Mail-Archiver

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for bigger archives or many mailboxes.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. The PostgreSQL database is never exposed on the network, and both Kestrel and PostgreSQL listen on 127.0.0.1 only.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Mail-Archiver by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:mail-archiver-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name mail-archiver \
  --image sac1647283583153:mail-archiver-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name mail-archiver --port 80 --priority 900

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that the Mail-Archiver (Kestrel) service, nginx and PostgreSQL are all active. Kestrel listens only on 127.0.0.1:5000 and PostgreSQL only on 127.0.0.1:5432. nginx is the only public listener, serving :80. The unauthenticated /healthz endpoint answers 200 for load balancer probes.

systemctl is-active mailarchiver nginx postgresql

ss -ltnH | grep -E ':(80|5000|5432)' | awk '{print $4}' | sort -u

curl -s -o /dev/null -w '/healthz -> %{http_code}\n' http://127.0.0.1/healthz

First boot provisions the database, runs the application's schema migrations and then starts the app. Right after first boot, the .NET app performs a short just-in-time warm-up. Allow around a minute for the first page request to respond.

Step 4 - Retrieve the per-VM administrator login

Every VM creates its own administrator on first boot. The username, the generated password and the site URL are written to a root-only credentials file. Read it with sudo:

sudo cat /root/mail-archiver-credentials.txt

Sign in with MAILARCHIVER_ADMIN_USER (which is admin) and the MAILARCHIVER_ADMIN_PASSWORD from this file.

Step 5 - Sign in and set your own password

Browse to http://<vm-public-ip>/. The login page opens. Sign in with the username admin and the password from Step 4.

On your first sign-in, the appliance prompts you to set your own administrator password. This built-in security step exists because the first login uses the generated per-VM password.

Enter the per-VM password as the current password, choose a new password, and confirm it. After that, your chosen password is the only administrator login.

Step 6 - Explore the dashboard

After you sign in, the dashboard opens. It gives an overview of the archive: the number of archived emails, the number of connected accounts, attachment counts and the database size. Panels show emails per month and top senders.

The top navigation links to Archive (search), Mail Accounts, Users, background Jobs and the access Log.

Step 7 - Connect your first mailbox

A fresh appliance has an empty archive until you connect a mailbox. No live mail server is needed to boot or run the appliance.

Open Mail Accounts, then select New Account. Give the account a name, enter the email address and choose the provider (IMAP or Microsoft 365). Fill in the server details and credentials, then save the account.

Mail-Archiver then begins synchronising and archiving the account's messages on a schedule in the background.

Step 8 - Search the archive

Open Archive to search your stored mail. Search by term, restrict by date range, account and direction, or use advanced field searches such as subject:invoice or from:john.

You can open results, export them, or batch restore them to a mailbox. Folders from each account are listed on the left.

Step 9 - No known or default credentials

The upstream Mail-Archiver sample ships a default administrator, and this image removes it entirely. The sample credential is stripped from the shipped configuration. The captured image contains no database and no DataProtection keyring. The administrator is created with a unique per-VM secret the first time the VM boots.

The built-in round-trip check confirms that only the per-VM secret works. It verifies that the per-VM administrator authenticates through the login form, while the upstream default secure123! and a wrong guess are both rejected:

sudo -u postgres psql -d MailArchiver -tAc 'SELECT "Username" FROM mail_archiver."Users";'

sudo bash /usr/local/sbin/mail-archiver-cred-roundtrip.sh

Step 10 - Verify the stack and where your data lives

Confirm the ASP.NET Core runtime and the built Mail-Archiver application. The PostgreSQL database, the ASP.NET Core DataProtection keyring and your configuration all live on this VM's disk. Your archive therefore persists across reboots and stays with the VM.

dotnet --list-runtimes | grep AspNetCore

ls /opt/mailarchiver/app/MailArchiver.dll

Adding your own domain and TLS

Out of the box, the image serves the application over plain HTTP on the VM's public IP. For production, front it with your own reverse proxy.

Point your DNS at the VM, or at an Azure Load Balancer or Application Gateway in front of it. Terminate HTTPS at that load balancer, at the Application Gateway, or at your own reverse proxy in front of nginx. Mail-Archiver reads the standard X-Forwarded-Proto and X-Forwarded-Host headers, so it works correctly behind a TLS-terminating proxy with no extra configuration.

For production, also set AllowedHosts to your own hostname instead of the permissive default (see the security notes).

Security notes

• Unique administrator. The administrator account is unique per VM, and no known or blank credential authenticates. The upstream default secure123! is removed from the image. Keep /root/mail-archiver-credentials.txt protected, and complete the forced password change at first sign-in.
• Per-VM secrets. The PostgreSQL password and the ASP.NET Core DataProtection keyring are generated per VM on first boot. Neither database access nor authentication cookies are shared between customer VMs.
• Loopback-only services. Kestrel listens on 127.0.0.1:5000 only and PostgreSQL on 127.0.0.1:5432 only. Neither is reachable from the network, and nginx is the only public listener.
• Restrict allowed hosts. The image ships with AllowedHosts set to * so you can reach it by IP immediately. For production, restrict it to your own hostname and front the application with your own TLS.
• Restrict the NSG. Limit inbound 80/tcp in your NSG to the networks that need the web interface.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating Mail-Archiver on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Mail-Archiver on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com