# Deployment — Mailcow

> **Terakhir Diperbarui:** 2026-07-03  
> **Target VM:** `10.100.1.28` · `sync.geonet.co.id`

Step-by-step install — **Mailcow + nginx proxy selesai 2026-07-03**.

---

## Prasyarat

- [x] VM spec diset (16 vCPU, 32 GB RAM, 2×512 GB SSD)
- [x] Keputusan storage: local SSD vmail + backup QNAP
- [x] Grup AD `Mail-Users` + `support@geonet.co.id`
- [x] VM `10.100.1.28` provisioned & SSH OK
- [x] DNS A `sync.geonet.co.id` → `117.102.73.102`
- [x] NAT mail `25/465/587/993` → `.28`
- [x] NAT `80/443` → `.24` (nginx)
- [x] Nginx vhost `sync.geonet.co.id` → proxy ke `.28:443` + certbot LE
- [ ] PTR `117.102.73.102` → `sync.geonet.co.id`

Lihat `docs/server.md` untuk detail VM.

---

## 1 — OS & disk

1. Install **Debian 12** atau **Ubuntu 22.04 LTS**
2. Disk 2 → format `ext4` → mount `/data/mailcow/vmail`
3. Tambah ke `/etc/fstab`
4. Swap 4 GiB

```bash
# Contoh mount disk 2 (sesuaikan device)
mkfs.ext4 /dev/sdb
mkdir -p /data/mailcow/vmail
echo '/dev/sdb /data/mailcow/vmail ext4 defaults 0 2' >> /etc/fstab
mount -a
```

---

## 2 — Docker

```bash
apt update && apt install -y ca-certificates curl gnupg
# Install Docker CE + compose plugin (lihat docs.docker.com)
docker --version   # >= 24
docker compose version  # >= 2
```

---

## 3 — Install Mailcow

```bash
cd /opt/stacks
git clone https://github.com/mailcow/mailcow-dockerized mailcow
cd mailcow
./generate_config.sh
# Hostname: sync.geonet.co.id
# Timezone: Asia/Jakarta
```

Edit `mailcow.conf`:

```bash
# Port 80/443 publik masuk nginx .24 — bukan langsung ke Mailcow
SKIP_LETS_ENCRYPT=y
```

Opsi lain: DNS-01 challenge di Mailcow jika ingin cert internal Mailcow (tanpa nginx SSL).

> Stack path `/opt/stacks/mailcow` agar terlihat di Dockge agent `.28`.

---

## 4 — Bind vmail ke disk 2

Buat `docker-compose.override.yml`:

```yaml
volumes:
  vmail-vol-1:
    driver: local
    driver_opts:
      type: none
      device: /data/mailcow/vmail
      o: bind
```

```bash
docker compose pull
docker compose up -d
```

---

## 4b — Nginx reverse proxy (`.24`)

Karena `80/443` publik masuk ke nginx, buat vhost `sync.geonet.co.id`:

```nginx
upstream mailcow_backend {
    server 10.100.1.28:443;
}

server {
    listen 80;
    server_name sync.geonet.co.id;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name sync.geonet.co.id;
    include /etc/nginx/conf.d/ssl.conf;   # atau certbot sync.geonet.co.id

    proxy_pass https://mailcow_backend;
    proxy_ssl_verify off;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 3600s;
    client_max_body_size 50M;
}
```

Cert publik: `certbot --nginx -d sync.geonet.co.id` di `.24`.

---

## 5 — Post-install

1. Login admin UI `https://sync.geonet.co.id` *(via nginx `.24`)*
2. Tambah domain `geonet.co.id`
3. Identity Provider → LDAP → AD `10.100.1.40`
4. fetchmail POP3 drain dari cPanel
5. Backup cron → QNAP
6. Zammad channel IMAP/SMTP → `10.100.1.28`

---

## Referensi

- [Mailcow Install](https://docs.mailcow.email/getstarted/install/)
- [Move vmail volume](https://docs.mailcow.email/manual-guides/Dovecot/u_e-dovecot-vmail-volume/)
- `docs/notes/ldap-ad-mailcow.md`
- `docs/notes/email-sync-migration-concept.md`