# Server — Mailcow VM

> **Terakhir Diperbarui:** 2026-07-03 (Dockge agent)

---

## VM Mailcow

| Item | Nilai |
|------|-------|
| **IP LAN** | `10.100.1.28` |
| Hostname | `mailserver` |
| FQDN mail (Mailcow nanti) | `sync.geonet.co.id` |
| **Role** | Mail server (Mailcow dockerized) |
| **Hypervisor** | Proxmox Opr `10.100.1.102` *(asumsi — sesuaikan jika beda)* |
| **Stack path** | `/opt/stacks/mailcow` (Dockge) |
| **Dockge agent** | `http://10.100.1.28:5001` — dikelola dari `dockge.gisportal.id` (`.24`) |
| **Web UI** | https://sync.geonet.co.id *(nginx `.24` → Mailcow `.28`)* |

## Desktop GNOME (opsional)

| | |
|--|--|
| **Boleh dipakai?** | ✅ Ya — dengan **32 GB RAM** tidak masalah |
| **Paket** | `ubuntu-desktop-minimal` + GDM |
| **Akses** | Proxmox noVNC / console |
| **Mailcow** | Tetap di Docker — desktop tidak mengganggu |

Yang tetap **tidak perlu** (boleh hapus): CUPS, Avahi, Snap, LibreOffice.

Prep script: `KEEP_DESKTOP=1 ./prepare-mailserver.sh` agar desktop tidak di-purge.

---

| Item | Nilai |
|------|-------|
| Hostname | `mailserver` |
| OS | Ubuntu 22.04.5 LTS |
| Desktop GNOME | ✅ `ubuntu-desktop-minimal` — akses Proxmox console |
| Snap | ❌ Dihapus (tidak wajib untuk desktop) |
| CUPS / Avahi services | ❌ Dihapus (tidak perlu mail server) |
| Docker | ✅ 29.x + Compose v5 |
| Dockge agent | ✅ `/opt/dockge` — port `5001` (LAN only) |
| UFW firewall | ✅ Aktif |
| `vm.max_map_count` | 262144 |
| Swap | 4 GiB |
| `/data/mailcow/vmail` | `/dev/sdb1` 503 GiB |

Script prep: `Mailcow/scripts/prepare-mailserver.sh`

---

### Spesifikasi hardware

| Resource | Nilai |
|----------|-------|
| **vCPU** | 16 core |
| **RAM** | 32 GiB |
| **Swap** | 4 GiB *(disarankan)* |
| **Disk 1** | 512 GiB SSD — OS + Docker + MariaDB + Redis |
| **Disk 2** | 512 GiB SSD — `vmail` (email live, local) |
| **Storage live** | Local SSD — prioritas uptime *(bukan NAS)* |
| **Backup** | QNAP `10.100.1.10` harian |

> Kapasitas 512 GiB vmail cukup untuk 30+ user aktif bertahun-tahun (asumsi ~10–15 GB/user).

---

## Host terkait

| Role | IP | Keterangan |
|------|-----|------------|
| **Mailcow VM** | `10.100.1.28` | Server ini |
| Dockge primary | `10.100.1.24` | `dockge.gisportal.id` — UI manajemen Docker |
| Zammad | `10.100.1.24` | IMAP/SMTP ke `.28` |
| AD / LDAP | `10.100.1.40` | Identity Provider Mailcow |
| QNAP NAS | `10.100.1.10` | Backup harian |
| cPanel POP3 | `mail.geonet.co.id` | fetchmail drain |
| Proxmox Opr | `10.100.1.102` | Host VM *(jika applicable)* |

---

## SSH

### Login (passwordless)

```bash
ssh mailcow
# atau
ssh root@10.100.1.28
```

Key: `~/.ssh/id_ed25519_mailcow` · Host alias `mailcow` di `~/.ssh/config`

### Setup key (sekali — sudah selesai 2026-07-03)

Jika perlu ulang di mesin lain: `Mailcow/scripts/fix-ssh-key.ps1`

**Catatan:** Hindari pipe script PowerShell ke `bash -s` (CRLF). Pakai SCP upload file `.sh` + `.pub`.

| File key | Lokasi |
|----------|--------|
| Private | `~/.ssh/id_ed25519_mailcow` |
| Public | `~/.ssh/id_ed25519_mailcow.pub` |
| SSH config | Host `mailcow` → `10.100.1.28` |

---

## Dockge agent (monitoring dari `.24`)

Docker di VM ini dikelola lewat **Dockge Agents** — instance Dockge di `.28` didaftarkan ke Dockge utama di `10.100.1.24` (`dockge.gisportal.id`).

| Item | Nilai |
|------|-------|
| Agent URL | `http://10.100.1.28:5001` |
| Compose | `/opt/dockge/compose.yaml` |
| Stacks dir | `/opt/stacks/` |
| Bind port | `10.100.1.28:5001` *(bukan `0.0.0.0` — tidak listen di localhost)* |
| Primary | Dockge v1.5.0 di `.24` |

### Instalasi (sudah selesai 2026-07-03)

```bash
# Di mailserver — atau ulang dari repo:
bash Mailcow/scripts/install-dockge-agent.sh
bash Mailcow/scripts/setup-dockge-agent-user.sh   # samakan user admin dengan primary
```

### Daftarkan agent di UI primary *(sekali)*

1. Buka https://dockge.gisportal.id
2. **Settings → Dockge Agents → Add Agent**
3. URL: `http://10.100.1.28:5001`
4. Username / password: sama dengan login Dockge primary (`admin`)
5. Status agent harus **online** — stack Mailcow nanti bisa dipilih agent **mailserver**

> Port `5001` **tidak** di-expose ke internet; hanya `10.100.1.24` yang diizinkan UFW.

---

## Firewall / port (VM `.28`)

UFW aktif — default deny incoming, allow outgoing.

| Port | Protokol | Layanan | Sumber |
|------|----------|---------|--------|
| 22 | TCP | SSH | Anywhere |
| 25 | TCP | SMTP inbound | Anywhere |
| 80 | TCP | HTTP (ACME redirect) | Anywhere |
| 443 | TCP | HTTPS — Mailcow UI | Anywhere |
| 465 | TCP | SMTPS | Anywhere |
| 587 | TCP | Submission | Anywhere |
| 993 | TCP | IMAPS | Anywhere |
| 995 | TCP | POP3S *(opsional)* | Anywhere |
| 5001 | TCP | Dockge agent | **Hanya** `10.100.1.24` |

### Akses internal yang diperlukan

| Dari | Ke | Port |
|------|-----|------|
| `10.100.1.28` | `10.100.1.40` | 389 LDAP |
| `10.100.1.28` | Internet | 995 POP3 (cPanel drain) |
| `10.100.1.24` | `10.100.1.28` | 5001 Dockge, 993, 587 |
| User LAN/VPN | `10.100.1.28` atau IP publik | 993, 587 |

---

## DNS & NAT publik

**IP publik:** `117.102.73.102`

| Record | Target |
|--------|--------|
| A `sync.geonet.co.id` | `117.102.73.102` |
| PTR | `sync.geonet.co.id` *(verifikasi di provider)* |

### Port forwarding (MikroTik / gateway)

| Port | NAT ke | Layanan |
|------|--------|---------|
| 25, 465, 587, 993 | `10.100.1.28` | Mailcow — SMTP / IMAP langsung |
| 80, 443 | `10.100.1.24` | Nginx reverse proxy |

> **HTTPS Mailcow UI** tidak langsung ke `.28` dari internet — Nginx di `.24` harus proxy `sync.geonet.co.id` → `https://10.100.1.28:443`. Saat install Mailcow set `SKIP_LETS_ENCRYPT=y`; sertifikat publik diurus Nginx `.24` (certbot).

Akses internal (Zammad, LAN): langsung ke `10.100.1.28:587` / `:993` tanpa lewat NAT publik.

---

## Partition disk (rencana)

| Device | Mount | Isi |
|--------|-------|-----|
| Disk 1 | `/` | Debian/Ubuntu + Docker |
| Disk 1 | `/var/lib/docker` | Container layers, MariaDB, Redis volumes |
| Disk 2 | `/data/mailcow/vmail` | Bind mount → `vmail-vol-1` Mailcow |

---

## Referensi

- `docs/notes/deployment-sizing.md`
- `docs/notes/storage-nas-qnap.md`
- `docs/project-status.md`