Initial VPS operations handbook

2026-08-03 12:26:42 +08:00
commit b73125e5bc
97 changed files with 3641 additions and 0 deletions
@@ -0,0 +1,54 @@
+# Runbook: use mailcow SMTP / IMAP (client)
+
+Target: [mx2.windy.me](../hosts/mx2.windy.me.md)  
+Prerequisite: a mailbox on `windy.me` (password from mailcow UI, not the admin account unless it is that mailbox).
+
+Clients should use **submission** to send. Do **not** use port 25 as a desktop/app outbound port.
+
+## Send (SMTP)
+
+| Item | Value |
+|------|--------|
+| Server | `mx2.windy.me` |
+| Port | **587** (STARTTLS) — preferred |
+| Alt port | **465** (SSL/TLS) |
+| Username | Full address, e.g. `zhiqiang@windy.me` |
+| Password | Mailbox password |
+| Auth | Required (LOGIN / PLAIN) |
+
+Match encryption to the port: 587 → STARTTLS; 465 → SSL/TLS (not STARTTLS).
+
+From address should be that mailbox or an allowed alias on the same domain.
+
+## Receive (IMAP / POP)
+
+| Protocol | Server | Port |
+|----------|--------|------|
+| IMAPS | `mx2.windy.me` | **993** |
+| POP3S | `mx2.windy.me` | **995** |
+
+Username = full email address; same mailbox password.
+
+## Webmail
+
+- UI / SOGo: https://mx2.windy.me  
+- Log in with the same mailbox credentials.
+
+## CLI smoke test (optional)
+
+```bash
+swaks --to someone@example.com \
+  --from YOU@windy.me \
+  --server mx2.windy.me --port 587 -tls \
+  --auth LOGIN --auth-user YOU@windy.me --auth-password 'MAILBOX_PASSWORD'
+```
+
+Do not commit or paste real passwords into this repo.
+
+## Auth failures — quick checks
+
+- Username is the **full** email, not a local part alone
+- Password is the **mailbox** password (not unrelated host/root secrets)
+- Port/TLS mode mismatch (587 vs 465)
+- Account active in mailcow; not rate-limited / fail2banned after bad attempts
+- Apps that store SMTP in their own config (e.g. Vaultwarden `config.json`) may keep a **stale** password even when `.env` is correct — verify AUTH against the effective config ([vaultwarden-health](vaultwarden-health.md) §5)