Stargate Deployment Information

🇩🇪 Hinweis zu Übersetzungen | 🇫🇷 Remarque concernant les traductions
🇮🇹 Avvertenza sulle traduzioni | 🇬🇧 Translation notice

🇩🇪🇫🇷🇮🇹🇬🇧

Für verlässliche Informationen nutzen Sie bitte die offiziellen Übersetzungen über den Sprachschalter . Automatische Browser-Übersetzungen können Inhalte verfälschen.

Pour obtenir des informations fiables, veuillez utiliser les traductions officielles accessibles via le sélecteur de langue . Les traductions automatiques du navigateur peuvent déformer le contenu.

Per informazioni affidabili, utilizzare le traduzioni ufficiali accessibili tramite il selettore della lingua . Le traduzioni automatiche del browser possono alterare i contenuti.

For reliable information, please use the official translations available via the language selector . Automatic browser translations may distort the content.

What is Stargate?

Pre-Requisites

Please ensure that all necessary preparatory steps have been completed before the HIN Gateway migration or new installation activities begin.

The following items must be available or confirmed before the installation:

• Credentials will be delivered to you by HIN

  • VM credential
  • Keycloak credential
  • Activation code

• Export of private key(s)

Info

Export of private keys is only for customers moving from existing MGW to a new HIN Gateway

• If you are working on a Windows machine that has access to the Mail Gateway VM via port 22, we can support you during the call in enabling the private key export from the MGW.
• If you do not have access to such a machine, please contact HIN Support by email or phone (support@hin.ch / 0848 830 740) to help you establish a support connection via System Administration → Support Connection → Connect.

For customers with multiple domains

Note: applicable for all multi-domain migration scenarios!

To reduce the time required to execute the migration, we encourage customers to complete the following steps before the planned migration date and session:

• Export the private key for each domain.
• Identify and document the incoming and outgoing mail flow for each domain.

Please contact HIN Support to obtain the unlock code required to export the private keys.

• Download latest version of VM image
• Firewall requirements for WireGuard. Configure the WireGuard port 19818 (TCP/UDP) in your firewall:
  • Incoming and outgoing traffic
  • Allow traffic: any-to-HIN Gateway and HIN Gateway-to-any

• DHCP access should be available. For more information see "Installation Guidelines".

• Backup requirements - see "Annex 1 - Backing up and restoring the appliance settings".

Info

Backup requirements is only for customers moving from existing MGW to a new HIN Gateway

• Confirmation that the existing MGW will not be deleted until acceptance has been completed.

Info

Keeping the existing MGW available till acceptance report have been completed is only for customers moving from existing MGW to a new HIN Gateway

• Access to DNS, mail server connectors, transport rules, and relay settings.

Deployment Information

Installation Options

• VM image installation:
  • Azure VM image installation
  • Windows 11 Pro (Hyper-V) image installation
  • VMware image installation
  • Proxmox image installation
  • Cloudscale.ch image installation

Second disk required: the Data Disk

The appliance uses two disks: the OS disk from the image, and a separate Data Disk that holds all configuration, secrets, mail, and databases. Keeping them apart lets an image upgrade replace the OS without touching your data.

The VMware OVA already includes this disk. On every other platform (Proxmox, Hyper-V, Azure, Cloudscale) the image is a single OS disk, so you must attach a second, blank disk of at least 30 GB before the first boot.

Do not format or partition it yourself. On first boot the appliance formats the blank disk (label VEREIGN-DATA) and mounts it at /var/data. Without it, the first boot fails its health check and rolls back.

🖨️

You can get this documentation printed or saved as PDF, please visit our Print page view.

Exchange Integration

• Exchange integration - Configure Microsoft Exchange (Online and On-Premises) connectors and transport rules to route mail through Stargate

Server Requirements

	Minimum	Recommended
CPU, Cores	4	6
RAM, GB	8	12
SSD, GB	60	60

Common Requirements

• Root access: Must be run as root or with sudo
• Supported distributions:
  • RHEL 8, 9 and 10 compatible distributions such as Alma Linux, Rocky Linux, CentOS Stream
  • Ubuntu 22 and 24
  • Debian 11, 12 and 13
• Real IPv4 address
• Valid DNS records. Your domain must have:
  • MX records pointing to your mail servers
  • SPF record defining allowed sending networks
  • Server must be able to resolve DNS (MX, SPF, A records)
  • Used for mail routing and SPF-based network allowlisting

Inbound Network Access (firewall must allow)

Port	Protocol	Purpose
25	TCP	SMTP - receiving mail from external servers or from an MTA installed in front of the HIN Gateway.
19818	UDP+TCP	WireGuard - encrypted tunnel for agent-to-agent communication. Read our Security Assessment WireGuard

Inbound VM Access (your administrative machine to the HIN Gateway VM)

Info

These firewall rules should be applied only between your administrative machine and the HIN Gateway VM. There is no need to expose these ports to the Internet.

Port	Protocol	Purpose
80	TCP	Redirects HTTP traffic to HTTPS
443	TCP	Used to manage the HIN Gateway through the web dashboard
8180	TCP	Used by Keycloak to authenticate users for the HIN Gateway dashboard
8190	TCP	Optional. Required for troubleshooting and viewing logs
22	TCP	Optional. Required for troubleshooting and modifying configuration

Outbound Network Access (server must reach)

Destination	Port	Protocol	Purpose
registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com	443	TCP	Docker Hub image registry
quay.io	443	TCP	Container registry (Keycloak, oauth2-proxy)
github.com	443	TCP	Policy repository (policy-sync)
Your own Loki endpoint (e.g. loki.example.com)	443	TCP	Optional. Only needed if you provide your own Loki instance the stack should ship logs to (Alloy → Loki)
Update Server of alpine, almalinux, etc.	80	TCP	Various Update servers - https://hub.docker.com/
Destination mail servers	25	TCP	Outbound mail delivery via MX lookup, or delivery to the next MTA configured as the outbound server.
Standard DNS queries and responses	53	UDP + TCP	DNS resolve
ntp.metas.ch (default NTP server)	123	UDP	NTP synchronizes the clocks of computers, servers, network devices, and virtual machines with accurate time sources
WireGuard peers (HIN network)	19818	UDP+TCP	WireGuard - encrypted tunnel for agent-to-agent communication
witness-{1,2,3}.verify-mail.hin-infra.ch	443	TCP	HIN KERI witness pool - required for agent identity verification (idagent / watcher)
app.hin.ch	443	TCP	HIN member / mail-domain list (mxengine)
apisix.verify-mail.hin-infra.ch	443	TCP	HIN gateway registration during onboarding (dashboard)

Using your own NTP server

The appliance is preconfigured to use ntp.metas.ch (Swiss Federal Institute of Metrology). If your network does not permit outbound NTP, configure your own time server instead of opening port 123 to the internet - an internal server is fully supported.

To set your own, create the file below on the appliance and reload. List as many servers as you need, one per line:

sudo tee /var/data/vereign/chrony/ntp.sources <<'EOF'
pool ntp1.example.local iburst
pool ntp2.example.local iburst
EOF
sudo chronyc reload sources
chronyc sources -v

The file must be named exactly ntp.sources. With that name your list replaces the default; under any other name it is added to the default instead. Delete the file and reload to go back to ntp.metas.ch.

Accurate time is not optional. If the clock drifts, certificate validation, message signing and sign-in sessions all begin to fail in ways that are hard to diagnose.

Important note regarding operation on Microsoft Azure

**Operation on Microsoft Azure**
For the SMTP relay connection between the HIN Gateway and Exchange Online, outgoing data traffic via TCP port 25 must be permitted.

Microsoft Azure blocks outbound connections via port 25 for most subscription models. HIN has no control over the availability or activation of this port by Microsoft. Operating the HIN Gateway on Azure is therefore **not a standard supported deployment scenario**. Exceptions apply in particular to [certain Microsoft Enterprise subscriptions](https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-network/troubleshoot-outbound-smtp-connectivity). Before installing on Azure, please check whether your subscription permits outbound SMTP traffic via TCP port 25.

If you have any questions regarding the appropriate deployment option, please contact your HIN contact person at an early stage.

Firewall note

Depending on your firewall or NAT configuration, you may need to explicitly allow traffic for the required ports. Refer to your firewall and NAT documentation for details.

The VM must be able to accept incoming connections on the required service ports and send responses back to the requester. With a stateful firewall (such as iptables using conntrack), return traffic is automatically allowed by the ESTABLISHED,RELATED rules.

Example iptables configuration:

# Allow return traffic for established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow inbound TCP connections to the open ports
iptables -A INPUT -p tcp -m multiport --dports 25,19818 -j ACCEPT

# Allow outbound TCP connections to the open ports
iptables -A OUTPUT -p tcp -m multiport --dports 25,19818 -j ACCEPT

# Allow inbound UDP port 19818 for Wireguard
iptables -A INPUT -p udp --dport 19818 -j ACCEPT

# Allow outbound UDP port 19818 for Wireguard
iptables -A OUTPUT -p udp --dport 19818 -j ACCEPT

# Additional Services that VM shall be able to reach
# DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT

# NTP
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT

# HTTP
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT

# HTTPS
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

Recommended Migration Approach by Number of Domains

Customers with 3 Domains or Fewer

• HIN recommends migrating all domains at once.
• HIN will support the customer in successfully migrating the first domain.
• Once the first domain has been migrated successfully, the customer can migrate the remaining domains independently.
• This approach keeps the migration simple and avoids the need for a parallel environment.

Customers with More Than 3 Domains

• HIN recommends setting up a parallel environment alongside the existing MGW.
• Domains can then be migrated gradually to the new environment.
• HIN will support the customer in successfully migrating the first domain.
• After the first successful migration, the customer can decide how and when to move the remaining domains to the new environment.

Contact us

Support

For any questions or issues related to the deployment and operation of the HIN Mail (Stargate) appliance, please contact HIN support.

Please include relevant information such as the customer name, appliance version, and screenshots/logs where applicable, to help us process your request efficiently.

---