README.md
Rama main · réplica de lectura del repositorio original.
<p align="center">
<a href="https://www.hermesseg.io">
<img alt="Hermes SEG logo" title="Hermes Secure Email Gateway" src="docs/images/hermes-logo-mark.png" width="120">
</a>
</p>
<h1 align="center">Hermes Secure Email Gateway and Email Server</h1>
<p align="center">
<strong>Self-hosted email security, mail server, and Nextcloud: one stack, one Docker Compose file.</strong><br>
Open-source spam & malware filtering, S/MIME & PGP encryption, DKIM/DMARC/ARC, mailboxes, webmail, and SSO.<br>
Pro adds time-of-click link protection, the inbound-link defense you'd otherwise pay Proofpoint or Mimecast for.
</p>
<p align="center">
<sub>
On GitHub since <a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/commit/3418b01a">December 2017</a> ·
<a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/commits/legacy">pre-Docker history: 186 commits, 2017-2025</a> ·
<a href="#project-history">Project history</a>
</sub>
</p>
<p align="center">
<a href="https://www.hermesseg.io/features/">Features</a> ·
<a href="https://docs.deeztek.com/shelves/hermes-seg-docker">Docs</a> ·
<a href="https://www.hermesseg.io/support/">Support</a>
</p>
<p align="center">
<a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/releases"><img alt="Latest pre-release" src="https://img.shields.io/github/v/release/deeztek/Hermes-Secure-Email-Gateway?include_prereleases&label=pre-release&color=ee6c2b"></a>
<a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/deeztek/Hermes-Secure-Email-Gateway?style=social"></a>
<a href="https://www.gnu.org/licenses/agpl-3.0.html"><img alt="License: AGPL v3" src="https://img.shields.io/badge/license-AGPLv3-blue.svg"></a>
<a href="https://github.com/deeztek/Hermes-Secure-Email-Gateway/issues"><img alt="GitHub issues" src="https://img.shields.io/github/issues/deeztek/Hermes-Secure-Email-Gateway?color=586069"></a>
<a href="https://matrix.to/#/#hermesseg:matrix.org"><img alt="Matrix" src="https://img.shields.io/badge/matrix-%23hermesseg%3Amatrix.org-0DBD8B?logo=matrix&logoColor=white"></a>
<a href="https://t.me/HermesSEG"><img alt="Telegram" src="https://img.shields.io/badge/telegram-HermesSEG-26A5E4?logo=telegram&logoColor=white"></a>
</p>
<p align="center">
<em>
Deployable as a gateway in front of Microsoft 365 / Google Workspace / Exchange,
as a full mail server with built-in mailboxes, or in hybrid mode.
</em>
</p>
<!--
Screenshots row. Add these PNGs under docs/images/screenshots/ in the repo,
or replace the src URLs with absolute hermesseg.io / imgur URLs if you prefer
to keep binaries out of git history.
-->
<p align="center">
<img alt="Admin Dashboard" src="docs/images/screenshots/dashboard.png" width="32%">
<img alt="Message History" src="docs/images/screenshots/message-history.png" width="32%">
<img alt="Organizational Signatures" src="docs/images/screenshots/organizational-signatures.png" width="32%">
</p>
---
## Table of contents
- [About](#about)
- [Editions](#editions)
- [Features](#features)
- [Architecture](#architecture)
- [Storage topology](#storage-topology)
- [Requirements](#requirements)
- [Installation](#installation)
- [Updating](#updating)
- [Configuration](#configuration)
- [Recovery and maintenance tools](#recovery-and-maintenance-tools)
- [Documentation](#documentation)
- [Support](#support)
- [Project history](#project-history)
- [License](#license)
---
## About
Hermes Secure Email Gateway is a Free Open Source Secure Email Gateway **and** Email Server.
It provides spam, virus, and malware protection through Apache SpamAssassin, ClamAV, and Amavisd-new; full in-transit and at-rest email encryption via SMTP TLS, S/MIME, PGP, encrypted PDF (powered by CipherMail), and Dovecot mail-crypt; full email archiving of every processed message, with self-service recovery for users and administrators; integrated mailbox hosting on Dovecot with per-user quotas, aliases, shared folders, Sieve rules, vacation auto-reply, and mobile-device autoconfiguration; file sync, webmail, calendars (CalDAV), and contacts (CardDAV) through Nextcloud; a local user directory and single sign-on via OpenLDAP and Authelia, with multi-factor authentication via TOTP, WebAuthn, and Duo Push; and modern email authentication standards including SPF, DKIM signing and verification, DMARC, and ARC through OpenDKIM, OpenDMARC, and OpenARC.
Hermes combines these Open Source technologies under one unified web-based administration console for easy management of your organization's inbound and outbound email, mailbox users, encryption keys, and authentication policies. End users get a self-service portal for managing their own signatures, sieve rules, vacation messages, app passwords, and mobile-device profiles.
Hermes can be deployed three ways:
- **As a gateway** in front of an existing mail solution (in-house Exchange / Postfix, Google Workspace, Microsoft 365). Hermes scans, filters, encrypts, and relays mail to your backend.
- **As a full mail server** with built-in mailbox hosting, webmail, file sync, calendars, and contacts. No external mail backend required.
- **As a hybrid**, at either of two granularities:
- *Per domain*: gateway for some domains AND mail server for others on the same install. Relay (gateway) domains and mailbox (mail server) domains coexist in a single deployment.
- *Per recipient, within one domain*: keep some recipients on an external provider and host the rest on Hermes, **on the same domain**. Mail for each address is routed independently, so an organization paying per mailbox can keep the few people who genuinely need that provider and host everyone else locally. Fifty paid seats become ten, with no change to the domain's MX, its DNS, or anything a sender sees.
This Docker Edition packages the entire stack as a set of containers managed by Docker Compose, replacing the legacy bare-metal Ubuntu installer with a portable, reproducible deployment.
## Editions
Hermes ships in two editions:
| Edition | License | What you get |
|---|---|---|
| **Community** | [AGPL v3](https://www.gnu.org/licenses/agpl.html), free and open source | The entire mail gateway and email server stack. All core security, encryption, mailbox hosting, and administration features. |
| **Pro** | Commercial, see [EULA](https://docs.deeztek.com/books/hermes-seg-general-documentation/page/hermes-secure-email-gateway-pro-end-user-license-agreement-eula) | Everything in Community plus 6 advanced features (see [Pro Features](#pro-features) below). |
A Pro license is purchased separately. Community Edition needs no license file and works fully without one.
The project is licensed under **AGPLv3** ([`LICENSE`](LICENSE)); a small set of proprietary **Pro Edition** files are excluded from the AGPL grant and governed by the Pro EULA. See [`LICENSING.md`](LICENSING.md) for the authoritative breakdown; the per-file header controls which license applies.
## Features
A condensed list. See [hermesseg.io/features](https://www.hermesseg.io/features/) for the full feature page with screenshots.
### Mail security (Community)
- Spam protection (Apache SpamAssassin, postscreen, RBL configuration, sender/recipient/network block-allow lists, global sender filters)
- Anti-virus protection (ClamAV via Amavisd-new, with built-in feeds: ClamAV official + URLhaus)
- Malware feeds management (managed via Fangfrisch): configure additional 3rd-party signature feeds including SaneSecurity, MalwarePatrol, SecuriteInfo, TwinWave, ClamPunch, RFXN, InterServer, Ditekshen, and more
- Per-recipient spam/virus/file policies
- Custom message rules, score overrides, custom file expressions/extensions/rules
- Quarantine, queue management, train as spam/ham, download messages
- **Recipient auto-provisioning**: read the relay recipient roster from a directory on a schedule instead of typing or pasting it. Reads from LDAP/Active Directory, Google Workspace (Admin SDK, works on every Workspace edition) or Microsoft 365 (Microsoft Graph). Stages results for review, or provisions unattended. Additive only: it never deletes a recipient, and an empty or failed read changes nothing
- **Full email archiving**: every processed message is archived, not only blocked mail. Clean deliveries, spam, banned attachments, and infected mail are each written to their own store. Searchable by date range, sender, recipient, subject, score, and verdict
- **Self-service recovery**: recipients search Message History and release messages back to their own mailbox from the per-mailbox portal, without administrator involvement. Administrators see the whole system record and can release on any user's behalf; release always delivers to the original recipient, so it cannot be used to redirect another user's mail. History depth is a function of allocated archive storage: there is no retention setting to configure, and the oldest messages are pruned automatically once the archive disk crosses its capacity threshold
### Encryption and authentication (Community)
- In-transit email encryption: SMTP TLS, S/MIME, PGP (via CipherMail)
- At-rest encryption: Dovecot mail crypt
- Encrypted PDF email for recipients without S/MIME or PGP
- Multi-factor authentication (Authelia): TOTP, WebAuthn, Duo Push
- Local LDAP user store (built-in OpenLDAP) for admins, mailbox users, and relay users
- App passwords for SMTP / IMAP / DAV clients (separate from main account password)
- Free Let's Encrypt (ACME) TLS certificates: automated issuance and auto-renewal for the admin console and per mailbox domain (SAN), plus import/CSR support for 3rd-party certificates
- haveibeenpwned password check integration
### Email standards (Community)
- SPF check, DKIM check + sign, DMARC verification (OpenDMARC)
- ARC (Authenticated Received Chain) signing and verification (OpenARC): preserves authentication results across trusted forwarders
- DKIM key generation and management (UI)
- Multi-instance OpenDKIM for differential outbound-sign vs inbound-verify behavior
- DMARC report aggregation and reporting
### Email server / mailbox hosting (Community)
- Local mailbox hosting (Dovecot 2.4) with IMAPS / POP3S / Submission (587/465) / LMTP
- Per-domain and per-mailbox quotas
- Mailbox aliases and forwarders
- Shared mailboxes and shared folders, with subfolders shared and subscribed automatically
- **Per-recipient delivery on a single domain**: relay some recipients to an external provider and deliver others to a local mailbox, chosen per address. Convert a relay recipient to a hosted mailbox in place, individually or in bulk, and convert back again
- Convert a departing user's mailbox into a shared mailbox, keeping their mail reachable instead of orphaned
- User-defined Sieve rules
- Vacation auto-reply with date scoping and per-address filtering
- Mobile device autoconfiguration via signed `.mobileconfig` profiles (iOS) and CalDAV/CardDAV autodiscovery
- Personal email signatures (rich HTML, with template gallery)
- External Sender Banner (inbound mail from outside the org gets a visual banner)
### Nextcloud integration (Community)
- File sync (Nextcloud Files)
- Webmail (Nextcloud Mail)
- Calendars (CalDAV) and contacts (CardDAV)
- Single sign-on via Authelia OIDC
- Pre-provisioning of Nextcloud user accounts on first login
- Team chat, voice/video calls, and meetings via Nextcloud Talk (optional: the app is not enabled by default, and dependable calls need the high-performance backend, deployed separately. See [Nextcloud Talk and the High-Performance Backend](docs/general/nextcloud-talk-hpb-deployment.md))
### Admin and user experience (Community)
- Modern AdminLTE 4 / Bootstrap 5 administrator console
- User self-service portal (per-mailbox)
- Real-time dashboard with system-resource monitoring
- Message statistics with visual charts
- Scheduled tasks UI (DB-backed Ofelia job management)
- Searchable system event logs
- Internal CA management (S/MIME)
- DNS resolver (Unbound, local-recursive)
- Console host and domain management
### Pro features
Pro Edition adds the following capabilities on top of everything in Community.
| Pro Feature | What it does |
|---|---|
| **Email disclaimers** | Per-domain outbound disclaimer templates, applied at the milter level. Form-based template renderer with reusable templates. |
| **Organizational signatures** | Centrally-managed per-domain employee signature templates with placeholder substitution (employee name, title, phone, email, department, organization info). Renders on every outbound message. Community Edition has Personal Signatures (per-user, free-form) only. |
| **Intrusion Prevention (IPS)** | Web UI for managing Fail2ban jails, ban thresholds, ban duration, whitelists. Real-time view of active bans. |
| **Console firewall** | Web UI for managing the host firewall protecting the admin console (port allowlisting, source-IP restriction). |
| **LDAP RemoteAuth** | Per-domain pass-through authentication to one or more external directories: Active Directory, OpenLDAP, FreeIPA, 389 Directory Server, and **Google Workspace** via Secure LDAP (Business Plus and above). End users sign in with the password they already have, and Hermes never stores it. **Microsoft 365 cannot be a target directly**, because Entra ID exposes no LDAP endpoint; in a hybrid deployment Hermes authenticates against the on-premises Active Directory those accounts synchronise from. Recipients must exist in Hermes before they can sign in, which [Recipient auto-provisioning](#mail-security-community) can do for you from the same directory. Transport is chosen per mapping, plain LDAP or LDAPS with certificate verification, and directories requiring mutual TLS are supported. |
| **Link Guard** | Time-of-click URL protection for inbound mail, comparable to Microsoft Safe Links and Proofpoint URL Defense. Links are rewritten to a Hermes redirect and the destination's reputation is checked at the moment the user clicks, catching links weaponized after delivery. Layered verdicts (heuristics + URLhaus / OpenPhish blocklist feeds + optional Google Safe Browsing / VirusTotal), open-redirect detection, an operator-managed list of abused cloud-storage / redirector hosts, and optional guarded redirect-chain following. Admin-configurable per-tier actions and outbound link restoration. Runs in-stack or on a separate host. |
## Architecture
Hermes SEG Docker Edition runs as **19 containers** orchestrated by Docker Compose:
| Container | Purpose |
|---|---|
| `hermes_unbound` | Recursive DNS resolver for the stack |
| `hermes_db_server` | MariaDB: Hermes, Authelia, Nextcloud, OpenDMARC, CipherMail, Syslog databases |
| `hermes_ofelia` | Scheduled task runner (cron replacement) |
| `hermes_nginx` | Reverse proxy + SSL termination (admin console, user portal, Nextcloud, CipherMail UI) |
| `hermes_authelia` | SSO portal with MFA (TOTP / WebAuthn / Duo Push) |
| `hermes_authelia_redis` | Session store for Authelia |
| `hermes_commandbox` | CFML application server (Lucee): hosts admin console + user portal |
| `hermes_postfix_dkim` | Postfix MTA + OpenDKIM signer / verifier |
| `hermes_dmarc` | OpenDMARC verifier + report aggregator |
| `hermes_openarc` | OpenARC chain signer / verifier |
| `hermes_mail_filter` | Amavisd-new + SpamAssassin + ClamAV content filter |
| `hermes_body_milter` | Body-modification milter: signatures, disclaimers, external-sender banners, and Link Guard link rewriting / restore |
| `hermes_linkguard` | Link Guard time-of-click safe-links endpoint (URL rewriting + click-time reputation) |
| `hermes_ciphermail` | S/MIME, PGP, encrypted-PDF encryption gateway |
| `hermes_fail2ban` | Brute-force prevention (Dovecot, Authelia jails) |
| `hermes_dovecot` | IMAP / POP3 / Submission / LMTP / Sieve server |
| `hermes_ldap` | OpenLDAP: local user directory (admins, mailboxes, relay users) |
| `hermes_nextcloud` | File sync, webmail, CalDAV, CardDAV |
| `hermes_nextcloud_redis` | Cache + locking backend for Nextcloud |
## Storage topology
Hermes splits storage across **five independent tiers** so each can live on the right type of disk for its workload:
| Tier | Default path | Contents | Storage profile |
|---|---|---|---|
| **Config** | install root (implicit) | Repo working tree, generated config, secrets, `.env` | Fast SSD; sized by repo location |
| **Data** | `/mnt/data` | Databases, service logs, mail-filter state, Postfix queue | Fast SSD; sized for DB growth and log retention. **High write rate, backup-critical.** |
| **Archive** | `/mnt/archive` | Email archive: every processed message (clean, spam, banned, infected) | Cheap bulk; sized for total mail volume, not just blocked mail. Grows unboundedly, cold access. |
| **Vmail** | `/mnt/vmail` | Dovecot mailboxes | Cheap bulk; sized for users × quota |
| **Nextcloud** | `/mnt/files` | Nextcloud app + user files + Redis cache | Cheap bulk; sized for user file storage |
Smaller deployments can collapse tiers: point Archive, Vmail, and Nextcloud at the same path as Data for a single-disk install. The installer prompts for each path; all four operator-selected mount points are mandatory (empty values risk relative path resolution during compose substitution).
See the canonical reference at [docs.deeztek.com · Storage Topology (5 tiers)](https://docs.deeztek.com/books/installation-reference/page/storage-topology-5-tiers) or [`docs/install/storage-topology.md`](docs/install/storage-topology.md) in the repo.
## Requirements
| Item | Recommendation |
|---|---|
| Host OS | Any Linux distribution capable of running Docker Engine 25.0+ and Compose v2. **Tested reference: Ubuntu 24.04 Server.** |
| Docker | Engine 25.0+ |
| Docker Compose | v2 |
| CPU | 4 vCPUs minimum, more for higher mail volume |
| RAM | 8 GB minimum, 16 GB+ recommended for production |
| Disk | **Config / OS disk: 120 GB minimum**: OS, Docker engine, the full Hermes image set + running containers, the repo, and install/service logs. The four data tiers (**Data**, **Archive**, **Vmail**, **Nextcloud**) are sized to your anticipated usage; see [Storage topology](#storage-topology). For a small single-disk test install where all tiers collapse onto one disk, ~275 GB total (thin-provisioned) is a comfortable starting point. |
| Network | Static IP or DHCP reservation. See [docs](https://www.hermesseg.io/download/) for the full inbound + outbound port list (anti-spam services need TCP/2703, UDP/6277, TCP/24441, etc.) |
| Console address | A **resolvable FQDN with a DNS record**, plus a plan for a **publicly trusted certificate** on it. The installer bootstraps on the host IP with a self-signed certificate so you can log in on day one, but Nextcloud login cannot work until the console address is a real hostname carrying a real certificate: OIDC requires the Nextcloud container to make a server-side HTTPS call back to that address, and it validates the certificate. Note also that the **Console Certificate and the SMTP TLS certificate are separate bindings**: setting only the first leaves the console perfect in a browser while mail clients are still offered the self-signed one, because autoconfig hands clients the console host as their SMTP server. |
| Host clock | **Must be correct and synchronised.** Hermes runs its own validating DNS resolver, and DNSSEC signatures are checked against the local clock, so a skewed clock invalidates every signature and takes all name resolution down with it. This bites hardest after restoring a VM snapshot. |
### Optional but recommended
For a production install, give **each storage tier its own physical or virtual disk**, separate from the OS disk and from each other. The tiers have deliberately different I/O and growth profiles, so isolating them lets you match disk to workload and size/expand each independently:
| Tier | Disk it wants | Why a dedicated disk |
| --- | --- | --- |
| **Data** | Fast SSD | High write rate (databases, logs, Postfix queue) and backup-critical; isolating it from the OS disk is the single biggest performance win |
| **Archive** | Commodity bulk | The email archive holds every processed message and grows unboundedly with mail volume; keep that growth off the DB/OS disk |
| **Vmail** | Commodity bulk | Dovecot mailboxes scale with users × quota; size and grow independently |
| **Nextcloud** | Commodity bulk | User files + Redis cache; size for file-storage growth independently |
None of this is *strictly required*; small or test deployments can collapse the tiers onto one disk (point Archive, Vmail, and Nextcloud at the same path as Data; see [Storage topology](#storage-topology) above). But for any install carrying real mail volume, a dedicated disk per tier is the recommended layout: it keeps the latency-sensitive Data tier fast, and prevents unbounded archive / mailbox / file growth from ever filling the database disk.
If you don't want a secondary drive for a given tier, simply create the directory on your primary disk (e.g., `mkdir /mnt/data /mnt/archive /mnt/vmail /mnt/files`) and point the installer at it.
## Installation
### 1. Clone the repository
Clone the repository wherever you'd like Hermes installed:
```bash
sudo git clone https://github.com/deeztek/Hermes-Secure-Email-Gateway.git
cd Hermes-Secure-Email-Gateway
```
**If you are reusing a clone made earlier, pull first:**
```bash
sudo git pull
```
The installer does not update itself. It runs whatever version of the script is
in your working tree, so an older clone installs an older installer, including
any first-run defects fixed since. A fresh clone is always current.
### 2. Run the installer
```bash
sudo ./scripts/install_hermes_docker.sh
```
The installer runs the full install in a single session and takes 10 to 30 minutes on a fresh host (mostly image downloads and fail2ban container build).
The installer will:
1. Display the Pro EULA and ask for acceptance (Community Edition users can accept; the EULA only takes effect if a Pro license is later activated).
2. Prompt for mail-server hostname (FQDN), console address, host IP, upstream DNS forwarders, and the four storage mount paths (Data, Archive, Vmail, Nextcloud).
3. Generate all secrets and per-service config files (LDAP secrets, DB passwords, Authelia session keys, OIDC keypair, self-signed bootstrap cert, etc.).
4. Render `docker-compose.override.yml` to bind the tier paths into the right containers.
5. Run `docker compose up -d --build` to pull images and start the stack.
6. Initialize all databases (Hermes, Authelia, Nextcloud, OpenDMARC, CipherMail, Syslog), populate the LDAP base structure, create the initial admin user, and pre-provision the Nextcloud admin.
7. Print an installation summary with the admin console URL and one-time admin credentials.
### 3. Access the consoles
After install completes:
- **Admin Console**: `https://<console-host>/admin/`
- **User Portal**: `https://<console-host>/users/`
- **Nextcloud**: `https://<console-host>/nc/`
The installer prints the initial admin username and password on completion. Change the password on first login.
## Updating
Hermes SEG ships a single-command update orchestrator that handles git pull, image refresh, schema migrations, service restarts, and post-upgrade hooks in one go.
### Update to the latest release
Run this from the folder you cloned Hermes into (`/opt/Hermes-Secure-Email-Gateway` in this example; use your own path if you cloned elsewhere):
```bash
cd /opt/Hermes-Secure-Email-Gateway
sudo ./scripts/system_update_docker.sh
```
This polls GitHub for the latest release, fetches the new tag, pulls updated images, applies any per-release schema/CFML/script artifacts, restarts services that need to be restarted, and runs the post-upgrade hook.
### Update to a specific release
```bash
sudo ./scripts/system_update_docker.sh v260918
```
### Preview without applying changes
```bash
sudo ./scripts/system_update_docker.sh --dry-run
```
### Other flags
| Flag | Purpose |
|---|---|
| `--skip-git` | Don't pull new code (containers + artifacts only) |
| `--skip-compose` | Don't touch docker images (git + artifacts only) |
| `--yes` | Skip the interactive confirmation prompt |
| `--help` | Show full usage |
For the full release-and-update methodology, including how artifacts are organized, idempotency rules, and the orchestrator's five-phase pipeline, see [`docs/install/release-and-update-methodology.md`](docs/install/release-and-update-methodology.md).
## Configuration
After the installer completes, the admin will be guided through first-run configuration tasks in the admin console:
1. **Confirm console host**: the install captures this at prompt time; admins can change it later under System > Console Settings.
2. **Configure DNS records**: install summary prints the recommended SPF, DKIM, DMARC, and MX records to add. Use a real DNS-resolvable hostname before requesting any production Let's Encrypt certificate.
3. **Add domains**: under Email Server > Domains (mailbox hosting) or Email Relay > Domains (gateway / relay mode).
4. **Create mailboxes or relay recipients**: under Email Server > Mailboxes or Email Relay > Recipients.
5. **Set up SSL**: either upload a 3rd-party certificate (System > System Certificates) or request a free Let's Encrypt certificate via the same page.
Detailed configuration walkthroughs, including SPF/DKIM/DMARC setup, mailbox provisioning, relay vs. mail-server modes, and the encryption gateway, live in the [Documentation](#documentation) section.
## Recovery and maintenance tools
The install script also provides a set of recovery and maintenance flags:
| Command | Purpose |
|---|---|
| `sudo ./scripts/install_hermes_docker.sh --show-config` | Display current storage paths and configuration |
| `sudo ./scripts/install_hermes_docker.sh --show-summary` | Reprint the post-install summary (admin URL, credentials reminder) |
| `sudo ./scripts/install_hermes_docker.sh --apply-schema` | Lower-level schema-only update (the canonical update path is `system_update_docker.sh`) |
| `sudo ./scripts/install_hermes_docker.sh --init-db` | Re-run phase 2 (post-container) initialization only: recovery flag for partial installs |
| `sudo ./scripts/install_hermes_docker.sh --generate-secrets` | Regenerate per-service secrets and re-render derived configs |
| `sudo ./scripts/install_hermes_docker.sh --configure-storage` | Re-prompt for storage mount paths and regenerate the override file |
| `sudo ./scripts/install_hermes_docker.sh --wipe` | **Destructive.** Tear down everything (containers, volumes, credentials, install state) for a fresh start. Requires double confirmation. |
Run any of the above with `--help` for full usage. The installer is **idempotent**: re-running it (or any of its sub-steps) on an already-installed system skips already-completed work via state guards.
## Documentation
### In-repo documentation
- [`docs/install/release-and-update-methodology.md`](docs/install/release-and-update-methodology.md): canonical reference for how Hermes is released, distributed, and upgraded
- [`docs/install/storage-topology.md`](docs/install/storage-topology.md): the five-tier storage model (Config / Data / Archive / Vmail / Nextcloud)
### Per-release change log
Each release's change log lives on its [GitHub Release page](https://github.com/deeztek/Hermes-Secure-Email-Gateway/releases): one body per tag, scoped to that release only.
### Online documentation
Operator and end-user documentation is published at **[docs.deeztek.com/shelves/hermes-seg-docker](https://docs.deeztek.com/shelves/hermes-seg-docker)**, organized into:
- [Installation & Reference](https://docs.deeztek.com/books/installation-reference): Get Started, Release & Update Methodology, Storage Topology, Email Flow
- [Administrator Guide](https://docs.deeztek.com/books/administrator-guide): full reference for system administrators (60 pages across 7 chapters)
- [User Guide](https://docs.deeztek.com/books/user-guide): end-user portal documentation (11 pages)
## Support
| Channel | Use it for |
|---|---|
| [GitHub Discussions](https://github.com/deeztek/Hermes-Secure-Email-Gateway/discussions) | Long-form Q&A, "how do I…", configuration help. Searchable. |
| [Matrix `#hermesseg:matrix.org`](https://matrix.to/#/#hermesseg:matrix.org) | Real-time community chat. |
| [Telegram `HermesSEG`](https://t.me/HermesSEG) | Same audience as Matrix, different client. |
| [GitHub Issues](https://github.com/deeztek/Hermes-Secure-Email-Gateway/issues) | Bugs and feature requests. |
| [helpdesk.deeztek.com](https://helpdesk.deeztek.com) | Paid support tickets (Pro license holders). |
| [hermesseg.io/support](https://www.hermesseg.io/support/) | All support options in one place + [Support Terms & Conditions](https://www.hermesseg.io/support-terms-conditions/). |
**Stay updated**: subscribe to release notes and security advisories at [hermesseg.io](https://www.hermesseg.io/) (newsletter signup in the footer).
## Project history
Hermes SEG is not a new project. This repository was created on **2017-12-21**, and its [oldest commit](https://github.com/deeztek/Hermes-Secure-Email-Gateway/commit/3418b01a) carries the same date. Both the project and its documentation were live and independently archived in 2018: the [product page in May](https://web.archive.org/web/20180516104102/https://www.deeztek.com/products/hermes-secure-email-gateway/) and the [GitHub repository in June](https://web.archive.org/web/20180617181749/https://github.com/deeztek/Hermes-Secure-Email-Gateway). The first bug report from an outside user, [issue #1](https://github.com/deeztek/Hermes-Secure-Email-Gateway/issues/1), was filed in January 2020.
For most of that time Hermes shipped as a bare-metal Ubuntu installer, versioned with `build-YYMMDD` labels. That history, **186 commits spanning 2017 to 2025**, is preserved in full on the [`legacy`](https://github.com/deeztek/Hermes-Secure-Email-Gateway/tree/legacy) branch, along with its [seven `build-*` releases](https://github.com/deeztek/Hermes-Secure-Email-Gateway/releases).
### Why `main` starts in 2026
**`main` and `legacy` are two separate codebases, not one continuous lineage.** The Docker Edition on `main` is a ground-up rewrite: a 19-container Docker Compose stack replacing host-level services, with its own installer, update orchestrator, and five-tier storage model. It is not a continuation of the bare-metal monolith, so it did not inherit that codebase's commits. Its history begins at the first public Docker release in June 2026.
This is worth stating explicitly because GitHub computes the commit count, the contributor graph, and the code-frequency graph from the **default branch only**, and never displays a repository's creation date. The pre-Docker history is public, but it is invisible from the landing page: it lives one branch over, on [`legacy`](https://github.com/deeztek/Hermes-Secure-Email-Gateway/commits/legacy).
## License
Hermes Secure Email Gateway **Community Edition** is free software licensed under the [GNU Affero General Public License v3.0](https://www.gnu.org/licenses/agpl.html).
Hermes Secure Email Gateway **Pro Edition** is **not** free software. It is covered by the [Hermes Secure Email Gateway Pro End-User License Agreement](https://docs.deeztek.com/books/hermes-seg-general-documentation/page/hermes-secure-email-gateway-pro-end-user-license-agreement-eula).
Copyright Dionyssios Edwards 2011-2026. All Rights Reserved.