend verwenden als in der Standard-Konfiguration\n          - DOMAIN=${MAILCOW_HOSTNAME}\n\nnetworks:\n  web:\n    external: true\n    # Name des externen Netzwerks\n    name: traefik_web\n\nvolumes:\n  acme:\n    external: true\n    # Name des externen Docker Volumes, welches Traefiks `acme.json' Datei enth\u00e4lt\n    name: traefik_acme\n

          Starten Sie die neuen Container mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Da Traefik 2 ein acme v2 Format verwendet, um ALLE Zertifikaten von allen Domains zu speichern, m\u00fcssen wir einen Weg finden, die Zertifikate auszulagern. Zum Gl\u00fcck haben wir [diesen kleinen Container] (https://hub.docker.com/r/humenius/traefik-certs-dumper), der die Datei acme.json \u00fcber ein Volume und eine Variable DOMAIN=example. org, und damit wird der Container die cert.pem und key.pem Dateien ausgeben, daf\u00fcr lassen wir einfach den traefik-certs-dumper Container laufen, binden das /traefik Volume an den Ordner, in dem unsere acme.json gespeichert ist, binden das /output Volume an unseren mailcow data/assets/ssl/ Ordner, und setzen die DOMAIN=example.org Variable auf die Domain, von der wir die Zertifikate ausgeben wollen.

          Dieser Container \u00fcberwacht die Datei acme.json auf \u00c4nderungen und generiert die Dateien cert.pem und key.pem direkt in data/assets/ssl/, wobei der Pfad mit dem /output-Pfad des Containers verbunden ist.

          Sie k\u00f6nnen es \u00fcber die Kommandozeile ausf\u00fchren oder das hier gezeigte docker-compose.yml verwenden.

          Nachdem wir die Zertifikate \u00fcbertragen haben, m\u00fcssen wir die Konfigurationen aus unseren Postfix- und Dovecot-Containern neu laden und die Zertifikate \u00fcberpr\u00fcfen. Wie das geht, sehen Sie hier.

          Und das sollte es gewesen sein \ud83d\ude0a, Sie k\u00f6nnen \u00fcberpr\u00fcfen, ob der Traefik-Router einwandfrei funktioniert, indem Sie das Dashboard von Traefik / traefik logs / \u00fcber https auf die eingestellte Domain zugreifen, oder / und HTTPS, SMTP und IMAP mit den Befehlen auf der zuvor verlinkten Seite \u00fcberpr\u00fcfen.

          "},{"location":"de/post_installation/reverse-proxy/r_p/","title":"\u00dcbersicht","text":"

          Sie m\u00fcssen die Nginx-Seite, die mit mailcow: dockerized geliefert wird, nicht \u00e4ndern. mailcow: dockerized vertraut auf das Standard-Gateway IP 172.22.1.1 als Proxy.

          Stellen Sie sicher, dass Sie HTTP_BIND und HTTPS_BIND in mailcow.conf auf eine lokale Adresse \u00e4ndern und die Ports entsprechend einstellen, zum Beispiel: 

          HTTP_BIND=127.0.0.1\nHTTP_PORT=8080\nHTTPS_BIND=127.0.0.1\nHTTPS_PORT=8443\n

          Dadurch werden auch die Bindungen innerhalb des Nginx-Containers ge\u00e4ndert! Dies ist wichtig, wenn Sie sich entscheiden, einen Proxy innerhalb von Docker zu verwenden.

          WICHTIG: Verwenden Sie nicht Port 8081, 9081 oder 65510!

          Erzeugen Sie die betroffenen Container neu, indem Sie den folgenden Befehl ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/post_installation/reverse-proxy/r_p/#wichtige-informationen-bitte-lesen-sie-diese-sorgfaltig-durch","title":"Wichtige Informationen, bitte lesen Sie diese sorgf\u00e4ltig durch!","text":"

          Info

          Wenn Sie planen, einen Reverse-Proxy zu verwenden und einen anderen Servernamen als MAILCOW_HOSTNAME verwenden wollen, m\u00fcssen Sie Zus\u00e4tzliche Servernamen f\u00fcr mailcow UI hierunter.

          Warnung

          Stellen Sie sicher, dass Sie generate_config.sh ausf\u00fchren, bevor Sie die Konfigurationsbeispiele aktivieren. Das Skript generate_config.sh kopiert die Snake-oil Zertifikate an den richtigen Ort, so dass die Dienste nicht aufgrund fehlender Dateien nicht starten k\u00f6nnen.

          Warnung

          Wenn Sie TLS SNI aktivieren (ENABLE_SSL_SNI in mailcow.conf), m\u00fcssen die Zertifikatspfade in Ihrem Reverse-Proxy mit den korrekten Pfaden in data/assets/ssl/{hostname} \u00fcbereinstimmen. Die Zertifikate werden in data/assets/ssl/{hostname1,hostname2,etc} aufgeteilt und werden daher nicht funktionieren, wenn Sie die Beispiele von unten kopieren, die auf data/assets/ssl/cert.pem etc. zeigen.

          Info

          Die Verwendung der Konfigurationsbeispiele wird acme-Anfragen an mailcow weiterleiten und es die Zertifikate selbst verwalten lassen. Der Nachteil der Verwendung von mailcow als ACME-Client hinter einem Reverse-Proxy ist, dass Sie Ihren Webserver neu laden m\u00fcssen, nachdem acme-mailcow das Zertifikat ge\u00e4ndert/erneuert/erstellt hat. Sie k\u00f6nnen entweder Ihren Webserver t\u00e4glich neu laden oder ein Skript schreiben, um die Datei auf \u00c4nderungen zu \u00fcberwachen. Auf vielen Servern wird logrotate den Webserver sowieso t\u00e4glich neu laden.

          Wenn Sie eine lokale Certbot-Installation verwenden m\u00f6chten, m\u00fcssen Sie die SSL-Zertifikatsparameter entsprechend \u00e4ndern. Stellen Sie sicher, dass Sie ein Post-Hook-Skript ausf\u00fchren, wenn Sie sich entscheiden, externe ACME-Clients zu verwenden. Ein Beispiel finden Sie hierunter.

          Konfigurieren Sie Ihren lokalen Webserver als Reverse Proxy anhand folgender Konfigurationsbeispiele:

          • Apache 2.4
          • Nginx
          • HAProxy
          • Traefik v2
          • Caddy v2
          "},{"location":"de/post_installation/reverse-proxy/r_p/#optional-post-hook-skript-fur-nicht-mailcow-acme-clients","title":"Optional: Post-Hook-Skript f\u00fcr nicht-mailcow ACME-Clients","text":"

          Die Verwendung eines lokalen Certbots (oder eines anderen ACME-Clients) erfordert den Neustart einiger Container, was Sie mit einem Post-Hook-Skript erledigen k\u00f6nnen. Stellen Sie sicher, dass Sie die Pfade entsprechend \u00e4ndern: 

          #!/bin/bash\ncp /etc/letsencrypt/live/my.domain.tld/fullchain.pem /opt/mailcow-dockerized/data/assets/ssl/cert.pem\ncp /etc/letsencrypt/live/my.domain.tld/privkey.pem /opt/mailcow-dockerized/data/assets/ssl/key.pem\npostfix_c=$(docker ps -qaf name=postfix-mailcow)\ndovecot_c=$(docker ps -qaf name=dovecot-mailcow)\nnginx_c=$(docker ps -qaf name=nginx-mailcow)\ndocker restart ${postfix_c} ${dovecot_c} ${nginx_c}\n

          "},{"location":"de/post_installation/reverse-proxy/r_p/#hinzufugen-weiterer-servernamen-fur-mailcow-ui","title":"Hinzuf\u00fcgen weiterer Servernamen f\u00fcr mailcow UI","text":"

          Wenn Sie vorhaben, einen Servernamen zu verwenden, der nicht MAILCOW_HOSTNAME in Ihrem Reverse-Proxy ist, stellen Sie sicher, dass Sie diesen Namen zuerst in mailcow.conf \u00fcber ADDITIONAL_SERVER_NAMES einpflegen. Die Namen m\u00fcssen durch Kommas getrennt werden und d\u00fcrfen keine Leerzeichen enthalten. Wenn Sie diesen Schritt \u00fcberspringen, kann es sein, dass mailcow auf Ihren Reverse-Proxy mit einer falschen Seite antwortet.

          ADDITIONAL_SERVER_NAMES=webmail.domain.tld,other.example.tld\n

          F\u00fchren Sie zum Anwenden folgendes aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#einfuhrung","title":"Einf\u00fchrung","text":"

          Borgmatic ist ein gro\u00dfartiger Weg, um Backups auf Ihrem mailcow-Setup durchzuf\u00fchren, da es Ihre Daten sicher verschl\u00fcsselt und extrem einfach einzurichten ist.

          Aufgrund seiner Deduplizierungsf\u00e4higkeiten k\u00f6nnen Sie eine gro\u00dfe Anzahl von Backups speichern, ohne gro\u00dfe Mengen an Speicherplatz zu verschwenden. So k\u00f6nnen Sie Backups in sehr kurzen Abst\u00e4nden durchf\u00fchren, um einen minimalen Datenverlust zu gew\u00e4hrleisten, wenn die Notwendigkeit besteht, Daten aus einer Sicherung wiederherzustellen.

          Dieses Dokument f\u00fchrt Sie durch den Prozess zur Aktivierung kontinuierlicher Backups f\u00fcr mailcow mit borgmatic. Die borgmatic Funktionalit\u00e4t wird durch das borgmatic Docker Image bereitgestellt. Schauen Sie sich die README in diesem Repository an, um mehr \u00fcber die anderen Optionen (wie z.B. Push-Benachrichtigungen) zu erfahren, die verf\u00fcgbar sind. Diese Anleitung behandelt nur die Grundlagen.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#einrichten-von-borgmatic","title":"Einrichten von borgmatic","text":""},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-oder-andern-sie-docker-composeoverrideyml","title":"Erstellen oder \u00e4ndern Sie docker-compose.override.yml","text":"

          Im mailcow-dockerized Stammverzeichnis erstellen oder bearbeiten Sie docker-compose.override.yml und f\u00fcgen Sie die folgende Konfiguration ein:

          services:\n  borgmatic-mailcow:\n    image: ghcr.io/borgmatic-collective/borgmatic\n    hostname: mailcow\n    restart: always\n    dns: ${IPV4_NETWORK:-172.22.1}.254\n    volumes:\n      - vmail-vol-1:/mnt/source/vmail:ro\n      - crypt-vol-1:/mnt/source/crypt:ro\n      - redis-vol-1:/mnt/source/redis:ro\n      - rspamd-vol-1:/mnt/source/rspamd:ro\n      - postfix-vol-1:/mnt/source/postfix:ro\n      - mysql-socket-vol-1:/var/run/mysqld/\n      - borg-config-vol-1:/root/.config/borg\n      - borg-cache-vol-1:/root/.cache/borg\n      - ./data/conf/borgmatic/etc:/etc/borgmatic.d:Z\n      - ./data/conf/borgmatic/ssh:/root/.ssh:Z\n    environment:\n      - TZ=${TZ}\n      - BORG_PASSPHRASE=${BORG_PASSPHRASE}\n      - DBNAME=${DBNAME}\n      - DBUSER=${DBUSER}\n      - DBPASS=${DBPASS}\n    networks:\n      mailcow-network:\n        aliases:\n          - borgmatic\n\nvolumes:\n  borg-cache-vol-1:\n  borg-config-vol-1:\n

          F\u00fcgen Sie BORG_PASSPHRASE=YouBetterPutSomethingRealGoodHere zu Ihrer mailcow.conf hinzu und stellen Sie sicher, dass Sie die BORG_PASSPHRASE in eine sichere Passphrase Ihrer Wahl \u00e4ndern.

          Aus Sicherheitsgr\u00fcnden mounten wir das maildir als schreibgesch\u00fctzt. Wenn Sie sp\u00e4ter Daten wiederherstellen wollen, m\u00fcssen Sie das ro-Flag entfernen, bevor Sie die Daten wiederherstellen. Dies wird im Abschnitt \u00fcber die Wiederherstellung von Backups beschrieben.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-sie-dataconfborgmaticetcconfigyaml","title":"Erstellen Sie data/conf/borgmatic/etc/config.yaml","text":"

          Als n\u00e4chstes m\u00fcssen wir die borgmatic-Konfiguration erzeugen. Borgmatic unterst\u00fctzt Umgebungsvariableninterpolation, dadurch erhalten wir die korrekten MySQL-Zugangsdaten \u00fcber Docker bzw. \u00fcber unsere mailcow.conf, ohne dass diese in der Konfigurationsdatei offengelegt werden.

          Vergewissern Sie sich, alle folgenden Zeilen zu kopieren!

          cat <<EOF > data/conf/borgmatic/etc/config.yaml\nsource_directories:\n    - /mnt/source/vmail\n    - /mnt/source/crypt\n    - /mnt/source/redis\n    - /mnt/source/rspamd\n    - /mnt/source/postfix\nrepositories:\n    - path: ssh://user@rsync.net:22/./mailcow\n      label: rsync\nexclude_patterns:\n    - '/mnt/source/postfix/public/'\n    - '/mnt/source/postfix/private/'\n    - '/mnt/source/rspamd/rspamd.sock'\n\nkeep_hourly: 24\nkeep_daily: 7\nkeep_weekly: 4\nkeep_monthly: 6\n\nmysql_databases:\n    - name: ${DBNAME}\n      username: ${DBUSER}\n      password: ${DBPASS}\n      options: --default-character-set=utf8mb4\nEOF\n

          Warning

          Ab borgmatic 1.8.0 (erschienen am 19. Juli 2023) wurde der Aufbau der Konfigurationsdatei ge\u00e4ndert. Sie k\u00f6nnen die Docker-Logs des Borgmatic-Containers auf Deprecation-Warnmeldungen pr\u00fcfen, um festzustellen, ob Sie betroffen sind und Ihre Konfigurationsdatei f\u00fcr eine \u00e4ltere Version von borgmatic erstellt wurde. In diesem Fall sollten Sie eine neue config.yaml-Datei wie oben beschrieben erstellen, um Probleme mit zuk\u00fcnftigen Versionen von borgmatic zu vermeiden.

          Diese Datei ist ein minimales Beispiel f\u00fcr die Verwendung von borgmatic mit einem Konto user beim Cloud-Speicheranbieter rsync.net f\u00fcr ein Repository namens mailcow (siehe Einstellung repositories). Dies muss entsprechend angepasst werden.

          Es wird sowohl das maildir als auch die MySQL-Datenbank gesichert, was alles ist, was Sie brauchen, um Ihre mailcow nach einem Vorfall wiederherzustellen.

          Im Backup wird jeweils ein Archiv f\u00fcr jede der letzten 24 Stunden, eines f\u00fcr jeden der letzten 7 Wochentage, eines f\u00fcr jede der letzten 4 Wochen und eines pro Monat des letzten halben Jahrs behalten.

          Schauen Sie in der borgmatic Dokumentation nach, wie Sie andere Arten von Repositories oder Konfigurationsoptionen nutzen k\u00f6nnen. Wenn Sie ein lokales Dateisystem als Backup-Ziel verwenden, stellen Sie sicher, dass Sie es in den Container einbinden. Der Container definiert zu diesem Zweck ein Volume namens /mnt/borg-repository.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#erstellen-sie-einen-crontab","title":"Erstellen Sie einen crontab","text":"

          Erstellen Sie eine neue Textdatei in data/conf/borgmatic/etc/crontab.txt mit folgendem Inhalt:

          14 * * * * PATH=$PATH:/usr/local/bin /usr/local/bin/borgmatic --stats -v 0 2>&1\n

          Diese Datei erwartet eine crontab-Syntax. Das hier gezeigte Beispiel veranlasst das Backup, jede Stunde um 14 Minuten nach der vollen Stunde auszuf\u00fchren und am Ende einige nette Statistiken zu protokollieren.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#ssh-schlussel-in-ordner-ablegen","title":"SSH-Schl\u00fcssel in Ordner ablegen","text":"

          Legen Sie die SSH-Schl\u00fcssel, die Sie f\u00fcr Verbindungen zu entfernten Repositories verwenden wollen, in data/conf/borgmatic/ssh ab. OpenSSH erwartet die \u00fcbliche id_rsa, id_ed25519 oder \u00e4hnliches in diesem Verzeichnis zu finden. Stellen Sie sicher, dass die Datei chmod 600 und nicht f\u00fcr alle lesbar ist, oder OpenSSH wird sich weigern, den SSH-Schl\u00fcssel zu benutzen.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#den-container-hochfahren","title":"Den Container hochfahren","text":"

          F\u00fcr den n\u00e4chsten Schritt m\u00fcssen wir den Container in einem konfigurierten Zustand hochfahren und laufen lassen. Um das zu tun, f\u00fchren Sie aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#das-backup-repository-initialisieren","title":"Das Backup Repository initialisieren","text":"

          Zwar ist Ihr borgmatic-Container jetzt betriebsbereit, aber die Backups schlagen derzeit fehl, da das Repository nicht initialisiert wurde.

          Um das Repository zu initialisieren, f\u00fchren Sie folgenden Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n
          docker-compose exec borgmatic-mailcow borgmatic init --encryption repokey-blake2\n

          Sie werden aufgefordert, den SSH-Hostschl\u00fcssel Ihres entfernten Repository-Servers zu authentifizieren. Pr\u00fcfen Sie, ob er \u00fcbereinstimmt und best\u00e4tigen Sie die Aufforderung mit yes. Das Repository wird mit der Passphrase initialisiert, die Sie zuvor in der Umgebungsvariable BORG_PASSPHRASE gesetzt haben.

          Bei Verwendung einer der repokey-Verschl\u00fcsselungsmethoden wird der Verschl\u00fcsselungsschl\u00fcssel im Repository selbst gespeichert und nicht auf dem Client, so dass in dieser Hinsicht keine weiteren Ma\u00dfnahmen erforderlich sind. Wenn Sie sich f\u00fcr die Verwendung eines keyfile anstelle von repokey entscheiden, stellen Sie sicher, dass Sie den Schl\u00fcssel exportieren und separat sichern. Lesen Sie den Abschnitt Exportieren von Schl\u00fcsseln um zu erfahren, wie Sie den Schl\u00fcssel abrufen k\u00f6nnen.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#container-neustarten","title":"Container neustarten","text":"

          Nachdem wir nun die Konfiguration und Initialisierung des Repositorys abgeschlossen haben, starten wir den Container neu, um sicherzustellen, dass er sich in einem definierten Zustand befindet:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart borgmatic-mailcow\n
          docker-compose restart borgmatic-mailcow\n
          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#wiederherstellung-von-einem-backup","title":"Wiederherstellung von einem Backup","text":"

          Das Wiederherstellen eines Backups setzt voraus, dass Sie mit einer neuen Installation von mailcow beginnen, und dass Sie derzeit keine benutzerdefinierten Daten in ihrem maildir oder ihrer mailcow-Datenbank haben.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#wiederherstellen-von-maildir","title":"Wiederherstellen von maildir","text":"

          Warnung

          Dies wird Dateien in Ihrem maildir \u00fcberschreiben! F\u00fchren Sie dies nicht aus, es sei denn, Sie beabsichtigen tats\u00e4chlich, Mail Dateien von einem Backup wiederherzustellen.

          Wenn Sie SELinux im Enforcing-Modus verwenden

          Wenn Sie mailcow auf einem Host mit SELinux im Enforcing-Modus verwenden, m\u00fcssen Sie ihn w\u00e4hrend der Extraktion des Archivs vor\u00fcbergehend deaktivieren, da das mailcow-Setup das vmail-Volume als privat kennzeichnet, das ausschlie\u00dflich dem Dovecot-Container geh\u00f6rt. SELinux wird (berechtigterweise) jeden anderen Container, wie z.B. den borgmatic Container, daran hindern, auf dieses Volume zu schreiben.

          Bevor Sie eine Wiederherstellung durchf\u00fchren, m\u00fcssen Sie das vmail-Volume in docker-compose.override.yml beschreibbar machen, indem Sie das ro-Flag aus dem Volume entfernen. Dann k\u00f6nnen Sie den folgenden Befehl verwenden, um das Maildir aus einem Backup wiederherzustellen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n
          docker-compose exec borgmatic-mailcow borgmatic extract --path mnt/source --archive latest\n

          Alternativ k\u00f6nnen Sie auch einen beliebigen Archivnamen aus der Liste der Archive angeben (siehe Auflistung aller verf\u00fcgbaren Archive)

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#mysql-wiederherstellen","title":"MySQL wiederherstellen","text":"

          Warnung

          Die Ausf\u00fchrung dieses Befehls l\u00f6scht und erstellt die mailcow-Datenbank neu! F\u00fchren Sie diesen Befehl nicht aus, es sei denn Sie beabsichtigen, die mailcow-Datenbank von einem Backup wiederherzustellen.

          Um die MySQL-Datenbank aus dem letzten Archiv wiederherzustellen, verwenden Sie diesen Befehl:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borgmatic restore --archive latest\n
          docker-compose exec borgmatic-mailcow borgmatic restore --archive latest\n

          Alternativ k\u00f6nnen Sie auch einen beliebigen Archivnamen aus der Liste der Archive angeben (siehe Auflistung aller verf\u00fcgbaren Archive)

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#nach-der-wiederherstellung","title":"Nach der Wiederherstellung","text":"

          Nach der Wiederherstellung m\u00fcssen Sie mailcow neu starten. Wenn Sie den Enforcing-Modus von SELinux deaktiviert haben, w\u00e4re jetzt ein guter Zeitpunkt, um ihn wieder zu aktivieren.

          Um mailcow neu zu starten, verwenden Sie den folgenden Befehl:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down && docker compose up -d\n
          docker-compose down && docker-compose up -d\n

          Wenn Sie SELinux verwenden, werden dadurch auch alle Dateien in Ihrem vmail-Volume neu benannt. Seien Sie geduldig, denn dies kann eine Weile dauern kann, wenn Sie viele Dateien haben.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#nutzliche-befehle","title":"N\u00fctzliche Befehle","text":""},{"location":"de/third_party/borgmatic/third_party-borgmatic/#manueller-archivierungslauf-mit-debugging-ausgabe","title":"Manueller Archivierungslauf (mit Debugging-Ausgabe)","text":"docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borgmatic -v 2\n
          docker-compose exec borgmatic-mailcow borgmatic -v 2\n
          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#auflistung-aller-verfugbaren-archive","title":"Auflistung aller verf\u00fcgbaren Archive","text":"docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borgmatic list\n
          docker-compose exec borgmatic-mailcow borgmatic list\n
          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#sperre-aufheben","title":"Sperre aufheben","text":"

          Wenn borg w\u00e4hrend eines Archivierungslaufs unterbrochen wird, hinterl\u00e4sst es eine Sperre, die gel\u00f6scht werden muss, bevor neue Operationen durchgef\u00fchrt werden k\u00f6nnen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borg break-lock\n
          docker-compose exec borgmatic-mailcow borg break-lock\n

          Jetzt w\u00e4re ein guter Zeitpunkt, einen manuellen Archivierungslauf durchzuf\u00fchren, um sicherzustellen, dass er erfolgreich durchgef\u00fchrt werden kann.

          "},{"location":"de/third_party/borgmatic/third_party-borgmatic/#exportieren-von-schlusseln","title":"Exportieren von Schl\u00fcsseln","text":"

          Wenn Sie eine der keyfile-Methoden zur Verschl\u00fcsselung verwenden, M\u00dcSSEN Sie sich selbst um die Sicherung der Schl\u00fcsseldateien k\u00fcmmern. Die Schl\u00fcsseldateien werden erzeugt, wenn Sie das Repository initialisieren. Die repokey-Methoden speichern die Schl\u00fcsseldatei innerhalb des Repositories, so dass eine manuelle Sicherung nicht so wichtig ist.

          Beachten Sie, dass Sie in beiden F\u00e4llen auch die Passphrase haben m\u00fcssen, um die Archive zu entschl\u00fcsseln.

          Um das keyfile zu holen, f\u00fchren Sie aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n
          docker-compose exec borgmatic-mailcow borg key export --paper user@rsync.net:mailcow\n

          Wobei user@rsync.net:mailcow die URI zu Ihrem Repository ist.

          "},{"location":"de/third_party/checkmk/u_e-checkmk/","title":"CheckMK","text":"

          mailcow bietet mittels des eigenen Update-Scripts die M\u00f6glichkeit zu pr\u00fcfen, ob Updates vorhanden sind.

          Sofern mailcow-Updates mittels checkmk abgefragt werden soll, kann man im local-Verzeichnis des checkmk-Agents (normalerweise /usr/lib/check_mk_agent/local/) eine ausf\u00fchrbare Datei mit dem Namen mailcow_update und nachfolgendem Inhalt erstellen:

          #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh --check-tags >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No newer tags available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 New tag is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/releases/latest\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

          Um jeden neu verf\u00fcgbaren Code als Update angezeigt zu bekommen, kann die ausf\u00fchrbare Datei mit folgendem Inhalt erstellt werden: 

          #!/bin/bash\ncd /opt/mailcow-dockerized/ && ./update.sh -c >/dev/null\nstatus=$?\nif [ $status -eq 3 ]; then\n  echo \"0 \\\"mailcow_update\\\" mailcow_update=0;1;;0;1 No updates available.\"\nelif [ $status -eq 0 ]; then\n  echo \"1 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\nelse\n  echo \"3 \\\"mailcow_update\\\" - Unknown output from update script ...\"\nfi\nexit\n

          Sofern das mailcow-Installationsverzeichnis nicht /opt/ ist, kann der Pfad in der zweiten Zeile angepasst werden.

          Danach f\u00fcr den mailcow-Host in checkmk die Services neu inventarisieren und es sollte ein neuer Check mit Namen mailcow_update ausw\u00e4hlbar sein.

          Der Check mailcow_update wird jedes Mal ausgef\u00fchrt, wenn der checkmk Agent den mailcow Server \u00fcberpr\u00fcft. Sie k\u00f6nnen das Ergebnis zwischenspeichern, indem Sie das Skript in einem Unterordner mit dem Namen der Anzahl von Sekunden ablegen, f\u00fcr die Sie es zwischenspeichern m\u00f6chten. \\ /usr/lib/check_mk_agent/local/3600/ speichert die Antwort f\u00fcr 3600 Sekunden (1 Stunde).

          "},{"location":"de/third_party/checkmk/u_e-checkmk/#keine-updates-verfugbar","title":"Keine Updates verf\u00fcgbar","text":"

          Sofern keine Updates / keine neuen Tags vorhanden sind, wird OK ausgegeben.

          "},{"location":"de/third_party/checkmk/u_e-checkmk/#neue-updates-verfugbar","title":"Neue Updates verf\u00fcgbar","text":"

          Sofern Updates / Neue Tags vorhanden sind, wird WARN ausgegeben.

          Sollte stattdessen CRIT gew\u00fcnscht sein, ist die 7. Zeile durch folgendes zu ersetzen:

          echo \"2 \\\"mailcow_update\\\" mailcow_update=1;1;;0;1 Updated code is available.\\nThe changes can be found here: https://github.com/mailcow/mailcow-dockerized/commits/master\"\n
          "},{"location":"de/third_party/checkmk/u_e-checkmk/#detailierter-check-output","title":"Detailierter Check-Output","text":"
          • Hier wird ein Link zu den GitHub Commits / des letzten Release von mailcow ausgegeben, sofern Updates verf\u00fcgbar sind.
          • Metriken werden ebenfalls ausgegeben (nicht nur bei vorhandenen Updates):
          • 0 = Keine Updates verf\u00fcgbar
          • 1 = Neue Updates verf\u00fcgbar
          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/","title":"Exchange Hybrid Setup","text":"

          Die Verwendung von Microsoft Exchange in einem hybriden Setup ist mit mailcow m\u00f6glich. Mit diesem Setup k\u00f6nnen Sie Postf\u00e4cher auf Ihrer mailcow hinzuf\u00fcgen und trotzdem Exchange Online Protection nutzen. Alle Postf\u00e4cher, die in Exchange eingerichtet sind, erhalten ihre Mails wie gewohnt, w\u00e4hrend mit dem hybriden Ansatz zus\u00e4tzliche Postf\u00e4cher in mailcow ohne weitere Konfiguration eingerichtet werden k\u00f6nnen.

          Dieses Setup ist sehr praktisch, wenn Sie die Office 365 Sicherheitsvorgaben aktiviert haben und Anwendungen von Drittanbietern sich nicht mehr in Ihre Postf\u00e4cher mit einer der unterst\u00fctzten Methoden einloggen k\u00f6nnen.

          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#voraussetzungen","title":"Voraussetzungen","text":"
          • Der mx Record Ihrer Domain muss auf den Exchange Mail Service zeigen. Melden Sie sich in Ihrem Admin-Center an und suchen Sie in den DNS-Einstellungen Ihrer Dom\u00e4ne nach Ihrer personalisierten Gateway-Dom\u00e4ne. Sie sollte wie folgt aussehen: contoso-com.mail.protection.outlook.com. Wenden Sie sich an Ihren Domainregistrator, um weitere Informationen zur \u00c4nderung des mx-Eintrags zu erhalten.
          • Die Dom\u00e4ne, f\u00fcr die Sie zus\u00e4tzliche Postf\u00e4cher haben m\u00f6chten, muss in Exchange als \"Interne Relay-Dom\u00e4ne\" eingerichtet werden.
            1. Melden Sie sich bei Ihrem Exchange Admin Center an.
            2. W\u00e4hlen Sie den Bereich \"Mailflow\" und klicken Sie auf \"Akzeptierte Dom\u00e4nen\".
            3. W\u00e4hlen Sie die Dom\u00e4ne aus und schalten Sie sie von \"autorisiert\" auf \"internes Relais\" um.
          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#einrichten-der-mailcow","title":"Einrichten der mailcow","text":"

          Ihre mailcow muss alle Mails an Ihren personalisierten Exchange Host weiterleiten. Es ist die gleiche Host-Adresse, die wir bereits f\u00fcr den mx Record gesucht haben.

          1. F\u00fcgen Sie die Domain zu Ihrer mailcow hinzu
          2. F\u00fcgen Sie Ihre personalisierte Exchange Host Adresse als relayhost hinzu
          3. F\u00fcgen Sie Ihre personalisierte Exchange Host Adresse als Weiterleitungshost hinzu, um alle weitergeleiteten Mails von Exchange bedingungslos zu akzeptieren. (Admin > Konfiguration & Details > Konfigurations-Dropdown > Weiterleitungshosts)
          4. Gehen Sie zu den Dom\u00e4neneinstellungen und w\u00e4hlen Sie den neu hinzugef\u00fcgten Host in der Dropdown-Liste \"Absenderabh\u00e4ngige Transporte\" aus. Aktivieren Sie die Weiterleitung, indem Sie die Kontrollk\u00e4stchen \"Diese Dom\u00e4ne weiterleiten\", \"Alle Empf\u00e4nger weiterleiten\" und \"Nur nicht vorhandene Postf\u00e4cher weiterleiten\" aktivieren.

          Info

          Von nun an wird Ihre mailcow alle Mails akzeptieren, die von Exchange weitergeleitet werden. Die Eingangsfilterung und damit das neuronale Lernen Ihrer Kuh wird nicht mehr funktionieren. Da alle Mails \u00fcber Exchange geroutet werden, wird der Filterungsprozess dort abgewickelt.

          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#connectors-in-exchange-einrichten","title":"Connectors in Exchange einrichten","text":"

          Der gesamte Mailverkehr l\u00e4uft nun \u00fcber Exchange. Zu diesem Zeitpunkt filtert der Exchange Online-Schutz bereits alle ein- und ausgehenden Mails. Jetzt m\u00fcssen wir zwei Konnektoren einrichten, um eingehende Mails von unserem Exchange Service an die mailcow weiterzuleiten und einen weiteren, um Mails zuzulassen, die von der mailcow an unseren Exchange Service weitergeleitet werden. Sie k\u00f6nnen der [offiziellen Anleitung von Microsoft] folgen (https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#2-set-up-a-connector-from-microsoft-365-or-office-365-to-your-email-server).

          Warnung

          F\u00fcr den Connector, der die Mails von Ihrer mailcow zu Exchange weiterleitet, bietet Microsoft zwei M\u00f6glichkeiten der Authentifizierung an. Der empfohlene Weg ist die Verwendung eines tls-Zertifikats, das mit einem Subject-Namen konfiguriert ist, der mit einer akzeptierten Dom\u00e4ne in Exchange \u00fcbereinstimmt. Andernfalls m\u00fcssen Sie die Authentifizierung mit der statischen IP-Adresse Ihrer mailcow w\u00e4hlen.

          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#validierung","title":"Validierung","text":"

          Der einfachste Weg, die hybride Einrichtung zu \u00fcberpr\u00fcfen, ist das Senden einer Mail aus dem Internet an eine Mailbox, die nur auf der mailcow existiert und andersherum.

          "},{"location":"de/third_party/exchange_onprem/third_party-exchange_onprem/#allgemeine-probleme","title":"Allgemeine Probleme","text":"
          • Die Validierung des Connectors von Exchange zu Ihrer mailcow schlug fehl mit 550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient test@contoso.com not found by SMTP address lookup M\u00f6gliche L\u00f6sung: Ihre Dom\u00e4ne ist nicht als \"internes Relay\" eingerichtet. Exchange kann daher den Empf\u00e4nger nicht finden.
          • Mails, die von der mailcow an eine Mailbox im Internet gesendet werden, k\u00f6nnen nicht zugestellt werden. Non Delivery Report mit Fehler 550 5.7.64 TenantAttribution; Relay Access Denied M\u00f6gliche L\u00f6sung: Die Authentifizierungsmethode ist fehlgeschlagen. Stellen Sie sicher, dass der Betreff des Zertifikats mit einer akzeptierten Dom\u00e4ne in Exchange \u00fcbereinstimmt. Versuchen Sie stattdessen die Authentifizierung \u00fcber eine statische IP.

          Microsoft-Anleitung f\u00fcr die Einrichtung des Connectors und zus\u00e4tzliche Anforderungen: https://docs.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/set-up-connectors-to-route-mail#prerequisites-for-your-on-premises-email-environment

          "},{"location":"de/third_party/gitea/third_party-gitea/","title":"Gitea","text":"

          Mit der F\u00e4higkeit von Gitea, sich \u00fcber SMTP zu authentifizieren, ist es trivial, es mit mailcow zu integrieren. Es sind nur wenige \u00c4nderungen erforderlich:

          1. Um eine Datenbank f\u00fcr Gitea zu erstellen, verbinden Sie sich mit ihrem Server und f\u00fchren Sie folgende Befehle aus: 

          source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gitea;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gitea'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gitea.* TO 'gitea'@'%';\"\n

          2. \u00d6ffnen Sie docker-compose.override.yml und f\u00fcgen Sie Gitea hinzu:

          services:\n\n        gitea-mailcow:\n            image: gitea/gitea:1\n            volumes:\n                - ./data/gitea:/data\n            networks:\n                mailcow-network:\n                    aliases:\n                        - gitea\n            ports:\n                - \"${GITEA_SSH_PORT:-127.0.0.1:4000}:22\"\n

          3. Erstellen Sie data/conf/nginx/site.gitea.custom, f\u00fcgen Sie folgendes hinzu: 

          location /gitea/ {\n        proxy_pass http://gitea:3000/;\n}\n

          4. \u00d6ffne mailcow.conf und definiere den Port Bind, den Gitea f\u00fcr SSH verwenden soll. Beispiel:

          GITEA_SSH_PORT=127.0.0.1:4000\n

          5. F\u00fchren Sie folgenden Befehl aus, um den Gitea-Container hochzufahren und f\u00fchren Sie anschlie\u00dfend einen Neustart von NGINX mit dem zweiten Befehl durch:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\ndocker compose restart nginx-mailcow\n
          docker-compose up -d\ndocker-compose restart nginx-mailcow\n

          6. Wenn Sie mailcow zu https gezwungen haben, f\u00fchren Sie Schritt 9 aus und starten Sie gitea mit dem folgenden Befehl neu.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart gitea-mailcow\n
          docker-compose restart gitea-mailcow\n

          Fahren Sie mit Schritt 7 fort (Denken Sie daran, https anstelle von http zu verwenden, https://mx.example.org/gitea/)

          7. \u00d6ffnen Sie http://${MAILCOW_HOSTNAME}/gitea/, zum Beispiel http://mx.example.org/gitea/. F\u00fcr Datenbank-Details setzen Sie mysql als Datenbank-Host. Verwenden Sie gitea als Datenbankname, gitea als Datenbankbenutzer und your_strong_password als Datenbankpasswort, welches Sie in Schritt 1 definiert haben.

          8. Sobald die Installation abgeschlossen ist, loggen Sie sich als Administrator ein und setzen Sie \"Einstellungen\" -> \"Autorisierung\" -> \"SMTP aktivieren\". SMTP-Host sollte postfix mit Port 587 sein, setzen Sie Skip TLS Verify, da wir ein nicht gelistetes SAN verwenden (\"postfix\" ist h\u00f6chstwahrscheinlich nicht Teil Ihres Zertifikats).

          9. Erstellen Sie data/gitea/gitea/conf/app.ini und setzen Sie die folgenden Werte. Sie k\u00f6nnen gitea cheat sheet, leider bisher nur in Englisch verf\u00fcgbar f\u00fcr deren Bedeutung und andere m\u00f6gliche Werte konsultieren.

          [server]\nSSH_LISTEN_PORT = 22\n# F\u00fcr GITEA_SSH_PORT=127.0.0.1:4000 in mailcow.conf, setzen:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# F\u00fcr MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (und Standard-Ports f\u00fcr HTTPS), setzen:\nROOT_URL = https://mx.example.org/gitea/\n

          10. Starten Sie gitea neu mit dem kommenden Befehl. Ihre Nutzer sollten in der Lage sein, sich mit von mailcow verwalteten Konten anzumelden.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart gitea-mailcow\n
          docker-compose restart gitea-mailcow\n
          "},{"location":"de/third_party/gogs/third_party-gogs/","title":"Gogs","text":"

          Mit Gogs' F\u00e4higkeit, sich \u00fcber SMTP zu authentifizieren, ist es einfach, es mit mailcow zu verbinden. Es sind nur wenige \u00c4nderungen erforderlich:

          1. Um eine Datenbank f\u00fcr Gogs zu erstellen, verbinden Sie sich mit ihrem Server und f\u00fchren Sie folgende Befehle aus: 

          source mailcow.conf\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE gogs;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'gogs'@'%' IDENTIFIED BY 'your_strong_password';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON gogs.* TO 'gogs'@'%';\n

          2. \u00d6ffne docker-compose.override.yml und f\u00fcge Gogs hinzu:

          services:\n\n    gogs-mailcow:\n      image: gogs/gogs\n      volumes:\n        - ./data/gogs:/data\n      networks:\n        mailcow-network:\n          aliases:\n            - gogs\n      ports:\n        - \"${GOGS_SSH_PORT:-127.0.0.1:4000}:22\"\n

          3. Erstelle data/conf/nginx/site.gogs.custom, f\u00fcge hinzu: 

          location /gogs/ {\n    proxy_pass http://gogs:3000/;\n}\n

          4. \u00d6ffne mailcow.conf und definiere die Bindung, die Gogs f\u00fcr SSH verwenden soll. Beispiel:

          GOGS_SSH_PORT=127.0.0.1:4000\n

          5. F\u00fchren Sie folgenden Befehl aus, um den Gogs-Container hochzufahren und f\u00fchren Sie anschlie\u00dfend einen Neustart von NGINX mit dem zweiten Befehl durch:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\ndocker compose restart nginx-mailcow\n
          docker-compose up -d\ndocker-compose restart nginx-mailcow\n

          6. \u00d6ffnen Sie http://${MAILCOW_HOSTNAME}/gogs/, zum Beispiel http://mx.example.org/gogs/. F\u00fcr Datenbank-Details setzen Sie mysql als Datenbank-Host. Verwenden Sie gogs als Datenbankname, gogs als Datenbankbenutzer und your_strong_password als Datenbankpasswort, welches Sie in Schritt 1 definiert haben.

          7. Sobald die Installation abgeschlossen ist, loggen Sie sich als Administrator ein und setzen Sie \"Einstellungen\" -> \"Autorisierung\" -> \"SMTP aktivieren\". SMTP-Host sollte postfix mit Port 587 sein, setzen Sie Skip TLS Verify, da wir ein nicht gelistetes SAN verwenden (\"postfix\" ist h\u00f6chstwahrscheinlich nicht Teil Ihres Zertifikats).

          8. Erstellen Sie data/gogs/gogs/conf/app.ini und setzen Sie die folgenden Werte. Sie k\u00f6nnen Gogs cheat sheet f\u00fcr ihre Bedeutung und andere m\u00f6gliche Werte konsultieren.

          [server]\nSSH_LISTEN_PORT = 22\n# F\u00fcr GOGS_SSH_PORT=127.0.0.1:4000 in mailcow.conf, setzen:\nSSH_DOMAIN = 127.0.0.1\nSSH_PORT = 4000\n# F\u00fcr MAILCOW_HOSTNAME=mx.example.org in mailcow.conf (und Standard-Ports f\u00fcr HTTPS), setzen:\nROOT_URL = https://mx.example.org/gogs/\n

          9. Starten Sie Gogs neu mit dem kommenden Befehl. Ihre Nutzer sollten in der Lage sein, sich mit von mailcow verwalteten Konten anzumelden.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart gogs-mailcow\n
          docker-compose restart gogs-mailcow\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/","title":"Installation von mailcow und Mailman 3 auf der Basis von dockerisierten Versionen","text":"

          Info

          Diese Anleitung ist eine Kopie von dockerized-mailcow-mailman. Bitte posten Sie Probleme, Fragen und Verbesserungen in den issue tracker dort.

          Warnung

          mailcow ist nicht verantwortlich f\u00fcr Datenverlust, Hardwaresch\u00e4den oder kaputte Tastaturen. Diese Anleitung kommt ohne jegliche Garantie. Macht Backups bevor ihr anfangt, Kein Backup kein Mitleid!

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#einleitung","title":"Einleitung","text":"

          Diese Anleitung zielt darauf ab, mailcow-dockerized mit [docker-mailman] (https://github.com/maxking/docker-mailman) zu installieren und zu konfigurieren und einige n\u00fctzliche Skripte bereitzustellen. Eine wesentliche Bedingung ist, dass mailcow und Mailman in ihren eigenen Installationen f\u00fcr unabh\u00e4ngige Updates erhalten bleiben.

          Es gibt einige Anleitungen und Projekte im Internet, aber sie sind nicht auf dem neuesten Stand und/oder unvollst\u00e4ndig in der Dokumentation oder Konfiguration. Diese Anleitung basiert auf der Arbeit von:

          • mailcow-mailman3-dockerized von Shadowghost
          • mailman-mailcow-integration

          Nach Beendigung dieser Anleitung werden mailcow-dockerized und docker-mailman laufen und Apache als Reverse-Proxy wird die Web-Frontends bedienen.

          Das verwendete Betriebssystem ist ein Ubuntu 20.04 LTS.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#installation","title":"Installation","text":"

          Diese Anleitung basiert auf verschiedenen Schritten:

          1. DNS-Einrichtung
          2. Installieren Sie Apache als Reverse Proxy
          3. Beziehen Sie SSL-Zertifikate mit Let's Encrypt.
          4. Installieren Sie mailcow mit Mailman Integration
          5. Installieren Sie Mailman.
          6. \ud83c\udfc3 Ausf\u00fchren
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#dns-einrichtung","title":"DNS-Einrichtung","text":"

          Der gr\u00f6\u00dfte Teil der Konfiguration ist in mailcows DNS Konfiguration enthalten. Nachdem diese Einrichtung abgeschlossen ist, f\u00fcgen Sie eine weitere Subdomain f\u00fcr Mailman hinzu, z.B. lists.example.org, die auf denselben Server zeigt:

          # Name Typ Wert\nlists IN A 1.2.3.4\nlists IN AAAA dead:beef\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-apache-als-reverse-proxy","title":"Installieren Sie Apache als Reverse Proxy","text":"

          Installieren Sie Apache, z.B. mit dieser Anleitung von Digital Ocean: How To Install the Apache Web Server on Ubuntu 20.04 (Englisch).

          Aktivieren Sie bestimmte Apache Module (als root oder sudo):

          a2enmod rewrite proxy proxy_http headers ssl wsgi proxy_uwsgi http2\n

          M\u00f6glicherweise m\u00fcssen Sie weitere Pakete installieren, um diese Module zu erhalten. Dieses PPA von Ond\u0159ej Sur\u00fd k\u00f6nnte Ihnen helfen.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#vhost-konfiguration","title":"vHost-Konfiguration","text":"

          Kopieren Sie die mailcow.conf und die mailman.conf in den Apache conf Ordner sites-available (z.B. unter /etc/apache2/sites-available).

          \u00c4nderung in mailcow.conf: - MAILCOW_HOSTNAME zu Ihrem MAILCOW_HOSTNAME

          \u00c4nderung in mailman.conf: - MAILMAN_DOMAIN in Ihre Mailman-Domain (z.B. Lists.example.org)

          **Aktivieren Sie die Konfiguration noch nicht, da die ssl-Zertifikate und Verzeichnisse noch fehlen.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#beziehen-sie-ssl-zertifikate-mit-lets-encrypt","title":"Beziehen Sie SSL-Zertifikate mit Let's Encrypt.","text":"

          Pr\u00fcfen Sie, ob Ihre DNS-Konfiguration \u00fcber das Internet verf\u00fcgbar ist und auf die richtigen IP-Adressen zeigt, z.B. mit MXToolBox:

          • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILCOW_HOSTNAME
          • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILCOW_HOSTNAME
          • https://mxtoolbox.com/SuperTool.aspx?action=a%3aMAILMAN_DOMAIN
          • https://mxtoolbox.com/SuperTool.aspx?action=aaaa%3aMAILMAN_DOMAIN

          Installieren Sie certbot (als root oder sudo):

          apt install certbot\n

          Holen Sie sich die gew\u00fcnschten Zertifikate (als root oder sudo):

          certbot certonly -d mailcow_HOSTNAME\ncertbot certonly -d MAILMAN_DOMAIN\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailcow-mit-mailman-integration","title":"Installieren Sie mailcow mit Mailman Integration","text":""},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailcow","title":"Installieren Sie mailcow","text":"

          Folgen Sie der mailcow installation. Schritt 5 auslassen und nicht mit starten!

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailcow-konfigurieren","title":"mailcow konfigurieren","text":"

          Dies ist auch Schritt 4 in der offiziellen mailcow-Installation (nano mailcow.conf). Passen Sie also Ihre Bed\u00fcrfnisse an und \u00e4ndern Sie die folgenden Variablen:

          HTTP_PORT=18080 # verwenden Sie nicht 8080, da mailman es braucht\nHTTP_BIND=127.0.0.1 #\nHTTPS_PORT=18443 # Sie k\u00f6nnen 8443 verwenden\nHTTPS_BIND=127.0.0.1 # # HTTPS_BIND=127.0.0.1\n\nSKIP_LETS_ENCRYPT=y # Der Reverse Proxy wird die SSL-Verifizierung durchf\u00fchren\n\nSNAT_TO_SOURCE=1.2.3.4 # \u00e4ndern Sie dies in Ihre IPv4\nSNAT6_TO_SOURCE=dead:beef # \u00c4ndern Sie dies in Ihre globale IPv6\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailman-integration-hinzufugen","title":"Mailman-Integration hinzuf\u00fcgen","text":"

          Erstelle die Datei /opt/mailcow-dockerized/docker-compose.override.yml (z.B. mit nano) und f\u00fcge die folgenden Zeilen hinzu:

          services:\n  postfix-mailcow:\n    volumes:\n      - /opt/mailman:/opt/mailman\n    networks:\n      - docker-mailman_mailman\n\nnetworks:\n  docker-mailman_mailman:\n    external: true\n

          Das zus\u00e4tzliche Volume wird von Mailman verwendet, um zus\u00e4tzliche Konfigurationsdateien f\u00fcr mailcow postfix zu generieren. Das externe Netzwerk wird von Mailman erstellt und verwendet. mailcow ben\u00f6tigt es, um eingehende Listenmails an Mailman zu liefern.

          Erstellen Sie die Datei /opt/mailcow-dockerized/data/conf/postfix/extra.cf (z.B. mit nano) und f\u00fcgen Sie die folgenden Zeilen hinzu:

          # mailman\n\nrecipient_delimiter = +\nunknown_local_recipient_reject_code = 550\nowner_request_special = no\n\nlocal_recipient_maps =\n  regexp:/opt/mailman/core/var/data/postfix_lmtp,\n  proxy:unix:passwd.byname,\n  $alias_maps\nvirtual_mailbox_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_mailbox_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\ntransport_maps =\n  pcre:/opt/postfix/conf/custom_transport.pcre,\n  pcre:/opt/postfix/conf/local_transport,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_ne.cf,\n  proxy:mysql:/opt/postfix/conf/sql/mysql_transport_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\nrelay_domains =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_virtual_relay_domain_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_domains\nrelay_recipient_maps =\n  proxy:mysql:/opt/postfix/conf/sql/mysql_relay_recipient_maps.cf,\n  regexp:/opt/mailman/core/var/data/postfix_lmtp\n

          Da wir hier die mailcow postfix Konfiguration \u00fcberschreiben, kann dieser Schritt Ihre normalen Mailtransporte unterbrechen. \u00dcberpr\u00fcfen Sie die originalen Konfigurationsdateien, wenn sich etwas ge\u00e4ndert hat.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#ssl-zertifikate","title":"SSL-Zertifikate","text":"

          Da wir mailcow als Proxy verwenden, m\u00fcssen wir die SSL-Zertifikate in die mailcow-Dateistruktur kopieren. Diese Aufgabe wird das Skript renew-ssl.sh f\u00fcr uns erledigen:

          • Kopieren Sie die Datei nach /opt/mailcow-dockerized
          • \u00c4ndere mailcow_HOSTNAME in deinen mailcow Hostnamen
          • Machen Sie es ausf\u00fchrbar (chmod a+x renew-ssl.sh)
          • Noch nicht ausf\u00fchren, da wir zuerst Mailman ben\u00f6tigen

          Sie m\u00fcssen einen cronjob erstellen, so dass neue Zertifikate kopiert werden. F\u00fchren Sie ihn als root oder sudo aus:

          crontab -e\n

          Um das Skript jeden Tag um 5 Uhr morgens laufen zu lassen, f\u00fcgen Sie hinzu:

          0 5 * * * /opt/mailcow-dockerized/renew-ssl.sh\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#installieren-sie-mailman","title":"Installieren Sie Mailman.","text":"

          Befolgen Sie im Wesentlichen die Anweisungen unter docker-mailman. Da sie sehr umfangreich sind, ist hier in aller K\u00fcrze beschrieben, was zu tun ist:

          Als root oder sudo:

          cd /opt\nmkdir -p mailman/core\nmkdir -p mailman/web\ngit clone https://github.com/maxking/docker-mailman\ncd docker-mailman\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#mailman-konfigurieren","title":"Mailman konfigurieren","text":"

          Erstellen Sie einen langen Schl\u00fcssel f\u00fcr Hyperkitty, z.B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie diesen Schl\u00fcssel vorerst als HYPERKITTY_KEY.

          Erstellen Sie ein langes Passwort f\u00fcr die Datenbank, z. B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie dieses Passwort zun\u00e4chst als DBPASS.

          Erstellen Sie einen langen Schl\u00fcssel f\u00fcr Django, z. B. mit dem Linux-Befehl cat /dev/urandom | tr -dc a-zA-Z0-9 | head -c30; echo. Speichern Sie diesen Schl\u00fcssel f\u00fcr einen Moment als DJANGO_KEY.

          Erstellen Sie die Datei /opt/docker-mailman/docker compose.override.yaml und ersetzen Sie HYPERKITTY_KEY, DBPASS und DJANGO_KEY durch die generierten Werte:

          services:\n  mailman-core:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - MTA=postfix\n    restart: always\n    networks:\n      - mailman\n\n  mailman-web:\n    environment:\n    - DATABASE_URL=postgresql://mailman:DBPASS@database/mailmandb\n    - HYPERKITTY_API_KEY=HYPERKITTY_KEY\n    - TZ=Europe/Berlin\n    - SECRET_KEY=DJANGO_KEY\n    - SERVE_FROM_DOMAIN=MAILMAN_DOMAIN # e.g. lists.example.org\n    - MAILMAN_ADMIN_USER=admin # the admin user\n    - MAILMAN_ADMIN_EMAIL=admin@example.org # the admin mail address\n    - UWSGI_STATIC_MAP=/static=/opt/mailman-web-data/static\n    restart: always\n\n  database:\n    environment:\n    - POSTGRES_PASSWORD=DBPASS\n    restart: always\n

          Bei mailman-web geben Sie die korrekten Werte f\u00fcr SERVE_FROM_DOMAIN (z.B. lists.example.org), MAILMAN_ADMIN_USER und MAILMAN_ADMIN_EMAIL ein. Sie ben\u00f6tigen die Admin-Zugangsdaten, um sich in der Web-Oberfl\u00e4che (Pistorius) anzumelden. Um das Passwort zum ersten Mal zu setzen, verwenden Sie die Funktion Passwort vergessen im Webinterface.

          \u00dcber andere Konfigurationsoptionen lesen Sie die Dokumentationen Mailman-web und Mailman-core.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#konfigurieren-sie-mailman-core-und-mailman-web","title":"Konfigurieren Sie Mailman core und Mailman web","text":"

          Erstellen Sie die Datei /opt/mailman/core/mailman-extra.cfg mit dem folgenden Inhalt. mailman@example.org sollte auf ein g\u00fcltiges Postfach oder eine Umleitung verweisen.

          [mailman]\ndefault_language: de\nsite_owner: mailman@example.org\n

          Erstellen Sie die Datei /opt/mailman/web/settings_local.py mit dem folgenden Inhalt. mailman@example.org sollte auf ein g\u00fcltiges Postfach oder eine Umleitung verweisen.

          # Gebietsschema\nLANGUAGE_CODE = 'de-de'\n\n# soziale Authentifizierung deaktivieren\nMAILMAN_WEB_SOCIAL_AUTH = []\n\n# \u00e4ndern\nDEFAULT_FROM_EMAIL = 'mailman@example.org'\n\nDEBUG = False\n
          Sie k\u00f6nnen LANGUAGE_CODE und SOCIALACCOUNT_PROVIDERS an Ihre Bed\u00fcrfnisse anpassen.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#ausfuhren","title":"\ud83c\udfc3 Ausf\u00fchren","text":"

          Ausf\u00fchren (als root oder sudo)

          docker compose (Plugin)docker-compose (Standalone) 
          a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker compose pull\ndocker compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker compose pull\n./renew-ssl.sh\n
          a2ensite mailcow.conf\na2ensite mailman.conf\nsystemctl restart apache2\n\ncd /opt/docker-mailman\ndocker-compose pull\ndocker-compose up -d\n\ncd /opt/mailcow-dockerized/\ndocker-compose pull\n./renew-ssl.sh\n

          Warten Sie ein paar Minuten! Die Container m\u00fcssen ihre Datenbanken und Konfigurationsdateien erstellen. Dies kann bis zu 1 Minute und mehr dauern.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#bemerkungen","title":"Bemerkungen","text":""},{"location":"de/third_party/mailman3/third_party-mailman3/#neue-listen-werden-von-postfix-nicht-sofort-erkannt","title":"Neue Listen werden von Postfix nicht sofort erkannt","text":"

          Wenn man eine neue Liste anlegt und versucht, sofort eine E-Mail zu versenden, antwortet postfix mit Benutzer existiert nicht, weil postfix die Liste noch nicht an Mailman \u00fcbergeben hat. Die Konfiguration unter /opt/mailman/core/var/data/postfix_lmtp wird nicht sofort aktualisiert. Wenn Sie die Liste sofort ben\u00f6tigen, starten Sie postifx manuell neu:

          docker compose (Plugin)docker-compose (Standalone) 
          cd /opt/mailcow-dockerized\ndocker compose restart postfix-mailcow\n
          cd /opt/mailcow-dockerized\ndocker-compose restart postfix-mailcow\n
          "},{"location":"de/third_party/mailman3/third_party-mailman3/#update","title":"Update","text":"

          mailcow hat sein eigenes Update-Skript in /opt/mailcow-dockerized/update.sh, siehe die Dokumentation.

          F\u00fcr Mailman holen Sie sich einfach die neueste Version aus dem github repository.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#sicherung","title":"Sicherung","text":"

          mailcow hat ein eigenes Backup-Skript. Lies die Docs f\u00fcr weitere Informationen.

          Mailman gibt keine Backup-Anweisungen in der README.md an. Im gitbucket von pgollor befindet sich ein Skript, das hilfreich sein k\u00f6nnte.

          "},{"location":"de/third_party/mailman3/third_party-mailman3/#skript-installieren","title":"Skript installieren","text":"

          Schreiben Sie ein Skript wie in mailman-mailcow-integration/mailman-install.sh, da viele der Schritte automatisierbar sind.

          1. Fragen Sie alle Konfigurationsvariablen ab und erstellen Sie Passw\u00f6rter und Schl\u00fcssel.
          2. F\u00fchren Sie eine (halb)automatische Installation durch.
          3. Viel Spa\u00df!
          "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/","title":"Mailpiler Integration","text":"

          Dies ist eine einfache Integration von mailcow-Aliasen und dem Mailbox-Namen in mailpiler bei Verwendung von IMAP-Authentifizierung.

          Disclaimer: Dies wird weder offiziell vom mailcow-Projekt noch von seinen Mitwirkenden gepflegt oder unterst\u00fctzt. Es wird keine Garantie oder Unterst\u00fctzung angeboten, jedoch steht es Ihnen frei, Themen auf GitHub zu \u00f6ffnen, um einen Fehler zu melden oder weitere Ideen zu liefern. GitHub Repo kann hier gefunden werden.

          Info

          Die Unterst\u00fctzung f\u00fcr Domain Wildcards wurde in Piler 1.3.10 implementiert, das am 03.01.2021 ver\u00f6ffentlicht wurde. Fr\u00fchere Versionen funktionieren grunds\u00e4tzlich, aber nach dem Einloggen sehen Sie keine E-Mails, die von oder an den Domain-Alias gesendet werden. (z.B. wenn @example.com ein Alias f\u00fcr admin@example.com ist)

          "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#das-zu-losende-problem","title":"Das zu l\u00f6sende Problem","text":"

          mailpiler bietet die Authentifizierung auf Basis von IMAP an, zum Beispiel:

          $config['ENABLE_IMAP_AUTH'] = 1;\n$config['IMAP_HOST'] = 'mail.example.com';\n$config['IMAP_PORT'] = 993;\n$config['IMAP_SSL'] = true;\n
          • Wenn Sie sich also mit patrik@example.com anmelden, sehen Sie nur zugestellte E-Mails, die von oder an diese spezielle E-Mail-Adresse gesendet wurden.
          • Wenn zus\u00e4tzliche Aliase in mailcow definiert werden, wie z.B. team@example.com, werden Sie keine Emails sehen, die an oder von dieser Email-Adresse gesendet wurden, auch wenn Sie ein Empf\u00e4nger von Emails sind, die an diese Alias-Adresse gesendet wurden.

          Indem wir uns in den Authentifizierungsprozess von mailpiler einklinken, sind wir in der Lage, die erforderlichen Daten \u00fcber die mailcow API w\u00e4hrend des Logins zu erhalten. Dies l\u00f6st API-Anfragen an die mailcow-API aus (die einen Nur-Lese-API-Zugang erfordern), um die Aliase auszulesen, an denen Ihre E-Mail-Adresse teilnimmt, und auch den \"Namen\" des Postfachs, der angegeben wurde, um ihn nach dem Login oben rechts in mailpiler anzuzeigen.

          Zugelassene E-Mail-Adressen k\u00f6nnen in den Mailpiler-Einstellungen oben rechts nach dem Einloggen eingesehen werden.

          Info

          Dies wird nur einmal w\u00e4hrend des Authentifizierungsprozesses abgefragt. Die autorisierten Aliase und der Realname sind f\u00fcr die gesamte Dauer der Benutzersitzung g\u00fcltig, da mailpiler sie in den Sitzungsdaten setzt. Wird ein Benutzer aus einem bestimmten Alias entfernt, so wird dies erst nach dem n\u00e4chsten Login wirksam.

          "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#die-losung","title":"Die L\u00f6sung","text":"

          Hinweis: Die Dateipfade k\u00f6nnen je nach Einrichtung variieren.

          "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#voraussetzungen","title":"Voraussetzungen","text":"
          • Eine funktionierende mailcow-Instanz
          • Eine funktionierende mailpiler Instanz (Sie finden eine Installationsanleitung hier, \u00fcberpr\u00fcfen Sie unterst\u00fctzte Versionen hier)
          • Ein mailcow API-Schl\u00fcssel (Nur-Lesen funktioniert): Konfiguration & Details - Zugang - Nur-Lesen-Zugang. Vergessen Sie nicht, den API-Zugang von Ihrer mailpiler IP zu erlauben.

          Warnung

          Da mailpiler sich gegen\u00fcber mailcow, unserem IMAP-Server, authentifiziert, k\u00f6nnen fehlgeschlagene Logins von Nutzern oder Bots eine Sperre f\u00fcr Ihre mailpiler-Instanz ausl\u00f6sen. Daher sollten Sie in Erw\u00e4gung ziehen, die IP-Adresse der mailpiler-Instanz innerhalb von mailcow auf eine Whitelist zu setzen: Konfiguration & Details - Konfiguration - Fail2ban-Parameter - Whitelisted networks/hosts.

          "},{"location":"de/third_party/mailpiler/third_party-mailpiler_integration/#einrichtung","title":"Einrichtung","text":"

          1. Setzen Sie die benutzerdefinierte Abfragefunktion von mailpiler und f\u00fcgen Sie diese an /usr/local/etc/piler/config-site.php an:

            $config['MAILCOW_API_KEY'] = 'YOUR_READONLY_API_KEY';\n$config['MAILCOW_SET_REALNAME'] = true; // wenn nicht angegeben, dann ist der Standardwert false\n$config['CUSTOM_EMAIL_QUERY_FUNCTION'] = 'query_mailcow_for_email_access';\ninclude('auth-mailcow.php');\n

            Sie k\u00f6nnen auch den mailcow-Hostnamen \u00e4ndern, falls erforderlich: 

            $config['MAILCOW_HOST'] = 'mail.domain.tld'; // standardm\u00e4\u00dfig $config['IMAP_HOST']\n

          2. Laden Sie die PHP-Datei mit den Funktionen aus dem GitHub Repo herunter:

            curl -o /usr/local/etc/piler/auth-mailcow.php https://raw.githubusercontent.com/patschi/mailpiler-mailcow-integration/master/auth-mailcow.php\n

          3. Erledigt!

          Stellen Sie sicher, dass Sie sich erneut mit Ihren IMAP-Zugangsdaten anmelden, damit die \u00c4nderungen wirksam werden.

          Wenn es nicht funktioniert, ist h\u00f6chstwahrscheinlich etwas mit der API-Abfrage selbst nicht in Ordnung. Versuchen Sie eine Fehlersuche, indem Sie manuelle API-Anfragen an die API senden. (Tipp: \u00d6ffnen Sie https://mail.domain.tld/api auf Ihrer Instanz)

          "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#nextcloud-mit-dem-helper-skript-verwalten","title":"Nextcloud mit dem Helper-Skript verwalten","text":"

          Deprecation Hinweis

          Diese Anleitung ist deprecated und betrifft das Nextcloud Helper-Skript, welches innerhalb mailcows geb\u00fcndelt ist. Ab Dezember 2024 wird diese Installationsart aus mailcow entfernt und kein Support daf\u00fcr geleistet. Sollten Sie noch besagte Installation nutzen, migrieren Sie ihre Nextcloud Installation in eine eigenst\u00e4ndige Nextcloud Instanz (entweder auch per Docker oder Nativ).

          Die Anleitung f\u00fcr die Nutzung von mailcow als Authentifizierungsquelle innerhalb Nextcloud's wird auch nach der Entfernung des Skriptes im Dezember 2024 erhalten und funktional bleiben.

          Nextcloud kann mit dem helper script, das in mailcow enthalten ist, eingerichtet (Parameter -i) und entfernt (Parameter -p) werden. Um Nextcloud zu installieren, navigieren Sie einfach zu Ihrem mailcow-dockerized Root-Ordner und f\u00fchren Sie das Helper-Skript wie folgt aus:

          ./helper-scripts/nextcloud.sh -i

          F\u00fcr den Fall, dass Sie das Passwort (z.B. f\u00fcr admin) vergessen haben und kein neues anfordern k\u00f6nnen [\u00fcber den Passwort-Reset-Link auf dem Login-Bildschirm] (https://docs.nextcloud.com/server/20/admin_manual/configuration_user/reset_admin_password.html?highlight=reset), k\u00f6nnen Sie durch den Aufruf des Helper-Skripts mit -r als Parameter ein neues Passwort setzen. Verwenden Sie diese Option nur, wenn Ihre Nextcloud nicht so konfiguriert ist, dass Sie mailcow zur Authentifizierung verwendet, wie im n\u00e4chsten Abschnitt beschrieben.

          Damit mailcow ein Zertifikat f\u00fcr die Nextcloud Domain generieren kann, muss die Domain unter welcher die Nextcloud sp\u00e4ter erreichbar sein soll als ADDITIONAL_SAN in die mailcow.conf hinzuf\u00fcgt werden und folgender Befehl zur \u00dcbernahme ausgef\u00fchrt werden.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          F\u00fcr weitere Informationen siehe: Erweitertes SSL.

          "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#hintergrund-aufgaben","title":"Hintergrund-Aufgaben","text":"

          Zur Verwendung der empfohlenen Einstellung (Cron) zur Verarbeitung der Hintergrund-Aufgaben m\u00fcssen in der docker-compose.override.yml folgende Zeilen hinzugef\u00fcgt werden:

          services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.nextcloud-cron.schedule: \"@every 5m\"\n      ofelia.job-exec.nextcloud-cron.command: \"su www-data -s /bin/bash -c \\\"/usr/local/bin/php -f /web/nextcloud/cron.php\\\"\"\n

          Zus\u00e4tzlich muss eine bestimmte Funktion f\u00fcr den php-fpm Worker aktiviert werden. Tun Sie dies in dem Sie die Datei data/conf/phpfpm/php-fpm.d/pools.conf bearbeiten und shell_exec aus allen Punkten samt dem , entfernen.

          Nachdem die beiden Schritte erledigt wurden muss der folgende Befehl ausgef\u00fchrt werden, um das Docker Image mit den entsprechenden Labels zu versehen und den Stack neuzustarten.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n

          Danach muss zudem der docker scheduler neu gestartet werden, um den neuen Job zu registrieren. Dazu wird der folgende Befehl ausgef\u00fchrt.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart ofelia-mailcow\n
          docker-compose restart ofelia-mailcow\n

          Zur \u00dcberpr\u00fcfung, ob die ofelia Konfiguration korrekt ist geladen wurde, kann mittels dem untenstehenden Befehl nach einer Zeile mit dem Inhalt New job registered \"nextcloud-cron\" - ... gesucht werden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs ofelia-mailcow\n
          docker-compose logs ofelia-mailcow\n

          Hierdurch wird alle 5 Minuten die Hintergrundverarbeitung gestartet. Da die Ausf\u00fchrung selbst keine Ausgabe liefert, kann die korrekte Funktionsweise in den Grundeinstellungen von Nextcloud \u00fcberpr\u00fcft werden. Hier wird automatisch mit der ersten Ausf\u00fchrung die Hintergrund-Aufgaben Verarbeitung auf (X) Cron gesetzt und der Zeitstempel Letzte Aufgabe ausgef\u00fchrt aktualisiert.

          "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#konfigurieren-sie-nextcloud-um-mailcow-fur-die-authentifizierung-zu-verwenden","title":"Konfigurieren Sie Nextcloud, um mailcow f\u00fcr die Authentifizierung zu verwenden","text":"

          Im Folgenden wird beschrieben, wie die Authentifizierung \u00fcber mailcow unter Verwendung des OAuth2-Protokolls eingerichtet wird. Wir nehmen nur an, dass Sie Nextcloud bereits unter cloud.example.com eingerichtet haben und dass Ihre mailcow unter mail.example.com l\u00e4uft. Es spielt keine Rolle, wenn Ihre Nextcloud auf einem anderen Server l\u00e4uft, Sie k\u00f6nnen immer noch mailcow f\u00fcr die Authentifizierung verwenden.

          1. Melden Sie sich bei mailcow als Administrator an.

          2. Klicken Sie im Dropdown Men\u00fc (oben rechts) auf Konfiguration.

          3. W\u00e4hlen Sie dann im Reiter \"Zugang\" den Dropdown Punkt OAuth2 aus.

          4. Scrollen Sie nach unten und klicken Sie auf die Schaltfl\u00e4che F\u00fcge OAuth2 Client hinzu. Geben Sie die Redirect URI als https://cloud.example.com/index.php/apps/sociallogin/custom_oauth2/mailcow an und klicken Sie auf Hinzuf\u00fcgen. Speichern Sie die Client-ID und das Geheimnis f\u00fcr sp\u00e4ter.

          Info

          Einige Installationen, einschlie\u00dflich derer, die mit dem Helper-Skript von mailcow eingerichtet wurden, m\u00fcssen index.php/ aus der URL entfernen, um einen erfolgreichen Redirect zu erhalten: https://cloud.example.com/apps/sociallogin/custom_oauth2/mailcow

          3. Melden Sie sich bei Nextcloud als Administrator an.

          4. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Apps. Klicken Sie auf die Schaltfl\u00e4che \"Suchen\" in der Symbolleiste, suchen Sie nach dem Plugin Social Login und klicken Sie daneben auf Herunterladen und aktivieren.

          5. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Einstellungen. Scrollen Sie zum Abschnitt Administration auf der linken Seite und klicken Sie auf Social Login.

          6. Entfernen Sie das H\u00e4kchen bei den folgenden Punkten:

          • \"Automatische Erstellung neuer Benutzer deaktivieren\"
          • \"Benutzern erlauben, soziale Logins mit ihren Konten zu verbinden\".
          • \"Nicht verf\u00fcgbare Benutzergruppen bei der Anmeldung nicht entfernen\"
          • \"Gruppen automatisch erstellen, wenn sie nicht vorhanden sind\"
          • \"Anmeldung f\u00fcr Benutzer ohne zugeordnete Gruppen einschr\u00e4nken\".

          7. \u00dcberpr\u00fcfen Sie die folgenden Punkte:

          • \"Die Erstellung eines Kontos verhindern, wenn die E-Mail-Adresse in einem anderen Konto existiert\"
          • \"Benutzerprofil bei jeder Anmeldung aktualisieren\"
          • \"Benachrichtigung der Administratoren \u00fcber neue Benutzer deaktivieren\".

          Klicken Sie auf die Schaltfl\u00e4che Speichern.

          8. Scrollen Sie nach unten zu Custom OAuth2 und klicken Sie auf die Schaltfl\u00e4che +. 9. Konfigurieren Sie die Parameter wie folgt:

          • Interner Name: mailcow
          • Titel: mailcow
          • API Basis-URL: https://mail.example.com
          • Autorisierungs-URL: https://mail.example.com/oauth/authorize
          • Token-URL: https://mail.example.com/oauth/token
          • Profil-URL: https://mail.example.com/oauth/profile
          • Abmelde-URL: (leer lassen)
          • Kunden-ID: (die Sie in Schritt 1 erhalten haben)
          • Client Secret: (was Sie in Schritt 1 erhalten haben)
          • Bereich: Profil

          Klicken Sie auf die Schaltfl\u00e4che Speichern ganz unten auf der Seite.

          Wenn Sie bisher Nextcloud mit mailcow-Authentifizierung \u00fcber user_external/IMAP verwendet haben, m\u00fcssen Sie einige zus\u00e4tzliche Schritte durchf\u00fchren, um Ihre bestehenden Benutzerkonten mit OAuth2 zu verkn\u00fcpfen.

          1. Klicken Sie auf die Schaltfl\u00e4che in der oberen rechten Ecke und w\u00e4hlen Sie Apps. Scrollen Sie nach unten zur App Externe Benutzerauthentifizierung und klicken Sie daneben auf Entfernen.

          2. F\u00fchren Sie die folgenden Abfragen in Ihrer Nextcloud-Datenbank aus (wenn Sie Nextcloud mit dem Skript von mailcow einrichten, k\u00f6nnen Sie folgenden Befehl nutzen um in den Container zu gelangen)

          docker compose (Plugin)docker-compose (Standalone) 
          source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
          source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
          INSERT INTO oc_users (uid, uid_lower) SELECT DISTINCT uid, LOWER(uid) FROM oc_users_external;\nINSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users_external;\n

          Wenn Sie Nextcloud bisher ohne mailcow-Authentifizierung, aber mit den gleichen Benutzernamen wie mailcow genutzt haben, k\u00f6nnen Sie Ihre bestehenden Benutzerkonten auch mit OAuth2 verkn\u00fcpfen.

          1. F\u00fchren Sie die folgenden Abfragen in Ihrer Nextcloud-Datenbank aus (wenn Sie Nextcloud mit dem Skript von mailcow einrichten, k\u00f6nnen Sie folgenden Befehl nutzen um in den Container zu gelangen):

          docker compose (Plugin)docker-compose (Standalone) 
          source mailcow.conf && docker compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
          source mailcow.conf && docker-compose exec mysql-mailcow mysql -u$DBUSER -p$DBPASS $DBNAME\n
          INSERT INTO oc_sociallogin_connect (uid, identifier) SELECT DISTINCT uid, CONCAT(\"mailcow-\", uid) FROM oc_users;\n
          "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#aktualisieren","title":"Aktualisieren","text":"

          Die Nextcloud-Instanz kann einfach mit dem Web-Update-Mechanismus aktualisiert werden. Bei gr\u00f6\u00dferen Updates k\u00f6nnen nach dem Update weitere \u00c4nderungen vorgenommen werden. Nachdem die Nextcloud-Instanz gepr\u00fcft wurde, werden Probleme angezeigt. Dies k\u00f6nnen z.B. fehlende Indizes in der DB oder \u00e4hnliches sein. Es wird angezeigt, welche Befehle ausgef\u00fchrt werden m\u00fcssen, diese m\u00fcssen im php-fpm-mailcow Container platziert werden.

          F\u00fchren Sie z.B. folgenden Befehl aus, um die fehlenden Indizes hinzuzuf\u00fcgen:

          docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/occ db:add-missing-indices\"

          Das Update kann bei Bedarf auch per CLI durchgef\u00fchrt werden. Dies ist mit folgedem Befehl im interaktiven Modus m\u00f6glich:

          docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar\"

          Um das Update ohne R\u00fcckfragen auszuf\u00fchren, z.B. durch einen CRON Job, kann folgender Befehl verwendet werden:

          Achtung

          Wir empfehlen dieses Vorgehen nicht! Es k\u00f6nnte \u00fcber die Zeit kaputt gehen und irreperable Sch\u00e4den an der Nextcloud Instanz erzeugen. NUTZUNG AUF EIGENE GEFAHR!!

          docker exec -it -u www-data $(docker ps -f name=php-fpm-mailcow -q) bash -c \"php /web/nextcloud/updater/updater.phar --no-interaction\"

          "},{"location":"de/third_party/nextcloud/third_party-nextcloud/#fehlersuche-und-fehlerbehebung","title":"Fehlersuche und Fehlerbehebung","text":"

          Es kann vorkommen, dass Sie die Nextcloud-Instanz von Ihrem Netzwerk aus nicht erreichen k\u00f6nnen. Dies kann daran liegen, dass der Eintrag Ihres Subnetzes im Array 'trusted_proxies' fehlt. Sie k\u00f6nnen \u00c4nderungen in der Nextcloud config.php in data/web/nextcloud/config/* vornehmen.

          'trusted_proxies' =>\n  array (\n    0 => 'fd4d:6169:6c63:6f77::/64',\n    1 => '172.22.1.0/24',\n    2 => 'NewSubnet/24',\n  ),\n

          Nachdem die \u00c4nderungen vorgenommen wurden, muss der nginx-Container neu gestartet werden.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart nginx-mailcow\n
          docker-compose restart nginx-mailcow\n
          "},{"location":"de/third_party/portainer/third_party-portainer/","title":"Portainer","text":"

          Um Portainer zu aktivieren, m\u00fcssen die docker-compose.yml und site.conf f\u00fcr Nginx ge\u00e4ndert werden.

          1. Erstellen Sie eine neue Datei docker-compose.override.yml im mailcow-dockerized Stammverzeichnis und f\u00fcgen Sie die folgende Konfiguration ein 

          services:\n    portainer-mailcow:\n      image: portainer/portainer-ce\n      volumes:\n        - /var/run/docker.sock:/var/run/docker.sock\n        - ./data/conf/portainer:/data\n      restart: always\n      dns:\n        - 172.22.1.254\n      dns_search: mailcow-network\n      networks:\n        mailcow-network:\n          aliases:\n            - portainer\n
          2a. Erstelle data/conf/nginx/portainer.conf: 
          upstream portainer {\n  server portainer-mailcow:9000;\n}\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  '' close;\n}\n

          2b. F\u00fcgen Sie einen neuen Standort f\u00fcr die Standard-mailcow-Site ein, indem Sie die Datei data/conf/nginx/site.portainer.custom erstellen: 

            location /portainer/ {\n    proxy_http_version 1.1;\n    proxy_set_header Host              $http_host;   # required for docker client's sake\n    proxy_set_header X-Real-IP         $remote_addr; # pass on real client's IP\n    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_read_timeout                 900;\n\n    proxy_set_header Connection \"\";\n    proxy_buffers 32 4k;\n    proxy_pass http://portainer/;\n  }\n\n  location /portainer/api/websocket/ {\n    proxy_http_version 1.1;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_pass http://portainer/api/websocket/;\n  }\n

          3. \u00dcbernehmen Sie Ihre \u00c4nderungen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d && docker compose restart nginx-mailcow\n
          docker-compose up -d && docker-compose restart nginx-mailcow\n

          Nun k\u00f6nnen Sie einfach zu https://${MAILCOW_HOSTNAME}/portainer/ navigieren, um Ihre Portainer-Container-\u00dcberwachungsseite anzuzeigen. Sie werden dann aufgefordert, ein neues Passwort f\u00fcr den admin Account anzugeben. Nachdem Sie Ihr Passwort eingegeben haben, k\u00f6nnen Sie sich mit der Portainer UI verbinden.

          "},{"location":"de/third_party/portainer/third_party-portainer/#reverse-proxy","title":"Reverse Proxy","text":"

          Wenn Sie einen Reverse-Proxy verwenden, muss dieser noch konfiguriert werden die Websocket Requests richtig weiterzuleiten.

          Dies wird f\u00fcr die Docker Konsole und andere Komponenten ben\u00f6tigt.

          Hier ist ein Bespiel f\u00fcr Apache:

          <Location /portainer/api/websocket/>\n  RewriteEngine on\n  RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]\n  RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]\n  RewriteRule /portainer/api/websocket/(.*) ws://127.0.0.1:8080/portainer/api/websocket/$1 [P]\n</Location>\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#installation-von-roundcube","title":"Installation von Roundcube","text":"

          Beachten Sie

          Sofern nicht abweichend angegeben wird f\u00fcr alle aufgef\u00fchrten Kommandos angenommen, dass diese im mailcow Installationsverzeichnis ausgef\u00fchrt werden, d. h. dem Verzeichnis, welches mailcow.conf usw. enth\u00e4lt. Bitte f\u00fchren Sie die Kommandos nicht blind aus, sondern verstehen Sie was diese bewirken. Keines der Kommandos sollte einen Fehler ausgeben; sollten Sie dennoch auf einen Fehler sto\u00dfen, beheben Sie diesen sofern notwendig bevor Sie mit den nachfolgenden Kommandos fortfahren.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#hinweise-zur-verwendung-von-composer","title":"Hinweise zur Verwendung von composer","text":"

          Diese Anweisungen verwenden das Programm composer zur Aktualisierung der Abh\u00e4ngigkeiten von Roundcube und um Roundcube-Plugins zu installieren bzw. zu aktualisieren.

          Das roundcube-plugin-installer composer Plugin hat eine Design-Schw\u00e4che, die dazu f\u00fchren kann, dass composer bei Operationen fehlschl\u00e4gt, im Rahmen derer Pakete aktualisiert oder deinstalliert werden.

          Die Fehlermeldung in diesem Falle besagt, dass eine require-Anweisung in autoload_real.php fehlgeschlagen ist, weil eine Datei nicht gefunden werden konnte. Beispiel:

          In autoload_real.php line 43:\n  require(/web/rc/vendor/composer/../guzzlehttp/promises/src/functions_include.php): Failed to open stream: No such file or directory\n

          Leider treten diese Fehler relativ h\u00e4ufig auf, sie lassen sich jedoch leicht beheben indem der Autoloader aktualisiert wird und das fehlgeschlagene Kommando im Anschluss erneut ausgef\u00fchrt wird:

          docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer dump-autoload -o\n# Nun das fehlgeschlagene Kommando erneut ausf\u00fchren\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#vorbereitung","title":"Vorbereitung","text":"

          Zun\u00e4chst laden wir mailcow.conf um Zugriff auf die mailcow-Einstellungen innerhalb der nachfolgenden Kommandos zu erhalten.

          source mailcow.conf\n

          Laden Sie Roundcube 1.6.x (pr\u00fcfen Sie das aktuellste Release und passen Sie die URL entsprechend an) in das web Verzeichnis herunter und entpacken Sie es (hier rc/):

          mkdir -m 755 data/web/rc\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar -xvz --no-same-owner -C data/web/rc --strip-components=1 -f -\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown www-data:www-data /web/rc/logs /web/rc/temp\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 750 /web/rc/logs /web/rc/temp /web/rc/config\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#optional-rechtschreibprufung","title":"Optional: Rechtschreibpr\u00fcfung","text":"

          Wenn Sie eine Rechtschreibpr\u00fcfung ben\u00f6tigen, erstellen Sie eine Datei data/hooks/phpfpm/aspell.sh mit folgendem Inhalt und geben Sie dann chmod +x data/hooks/phpfpm/aspell.sh ein. Dadurch wird eine lokale Rechtschreibpr\u00fcfung installiert. Beachten Sie, dass die meisten modernen Webbrowser eine eingebaute Rechtschreibpr\u00fcfung haben, so dass Sie diese vielleicht nicht ben\u00f6tigen.

          #!/bin/bash\napk update\napk add aspell-de # oder jede andere Sprache\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#installation-des-mime-typ-verzeichnisses","title":"Installation des MIME-Typ-Verzeichnisses","text":"

          Laden Sie die mime.types Datei herunter, da diese nicht im php-fpm-Container enthalten ist.

          wget -O data/web/rc/config/mime.types http://svn.apache.org/repos/asf/httpd/httpd/trunk/docs/conf/mime.types\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#anlegen-der-roundcube-datenbank","title":"Anlegen der Roundcube-Datenbank","text":"

          Erstellen Sie eine Datenbank f\u00fcr Roundcube im mailcow mysql Container. Dies erstellt einen neuen roundcube Datenbank-Benutzer mit einem Zufallspasswort, welches in die Shell ausgegeben wird und in einer Shell-Variable f\u00fcr die Verwendung durch die nachfolgenden Kommandos gespeichert wird. Beachten Sie, dass Sie die DBROUNDCUBE-Shell-Variable manuell auf das ausgegebene Passwort setzen m\u00fcssen, falls sie den Installationsprozess unterbrechen und sp\u00e4ter in einer neuen Shell fortsetzen sollten.

          DBROUNDCUBE=$(LC_ALL=C </dev/urandom tr -dc A-Za-z0-9 2> /dev/null | head -c 28)\necho Das Datenbank-Password f\u00fcr den Benutzer roundcube lautet $DBROUNDCUBE\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE DATABASE roundcubemail CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"CREATE USER 'roundcube'@'%' IDENTIFIED BY '${DBROUNDCUBE}';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"GRANT ALL PRIVILEGES ON roundcubemail.* TO 'roundcube'@'%';\"\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-konfigurationsdatei","title":"Roundcube-Konfigurationsdatei","text":"

          Erstellen Sie eine Datei data/web/rc/config/config.inc.php mit dem folgenden Inhalt. - Die des_key-Einstellung wird auf einen Zufallswert gesetzt. Sie wird u. a. zur Verschl\u00fcsselung vor\u00fcbergehend gespeicherter IMAP-Passw\u00f6rter verwendet. - Die Liste der Plugins kann nach Belieben angepasst werden. Die folgende Liste enth\u00e4lt eine Liste von Standard-Plugins, welche ich als allgemein n\u00fctzlich empfinde und die gut mit mailcow zusammenspielen: - Das archive-Plugin f\u00fcgt einen Archiv-Button hinzu, der ausgew\u00e4hlte E-Mails in ein konfigurierbares Archiv-Verzeichnis verschiebt. - Das managesieve-Plugin bietet eine benutzerfreundliche Oberfl\u00e4che zur Verwaltung serverseitiger E-Mail-Filter und Abwesenheits-Benachrichtigungen. - Das acl-Plugin erm\u00f6glicht die Verwaltung von Zugriffskontroll-Listen auf IMAP-Verzeichnissen, mit der M\u00f6glichkeit IMAP-Verzeichnisse mit anderen Benutzern zu teilen. - Das markasjunk-Plugin f\u00fcgt Buttons hinzu, um ausgew\u00e4hlte E-Mails als Spam (oder E-Mails im Junk-Verzeichnis nicht als Spam) zu markieren und diese in das Junk-Verzeichnis (oder zur\u00fcck in den Posteingang) zu verschieben. Die in mailcow enthaltenen Sieve-Filter l\u00f6sen automatisch die zugeh\u00f6rige Lern-Operation in rspamd aus, so dass keine weitere Konfiguration des Plugins erforderlich ist. - Das zipdownload-Plugin erlaubt es, mehrere E-Mail-Anh\u00e4nge oder E-Mails als ZIP-Archiv herunterzuladen. - Wenn Sie die Rechtschreibpr\u00fcfung im obigen Schritt nicht installiert haben, entfernen Sie den Parameter spellcheck_engine.

          cat <<EOCONFIG >data/web/rc/config/config.inc.php\n<?php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\n\\$config['imap_host'] = 'dovecot:143';\n\\$config['smtp_host'] = 'postfix:588';\n\\$config['smtp_user'] = '%u';\n\\$config['smtp_pass'] = '%p';\n\\$config['support_url'] = '';\n\\$config['product_name'] = 'Roundcube Webmail';\n\\$config['cipher_method'] = 'chacha20-poly1305';\n\\$config['des_key'] = '$(LC_ALL=C </dev/urandom tr -dc \"A-Za-z0-9 !#$%&()*+,-./:;<=>?@[\\\\]^_{|}~\" 2> /dev/null | head -c 32)';\n\\$config['plugins'] = [\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n];\n\\$config['spellcheck_engine'] = 'aspell';\n\\$config['mime_types'] = '/web/rc/config/mime.types';\n\\$config['enable_installer'] = true;\n\n\\$config['managesieve_host'] = 'dovecot:4190';\n// Enables separate management interface for vacation responses (out-of-office)\n// 0 - no separate section (default); 1 - add Vacation section; 2 - add Vacation section, but hide Filters section\n\\$config['managesieve_vacation'] = 1;\nEOCONFIG\n\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chown root:www-data /web/rc/config/config.inc.php\ndocker exec -it $(docker ps -f name=php-fpm-mailcow -q) chmod 640 /web/rc/config/config.inc.php\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#initialisierung-der-datenbank","title":"Initialisierung der Datenbank","text":"

          Richten Sie Ihren Browser auf https://myserver/rc/installer. Pr\u00fcfen Sie, dass die Webseite in keinem der Schritte \"NOT OK\"-Testergebnisse zeigt. Einige \"NOT AVAILABLE\"-Testergebnisse sind bzgl. der verschiedenen Datenbank-Erweiterungen erwartet, von denen nur MySQL ben\u00f6tigt wird.

          Initialisieren Sie die Datenbank und verlassen Sie das Installationsprogramm. Es ist nicht notwendig, die Konfigurationsdatei mit der heruntergeladenen Datei zu aktualisieren, sofern Sie keine \u00c4nderungen an den Einstellungen innerhalb des Installationsprogramms durchgef\u00fchrt habe, die Sie \u00fcbernehmen m\u00f6chten.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#webserver-konfiguration","title":"Webserver-Konfiguration","text":"

          Das Roundcube-Verzeichnis enth\u00e4lt einige Inhalte, die nicht an Web-Nutzer ausgeliefert werden sollen. Wir erstellen daher eine Konfigurations-Erg\u00e4nzung f\u00fcr nginx, um nur die \u00f6ffentlichen Teile von Roundcube im Web zu exponieren:

          cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#deaktivieren-und-entfernen-des-installationsprogramms","title":"Deaktivieren und entfernen des Installationsprogramms","text":"

          L\u00f6schen Sie das Verzeichnis data/web/rc/installer nach einer erfolgreichen Installation, und setzen Sie die enable_installer-Option in data/web/rc/config/config.inc.php auf false:

          rm -r data/web/rc/installer\nsed -i -e \"s/\\(\\$config\\['enable_installer'\\].* = \\)true/\\1false/\" data/web/rc/config/config.inc.php\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-der-roundcube-abhangigkeiten","title":"Aktualisierung der Roundcube-Abh\u00e4ngigkeiten","text":"

          Dieser Schritt ist nicht unbedingt notwendig, aber zumindest zum Zeitpunkt der Erstellung dieser Anweisungen enthielten die mit Roundcube ausgelieferten Abh\u00e4ngigkeiten Versionen mit Sicherheitsl\u00fccken, daher k\u00f6nnte es eine gute Idee sein, die Abh\u00e4ngigkeiten auf die neusten Versionen zu aktualisieren. Aus demselben Grund sollte composer update hin und wieder ausgef\u00fchrt werden.

          cp -n data/web/rc/composer.json-dist data/web/rc/composer.json\ndocker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n

          Sie k\u00f6nnen au\u00dferdem composer audit verwenden, um bekannte Sicherheitsl\u00fccken in den installierten composer-Paketen anzuzeigen.

          docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer audit\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#ermoglichen-der-klartext-authentifizierung-fur-den-php-fpm-container-ohne-die-verwendung-von-tls","title":"Erm\u00f6glichen der Klartext-Authentifizierung f\u00fcr den php-fpm-Container ohne die Verwendung von TLS","text":"

          Wir m\u00fcssen die Verwendung von Klartext-Authentifizierung \u00fcber nicht verschl\u00fcsselte Verbindungen (innerhalb der Container-Netzwerks) in Dovecot zulassen, was in der Standard-Installation von mailcow nur f\u00fcr den SOGo-Container zum gleichen Zweck m\u00f6glich ist. Danach starten Sie den Dovecot-Container neu, damit die \u00c4nderung wirksam wird.

          cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nremote ${IPV4_NETWORK}.0/24 {\n  disable_plaintext_auth = no\n}\nremote ${IPV6_NETWORK} {\n  disable_plaintext_auth = no\n}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#ofelia-job-fur-roundcube-aufraumtatigkeiten","title":"Ofelia-Job f\u00fcr Roundcube-Aufr\u00e4umt\u00e4tigkeiten","text":"

          Roundcube muss regelm\u00e4ssig die Datenbank von nicht mehr ben\u00f6tigter Information befreien. Wir legen einen Ofelia-Job an, der das Roundcube cleandb.sh-Skript regelm\u00e4ssig ausf\u00fchrt.

          Um dies zu tun, f\u00fcgen Sie folgendes zu docker-compose.override.yml hinzu (falls Sie bereits einige Anpassungen f\u00fcr den php-fpm-Container durchgef\u00fchrt haben, f\u00fcgen Sie die Label dem bestehenden Abschnitt hinzu):

          services:\n  php-fpm-mailcow:\n    labels:\n      ofelia.enabled: \"true\"\n      ofelia.job-exec.roundcube_cleandb.schedule: \"@every 168h\"\n      ofelia.job-exec.roundcube_cleandb.user: \"www-data\"\n      ofelia.job-exec.roundcube_cleandb.command: \"/bin/bash -c \\\"[ -f /web/rc/bin/cleandb.sh ] && /web/rc/bin/cleandb.sh\\\"\"\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#optionale-zusatz-funktionalitaten","title":"Optionale Zusatz-Funktionalit\u00e4ten","text":""},{"location":"de/third_party/roundcube/third_party-roundcube/#aktivieren-der-funktion-passwort-andern-in-roundcube","title":"Aktivieren der Funktion \"Passwort \u00e4ndern\" in Roundcube","text":"

          Das \u00c4ndern des mailcow Passworts aus der Roundcube-Benutzeroberfl\u00e4che wird durch das password-Plugin erm\u00f6glicht. Wir konfigurieren dieses zur Verwendung der mailcow-API zur Passwort-Aktualisierung, was es zun\u00e4chst erfordert, die API zu aktivieren und den API-Schl\u00fcssel zu ermitteln (Lese-/Schreib-Zugriff notwendig). Die API kann in der mailcow-Administrationsoberfl\u00e4che aktiviert werden, wo Sie auch den API-Schl\u00fcssel finden.

          \u00d6ffnen Sie data/web/rc/config/config.inc.php und aktivieren Sie das Passwort-Plugin, indem Sie es dem $config['plugins']-Array hinzuf\u00fcgen, zum Beispiel:

          $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n);\n

          Konfigurieren Sie das password-Plugin (stellen Sie sicher, **API_KEY** auf Ihren mailcow Lese-/Schreib-API-Schl\u00fcssel anzupassen):

          cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'http://nginx';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n

          Hinweis: Sollten Sie die mailcow nginx-Konfiguration so angepasst haben, dass http-Anfragen auf https umgeleitet werden (wie z. B. hier beschrieben), dann wird die direkte Verbindung zum nginx-Container via HTTP nicht funktionieren, da nginx kein im Zertifikat enthaltener Hostname ist. In solchen F\u00e4llen setzen Sie password_mailcow_api_host stattdessen auf die \u00f6ffentliche URI:

          cat <<EOCONFIG >data/web/rc/plugins/password/config.inc.php\n<?php\n\\$config['password_driver'] = 'mailcow';\n\\$config['password_confirm_current'] = true;\n\\$config['password_mailcow_api_host'] = 'https://${MAILCOW_HOSTNAME}';\n\\$config['password_mailcow_api_token'] = '**API_KEY**';\nEOCONFIG\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#carddav-adressbucher-in-roundcube-einbinden","title":"CardDAV-Adressb\u00fccher in Roundcube einbinden","text":"

          Installieren Sie die neuste v5-Version (die untenstehende Konfiguration ist kompatibel zu v5-Releases) mit composer. Antworten Sie Y, wenn Sie gefragt werden, ob Sie das Plugin aktivieren m\u00f6chten.

          docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"roundcube/carddav:~5\"\n

          Editieren Sie die Datei data/web/rc/plugins/carddav/config.inc.php und f\u00fcgen Sie folgenden Inhalt hinzu:

          cat <<EOCONFIG >data/web/rc/plugins/carddav/config.inc.php\n<?php\n\\$prefs['_GLOBAL']['pwstore_scheme'] = 'des_key';\n\n\\$prefs['SOGo'] = [\n    'accountname'    => 'SOGo',\n    'username'       => '%u',\n    'password'       => '%p',\n    'discovery_url'  => 'http://sogo:20000/SOGo/dav/',\n    'name'           => '%N',\n    'use_categories' => true,\n    'fixed'          => ['username', 'password'],\n];\nEOCONFIG\n

          RCMCardDAV legt alle Adressb\u00fccher des Benutzers beim Login in Roundcube an, einschlie\u00dflich abonnierten Adressb\u00fcchern die mit dem Benutzers von anderen Benutzern geteilt werden.

          Wenn Sie das Standard-Adressbuch (gespeichert in der Roundcube-Datenbank) entfernen m\u00f6chten, so dass nur CardDAV-Adressb\u00fccher verwendet werden k\u00f6nnen, f\u00fcgen Sie der Konfigurationsdatei data/web/rc/config/config.inc.php die Option $config['address_book_type'] = ''; hinzu.

          Hinweis: RCMCardDAV verwendet zus\u00e4tzliche Datenbank-Tabellen. Nach der Installation (oder Aktualisierung) von RCMCardDAV ist es notwendig, sich in Roundcube neu anzumelden (melden Sie sich vorher ab, wenn Sie bereits eingeloggt sind), da die Erzeugung der Datenbank-Tabellen bzw. \u00c4nderungen nur bei der Anmeldung in Roundcube durchgef\u00fchrt werden.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#ubermittlung-der-client-netzwerkadresse-an-dovecot","title":"\u00dcbermittlung der Client-Netzwerkadresse an Dovecot","text":"

          Normalerweise sieht der IMAP-Server Dovecot die Netzwerkadresse des php-fpm-Containers wenn Roundcube zu diesem Verbindungen aufbaut. Durch Verwendung einer IMAP-Erweiterung und dem dovecot_client_ip Roundcube-Plugin ist es m\u00f6glich, dass Roundcube Dovecot die Client-Netzwerkadresse \u00fcbermittelt, so dass in den Log-Dateien die Client-Netzwerkadresse erscheint. Dies f\u00fchrt dazu, dass Login-Versuche an Roundcube in den Dovecot-Logs genauso wie direkte Client-Verbindungen zu Dovecot aufgezeichnet werden, und fehlgeschlagene Login-Versuche an Roundcube analog zu fehlgeschlagenen direkten IMAP-Logins durch den netfilter-Container oder andere ggf. verf\u00fcgbare Mechanismen zur Behandlung von Bruteforce-Attacken auf den IMAP-Server aufgegriffen werden und z. B. zu einer Blockierung des Clients f\u00fchren.

          Hierzu muss das Roundcube-Plugin installiert werden:

          docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer require --update-no-dev -o \"foorschtbar/dovecot_client_ip:~2\"\n

          Bearbeiten Sie die Datei data/web/rc/config/config.inc.php und f\u00fcgen Sie den folgenden Inhalt ein:

          cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['dovecot_client_ip_trusted_proxies'] = ['${IPV4_NETWORK}.0/24', '${IPV6_NETWORK}'];\nEOCONFIG\n

          Weiterhin m\u00fcssen wir Dovecot konfigurieren, so dass der php-fpm-Container als Teil eines vertrauensw\u00fcrdigen Netzwerks betrachtet wird und somit die Client-Netzwerkadresse innerhalb einer IMAP-Sitzung \u00fcberschreiben darf. Beachten Sie, dass dies auch die Klartext-Authentifizierung f\u00fcr die aufgef\u00fchrten Netzwerkbereiche erlaubt, so dass das explizite \u00dcberschreiben von disable_plaintext_auth weiter oben in diesem Fall nicht notwendig ist.

          cat  <<EOCONFIG >>data/conf/dovecot/extra.conf\nlogin_trusted_networks = ${IPV4_NETWORK}.0/24 ${IPV6_NETWORK}\nEOCONFIG\n\ndocker compose restart dovecot-mailcow\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-zur-mailcow-apps-liste-hinzufugen","title":"Roundcube zur mailcow Apps-Liste hinzuf\u00fcgen","text":"

          Optional k\u00f6nnen Sie Roundcubes Link zu der mailcow Apps Liste hinzuf\u00fcgen. Um dies zu tun, \u00f6ffnen oder erstellen Sie data/web/inc/vars.local.inc.php und stellen Sie sicher, dass es den folgenden Konfigurationsblock beinhaltet:

          <?php\n\n$MAILCOW_APPS = [\n    [\n        'name' => 'SOGo',\n        'link' => '/SOGo/'\n    ],\n    [\n        'name' => 'Roundcube',\n        'link' => '/rc/'\n    ]\n];\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#administratoren-ohne-passwort-in-roundcube-einloggen-lassen","title":"Administratoren ohne Passwort in Roundcube einloggen lassen","text":"

          Installieren Sie zun\u00e4chst das Plugin dovecot_impersonate und f\u00fcgen Sie Roundcube als App hinzu (siehe oben).

          docker exec -it -w /web/rc/plugins $(docker ps -f name=php-fpm-mailcow -q) git clone https://github.com/corbosman/dovecot_impersonate.git\n

          Editieren Sie data/web/rc/config/config.inc.php und aktivieren Sie das dovecot_impersonate Plugin indem Sie es zum Array $config['plugins'] hinzuf\u00fcgen, zum Beispiel:

          $config['plugins'] = array(\n  'archive',\n  'managesieve',\n  'acl',\n  'markasjunk',\n  'zipdownload',\n  'password',\n  'dovecot_impersonate'\n);\n

          Editieren Sie mailcow.conf und f\u00fcgen Sie folgendes hinzu:

          # Erlaube Admins, sich in Roundcube als Email-Benutzer einzuloggen (ohne Passwort)\n# Roundcube mit Plugin dovecot_impersonate muss zuerst installiert werden\n\nALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=y\n

          Editieren Sie docker-compose.override.yml und verfassen/erweitern Sie den Abschnitt f\u00fcr php-fpm-mailcow:

          services:\n  php-fpm-mailcow:\n    environment:\n      - ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE=${ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE:-n}\n

          Bearbeiten Sie data/web/js/site/mailbox.js und den folgenden Code nach if (ALLOW_ADMIN_EMAIL_LOGIN) { ... }

          if (ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE) {\n  item.action += '<a href=\"/rc-auth.php?login=' + encodeURIComponent(item.username) + '\" class=\"login_as btn btn-sm btn-xs-half btn-primary\" target=\"_blank\"><i class=\"bi bi-envelope-fill\"></i> Roundcube</a>';\n}\n

          Bearbeiten Sie data/web/mailbox.php und f\u00fcgen Sie diese Zeile zum Array $template_data hinzu:

            'allow_admin_email_login_roundcube' => (preg_match(\"/^(yes|y)+$/i\", $_ENV[\"ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE\"])) ? 'true' : 'false',\n

          Bearbeiten Sie data/web/templates/mailbox.twig und f\u00fcgen Sie diesen Code am Ende des Javascript-Abschnitts ein:

            var ALLOW_ADMIN_EMAIL_LOGIN_ROUNDCUBE = {{ allow_admin_email_login_roundcube }};\n

          Kopieren Sie den Inhalt der folgenden Dateien aus diesem Snippet:

          • data/web/inc/lib/RoundcubeAutoLogin.php
          • data/web/rc-auth.php
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#abschluss-der-installation","title":"Abschluss der Installation","text":"

          Starten Sie schlie\u00dflich mailcow neu

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-von-roundcube","title":"Aktualisierung von Roundcube","text":"

          Ein Upgrade von Roundcube ist recht einfach: Gehen Sie auf die GitHub releases Seite f\u00fcr Roundcube und holen Sie sich den Link f\u00fcr die \"complete.tar.gz\" Datei f\u00fcr die gew\u00fcnschte Version. Dann folgen Sie den untenstehenden Befehlen und \u00e4ndern Sie die URL und den Namen des Roundcube-Ordners, falls n\u00f6tig.

          # Starten Sie eine Bash-Sitzung des mailcow PHP-Containers\ndocker exec -it mailcowdockerized-php-fpm-mailcow-1 bash\n\n# Installieren Sie die erforderliche Upgrade-Abh\u00e4ngigkeit, dann aktualisieren Sie Roundcube auf die gew\u00fcnschte Version\napk add rsync\ncd /tmp\nwget -O - https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz | tar xfvz -\ncd roundcubemail-1.6.9\nbin/installto.sh /web/rc\n\n# Geben Sie 'Y' ein und dr\u00fccken Sie die Eingabetaste, um Ihre Installation von Roundcube zu aktualisieren.\n# Geben Sie 'N' ein, wenn folgender Dialog erscheint: \"Do you want me to fix your local configuration\".\n\n# Sollte im Output eine Notice kommen \"NOTICE: Update dependencies by running php composer.phar update --no-dev\" f\u00fchren\nSie composer aus:\ncd /web/rc\ncomposer update --no-dev -o\n# Auf die Frage \"Do you trust \"roundcube/plugin-installer\" to execute code and wish to enable it now? (writes \"allow-plugins\" to composer.json) [y,n,d,?] \" bitte mit y antworten.\n\n# Entfernen Sie \u00fcbrig gebliebene Dateien\nrm -rf /tmp/roundcube*\n\n# Falls Sie von Version 1.5 auf 1.6 updaten, dann f\u00fchren Sie folgende Befehle aus, um die Konfigurationsdatei anzupassen:`\nsed -i \"s/\\$config\\['default_host'\\].*$/\\$config\\['imap_host'\\]\\ =\\ 'dovecot:143'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['default_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['smtp_server'\\].*$/\\$config\\['smtp_host'\\]\\ =\\ 'postfix:588'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['smtp_port'\\].*$/d\" /web/rc/config/config.inc.php\nsed -i \"s/\\$config\\['managesieve_host'\\].*$/\\$config\\['managesieve_host'\\]\\ =\\ 'dovecot:4190'\\;/\" /web/rc/config/config.inc.php\nsed -i \"/\\$config\\['managesieve_port'\\].*$/d\" /web/rc/config/config.inc.php\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-von-composer-plugins","title":"Aktualisierung von composer-Plugins","text":"

          Um Roundcube-Plugins und -Abh\u00e4ngigkeiten zu aktualisieren, die mit composer installiert wurden (z. B. RCMCardDAV-Plugin), f\u00fchren Sie einfach composer im Container aus:

          docker exec -it -w /web/rc $(docker ps -f name=php-fpm-mailcow -q) composer update --no-dev -o\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-des-mime-typ-verzeichnisses","title":"Aktualisierung des MIME-Typ-Verzeichnisses","text":"

          Um das MIME-Typ-Verzeichnis zu aktualisieren, laden Sie dieses erneut mit dem Kommando aus den Installations-Anweisungen herunter.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#deinstallation-von-roundcube","title":"Deinstallation von Roundcube","text":"

          F\u00fcr die Deinstallation wird ebenfalls angenommen, dass die Kommandos im mailcow-Installationsverzeichnis ausgef\u00fchrt werden und dass mailcow.conf in die Shell geladen wurde, siehe Abschnitt Vorbereitung oben.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-des-web-verzeichnisses","title":"Entfernen des Web-Verzeichnisses","text":"

          Dies entfernt die Roundcube-Installation mit allen Plugins und Abh\u00e4ngigkeiten die Sie ggf. installiert haben, einschlie\u00dflich solcher, die mit composer installiert wurden.

          Hinweis: Dies entfernt auch alle angepassten Konfigurationen die Sie ggf. in Roundcube durchgef\u00fchrt haben. Sollten Sie diese erhalten wollen, verschieben Sie das Verzeichnis an einen anderen Ort statt es zu entfernen.

          rm -r data/web/rc\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-datenbank","title":"Entfernen der Datenbank","text":"

          Hinweis: Dies l\u00f6scht alle Daten, die Roundcube abgespeichert hat. Wenn Sie diese erhalten m\u00f6chten, k\u00f6nnen Sie mysqldump ausf\u00fchren, bevor Sie die Datenbank l\u00f6schen, oder die Datenbank einfach nicht l\u00f6schen.

          docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP USER 'roundcube'@'%';\"\ndocker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -e \"DROP DATABASE roundcubemail;\"\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-konfigurationsanpassungen-fur-mailcow","title":"Entfernen der Konfigurationsanpassungen f\u00fcr mailcow","text":"

          Um die Dateien zu ermitteln, lesen Sie bitte die Installationsanweisungen und machen Sie die Schritte, die Sie dort zuvor durchgef\u00fchrt haben, r\u00fcckg\u00e4ngig.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#migration-von-einer-alteren-mailcow-roundcube-installation","title":"Migration von einer \u00e4lteren mailcow-Roundcube-Installation","text":"

          \u00c4ltere Versionen dieser Anleitung verwendeten die mailcow-Datenbank auch f\u00fcr Roundcube, mit einem konfigurierten Pr\u00e4fix mailcow_rc1 f\u00fcr alle Roundcube-Tabellen.

          Zur Migration wird ebenfalls angenommen, dass alle Kommandos im mailcow-Installationsverzeichnis ausgef\u00fchrt werden und mailcow.conf in die Shell geladen wurde, siehe Vorbereitung oben. Dies Kommandos der verschiedenen Schritte bauen aufeinander auf und m\u00fcssen innerhalb derselben Shell ausgef\u00fchrt werden. Insbesondere setzen einige Schritte Shell-Variablen (besonders die DBROUNDCUBE-Variable mit dem Datenbank-Passwort f\u00fcr den roundcube-Datenbankbenutzer), die in sp\u00e4teren Schritten verwendet werden.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#anlegen-eines-neuen-roundcube-datenbankbenutzers-und-der-datenbank","title":"Anlegen eines neuen roundcube-Datenbankbenutzers und der Datenbank","text":"

          Folgen Sie den Anweisungen oben um den roundcube-Datenbankbenutzer und die getrennte Datenbank anzulegen.

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#migration-der-roundcube-daten-aus-der-mailcow-datenbank","title":"Migration der Roundcube-Daten aus der mailcow-Datenbank","text":"

          Bevor wir mit der Migration starten, deaktivieren wir Roundcube, um weitere \u00c4nderungen an dessen Datenbank-Tabellen zu vermeiden.

          cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation ^~ /rc/ {\n  return 503;\n}\nEOCONFIG\ndocker compose exec nginx-mailcow nginx -s reload\n

          Nun kopieren wir die Roundcube-Daten in die neue Datenbank. Wir entfernen das Datenbank-Tabellen-Pr\u00e4fix in diesem Schritt, welches Sie ggf. anpassen m\u00fcssen, wenn Sie ein anderes Pr\u00e4fix als mailcow_rc1 verwendet haben. Es ist auch m\u00f6glich, das Pr\u00e4fix beizubehalten (in diesem Fall behalten Sie auch die zugeh\u00f6rige Roundcube-Einstellung db_prefix bei). \u00c4ndern Sie dann die Datenbank-Fremdschl\u00fcssel.

          RCTABLES=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"show tables like 'mailcow_rc1%';\" | tr '\\n\\r' ' ')\ndocker exec $(docker ps -f name=mysql-mailcow -q) /bin/bash -c \"mysqldump -uroot -p${DBROOT} mailcow $RCTABLES | sed 's/mailcow_rc1//' | mysql -uroot -p${DBROOT} roundcubemail\"\nFOREIGNKEYS=$(docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SELECT CONCAT('ALTER TABLE \\`', TABLE_NAME, '\\` ', 'DROP FOREIGN KEY \\`', CONSTRAINT_NAME, '\\`;', 'ALTER TABLE \\`', TABLE_NAME, '\\` ', 'ADD FOREIGN KEY \\`', CONSTRAINT_NAME, '\\` (', COLUMN_NAME, ') ', 'REFERENCES \\`', REPLACE(REFERENCED_TABLE_NAME, 'mailcow_rc1', ''), '\\` (', REFERENCED_COLUMN_NAME, ');') FROM INFORMATION_SCHEMA.KEY_COLUMN_USAGE WHERE TABLE_SCHEMA = 'roundcubemail' AND REFERENCED_TABLE_NAME IS NOT NULL;\")\ndocker exec $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} roundcubemail -e \"$FOREIGNKEYS\"\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#aktualisierung-der-roundcube-konfiguration","title":"Aktualisierung der Roundcube-Konfiguration","text":"

          F\u00fchren Sie folgende Kommandos aus, um die nicht mehr notwendige db_prefix Option zu entfernen. Wir aktivieren au\u00dferdem das Logging in Roundcube, indem wir die Einstellungen log_dir und temp_dir entfernen, welche Teil der alten Anweisungen waren.

          sed -i \"/\\$config\\['db_prefix'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['log_dir'\\].*$/d\" data/web/rc/config/config.inc.php\nsed -i \"/\\$config\\['temp_dir'\\].*$/d\" data/web/rc/config/config.inc.php\n

          Wir m\u00fcssen die nginx-Konfiguration anpassen, so dass nicht-\u00f6ffentliche Verzeichnisse von Roundcube nicht exponiert werden, insbesondere die Verzeichnisse, welche Log-Dateien und tempor\u00e4re Dateien enthalten:

          cat <<EOCONFIG >data/conf/nginx/site.roundcube.custom\nlocation /rc/ {\n  alias /web/rc/public_html/;\n}\nEOCONFIG\n

          Wir k\u00f6nnen auch die cipher_method-Einstellung auf eine sicherere Einstellung \u00e4ndern, aber beachten Sie, dass mit der alten Methode verschl\u00fcsselte Daten danach nicht mehr entschl\u00fcsselt werden k\u00f6nnen. Dies betrifft insbesondere CardDAV-Passw\u00f6rter, sofern Sie RCMCardDAV verwenden und Ihre Nutzer benutzerdefinierte Adressb\u00fccher hinzugef\u00fcgt haben (die Admin-Voreinstellungen f\u00fcr die SOGo-Adressb\u00fccher werden automatisch beim n\u00e4chsten Login f\u00fcr den jeweiligen Nutzer korrigiert). Wenn Sie die cipher_method \u00e4ndern wollen, f\u00fchren Sie folgendes Kommando aus:

          cat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['cipher_method'] = 'chacha20-poly1305';\nEOCONFIG\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#umstellung-des-rcmcarddav-plugins-auf-die-installation-mittels-composer","title":"Umstellung des RCMCardDAV-Plugins auf die Installation mittels composer","text":"

          Dieser Schritt ist optional, aber er gleicht Ihre Installation an die aktuelle Fassung der Anweisungen an und erm\u00f6glicht die Aktualisierung von RCMCardDAV mittels composer. Dies wird einfach dadurch erreicht, dass das carddav-Plugin aus dem Installationsverzeichnis gel\u00f6scht und entsprechend der Anweisungen oben installiert wird, einschlie\u00dflich der Erstellung einer neuen RCMCardDAV v5-Konfiguration. Falls Sie das RCMCardDAV angepasst haben, sollten Sie dieses sichern, bevor Sie das Plugin l\u00f6schen, und Ihre Anpassungen sp\u00e4ter in die neue Konfigurationsdatei \u00fcbernehmen.

          Um das carddav-Plugin zu l\u00f6schen, f\u00fchren Sie folgendes Kommando aus, danach befolgen Sie zur Neuinstallation die Anweisungen oben:

          rm -r data/web/rc/plugins/carddav\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#umschalten-von-roundcube-auf-die-neue-datenbank","title":"Umschalten von Roundcube auf die neue Datenbank","text":"

          Zun\u00e4chst passen wir die Roundcube-Konfiguration an, so dass die neue Datenbank verwendet wird. 

          sed -i \"/\\$config\\['db_dsnw'\\].*$/d\" data/web/rc/config/config.inc.php\ncat <<EOCONFIG >>data/web/rc/config/config.inc.php\n\\$config['db_dsnw'] = 'mysql://roundcube:${DBROUNDCUBE}@mysql/roundcubemail';\nEOCONFIG\n

          "},{"location":"de/third_party/roundcube/third_party-roundcube/#roundcube-web-zugriff-reaktivieren","title":"Roundcube Web-Zugriff reaktivieren","text":"

          F\u00fchren Sie chown und chmod auf den sensitiven Roundcube-Verzeichnissen, welche in Vorbereitung aufgef\u00fchrt sind aus, um sicherzustellen, dass der nginx-Webserver nicht auf Dateien zugreifen darf, die er nicht ausliefern soll.

          Dann reaktivieren Sie den Web-Zugriff f\u00fcr Roundcube, indem Sie die tempor\u00e4re Roundcube-Konfigurations-Erweiterung f\u00fcr nginx durch die oben beschriebene ersetzen, und laden anschlie\u00dfend die nginx-Konfiguration neu:

          docker compose exec nginx-mailcow nginx -s reload\n
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#andere-anpassungen","title":"Andere Anpassungen","text":"

          Sie m\u00fcssen auch die Konfiguration des Roundcube password-Plugins entsprechend dieser Anweisungen anpassen, sofern Sie diese Funktionalit\u00e4t aktiviert haben, da die alten Anweisungen das Passwort direkt in der mailcow-Datenbank \u00e4nderten, wohingegen diese Fassung der Anweisungen die mailcow-API zur Passwort-\u00c4nderung verwendet.

          Bez\u00fcglich weiterer Anpassungen und Neuerungen (z. B. roundcube-dovecot_client_ip Plugin) k\u00f6nnen Sie die aktuellen Anweisungen durchgehen und Ihre Konfiguration entsprechend anpassen bzw. die genannten Installationsschritte f\u00fcr neue Funktionalit\u00e4ten ausf\u00fchren.

          Insbesondere beachten Sie folgende Abschnitte:

          • Ofelia-Job f\u00fcr Roundcube-Aufr\u00e4umt\u00e4tigkeiten
          • Erm\u00f6glichen der Klartext-Authentifizierung f\u00fcr den php-fpm-Container ohne die Verwendung von TLS
          • \u00dcbermittlung der Client-Netzwerkadresse an Dovecot
          "},{"location":"de/third_party/roundcube/third_party-roundcube/#entfernen-der-roundcube-tabellen-aus-der-mailcow-datenbank","title":"Entfernen der Roundcube-Tabellen aus der mailcow-Datenbank","text":"

          Nachdem Sie sichergestellt haben, dass die Migration erfolgreich durchgef\u00fchrt wurde und Roundcube mit der getrennten Datenbank funktioniert, k\u00f6nnen Sie die Roundcube-Tabellen aus der mailcow-Datenbank mit dem folgenden Kommando entfernen:

          docker exec -it $(docker ps -f name=mysql-mailcow -q) mysql -uroot -p${DBROOT} -sN mailcow -e \"SET SESSION foreign_key_checks = 0; DROP TABLE IF EXISTS $(echo $RCTABLES | sed -e 's/ \\+/,/g');\"\n
          "},{"location":"de/troubleshooting/debug-admin_login_sogo/","title":"Admin-Anmeldung bei SOGo","text":"

          Dies ist eine experimentelle Funktion, die es Admins und Dom\u00e4nenadmins erlaubt, sich direkt als Mailbox-Benutzer bei SOGo anzumelden, ohne das Passwort des Benutzers zu kennen. Dazu wird ein zus\u00e4tzlicher Link zu SOGo in der Mailbox-Liste (mailcow UI) angezeigt.

          Auch mehrere gleichzeitige Admin-Logins auf verschiedene Postf\u00e4cher sind mit dieser Funktion m\u00f6glich.

          "},{"location":"de/troubleshooting/debug-admin_login_sogo/#aktivieren-der-funktion","title":"Aktivieren der Funktion","text":"

          Die Funktion ist standardm\u00e4\u00dfig deaktiviert. Es kann in der mailcow.conf durch Setzen aktiviert werden: 

          ALLOW_ADMIN_EMAIL_LOGIN=y\n
          und die betroffenen Container neu erstellen mit

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose up -d\n
          docker-compose up -d\n
          "},{"location":"de/troubleshooting/debug-admin_login_sogo/#nachteile-bei-aktivierung","title":"Nachteile bei Aktivierung","text":"
          • Jeder SOGo-Seiten-Load und jede Active-Sync-Anfrage verursacht eine zus\u00e4tzliche Ausf\u00fchrung eines internen PHP-Skripts. Dies kann die Ladezeiten von SOGo / EAS beeintr\u00e4chtigen. In den meisten F\u00e4llen sollte dies nicht sp\u00fcrbar sein, aber Sie sollten es im Hinterkopf behalten, wenn Sie Performance-Probleme haben.
          • SOGo zeigt keinen Logout-Link f\u00fcr Admin-Logins an, um sich normal anzumelden, muss man sich von der mailcow UI abmelden, so dass die PHP-Sitzung zerst\u00f6rt wird.
          • Das Abonnieren des Kalenders oder Adressbuchs eines anderen Nutzers, w\u00e4hrend man als Admin eingeloggt ist, funktioniert nicht. Ebenso wenig funktioniert das Einladen anderer Nutzer zu Kalender-Events. Die Seite wird neu geladen, wenn diese Dinge versucht werden.
          "},{"location":"de/troubleshooting/debug-admin_login_sogo/#technische-details","title":"Technische Details","text":"

          Die Option SOGoTrustProxyAuthentication ist auf YES gesetzt, so dass SOGo dem x-webobjects-remote-user-Header vertraut.

          Dovecot erh\u00e4lt ein zuf\u00e4lliges Master-Passwort, das f\u00fcr alle Mailboxen g\u00fcltig ist, wenn es vom SOGo-Container verwendet wird.

          Ein Klick auf den SOGo-Button in der Mailbox-Liste \u00f6ffnet die Datei sogo-auth.php, die Berechtigungen pr\u00fcft, Session-Variablen setzt und auf die SOGo-Mailbox umleitet.

          Jede SOGo, CardDAV, CalDAV und EAS http-Anfrage verursacht einen zus\u00e4tzlichen, nginx-internen auth_request-Aufruf an sogo-auth.php mit folgendem Verhalten:

          • Wenn ein basic_auth-Header vorhanden ist, wird das Skript die Anmeldedaten anstelle von SOGo validieren und die folgenden Header bereitstellen: x-webobjects-remote-user, Authorization und x-webobjects-auth-type.

          • Wenn kein basic_auth-Header vorhanden ist, wird das Skript nach einer aktiven mailcow-Admin-Sitzung f\u00fcr den angeforderten E-Mail-Benutzer suchen und die gleichen Header bereitstellen, aber mit dem Dovecot-Master-Passwort, das im Authorization-Header verwendet wird.

          • Wenn beides fehlschl\u00e4gt, werden die Header leer gesetzt, was SOGo dazu bringt, seine Standard-Authentifizierungsmethoden zu verwenden.

          Alle diese Optionen/Verhaltensweisen sind deaktiviert, wenn die Option ALLOW_ADMIN_EMAIL_LOGIN in der Konfiguration nicht aktiviert ist.

          "},{"location":"de/troubleshooting/debug-attach_service/","title":"In einen Container wechseln (CLI)","text":""},{"location":"de/troubleshooting/debug-attach_service/#anhangen-eines-containers-an-ihre-shell","title":"Anh\u00e4ngen eines Containers an Ihre Shell","text":"

          Um einen Container an Ihre Shell anzuh\u00e4ngen, k\u00f6nnen Sie einfach folgendes ausf\u00fchren

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec $Dienst_Name /bin/bash\n
          docker-compose exec $Dienst_Name /bin/bash\n
          "},{"location":"de/troubleshooting/debug-attach_service/#verbindung-zu-diensten-herstellen","title":"Verbindung zu Diensten herstellen","text":"

          Wenn Sie sich direkt mit einem Dienst / einer Anwendung verbinden wollen, ist es immer eine gute Idee, source mailcow.conf zu benutzen, um alle relevanten Variablen in Ihre Umgebung zu bekommen.

          "},{"location":"de/troubleshooting/debug-attach_service/#dienstbeschreibungen","title":"Dienstbeschreibungen","text":"

          Hier ist eine kurze \u00dcbersicht, welcher Container / Dienst was macht:

          Dienstname Dienstbeschreibungen unbound-mailcow Lokaler (DNSSEC) DNS-Aufl\u00f6ser mysql-mailcow Speichert die SOGo's und die meisten Einstellungen von mailcow postfix-mailcow Empf\u00e4ngt und sendet Mails dovecot-mailcow Benutzer-Logins und Siebfilter redis-mailcow Speicher-Backend f\u00fcr DKIM-Schl\u00fcssel und Rspamd rspamd-mailcow Mail-Filter-System. Verwendet f\u00fcr Av-Behandlung, DKIM-Signierung, Spam-Behandlung clamd-mailcow Scannt Anh\u00e4nge auf Viren olefy-mailcow Scannt angeh\u00e4ngte Office-Dokumente auf Makro-Viren solr-mailcow Bietet Volltextsuche in Dovecot sogo-mailcow Webmail-Client, der Microsoft ActiveSync und Cal- / CardDav verarbeitet nginx-mailcow Nginx Remote-Proxy, der alle mailcow-bezogenen HTTP / HTTPS-Anfragen bearbeitet acme-mailcow Automatisiert den Einsatz von HTTPS (SSL/TLS) Zertifikaten memcached-mailcow Internes Caching-System f\u00fcr mailcow-Dienste watchdog-mailcow Erm\u00f6glicht die \u00dcberwachung von Docker-Containern / Diensten php-fpm-mailcow Betreibt die mailcow Web UI netfilter-mailcow Fail2Ban \u00e4hnliche Integration"},{"location":"de/troubleshooting/debug-common_problems/","title":"H\u00e4ufig auftretende Probleme","text":"

          Hier sind h\u00e4ufige Probleme und m\u00f6gliche L\u00f6sungen:

          "},{"location":"de/troubleshooting/debug-common_problems/#mail-kommt-in-einer-schleife-zu-sich-selbst-zuruck","title":"Mail kommt in einer Schleife zu sich selbst zur\u00fcck.","text":"

          Bitte \u00fcberpr\u00fcfen Sie in Ihrer mailcow UI, ob Sie die Domain als Backup MX eingestellt haben:

          "},{"location":"de/troubleshooting/debug-common_problems/#ich-kann-mails-empfangen-aber-nicht-senden","title":"Ich kann Mails empfangen, aber nicht senden","text":"

          Es gibt viele Gr\u00fcnde, die Sie daran hindern k\u00f6nnen, Mails zu versenden:

          • Pr\u00fcfen Sie, ob Ihre IP-Adresse auf einer schwarzen Liste steht. Sie k\u00f6nnen dnsbl.info oder einen \u00e4hnlichen Dienst verwenden, um Ihre IP-Adresse zu \u00fcberpr\u00fcfen.
          • Es gibt einige ISP-Router, die Mail-Ports f\u00fcr nicht auf der Blacklist stehende Domains blockieren. Bitte \u00fcberpr\u00fcfen Sie, ob Sie Ihren Server \u00fcber die Ports 465 oder 587 erreichen k\u00f6nnen:
          # telnet 74.125.133.27 465\nVersucht 74.125.133.27...\nVerbunden mit 74.125.133.27.\nEscape-Zeichen ist '^]'.\n
          "},{"location":"de/troubleshooting/debug-common_problems/#meine-mails-werden-als-spam-identifiziert","title":"Meine Mails werden als Spam identifiziert","text":"

          Bitte lesen Sie unsere DNS-Konfiguration Anleitung.

          "},{"location":"de/troubleshooting/debug-common_problems/#docker-compose-wirft-seltsame-fehler-aus","title":"docker compose wirft seltsame Fehler aus.","text":"

          ... wie:

          • ERROR: Ung\u00fcltiges Interpolationsformat ...
          • AttributeError: 'NoneType' Objekt hat kein Attribut 'keys'.
          • ERROR: In der Datei './docker-compose.yml' hat der Dienst 'version' keine Konfigurationsoptionen.

          Wenn Sie eine oder \u00e4hnliche Meldungen erhalten, w\u00e4hrend Sie versuchen, mailcow: dockerized auszuf\u00fchren, \u00fcberpr\u00fcfen Sie bitte, ob Sie die aktuellste Version von Docker und docker compose haben.

          "},{"location":"de/troubleshooting/debug-common_problems/#container-xy-ist-ungesund","title":"Container XY ist ungesund","text":"

          Dieser Fehler versucht Ihnen mitzuteilen, dass eine der (Gesundheits-)Bedingungen f\u00fcr einen bestimmten Container nicht erf\u00fcllt ist. Daher kann er nicht gestartet werden. Dies kann verschiedene Gr\u00fcnde haben, der h\u00e4ufigste ist ein aktualisierter Git-Klon, aber ein altes Docker-Image oder umgekehrt.

          Auch eine falsch konfigurierte Firewall kann einen solchen Fehler verursachen. Die Container m\u00fcssen in der Lage sein, \u00fcber das Netzwerk 172.22.1.1/24 miteinander zu kommunizieren.

          Es k\u00f6nnte auch eine falsch verkn\u00fcpfte Datei sein (z. B. ein SSL-Zertifikat), die den Start eines wichtigen Containers (nginx) verhindert. Pr\u00fcfen Sie daher immer Ihre Protokolle, um herauszufinden, woher das Problem kommt.

          "},{"location":"de/troubleshooting/debug-common_problems/#adresse-bereits-in-gebrauch","title":"Adresse bereits in Gebrauch","text":"

          Wenn Sie eine Fehlermeldung erhalten wie:

          ERROR: for postfix-mailcow Cannot start service postfix-mailcow: driver failed programming external connectivity on endpoint mailcowdockerized_postfix-mailcow_1: Error starting userland proxy: listen tcp 0.0.0:25: bind: address already in use\n

          w\u00e4hrend Sie versuchen, mailcow: dockerized zu starten / zu installieren, stellen Sie sicher, dass Sie unseren Abschnitt \u00fcber prerequisites befolgt haben.

          "},{"location":"de/troubleshooting/debug-common_problems/#xyz-kann-keine-verbindung-zu","title":"XYZ kann keine Verbindung zu ...","text":"

          Bitte \u00fcberpr\u00fcfen Sie Ihre lokale Firewall! Docker und iptables-basierte Firewalls erstellen manchmal widerspr\u00fcchliche Regeln. Deaktivieren Sie daher die Firewall auf Ihrem Host, um festzustellen, ob Ihre Verbindungsprobleme durch solche Konflikte verursacht werden. Wenn dies der Fall ist, m\u00fcssen Sie manuell entsprechende Regeln in Ihrer Host-Firewall erstellen, um die erforderlichen Verbindungen zuzulassen.

          Wenn Sie Verbindungsprobleme von zu Hause aus haben, \u00fcberpr\u00fcfen Sie bitte auch die Firewall Ihres ISP-Routers, da einige von ihnen den E-Mail-Verkehr \u00fcber die Ports SMTP (587) oder SMTPS (465) blockieren. Es k\u00f6nnte auch sein, dass Ihr ISP die Ports f\u00fcr SUBMISSION (25) blockiert.

          W\u00e4hrend Linux-Benutzer aus einer Vielzahl von Tools1 w\u00e4hlen k\u00f6nnen, um zu \u00fcberpr\u00fcfen, ob ein Port offen ist, steht Windows-Benutzern standardm\u00e4\u00dfig nur der PowerShell-Befehl Test-NetConnection -ComputerName host -Port port zur Verf\u00fcgung.

          Um Telnet auf einem Windows nach Vista zu aktivieren, lesen Sie bitte diese Anleitung oder geben Sie den folgenden Befehl in einem Terminal mit Administratorrechten ein:

          dism /online /Enable-Feature /FeatureName:TelnetClient\n
          "},{"location":"de/troubleshooting/debug-common_problems/#inotify-instanz-limit-uberschritten-fur-benutzer-5000-uid-vmail-siehe-453","title":"Inotify-Instanz-Limit \u00fcberschritten f\u00fcr Benutzer 5000 (UID vmail) (siehe #453).","text":"

          Docker-Container verwenden die inotify-Limits von Docker-Hosts. Wenn Sie sie auf Ihrem Docker-Host setzen, werden sie an den Container weitergegeben.

          "},{"location":"de/troubleshooting/debug-common_problems/#dovecot-startet-standig-neu-siehe-2672","title":"Dovecot startet st\u00e4ndig neu (siehe #2672).","text":"

          Stellen Sie sicher, dass Sie mindestens die folgenden Dateien in data/assets/ssl haben:

          cert.pem\ndhparams.pem\nkey.pem\n

          Wenn dhparams.pem fehlt, k\u00f6nnen Sie es mit Bash

          openssl dhparam -out data/assets/ssl/dhparams.pem 4096\n
          "},{"location":"de/troubleshooting/debug-common_problems/#rspamd-meldet-cannot-open-hyperscan-cache-file-varlibrspamdhs-compiled-for-a-different-platform","title":"Rspamd meldet: cannot open hyperscan cache file /var/lib/rspamd/{...}.hs: compiled for a different platform","text":"

          Bei einer Migration von mailcow auf ein anderes System (meistens mit einer anderen CPU) kann es unter Umst\u00e4nden passieren, dass Rspamd meldet er k\u00f6nne einige (evtl. alle) .hs Dateien nicht laden, da diese f\u00fcr eine andere Plattform (CPU) kompiliert wurden.

          Dies h\u00e4ngt mit Hyperscan2 zusammen einer Intel Technik zum vorkompilieren von regex Schemata, welche Rspamd einsetzt.

          Diese Funktion bringt einen erheblichen Performance Boost mit sich und ist deswegen stark in Rspamd verankert.

          Um diesen Fehler zu beheben, m\u00fcssen alle .hs und .hsmp Dateien aus dem Rspamd Verzeichnis gel\u00f6scht werden:

          docker compose (Plugin)docker-compose (Standalone) 
          cd MAILCOW_ROOT # Meistens /opt/mailcow-dockerized\ndocker compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n
          cd MAILCOW_ROOT # Meistens /opt/mailcow-dockerized\ndocker-compose exec rspamd-mailcow bash\nrm -rf /var/lib/rspamd/*.hs\nrm -rf /var/lib/rspamd/*.hsmp\n

          Anschlie\u00dfend Rspamd neustarten mit:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Nun kompiliert Rspamd die besagten Regex Maps wieder neu mit Hyperscan.

          1. netcat, nmap, openssl, telnet, etc.\u00a0\u21a9

          2. Hyperscan \u21a9

          "},{"location":"de/troubleshooting/debug-logs/","title":"Logs","text":"

          Warnung

          Dieser Abschnitt gilt nur f\u00fcr Docker's Standard-Logging-Treiber (JSON).

          Um die Logs aller mailcow: dockerized bezogenen Container zu sehen, k\u00f6nnen Sie den folgenden Befehl innerhalb Ihres mailcow-dockerized Ordners verwenden, der Ihre mailcow.conf enth\u00e4lt:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs\n
          docker-compose logs\n

          Dies ist normalerweise ein bisschen viel, aber Sie k\u00f6nnen die Ausgabe mit --tail=100 auf die letzten 100 Zeilen pro Container k\u00fcrzen, oder ein -f hinzuf\u00fcgen, um die Live-Ausgabe aller Ihrer Dienste zu verfolgen.

          Um die Logs eines bestimmten Dienstes zu sehen, kann man folgendes verwenden:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose logs [options] $service_name\n
          docker-compose logs [options] $service_name\n

          Info

          Die verf\u00fcgbaren Optionen f\u00fcr den Befehl obrigen Befehlsind:

          • -no-color: Erzeugt eine einfarbige Ausgabe.
          • -f: Der Log-Ausgabe folgen.
          • -t: Zeitstempel anzeigen.
          • --tail=\"all \": Anzahl der Zeilen, die ab dem Ende der Protokolle f\u00fcr jeden Container angezeigt werden sollen.
          "},{"location":"de/troubleshooting/debug-mysql_aria/","title":"Abgest\u00fcrzte Aria-Speicher-Engine wiederherstellen","text":""},{"location":"de/troubleshooting/debug-mysql_aria/#mariadb-aria-wiederherstellung-nach-absturz","title":"MariaDB: Aria-Wiederherstellung nach Absturz","text":"

          Wenn Ihr Server abgest\u00fcrzt ist und MariaDB eine Fehlermeldung \u00e4hnlich [ERROR] mysqld: Aria recovery failed. Please run aria_chk -r on all Aria tables (*.MAI) and delete all aria_log.######## files, k\u00f6nnen Sie Folgendes versuchen, um die Datenbank in einen gesunden Zustand zu bringen:

          Starten Sie den Stack und warten Sie, bis mysql-mailcow beginnt, einen Neustart zu melden. \u00dcberpr\u00fcfen Sie dies, indem Sie den folgenden Befehl ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose ps\n
          docker-compose ps\n

          F\u00fchren Sie nun die folgenden Befehle aus:

          Stoppen Sie den Stack, nicht \"down\" ausf\u00fchren

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose stop\n
          docker-compose stop\n

          F\u00fchren Sie eine Bash in dem gestoppten Container als Benutzer mysql aus

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n
          docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql bash\"' mysql-mailcow\n

          cd in das SQL-Datenverzeichnis 

          cd /var/lib/mysql\n

          aria_chk ausf\u00fchren 

          aria_chk --check --force */*.MAI\n
          L\u00f6schen der aria-Logdateien 
          rm aria_log.*\n

          F\u00fchren Sie nun einen kompletten Stack neustart durch:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down\ndocker compose up -d\n
          docker-compose down\ndocker-compose up -d\n
          "},{"location":"de/troubleshooting/debug-mysql_upgrade/","title":"Manuelles MySQL-Upgrade","text":""},{"location":"de/troubleshooting/debug-mysql_upgrade/#fuhren-sie-ein-manuelles-mysql_upgrade-durch","title":"F\u00fchren Sie ein manuelles mysql_upgrade durch.","text":"

          Dieser Schritt ist normalerweise nicht notwendig.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose stop mysql-mailcow watchdog-mailcow\ndocker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n
          docker-compose stop mysql-mailcow watchdog-mailcow\ndocker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && bash && exit 0\"' mysql-mailcow\n

          Sobald die SQL-Shell gestartet wurde, f\u00fchren Sie mysql_upgrade aus und verlassen den Container:

          mysql_upgrade\nexit\n
          "},{"location":"de/troubleshooting/debug-resend-quarantine-notifications/","title":"Erneutes Senden von Quarant\u00e4ne-Benachrichtigungen","text":"

          Um eine Quarant\u00e4ne Benachrichtigung erneut zu versenden geben Sie folgenden Befehl ein:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n
          docker-compose exec dovecot-mailcow bash\nmysql -umailcow -p$DBPASS mailcow -e \"update quarantine set notified = 0;\"\nredis-cli -h redis DEL Q_LAST_NOTIFIED\nquarantine_notify.py\n

          Info

          Wir empfehlen die Verwendung dieses Befehles NUR zum debugging Prozess, da die Benachrichtigung im Normalfall automatisiert, anhand der pro Mailbox gesetzten Einstellungen, ausgel\u00f6st wird.

          "},{"location":"de/troubleshooting/debug-reset_pw/","title":"Passw\u00f6rter zur\u00fccksetzen (inkl. SQL)","text":""},{"location":"de/troubleshooting/debug-reset_pw/#mailcow-admin-konto","title":"mailcow Admin-Konto","text":"

          Setzt den mailcow Admin Account auf ein zuf\u00e4lliges Passwort zur\u00fcck. \u00c4ltere mailcow: dockerisierte Installationen k\u00f6nnen das mailcow-reset-admin.sh Skript in ihrem mailcow Stammverzeichnis (mailcow_path) finden.

          cd mailcow_pfad\n./helper-scripts/mailcow-reset-admin.sh\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#mysql-passworter-zurucksetzen","title":"MySQL-Passw\u00f6rter zur\u00fccksetzen","text":"

          Stoppen Sie den Stack, indem Sie den folgenden Befehl ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose stop\n
          docker-compose stop\n

          Wenn die Container heruntergefahren sind, f\u00fchren Sie diesen Befehl aus:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
          docker-compose run --rm --entrypoint '/bin/sh -c \"gosu mysql mysqld --skip-grant-tables & sleep 10 && mysql -hlocalhost -uroot && exit 0\"' mysql-mailcow\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#1-datenbank-name-finden","title":"1. Datenbank-Name finden","text":"docker compose (Plugin)docker-compose (Standalone) 
          # source mailcow.conf\n# docker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| information_schema |\n| mailcow_database | <=====\n| mysql |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
          # source mailcow.conf\n# docker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME}\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| information_schema |\n| mailcow_database | <=====\n| mysql |\n| performance_schema |\n+--------------------+\n4 rows in set (0.00 sec)\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#2-einen-oder-mehrere-benutzer-zurucksetzen","title":"2. Einen oder mehrere Benutzer zur\u00fccksetzen","text":""},{"location":"de/troubleshooting/debug-reset_pw/#21-maria-db-104-altere-mailcow-installationen","title":"2.1 Maria DB < 10.4 (\u00e4ltere mailcow-Installationen)","text":"

          Sowohl \"password\" als auch \"authentication_string\" existieren. Derzeit wird \"password\" verwendet, aber besser ist es, beide zu setzen.

          MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user |\n+--------------+\n| mailcow | <=====\n| root |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('gotr00t'), password = PASSWORD('gotr00t') WHERE User = 'root';\nMariaDB [(none)]> UPDATE mysql.user SET authentication_string = PASSWORD('mookuh'), password = PASSWORD('mookuh') WHERE User = 'mailcow' AND Host = '%';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#22-maria-db-104-aktuelle-mailcows","title":"2.2 Maria DB >= 10.4 (aktuelle mailcows)","text":"
          MariaDB [(none)]> SELECT user FROM mysql.user;\n+--------------+\n| user |\n+--------------+\n| mailcow | <=====\n| root |\n+--------------+\n2 rows in set (0.00 sec)\n\nMariaDB [(none)]> FLUSH PRIVILEGES;\nMariaDB [(none)]> ALTER USER 'mailcow'@'%' IDENTIFIED BY 'mookuh';\nMariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t'; MariaDB [(none)]> ALTER USER 'root'@'%' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t'; MariaDB [(none)]> ALTER USER 'root'@'localhost' IDENTIFIED BY 'gotr00t';\nMariaDB [(none)]> FLUSH PRIVILEGES;\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#zwei-faktor-authentifizierung-entfernen","title":"Zwei-Faktor-Authentifizierung entfernen","text":""},{"location":"de/troubleshooting/debug-reset_pw/#fur-mailcow-webui","title":"F\u00fcr mailcow WebUI:","text":"

          Dies funktioniert \u00e4hnlich wie das Zur\u00fccksetzen eines MySQL-Passworts, jetzt machen wir es vom Host aus, ohne uns mit dem MySQL CLI zu verbinden:

          docker compose (Plugin)docker-compose (Standalone) 
          source mailcow.conf\ndocker compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
          source mailcow.conf\ndocker-compose exec mysql-mailcow mysql -u${DBUSER} -p${DBPASS} ${DBNAME} -e \"DELETE FROM tfa WHERE username='YOUR_USERNAME';\"\n
          "},{"location":"de/troubleshooting/debug-reset_pw/#fur-sogo","title":"F\u00fcr SOGo:","text":"docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
          docker-compose exec -u sogo sogo-mailcow sogo-tool user-preferences set defaults user@example.com SOGoGoogleAuthenticatorEnabled '{\"SOGoGoogleAuthenticatorEnabled\":0}'\n
          "},{"location":"de/troubleshooting/debug-reset_tls/","title":"TLS-Zertifikate zur\u00fccksetzen","text":"

          Sollten Sie Probleme mit Ihrem Zertifikat, Schl\u00fcssel oder Let's Encrypt-Konto haben, versuchen Sie bitte, die TLS-Assets zur\u00fcckzusetzen:

          source mailcow.conf\ndocker compose down\nrm -rf data/assets/ssl\nmkdir data/assets/ssl\nopenssl req -x509 -newkey rsa:4096 -keyout data/assets/ssl-example/key.pem -out data/assets/ssl-example/cert.pem -days 365 -subj \"/C=DE/ST=NRW/L=Willich/O=mailcow/OU=mailcow/CN=${MAILCOW_HOSTNAME}\" -sha256 -nodes\ncp -n -d data/assets/ssl-example/*.pem data/assets/ssl/\ndocker compose up -d\n

          Dies wird mailcow stoppen, die ben\u00f6tigten Variablen beschaffen, ein selbstsigniertes Zertifikat erstellen und mailcow starten.

          Wenn Sie Let's Encrypt verwenden, sollten Sie vorsichtig sein, da Sie ein neues Konto und einen neuen Satz von Zertifikaten erstellen werden. Sie werden fr\u00fcher oder sp\u00e4ter auf ein Ratelimit sto\u00dfen.

          Bitte beachten Sie auch, dass fr\u00fchere TLSA-Datens\u00e4tze ung\u00fcltig werden.

          "},{"location":"de/troubleshooting/debug-rm_volumes/","title":"Persistente Daten l\u00f6schen","text":"

          Es kann sein, dass Sie einen Satz persistenter Daten entfernen wollen, um einen Konflikt zu l\u00f6sen oder um neu zu beginnen.

          mailcowdockerized kann variieren und h\u00e4ngt von Ihrem Compose-Projektnamen ab (wenn er unver\u00e4ndert ist, ist mailcowdockerized der richtige Wert). Wenn Sie sich unsicher sind, f\u00fchren Sie docker volume ls aus, um eine vollst\u00e4ndige Liste zu erhalten.

          L\u00f6schen Sie ein einzelnes Volume:

          docker volume rm mailcowdockerized_${VOLUME_NAME}\n
          • Entfernen Sie Volume mysql-vol-1, um alle MySQL-Daten zu entfernen.
          • Entfernen Sie Volume redis-vol-1 um alle Redis Daten zu entfernen.
          • Volume vmail-vol-1 entfernen, um alle Inhalte von /var/vmail zu entfernen, die in dovecot-mailcow eingebunden sind.
          • Entfernen Sie das Volume rspamd-vol-1, um alle Rspamd-Daten zu entfernen.
          • Entfernen Sie Volume crypt-vol-1, um alle Crypto-Daten zu entfernen. Dies wird alle Mails unlesbar machen.

          Alternativ dazu wird die Ausf\u00fchrung des folgenden Befehles alle mailcow: dockerized volumes zerst\u00f6ren und alle zugeh\u00f6rigen Container und Netzwerke l\u00f6schen:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose down -v\n
          docker-compose down -v\n
          "},{"location":"de/troubleshooting/debug-rspamd_memory_leaks/","title":"Fortgeschritten: Memory-Leaks in Rspamd finden","text":"

          Eine kurze Anleitung, um einen schlecht funktionierenden Rspamd tiefgehend zu analysieren.

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# F\u00fcgen Sie vor \"exec \"$@\"\" die folgenden Zeilen ein:\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n
          docker-compose exec rspamd-mailcow bash\n\nif ! grep -qi 'apt-stable-asan' /etc/apt/sources.list.d/rspamd.list; then\n  sed -i 's/apt-stabil/apt-stabil-asan/i' /etc/apt/sources.list.d/rspamd.list\nfi\n\napt-get update ; apt-get upgrade rspamd\n\nnano /docker-entrypoint.sh\n\n# F\u00fcgen Sie vor \"exec \"$@\"\" die folgenden Zeilen ein:\n\nexport G_SLICE=always-malloc\nexport ASAN_OPTIONS=new_delete_type_mismatch=0:detect_leaks=1:detect_odr_violation=0:log_path=/tmp/rspamd-asan:quarantine_size_mb=2048:malloc_context_size=8:fast_unwind_on_malloc=0\n

          Starten Sie Rspamd neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Ihr Speicherverbrauch wird stark ansteigen, er wird auch stetig wachsen, was nicht mit einem m\u00f6glichen Memory Leak zusammenh\u00e4ngt, nach dem Sie suchen.

          Lassen Sie den Container f\u00fcr ein paar Minuten, Stunden oder Tage laufen (es sollte die Zeit sein, die Sie normalerweise warten, bis der Memory Leak \"passiert\") und starten Sie ihn neu:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose restart rspamd-mailcow\n
          docker-compose restart rspamd-mailcow\n

          Betreten Sie nun den Container, indem Sie den folgenden Befehl ausf\u00fchren:

          docker compose (Plugin)docker-compose (Standalone) 
          docker compose exec rspamd-mailcow bash\n
          docker-compose exec rspamd-mailcow bash\n

          Wechseln Sie das Verzeichnis zu /tmp und kopieren Sie die asan-Dateien an den gew\u00fcnschten Ort oder laden Sie sie \u00fcber termbin.com hoch (cat /tmp/rspamd-asan.* | nc termbin.com 9999).

          "},{"location":"de/troubleshooting/debug/","title":"Einf\u00fchrung","text":"

          Wenn ein Problem auftritt, dann immer aus einem bestimmten Grund! Was Sie in einem solchen Fall tun sollten, ist:

          1. Lesen Sie Ihre Logs; verfolgen Sie sie, um herauszufinden, was der Grund f\u00fcr Ihr Problem ist.
          2. Folgen Sie den Hinweisen in Ihren Logdateien und beginnen Sie mit der Untersuchung.
          3. Starten Sie den gest\u00f6rten Dienst oder den gesamten Stack neu, um zu sehen, ob das Problem weiterhin besteht.
          4. Lesen Sie die Dokumentation des gest\u00f6rten Dienstes und suchen Sie in dessen Bugtracker nach Ihrem Problem.
          5. Durchsuchen Sie unsere Github Issues nach Ihrem Problem.
          6. Erstelle einen Github Issue in unserem GitHub Repository, wenn Sie glauben, dass Ihr Problem ein Fehler oder eine fehlende Funktion ist, die Sie dringend ben\u00f6tigen. Bitte stellen Sie aber sicher, dass Sie alle Logs und eine vollst\u00e4ndige Beschreibung Ihres Problems mitschicken. Bitte fragen Sie nicht nach Support auf Github.
          7. Treten Sie unserer Telegram-Community bei oder finden Sie die offiziellen Support-Pakete bei Servercow. Alternativ fragen Sie Twitter um Rat und taggen uns mit @mailcow_email.
          "}]} \ No newline at end of file