On this page
3 min read

Day 11 - KM0 Email in production

@km0digital.com mail with Postfix, Dovecot, Rspamd, and Roundcube on mail.km0digital.com; MX/SPF/DKIM/DMARC DNS, OpenCloud relay, and phase 1b plans.

Introduction

Day 9 shipped pricing, legal, OpenCloud registration, and conversion polish. We did not publish a day 10 entry (internal mail deployment without an article). On 14 June 2026 we turned on KM0 Email: @km0digital.com mailboxes, webmail at mail.km0digital.com, and SMTP relay for OpenCloud notifications.

KM0 no longer relies on Gmail or external APIs for operational mail on the domain, and opens the path to registration verification, idea alerts, and marketing on the same infrastructure.

Summary

Day milestones

  • Stack: AMVARA-CONSULTING/km0-mail repo with Postfix, Dovecot, Rspamd, Roundcube, and PostgreSQL (Docker Compose).
  • Hostname: mail.km0digital.com on the same VPS as OpenCloud (116.202.10.106).
  • Webmail: Nginx + Let's Encrypt to Roundcube on loopback :8080.
  • Operations: postmaster@ and noreply@ mailboxes; CLI ./scripts/km0-mail-admin.
  • Security: Rspamd + DKIM signing; fail2ban km0-mail jail; UFW 25, 587, 993.
  • OpenCloud: local Postfix relay (host.docker.internal:587, no auth) with sender noreply@km0digital.com.

KM0 Email

Architecture and flow

Internet (MX @ → mail.km0digital.com)
        ↓
  Postfix (:25 / :587 submission)
        ↓
  Rspamd (anti-spam, DKIM signing)
        ↓
  Dovecot (:993 IMAPS) → Maildir
        ↓
  Roundcube (webmail, loopback :8080 → Nginx TLS)
  • Inbound: Postfix accepts mail for @km0digital.com and delivers to Maildir via Dovecot LMTP.
  • Outbound: authenticated clients (587) and internal relay from OpenCloud without Docker-network credentials.
  • Webmail: Roundcube talks to Dovecot; public access only via HTTPS on the mail subdomain.
  • Admin: km0-mail-admin create-mailbox, alias, set-password documented in the km0-mail runbook.
  • Reference issue: km0-mail #1 (Redmine #7605).

DNS

Deliverability

Without correct records mail lands in spam or bounces. The full checklist lives in docs/joker-dns-checklist.md in the km0-mail repo.

  • MX: @ → mail.km0digital.com.
  • SPF: TXT record authorising the KM0 outbound server.
  • DKIM: selector mail._domainkey with public key in DNS.
  • DMARC: policy p=none with reports to postmaster@km0digital.com.
  • PTR: Hetzner points to mail.km0digital.com (consistent with HELO/EHLO).

OpenCloud

Phase 1 integration (partial)

OpenCloud (notifications)
        ↓
  host.docker.internal:587 (Postfix relay, no auth)
        ↓
  Postfix → Rspamd → Internet outbound
  Sender: noreply@km0digital.com
  • km0-opencloud: SMTP_* variables in .env and extra_hosts in compose to reach host Postfix.
  • Scope: cloud notifications already leave via KM0 Email; registration email verification remains pending (phase 1b).
  • LDAP: no unification in phase 1; mail_accounts.opencloud_uuid column reserved for later.

Product

Decisions today

  • Pricing: mail included de facto in the KM0 offer; executive pricing decision later.
  • Scale: target >1000 mailboxes before year end.
  • Legal: /legal/ and /security/ pages do not yet cover mail.km0digital.com (separate issue).
  • Services: Email card on the home page stays disabled until phase 1b (separate issue).

Roadmap

Phase 1b pending

The following is planned but not implemented yet in this release:

  1. register-api: email verification via local Postfix (replace Gmail/external).
  2. km0-web scripts/notify-idea-email.sh: local relay (today AutoMail API).
  3. Marketing / tmp: local SMTP for campaigns and temporary environments.
  4. Legal and security on km0-web: cover mail.km0digital.com.
  5. Email block in services: enable active card on the landing.
  6. Backup: maildir cron documented in runbook.
  7. Phase 2: ClamAV, LDAP unification, automated provisioning.

Verification

Check day 11

  1. Webmail: open mail.km0digital.com and verify TLS certificate.
  2. MX: dig +short MX km0digital.com should resolve to mail.km0digital.com.
  3. SPF: dig +short TXT km0digital.com includes an SPF record.
  4. DKIM: dig +short TXT mail._domainkey.km0digital.com returns the public key.
  5. DMARC: dig +short TXT _dmarc.km0digital.com shows policy and reporting.
  6. PTR: dig +short -x 116.202.10.106 matches the mail server hostname.
  7. Checklist: follow joker-dns-checklist.md step by step.
  8. OpenCloud: trigger a test notification and verify sender noreply@km0digital.com.

Series

Next entry

Day 12 covers the client talk on UX; day 13 covers meet 6: visibility, associations (PTAs, neighbours), and commercial next steps. Meanwhile, try the webmail or see pricing. Questions: contact.

More from the blog