Four mail servers, one modern stack: our summer overhaul is complete
The Maximusconfessor upgrade is complete. It closes an important summer programme across all2all’s four main mail servers: Moses, Hermes, Maximusconfessor and Vonmuenchhausen now all run Debian 13 stable, with a modernised and harmonised mail stack.
This was much more than changing a version number. We reviewed each server from the ground up: operating system, kernel, storage, security, filtering, webmail, backups, monitoring and capacity settings. The objective is straightforward: more reliable mail routing, easier maintenance and a sound base for the years ahead.
What this means for users
The four servers now share the same configuration principles and supported components. SMTP, IMAP, POP and webmail behave more consistently from one node to another, antivirus and antispam protection once again use maintained versions, and security updates can be followed regularly.
Existing mailboxes, aliases and domains were preserved throughout the work. After every stage we checked queues, secure connections, sending and receiving, mailbox access and Roundcube. The modernisation is meant to remain unobtrusive for users, while substantially reducing the technical debt behind the everyday service.
For the technically curious
Vonmuenchhausen underwent the most visible transformation: its old hardware was replaced by an entirely new server with fast, redundant NVMe storage. On existing servers we introduced SSDs or improved storage paths wherever their architecture allowed it, while retaining hardware RAID controllers where they remain appropriate. Disk, SSD, RAID and filesystem health are now monitored consistently.
All four systems received current Debian 13 kernels and packages. Boot paths, storage controllers and services were checked after the successive upgrades. Automatic Debian security updates are enabled without automatic reboots: restarting a mail server remains a planned and controlled operation.
The common stack includes Postfix, Courier, OpenDKIM, Amavis, ClamAV, SpamAssassin and Roundcube on PHP-FPM. We aligned TLS, authentication, inbound and outbound filtering, recoverable quarantines, Fail2ban with nftables, sending safeguards and alerts. Process limits still reflect each machine’s resources: Maximusconfessor, for example, hosts close to one thousand mail accounts and now has Courier limits sized for that workload.
SQL backups are stored inside the tree that is actually transferred to the backup servers. SMART/RAID monitoring, system alerts and administrative mail routing were also checked on all four nodes.
From Courier to Dovecot: a separate study
We are also studying a separate evolution of mailbox access: a possible move from Courier to Dovecot for IMAP and POP. This concerns the server presenting mailboxes to clients, not necessarily the storage format: Dovecot can continue to use the existing Maildirs.
Courier remains in production today and no migration has been decided. Before any pilot, we must validate authentication, UID/GID and permissions, quotas, subscriptions and special folders, TLS, concurrent access, indexes, compatibility with Virtualmin and Roundcube, and a loss-free rollback.
A cautious Rspamd pilot
We have also started an offline Rspamd pilot on Vonmuenchhausen. It compares Rspamd’s modern filtering with the current Amavis/SpamAssassin chain, using a controlled corpus and without changing production mail delivery.
Rspamd has therefore not replaced Amavis yet. If the results are convincing, a gradual and easily reversible transition can be considered. ClamAV’s antivirus role and quarantine handling will be assessed separately: we will not change several critical mechanisms at once.
The major harmonisation is complete, but mail infrastructure is never “finished”. We will continue to watch queues, sending reputation, performance and upstream updates — now from a shared, current and far more maintainable foundation.
Illustration: Baron Münchhausen riding a cannonball, engraving by August von Wille, before 1872, public domain, via Wikimedia Commons. Cropped for previews.
