Self-Hosting Server Guide: Mail Servers (Port 25 / rDNS), Docker, PostgreSQL & Nextcloud

1. Provider Capabilities for Self-Hosters

Self-hosting stateful services requires capabilities that many cloud providers restrict by default — specifically outbound TCP Port 25, customizable IPv4 and IPv6 reverse DNS (PTR), sustained CPU/disk I/O without throttling, and off-provider image backups:

2. Self-Hosted Mail Server Configuration (Port 25, FCrDNS, DNS Zone & Postfix IPv6)

Delivering email directly to Gmail, Microsoft 365 and European MX hosts requires four verified configuration steps:

1. Unblock Outbound TCP Port 25 in SCP & Verify Connectivity: On netcup G9–G12.5 servers, open SCP → Select Server → Firewall, remove the default netcup Mail block policy, click Save, and verify outbound SMTP plus forward-confirmed reverse DNS (FCrDNS) from the server shell:

   # 1. Test outbound TCP Port 25 connectivity to Gmail MX
   nc -zv -w 5 gmail-smtp-in.l.google.com 25
   
   # 2. Verify IPv4 and IPv6 Reverse DNS (PTR) matches your mail hostname
   dig +short -x 203.0.113.45
   dig +short -x 2a03:4000:60:1234::1

2. Required DNS Zone Records & SCP Reverse DNS (PTR): Set the PTR record in SCP → Network for both your IPv4 address and your chosen IPv6 address (::1) to mail.example.com, and publish the matching records in your DNS zone:

   Record Type	Host / Name	Value / Example Target	Purpose
   A	mail.example.com	203.0.113.45	Maps mail hostname to your server IPv4 (must match SCP IPv4 PTR)
   AAAA	mail.example.com	2a03:4000:60:1234::1	Maps mail hostname to the specific IPv6 address (must match SCP IPv6 PTR)
   MX	example.com	10 mail.example.com.	Directs inbound mail for your domain to your mail host
   TXT (SPF)	example.com	"v=spf1 mx -all"	Authorizes only the hosts listed in your MX record to send mail
   TXT (DKIM)	dkim._domainkey	"v=DKIM1; k=rsa; p=MIIBIjANBg..."	Cryptographic signature generated by Rspamd / OpenDKIM / Stalwart
   TXT (DMARC)	_dmarc.example.com	"v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com"	Instructs receiving servers to quarantine messages failing SPF + DKIM

3. Bind Outbound Postfix to the Exact IPv6 PTR Address (/etc/postfix/main.cf): Because Linux may otherwise pick an arbitrary address from your /64 subnet without a matching PTR record (causing Gmail IPv6 rejections), explicitly bind Postfix to your primary IPv4 and IPv6 addresses:

   # /etc/postfix/main.cf — explicit outbound bind for FCrDNS compliance
   myhostname = mail.example.com
   inet_protocols = all
   smtp_bind_address = 203.0.113.45
   smtp_bind_address6 = 2a03:4000:60:1234::1
   smtp_helo_name = mail.example.com
   smtp_tls_security_level = may

3. Docker Compose, daemon.json & the SCP Stateful Firewall Matrix

Publishing a port with -p 5432:5432 in Docker writes directly to the Linux kernel nat / FORWARD chains, bypassing UFW / iptables INPUT rules and exposing internal databases to the public internet. Harden your container host with two layers:

1. Bind internal containers to 127.0.0.1 and cap container logs in /etc/docker/daemon.json:

   {
     "log-driver": "json-file",
     "log-opts": {
       "max-size": "20m",
       "max-file": "3"
     },
     "live-restore": true
   }

2. Enforce ingress filtering outside the VM using the hypervisor-level SCP Stateful Firewall: Because SCP’s OpenStack-backed firewall filters packets at the host hypervisor tap interface before they reach the VM kernel, Docker cannot bypass it. Use this baseline rule table:

   Order	Direction	Protocol	Port(s)	Source / Destination	Action & Purpose
   1	INGRESS	TCP	22	Your admin IP / VPN subnet (or 0.0.0.0/0)	ACCEPT — SSH access
   2	INGRESS	TCP	80, 443	0.0.0.0/0, ::/0	ACCEPT — Reverse proxy (Caddy / Traefik / Nginx)
   3	INGRESS	UDP	443	0.0.0.0/0, ::/0	ACCEPT — HTTP/3 (QUIC)
   4	INGRESS	TCP	25, 465, 587, 993	0.0.0.0/0, ::/0	ACCEPT — Mail server (if running SMTP + IMAPS)
   5	INGRESS	ICMP / ICMPv6	All	0.0.0.0/0, ::/0	ACCEPT — Required for Path MTU Discovery & IPv6 Neighbor Discovery
   6	INGRESS	ALL	All other ports	0.0.0.0/0, ::/0	DROP — Blocks direct external access to Docker ports (5432, 6379, etc.)

4. PostgreSQL NVMe Tuning for an 8 GB Root Server (RS 1000 G12.5)

Default PostgreSQL settings assume spinning disks and 128 MB of shared memory. On a 4-core / 8 GB DDR5 / NVMe server such as netcup RS 1000 G12.5, apply these tuned parameters in postgresql.conf (or pass them via Docker command: -c ...):

# postgresql.conf — tuned for 4 dedicated EPYC cores, 8 GB RAM, NVMe storage
shared_buffers = 2GB                  # 25% of total RAM
effective_cache_size = 6GB            # 75% of total RAM (OS page cache + shared_buffers)
maintenance_work_mem = 512MB          # Speeds up VACUUM and CREATE INDEX
work_mem = 16MB                       # Per sort/hash operation
max_worker_processes = 4              # Match dedicated physical CPU cores
max_parallel_workers_per_gather = 2
max_parallel_workers = 4
random_page_cost = 1.1                # Tell query planner storage is NVMe SSD (default is 4.0)
effective_io_concurrency = 200        # Concurrent async NVMe I/O requests
wal_compression = zstd                # Reduce WAL write amplification on NVMe
checkpoint_completion_target = 0.9

5. Recommended Server Tiers & Active Vouchers