Operate

#Operating model

Alt8Mail separates tenant administration from host operations.

Do not use a tenant administrator account as the host operator role. System Control runs with root-level authority and has a separate login, session, audit trail and permission model. Keep it on a management network or VPN.

#Service inventory

The monitored stack normally includes:

The installer also installs a8m-mailprovision.timer and a8m-dkimprovision.timer, which repair Maildirs and DKIM material on a short interval.

#Health checks

Use read-only checks first. Do not restart the full stack because one surface has a problem.

System Control's /healthz is a cheap liveness check and does not test PostgreSQL or Redis. Use the webmail and admin health endpoints plus diagnostics for dependency health.

#Logs and queue

Common log locations and commands:

journalctl -u a8m-server --since today
journalctl -u a8m-admin --since today
journalctl -u alt8mail-control --since today
journalctl -u postfix --since today
journalctl -u dovecot --since today
journalctl -u nginx --since today
tail -n 100 /var/log/mail.log
tail -n 100 /var/log/a8m-install.log
tail -n 100 /var/log/alt8mail-update.log

System Control can ingest and search mail logs, with configurable retention. Default retention is 365 days. A mail log is an operational record, not a complete audit system; keep access restricted.

Postfix is authoritative for the mail queue. postqueue -p lists it, postcat -q -v <id> inspects a message, and the queue actions in System Control can flush or delete entries. Queue deletion is a destructive operation and must be authorized.

#Day-two administration

#Tenant management

Use Customer Admin to:

• create or verify domains and publish the exact DNS records shown;
• create users, one-time credentials and mailboxes;
• assign built-in or custom roles;
• review or change password, MFA and session policy;
• configure external forwarding, IMAP/POP3, attachment limits and retention;
• manage groups, org units and delegation;
• review quarantine and audit activity;
• process legal holds, eDiscovery and offboarding where licensed;
• configure API keys, webhooks, CRM and SIEM integrations.

The last active owner cannot be removed or demoted by ordinary admin actions. Do not bypass that safety rail by editing the database.

#Domain and mail readiness

After DNS changes, rerun domain verification. Check that:

• the ownership TXT is present;
• MX points to the expected mail hostname;
• SPF is present and valid;
• DKIM p= matches the active key;
• DMARC is present with a deliberate policy;
• MTA-STS is correct if you enable it.

A domain that is not mail-ready can still have a working web interface. Do not use web login success as proof that mail can leave or enter the domain.

#Operator checks

At a regular interval:

1. Run alt8mail-control doctor.
2. Confirm TLS expiry and renewal.
3. Check the mail queue and recent delivery status.
4. Inspect disk, memory and database growth.
5. Review failed services and security reports.
6. Run Config sync and confirm a second run reports no drift.
7. Confirm a recent backup exists and validate its contents.

#Backups

Backups are local files by default. They are not encrypted by the panel and are not replicated off-host automatically. A backup on the same failed host is not disaster recovery.

System Control → Backups creates a .tar.gz under /var/backups/alt8mail with selectable contents:

• panel/mail PostgreSQL dump;
• Postfix and Dovecot configuration;
• DKIM material;
• Let's Encrypt state;
• Maildir message stores;
• uploads.

Maildirs are not selected by default. Select the Maildir stores explicitly for a complete mail backup. The archive also does not contain /etc/a8m or the root-only secrets directory. Create a separate critical-configuration archive:

sudo tar -C / -czf /root/alt8mail-critical-$(date -u +%F).tar.gz \
  opt/a8m/secrets \
  etc/a8m \
  etc/nginx \
  etc/redis/a8m.conf \
  etc/ssl/alt8mail
sudo chmod 600 /root/alt8mail-critical-$(date -u +%F).tar.gz

Encrypt both archives before moving them off-host. Store them in a separate failure domain. Record who can decrypt them and test a restore before an emergency.

#Backup limits

• No PostgreSQL WAL/PITR continuous recovery.
• No built-in off-site replication.
• No scheduled automatic restore.
• Full restore is a disaster-recovery operation, not a per-user fix.
• Per-mailbox restore is additive and must be previewed first.
• The panel backup excludes root-only secrets and application environment files.

#Updates

Use the packaged updater, not a blind installer re-run.

sudo alt8mail-update --check
sudo alt8mail-update
sudo alt8mail-update --to vX.Y.Z
sudo alt8mail-update --force

The updater:

1. Checks the current release and disk headroom.
2. Selects a release asset with a checksum, or builds the requested tag from source.
3. Takes a pre-update PostgreSQL dump and configuration archive.
4. Applies migrations, installs units, switches the release symlinks and restarts services.
5. Waits for the webmail, customer admin and Control health endpoints to report the target version.
6. Rolls back the release and database if activation fails.

The automatic rollback restores the prior release and database, but not every configuration tarball. Retain the backup directory printed by the updater and review the release notes before upgrading.

OS package updates are separate. System Control → Infrastructure → Software updates can apply listed apt upgrades, but it does not automatically restart services or schedule a reboot. Plan a maintenance window for kernel and service-impacting updates.

#Monitoring and capacity

• System Control exposes an unauthenticated Prometheus /metrics endpoint on port 8808. Network-restrict it; do not expose 8808 to the internet.
• Expose only a protected scrape path, or terminate the scrape inside the management network.
• Alert on health endpoint failure, queue growth, disk and inode pressure, certificate expiry, mail delivery failures, service restarts and backup absence.
• Monitor PostgreSQL size and growth. Mail rows and search vectors live in PostgreSQL; storage is not only /var/vmail.
• Monitor Maildir and Cabinet storage separately.
• Capacity guard behavior should be tested before a busy migration or mailbox move.

#Operating checklist

#Daily

• Check services and health.
• Review the queue for stuck or deferred mail.
• Confirm recent deliveries and TLS negotiation.
• Check security reports and unusual admin activity.

#Weekly

• Verify backup completion and free disk.
• Review audit and login failures.
• Confirm certificate renewal status.
• Review storage growth against forecast.

#Monthly

• Run a restore drill on a scratch host with the same hostname/domain plan.
• Test a mailbox/folder restore without changing live data.
• Confirm operator and tenant-admin access lists.
• Review policies for external forwarding, IMAP/POP3 and retention.

#Each release

• Read release notes and back up first.
• Run alt8mail-update --check.
• Schedule a maintenance window.
• Verify health, mail delivery, sign-in, Office and backups after the update.
• Retain the rollback path until acceptance is complete.

#Boundaries

Alt8Mail is a single-host deployment. It does not provide high availability, automatic failover, PostgreSQL replication, WAL/PITR, off-site backup replication or a cross-installation restore. If your continuity requirement cannot tolerate the restore objective you can prove with this design, address it at the infrastructure layer before production.