Skip to main content
Experimental. Needs APP_EXPERIMENTAL=mail on the control plane: without it this template is hidden and cannot be installed. Install with the MAIL_FIRST_DOMAIN setting (templates install mail-mox —env MAIL_FIRST_DOMAIN=example.com). MAIL_HOSTNAME (the FQDN other servers connect to) defaults to mail. that domain and MAIL_ADMIN_EMAIL to postmaster@ that domain. Ports 25, 465, 587 and 993 are published on the host with a private bind by default. After install, open them with the CLI command mail ports open —confirm (or Open mail ports on the Mail page): that makes only those four ports public and allows them in the host firewall, then set up DNS. Webmail and the account UI are on port 8025 (private, no admin pages). The admin API and metrics are never published; never make them public. TLS: the first start makes a self-signed certificate (valid for localhost only, made by mox itself) so the server comes up with no manual steps. Replace it before sending real mail: put your certificate and key in the config volume and set MAIL_TLS_CERT_FILE and MAIL_TLS_KEY_FILE (paths under /mox/config, for example certs/cur.pem and certs/cur.key). Existing files at those paths are never overwritten. A changed certificate needs a container restart. Relay mode: set MAIL_SMARTHOST_HOST (and port, user, password) to send through a provider. Changing it needs a restart. The admin password is the generated secret SERVICE_PASSWORD_MAILADMIN. Back up the config and data volumes together. Deliverability depends on reverse DNS, SPF, DKIM and a clean IP; see the mail template guide. Licence: MIT. This page describes the Levelrail template for Mail server (mox, experimental) (Communication). It deploys the services below as one Docker Compose app on your own server. Project site: https://www.xmox.nl/. Recommended memory: about 256 MiB.

Services, ports and volumes

Environment variables

Passwords and keys marked as generated are created for you when the app is deployed and stored as secrets. Values are not shown here.

Security and requirements

Level: Standard. What this template needs:
  • Publishes ports directly on the host (mox): 25:25, 465:465, 587:587, 8025:8081, 993:993.
  • You must provide one or more secrets before it can deploy (mox): MAIL_FIRST_DOMAIN.
  • Passwords and keys are generated at deploy time (mox): MAIL_ADMIN_PASSWORD.
  • Stores data in named volumes (mox): mail_config, mail_data.
What Levelrail adds around it:
  • Automatic HTTPS and an ingress shield in front of every domain.
  • Secrets are generated, stored encrypted and masked in logs and the UI.
  • Named volumes can be backed up and restored.
  • Deploys are gated on the health check before traffic switches.
  • One-step rollback to the previous revision.
  • Exposure report shows what is reachable from outside.
  • Host firewall rules managed for published ports.
This template needs configuration before it can deploy. Open it in the dashboard, set each variable marked “You must provide” in the Compose body, then deploy.

Deploy Mail server (mox, experimental) with Levelrail

In the dashboard, open Apps, choose New app, then Browse templates, and select Mail server (mox, experimental). Review the Compose body and deploy. With the CLI:
See the service template catalog for how templates work, and Getting started if you have not installed Levelrail yet.

More Communication templates

All templates are listed in the self-host gallery.
Last modified on October 31, 2026