Arghhhh!!!

Ok, thank you!

*) EncFS should be done after server OS installation by sys admin, not by iRedMail.
*) iRedMail doesn't install a local DNS server, so all DNS server side settings are not applicable. for example, DNSSEC.
*) DMARC is planned, but no deadline yet.
*) No plan for z-push. We use SOGo groupware, it offers ActiveSync.
*) HSTS is implemented in Nginx, and will be available in upcoming iRedMail release. Actually, it's just one line in /etc/nginx/conf.d/default.conf (inside https block):

    # Use HTTP Strict Transport Security to force client to use secure             
    # connections only. Reference:                                                 
    # https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";

About LAMP, you can use LNMP instead.

*) Looks like we have to keep both Apache and Nginx for a long time.
*) I don't want to drop any backend database (LDAP/MySQL/PGSQL).

PGSQL is too different than MySQL/MariaDB, and many admins prefer PGSQL, they don't like Oracle MySQL due to license concern.

*) We dropped Gentoo, openSUSE before, because just very few users chose them. No plan to drop one more.

Is it possible to give back openSuse ....  Leap has now 36 months maintance. I could help if needed.

hey Zhang,

is it possible to request for next versions of iredmail-mysql/mariadb to use innodb as the default engine for table creation?
since we're trying to create cluster of iredmail-mariadb server using maria-db wsrep, but noticed that account creation doesn't get synced across the nodes, since vmail table still uses myisam.

Sure, I'll share it later once our new cluster setup is a success.

our current setup is also basically an iredmail cluster at the moment, using 3 ubuntu servers: 2 for iredmail and 1 for the nfs storage & mysql database. once we installed both iredmail server, we just moved the database from one server to the central database, and changed the iredmail configuration to use that database instead.
For the storage, we just nfs mounted the /var/vmail from the storage to each iredmail server. and then setup dns pointer to both iredmail server for round-robin resolve.
As for the webmail it's optional; on our setup actually we used another server and used horde-groupware for the webmail service.

The weakest link is at the database server, if it has problem, all the services will halt; (we have to restart each services again)

Right now we are trying to improve the setup by using GlusterFS Cluster mounted storage and Master/Master mariaDB replication, plus using dovecot director to better handle the IMAP session. The details will be shared later.

Yea, I've considered the adding ha-proxy for the new setup.

The old setup was done early 2012-ish, before dovecot and postfix fully support the proxy protocol, thus why only simple dns round-robin was used.

Excuse me, what do you mean "ident system"? Does it mean some kind of identity management system, or a central account management system?

Have you considered adding Horde 5 as a groupware option? Any chance Horde's ActiveSync would be more stable than Sogo? Here's a bit of background on this...

I am responsible for a few iRedmail instances -- been installing it for clients who need an onsite mail solution.

In a couple of these, we use Sogo Activesync; and I'm disappointed to report that it seems very buggy. Moving more than a few messages at a time in Outlook doesn't work; various things break from one update to another, random things may get fixed when an update occurs, etc. It's very frustrating. Recently the CardDAV protocol seems to have quit working correctly also; contacts mysteriously just quit syncing with my BlackBerry and Thunderbird. It used to work. Sometimes I have gotten issues fixed simply by updating to the latest nightly build; other times, the nightly build broke things which didn't get fixed til the next stable release.

Horde 5 has ActiveSync support also, apparently. And Horde has been around for a long time. Does anybody know if their ActiveSync implementation is more stable than that of Sogo?

I think Kolab is better than SoGo and more similar to Roundcube.

(http://www.kolab.org/)