Managing the server

The Server section of the console (MSP administrators only) manages the machine the gateway runs on: its network and firewall, disks, operating system updates, time, services, logs and backups. The same tools are on the gateway's own screen: sign in on the VM console (or over SSH run sudo obsidian-console) and a menu opens. The menu works even when the scanner, the database or the web console does not, so it is the place to fix a wrong network setting.

Everything is done by one small helper that runs with administrator rights on the gateway (obsidian-os); the console itself never has them, and the helper checks every request again. Every change made from the console is recorded in the Audit log (passwords never are).

System & updates

• This machine: the mail name (what the gateway answers mail with, set in Settings › General), the machine's own name, the gateway version, operating system, uptime, load, memory and disk. Rename the machine changes only the operating system's name.
• Updates: Check now and Install all update the operating system's packages (Postfix, ClamAV, PostgreSQL, nginx, the kernel...) in the background with their output shown live; you can leave the page. Configuration files you changed are kept. If an update needs a restart, a notice says so; tick Restart automatically if needed to let it happen right away. The gateway software itself is updated by its deploy, not here.
• Time: the machine's time zone (system logs, scheduled jobs; the console's clock follows Settings › General › Time zone) and its time servers, for example your domain controllers. Correct time matters for mail headers, DKIM signatures and certificates.
• Services: whether each part runs (Postfix, the scanner, the worker, the console, ClamAV, unbound, PostgreSQL, nginx, certificate renewal, SSH, the firewall...), with Restart. While the scanner is stopped or restarting, Postfix answers "try again later", so senders retry and no mail is lost or let through unscanned.
• Remote console (SSH): on or off. Turning it off keeps sessions that are already open.
• Restart or shut down, now or later; a scheduled one can be cancelled. Mail is not accepted meanwhile; senders retry.

Network & firewall

Each network interface with its addresses and traffic, the gateway and DNS servers. The gateway resolves names through its own DNSSEC-validating resolver (unbound on 127.0.0.1:5335); the DNS servers here are the machine's own.

• Change the address switches between DHCP and a static address (IPv4, and IPv6 automatic, static or off), and sets DNS servers, search domains and the MTU. A mail gateway needs an address that does not change: use a static address, or a DHCP reservation. A new address also means new targets for the router's port forwards and the DNS records.
• Changes undo themselves unless you keep them. After Apply, open the console at the new address within the time you chose (5 minutes by default) and press Keep. If you cannot reach it, do nothing: the previous configuration comes back by itself. The console menu does the same with a 2-minute window.
• Connectivity test checks the default gateway, the internet, DNS, the local resolver's DNSSEC validation, HTTPS out, outgoing mail on port 25 (many internet providers block it) and whether the gateway's mail name resolves.
• Firewall: the ports that accept connections. Reset to the gateway's ports opens exactly what the gateway serves: SSH 22, SMTP 25, HTTP 80 (certificate renewals) and HTTPS 443 (console, user portal, secure messages), plus the release uploads (FTPS 21 and 40000-40009) from the local network where that service is installed. Turning the firewall on opens 22 and 443 first so you are not locked out. Closing 25, 22 or 443 for everyone asks first: it stops mail, or can lock you out of SSH or this console.

Storage

How full each file system is and what uses the space: the quarantine and message store, the database, virus signatures, logs, the package cache. The System page warns when the disk has less than 15 % free (or less than 2 GB on a large disk); when it is full, Postfix stops accepting mail.

• Grow the system volume: after enlarging the VM's virtual disk in Hyper-V or VMware, this adds the new space to the system volume while the gateway keeps running (partition, LVM and file system).
• Add a disk: attach a new, empty virtual disk and it appears here. Add it to the system volume (LVM installations) needs no downtime. Hold the message store formats the disk, copies the quarantine and message store there and mounts it in place; the scanner, worker and console stop while it copies (senders retry). Type the disk's name to confirm: everything on it is erased.
• Clean up lists what can go: downloaded update packages, old system log entries, rotated log files, old support bundles, and copies kept by a restore or a disk move once you no longer need them.

Logs & diagnostics

The scanner, worker and console; Postfix; antivirus; the DNS resolver; nginx; the database; the server tools; the network; SSH sign-ins; firewall blocks; the kernel; and every warning and error, filtered by time, level and text. Support bundles put the logs of the last two days, versions, Postfix settings, disks, network and services into one file, with keys and passwords removed, to download and send when asking for help. The server tools' background jobs (updates, backups, restores, disk changes) and how they ended are listed at the bottom; each one has a page with its live output.

Backup

Server › Backup backs up everything needed to rebuild the gateway: the database (organizations, domains, policies, users, the message log, settings and the encrypted connector secrets and DKIM keys), the quarantine and message store, the configuration with the keys that decrypt those secrets, the certificates and the network settings.

1. Where backups go: a Windows or NAS share (SMB), an NFS export, or a folder on another disk of this machine. The share's password is stored readable only by root on the gateway and never shown again.
2. Schedule: every day at a time you choose, keeping the newest backups (7 by default); older ones of this gateway are removed after each new one.
3. Back up now at any time.

Each backup is a folder obsidian-backup/<machine>-<date>-<time> with database.dump, data.tar.zst, config.tar.gz and manifest.json (sizes and checksums). Keep the destination as safe as the gateway: the configuration archive holds the keys that decrypt the stored secrets.

Restoring (type the backup's name and press Restore) checks the backup's checksums, pauses the scanner, worker and console (Postfix keeps running and asks senders to retry), sets the current data and database aside, puts the backup's in their place, takes over the backup's encryption keys if they differ (the running gateway keeps its own database password and addresses) and starts everything again. If anything fails, the previous data and database are put back. Mail that arrived after the backup is in the set-aside copy, not merged. Once everything works, remove the set-aside copies under Storage › Clean up. A backup from a newer version is refused: update this gateway first. To move to a new machine, install the gateway there, point it at the same destination and restore.

VM snapshots or VM-level backups (Hyper-V, Veeam, VMware) remain a good second layer.

On the gateway's own screen

An administrator (a member of the sudo group) who signs in on the VM's screen gets the menu right away; over SSH, run sudo obsidian-console. It shows the gateway's addresses, whether anything needs attention, and the same sections as these pages. Open a shell leaves the menu; sudo obsidian-console opens it again. For scripts, sudo obsidian-os OPERATION runs one operation (see Command line & services).