Documentation / Start here
Requirements
Server, DNS, network and access requirements for a supported Alt8Mail deployment.
#Supported platform
The supported Alt8Mail deployment target is Debian 12 (bookworm), 64-bit. The installer checks the operating system and refuses to continue on a different release.
Use a clean host dedicated to Alt8Mail. The installer installs and rewrites the mail, database, cache, web and systemd configuration. It also resets the host firewall to its own rule set. Do not run it on a server that already carries another mail or web stack you intend to keep.
| Requirement | Supported baseline |
|---|---|
| Operating system | Debian 12, 64-bit |
| Service manager | systemd |
| Access | Root or sudo over SSH |
| Network | Public IPv4 address; provider firewall you can edit |
| DNS | Control of the mail domain and its records |
| Release architecture | Published builds target linux/amd64 |
| Core runtime | Installed by the Alt8Mail installer; Node.js is not a production dependency |
| Optional Office runtime | Docker plus Docker Compose, managed through System Control |
Source builds on ARM64 are possible because the installer can provision Go, but no published ARM64 release artifact is evidenced. For a production rollout, use the published release and confirm your architecture with the project before committing.
#Server sizing
The documented practical floor is 2 vCPU and 4 GB RAM. Use 4 vCPU and 8 GB RAM or more for production, and size disk for mailbox data, attachments, database growth and backups.
| Resource | Evaluation guidance | Production guidance |
|---|---|---|
| CPU | 2 vCPU | 4 vCPU or more |
| Memory | 4 GB | 8 GB or more |
| Disk | 50 GB minimum | Size to mail + files + database + versions + backups |
| Swap | Installer adds a 2 GB swapfile when needed | Keep monitored swap, not as a substitute for RAM |
Mail storage grows with every mailbox, attachment and version snapshot. Cabinet and Office versioning, legal holds and backups can consume far more disk than an empty evaluation installation suggests. Monitor capacity and plan storage before a migration, not during it.
#DNS requirements
Plan DNS before installation. The installer attempts a Let's Encrypt certificate for the mail hostname and the mail domain. Automatic TLS needs the relevant A records to resolve to the host's public IPv4 address and inbound TCP 80 to reach it.
At minimum, plan for:
| Record | Purpose |
|---|---|
A for the mail hostname, such as mail.example.com | Web, IMAP, POP3, submission and the mail hostname |
A for the mail domain, such as a8m.example.com | Webmail/admin host and certificate coverage |
PTR / reverse DNS from the provider | Outbound mail reputation and deliverability |
CAA allowing your ACME CA where the domain uses CAA | Let's Encrypt issuance |
MX for the mail domain | Inbound mail, verified in the customer admin console |
SPF TXT | Sender authorization |
DKIM TXT at the active selector | Message signing and domain verification |
DMARC TXT | Domain policy and reporting |
_a8m-verification TXT | Domain ownership verification inside Alt8Mail |
_mta-sts and mta-sts policy records, if using MTA-STS | MTA-STS enforcement |
The customer admin console performs real DNS checks for ownership, MX, SPF, DKIM and DMARC. Outbound sending remains gated until the sender domain satisfies the policy. The installation can succeed before MX, SPF, DKIM and DMARC are complete, but mail readiness cannot.
If Let's Encrypt cannot validate the hostname, the installer falls back to a self-signed certificate. Replace that certificate with a trusted one before exposing the service to users.
#Network exposure
Open only the ports your deployment needs. The installer opens the detected SSH port plus the following public service ports.
| Port | Protocol | Purpose | Exposure |
|---|---|---|---|
| 25 | SMTP | Inbound mail from the internet | Public |
| 80 | HTTP | ACME validation, redirect to HTTPS | Public |
| 443 | HTTPS | Webmail, customer admin, CalDAV/CardDAV and APIs | Public |
| 587 | Submission | Authenticated mail submission with STARTTLS | Public, authenticated |
| 993 | IMAPS | Mail client access | Public, authenticated |
| 995 | POP3S | POP3 access when policy permits | Public, authenticated |
| 4190 | ManageSieve | Sieve management when enabled | Public, authenticated; restrict if unused |
| 8808 | HTTPS | System Control | Management network / VPN only |
Port 8808 is root-equivalent. The installer opens it to every source, so restrict it at the provider firewall or VPN before putting the host into service. System Control has no application-level IP allowlist.
The following ports must stay on loopback and must never be exposed through the provider firewall or a reverse proxy:
| Port | Service |
|---|---|
| 5432 | PostgreSQL |
| 6379 | Redis |
| 8080 | Webmail Go API |
| 8081 | Customer admin Go API |
| 8098 | Optional Office agent |
| 10040 | Postfix policy daemon |
| 8082 | Optional OnlyOffice container |
| 8099 | Optional add-on relay |
Your provider must permit inbound and outbound TCP 25 for direct internet mail. A provider that blocks port 25 cannot support direct SMTP delivery. Use the supported relay configuration only after understanding the provider's egress restrictions and outbound reputation model.
#TLS
Alt8Mail expects HTTPS for webmail, the customer admin, CalDAV/CardDAV and System Control. The mail services use TLS 1.2 or later. System Control starts with a bootstrap certificate and must be replaced with a trusted certificate or accessed through a trusted management path.
Plan:
- a stable mail hostname with a DNS A record;
- an ACME-compatible HTTP path on port 80, or a certificate you can install manually;
- certificate renewal and a calendar reminder to verify it;
- a policy for IMAP, POP3, submission and ManageSieve exposure.
#Optional dependencies
These are not required for core mail, but they affect the supported feature set:
| Capability | Additional requirement |
|---|---|
| Office editing | Docker + Docker Compose, an OnlyOffice deployment, and a running Office agent. OnlyOffice licensing is separate. |
| Google/Microsoft connected accounts | OAuth applications and provider registration configured by an operator |
| Google/Microsoft mailbox migration | Source OAuth credentials or app passwords plus source-mailbox access |
| S3-compatible Cabinet storage | An S3/MinIO endpoint, bucket and credentials |
| CalDAV/CardDAV clients | HTTPS and an app password for MFA-protected accounts |
| Push notifications | VAPID keys configured in System Control |
| Public booking pages | The booking_pages entitlement and a published page |
| AI | A tenant AI provider, model, endpoint and optional key |
#Preflight check
Run these read-only checks on the target host before installing:
cat /etc/os-release
nproc
free -h
df -h /
ip -4 addr show
ss -ltnp
dig +short A mail.example.com
dig +short A a8m.example.com
dig +short MX example.comDo not continue if the host is not Debian 12, the public IPv4 address is missing, DNS points at another server, or another service already owns ports 25, 80, 443, 587, 993, 995, 4190 or 8808.
#Out of scope
The current deployment model does not provide multi-node high availability, PostgreSQL point-in-time recovery, off-site backup replication, a native mobile app or a built-in ticketing system. Do not plan a deployment around capabilities that are not present. See Secure and Operate for the operating boundaries.
Next: Installation.
Need a hand?