-------------------------------------------
  * **chatmail** 
  * **Jonathan Haack**
  * **Haack's Networking**
  * **webmaster@haacksnetworking.org**

-------------------------------------------

//chatmail// 

-------------------------------------------

This tutorial contains my setup notes for creating my chatmail instance.

  * Official docs: [[https://chatmail.at/doc/relay/getting_started.html|Chatmail]] 
  * Ticket for Trixie: [[https://github.com/chatmail/relay/issues/476 |Trixie Status]]
  * Chatmail Relay: [[https://mail.haacknet.org|Haacknet Chatmail Server]]

Set up Debian 12 machine and a dedicated non-root user that will ssh into the root user and deploy the instance. Exchange keys etc., and make sure to use a ed25519 key. Once that's done, setup all DNS before starting and make sure all required packages are installed: 

  sudo apt install git rsync python3-venv python3-dev gcc libcrypt-dev

Make sure the following DNS records are established to begin with:

  * A
  * AAAA
  * MX

Then, as worker 
  
  ssh-keygen -t ed25519 -C "worker@$(hostname)" -f ~/.ssh/id_ed25519
  chmod 700 ~/.ssh
  chmod 600 ~/.ssh/id_ed25519
  
Let's now create a config file for ssh so we don't go out and back in but instead ssh directly into localhost:
  
  su - worker
  nano ~/.ssh/config

Inside that, put the following:

<code>
Host mail.haacknet.org
HostName 127.0.0.1
User root
IdentityFile ~/.ssh/id_ed25519
IdentitiesOnly yes
</code>

When exchanging keys, you will need to use the ''-f'' flag. Okay, now let's set perms and start configuring the instance.

  chmod 700 ~/.ssh
  git clone https://github.com/chatmail/relay
  cd relay
  scripts/initenv.sh
  scripts/cmdeploy init mail.gnulinux.online
  scripts/cmdeploy run
  scripts/cmdeploy dns
  scripts/cmdeploy status

This creates ''chatmail.ini'' for you so that when you run cmdeploy it knows where to ssh and which instance to control, etc. Now, we setup the instance:

  scripts/cmdeploy run

I had to run this twice. The second time it created the LE records. After that, run its DNS checker and then create all the records it requests
  
  su - worker
  cd ~/Repositories/relay
  scripts/cmdeploy dns

After setup, run the status and test commands to check everything:

  su - worker
  cd ~/Repositories/relay
  scripts/cmdeploy status
  scripts/cmdeploy test

To upgrade (in progress), probably:

  cd ~/Repositories/relay
  git pull origin main --rebase --autostash
  scripts/initenv.sh
  scripts/cmdeploy run

You can see new accounts here:

  find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d
  
If a flood of new accounts comes in and/or you suspect bots, then disable public reg:

  touch /etc/chatmail-nocreate
  
If you need to setup a firewall, I recommend ufw:

  ufw allow 22/tcp
  ufw allow 25/tcp
  ufw allow 80/tcp
  ufw allow 143/tcp
  ufw allow 443/tcp
  ufw allow 465/tcp
  ufw allow 587/tcp
  ufw allow 993/tcp
  #ufw allow 3340/tcp #used by nginx and IROH, if one box only, keep closed
  ufw allow 8443/tcp
  ufw allow 3478/tcp #used by stock turn, but kept open in case chatmail-turn library uses it
  ufw allow 3478/udp
  ufw allow 7842/udp
  ufw allow 49152:65535/udp #recommended for turn rfc 6335/8656, needs custom rule, see below
  ufw enable

By default, ''chatmail-turn'' will take any free udp port that the kernel offers it. On Debian systems, this ephemeral range default can be queried with ''cat /proc/sys/net/ipv4/ip_local_port_range'' and, at least on my systems is ''32768-60999''. This range is apparently the default on many Linux kernels, however, [[https://www.rfc-editor.org/rfc/rfc8656.html|RFC8656]] and [[https://www.rfc-editor.org/rfc/rfc6335.html|RFC6335]] suggest ''49152-65535''. For this reason, and since these are dedicated chatmail boxes, I figured it was wiser to tightly restrict ephemeral port usage to this recommended range only. I did that with ''sysctl'' by opening ''sudo nano /etc/sysctl.d/99-ephemeral-rfc6335.conf'' and entering:

  net.ipv4.ip_local_port_range = 49152 65535

Then, either reboot the server or run ''sysctl --system'' and then confirm the rule stuck with ''cat /proc/sys/net/ipv4/ip_local_port_range'' and you should see ''49152 65535'' as the output. Once this was done, I made a simple script to see RAM use, storage use, and track total users:

<code>
cat << 'EOF' > /usr/local/bin/chatmail-report.sh
#!/bin/bash
DATE=$(date +"%Y%m%d-%H:%M:%S")
LOG="/home/logs/chatmail-report.log"
echo "Jonathan, at $(date), your vitals for $(hostname -f) were as follows:" > $LOG
echo "" >> $LOG
echo "Here's the df and ram report ..." >> $LOG
df -h >> $LOG
free -h >> $LOG
echo "" >> $LOG
echo "Here are the mail directories for mail.haacknet.org ..." >> $LOG
echo "Total users: $(find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d | wc -l)" >> $LOG
find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d >> $LOG
echo "" >> $LOG
printf "To: email@haacksnetworking.org\nSubject: [%s]-chatmail-report-%s\n\n" "mail.haacknet.org" "$(date)" | cat - "$LOG" | sendmail -t
rm -f /tmp/chatmail-report.lock
EOF
chmod 750 /usr/local/bin/chatmail-report.sh
</code>

 --- //[[alerts@haacksnetworking.org|oemb1905]] 2026/09/23 23:16//