The installer expects a fresh Debian 13 “Trixie” system and takes over Postfix, nginx and PostgreSQL on it. Give it a dedicated host or VM — do not install it alongside an existing mail server or web server, because it will rewrite their configuration.
Base operating system
Install Debian 13 with the SSH server and standard system utilities tasks only. Deselect every desktop environment and, in particular, deselect the Mail server task — the installer configures Postfix itself and a pre-configured one only gets in the way.
The gateway checks /etc/os-release at install time. Another Debian release, or a derivative such as Ubuntu, produces a warning and then continues; it is not blocked, but it is not what is tested in production, and Trixie package versions are what the dependency set is pinned against.
Sizing and disk layout
| Resource | Minimum | Why |
|---|---|---|
| CPU | 2 vCPU | One Python filter process is forked per message, capped at 10 concurrent. |
| RAM | 4 GB | ClamAV alone holds roughly 2 GB of signatures once enabled. |
| Disk | 40 GB+ | Encrypted message bodies, the eDiscovery archive and backups all live on this host. Size against your retention settings, not your daily volume. |
A single root filesystem is fine. If you prefer to separate the data, give /var/lib/securemail its own volume — encrypted message bodies, the archive and backups are all written beneath it. Everything else the appliance owns is small and lives in /opt/securemail (code), /etc/securemail (configuration and the master key) and /var/log/securemail.
Networking
Give the host a static address and a fully-qualified hostname that resolves publicly. Both matter more than usual here: the hostname becomes Postfix’s myhostname, the subject of your TLS certificate, and the name receiving mail servers will check against your reverse DNS.
sudo hostnamectl set-hostname secure.example.comPorts that must reach the host
| Port | Direction | Purpose |
|---|---|---|
| 25/tcp | Inbound | Mail from the internet. Also used outbound. |
| 80/tcp | Inbound | Certificate issuance and renewal, plus the setup phase before TLS exists. |
| 443/tcp | Inbound | Recipient portal, admin console and the send API. |
| 587/tcp | Inbound | Optional. Authenticated submission, off by default. |
| 25/tcp | Outbound | Delivery to arbitrary MX hosts. |
| 443/tcp | Outbound | Certificate issuance, signature updates, licence and update checks. |
Port 80 stays open permanently. It is not only for the initial certificate. Renewal uses the same HTTP-01 challenge, so closing 80 after setup means the certificate quietly fails to renew and expires 90 days later. After TLS is issued, port 80 serves only the ACME challenge path and redirects everything else to HTTPS.
Outbound port 25 is frequently blocked by cloud providers. AWS, Azure, GCP and most VPS hosts block it by default and require a support request to lift. Confirm it is open before you cut MX over, or use a smarthost for outbound relay. The preflight check tests this and reports it explicitly.
Reverse DNS
Ask whoever controls the IP address for a PTR record matching your mail hostname. This is not optional in practice: a mismatched or absent PTR is one of the most reliable ways to have legitimate mail rejected, and the preflight check treats it as a failure rather than a warning.
Firewall
If you run a host firewall, allow the ports above. Note that the appliance’s own “firewall” feature is an application-layer control — it blocks abusive clients from the web console and portal by IP after repeated authentication failures. It does not touch nftables and does not protect port 25, so a host firewall is still yours to manage.
sudo apt install nftables
# Allow 22 (your SSH), 25, 80, 443 inbound; default-deny the rest.DNS to put in place now
Two records should exist before you install, because the certificate step needs them:
- An A record (and AAAA if you use IPv6) for the appliance hostname, pointing at this host.
- A PTR record for the host’s public IP, matching that hostname.
MX, SPF, DKIM and DMARC come later — you publish those once the gateway is filtering correctly, so a misconfiguration cannot affect live mail. That sequence is covered in DNS, TLS & mail records.
Before you continue
- Debian 13, SSH reachable, fully patched (
sudo apt update && sudo apt full-upgrade). - Static IP, FQDN set, A record resolving, PTR matching.
- Ports 25, 80 and 443 reachable inbound; 25 and 443 open outbound.
- Root or
sudoaccess. - No existing Postfix, nginx or PostgreSQL configuration you care about.