- chatmail
- Jonathan Haack
- Haack's Networking
- webmaster@haacksnetworking.org
chatmail
This tutorial contains my setup notes for creating my chatmail instance.
- Official docs: Chatmail
- Ticket for Trixie: Trixie Status
- Chatmail Relay: Haacknet Chatmail Server
Set up Debian 12 machine and a dedicated non-root user that will ssh into the root user and deploy the instance. Exchange keys etc., and make sure to use a ed25519 key. Once that's done, setup all DNS before starting and make sure all required packages are installed:
sudo apt install git rsync python3-venv python3-dev gcc libcrypt-dev
Make sure the following DNS records are established to begin with:
- A
- AAAA
- MX
Then, as worker
ssh-keygen -t ed25519 -C "worker@$(hostname)" -f ~/.ssh/id_ed25519 chmod 700 ~/.ssh chmod 600 ~/.ssh/id_ed25519
Let's now create a config file for ssh so we don't go out and back in but instead ssh directly into localhost:
su - worker nano ~/.ssh/config
Inside that, put the following:
Host mail.haacknet.org HostName 127.0.0.1 User root IdentityFile ~/.ssh/id_ed25519 IdentitiesOnly yes
When exchanging keys, you will need to use the -f flag. Okay, now let's set perms and start configuring the instance.
chmod 700 ~/.ssh git clone https://github.com/chatmail/relay cd relay scripts/initenv.sh scripts/cmdeploy init mail.gnulinux.online scripts/cmdeploy run scripts/cmdeploy dns scripts/cmdeploy status
This creates chatmail.ini for you so that when you run cmdeploy it knows where to ssh and which instance to control, etc. Now, we setup the instance:
scripts/cmdeploy run
I had to run this twice. The second time it created the LE records. After that, run its DNS checker and then create all the records it requests
su - worker cd ~/Repositories/relay scripts/cmdeploy dns
After setup, run the status and test commands to check everything:
su - worker cd ~/Repositories/relay scripts/cmdeploy status scripts/cmdeploy test
To upgrade (in progress), probably:
cd ~/Repositories/relay git pull origin main --rebase --autostash scripts/initenv.sh scripts/cmdeploy run
You can see new accounts here:
find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d
If a flood of new accounts comes in and/or you suspect bots, then disable public reg:
touch /etc/chatmail-nocreate
If you need to setup a firewall, I recommend ufw:
ufw allow 22/tcp ufw allow 25/tcp ufw allow 80/tcp ufw allow 143/tcp ufw allow 443/tcp ufw allow 465/tcp ufw allow 587/tcp ufw allow 993/tcp #ufw allow 3340/tcp #used by nginx and IROH, if one box only, keep closed ufw allow 8443/tcp ufw allow 3478/tcp #used by stock turn, but kept open in case chatmail-turn library uses it ufw allow 3478/udp ufw allow 7842/udp ufw allow 49152:65535/udp #recommended for turn rfc 6335/8656, needs custom rule, see below ufw enable
By default, chatmail-turn will take any free udp port that the kernel offers it. On Debian systems, this ephemeral range default can be queried with cat /proc/sys/net/ipv4/ip_local_port_range and, at least on my systems is 32768-60999. This range is apparently the default on many Linux kernels, however, RFC8656 and RFC6335 suggest 49152-65535. For this reason, and since these are dedicated chatmail boxes, I figured it was wiser to tightly restrict ephemeral port usage to this recommended range only. I did that with sysctl by opening sudo nano /etc/sysctl.d/99-ephemeral-rfc6335.conf and entering:
net.ipv4.ip_local_port_range = 49152 65535
Then, either reboot the server or run sysctl –system and then confirm the rule stuck with cat /proc/sys/net/ipv4/ip_local_port_range and you should see 49152 65535 as the output. Once this was done, I made a simple script to see RAM use, storage use, and track total users:
cat << 'EOF' > /usr/local/bin/chatmail-report.sh #!/bin/bash DATE=$(date +"%Y%m%d-%H:%M:%S") LOG="/home/logs/chatmail-report.log" echo "Jonathan, at $(date), your vitals for $(hostname -f) were as follows:" > $LOG echo "" >> $LOG echo "Here's the df and ram report ..." >> $LOG df -h >> $LOG free -h >> $LOG echo "" >> $LOG echo "Here are the mail directories for mail.haacknet.org ..." >> $LOG echo "Total users: $(find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d | wc -l)" >> $LOG find /home/vmail/mail/mail.haacknet.org -mindepth 1 -maxdepth 1 -type d >> $LOG echo "" >> $LOG printf "To: email@haacksnetworking.org\nSubject: [%s]-chatmail-report-%s\n\n" "mail.haacknet.org" "$(date)" | cat - "$LOG" | sendmail -t rm -f /tmp/chatmail-report.lock EOF chmod 750 /usr/local/bin/chatmail-report.sh
— oemb1905 2026/09/23 23:16
