Stargate Deployment Information¶
🇩🇪 Hinweis zu Übersetzungen | 🇫🇷 Remarque concernant les traductions
🇮🇹 Avvertenza sulle traduzioni | 🇬🇧 Translation notice
Für verlässliche Informationen nutzen Sie bitte die offiziellen Übersetzungen über den Sprachschalter . Automatische Browser-Übersetzungen können Inhalte verfälschen.
Pour obtenir des informations fiables, veuillez utiliser les traductions officielles accessibles via le sélecteur de langue . Les traductions automatiques du navigateur peuvent déformer le contenu.
Per informazioni affidabili, utilizzare le traduzioni ufficiali accessibili tramite il selettore della lingua . Le traduzioni automatiche del browser possono alterare i contenuti.
For reliable information, please use the official translations available via the language selector . Automatic browser translations may distort the content.
Pre-Requisites¶
Please ensure that all necessary preparatory steps have been completed before the HIN Gateway migration or new installation activities begin.
The following items must be available or confirmed before the installation:
-
Credentials will be delivered to you by HIN
- VM credential
- Keycloak credential
- Activation code
-
Export of private key(s)
Info
Export of private keys is only for customers moving from existing MGW to a new HIN Gateway
- If you are working on a Windows machine that has access to the Mail Gateway VM via port 22, we can support you during the call in enabling the private key export from the MGW.
- If you do not have access to such a machine, please contact HIN Support by email or phone (support@hin.ch / 0848 830 740) to help you establish a support connection via System Administration → Support Connection → Connect.
For customers with multiple domains
Note: applicable for all multi-domain migration scenarios!
To reduce the time required to execute the migration, we encourage customers to complete the following steps before the planned migration date and session:
- Export the private key for each domain.
- Identify and document the incoming and outgoing mail flow for each domain.
Please contact HIN Support to obtain the unlock code required to export the private keys.
- Download latest version of VM image
- Firewall requirements for WireGuard. Configure the WireGuard port 19818 (TCP/UDP) in your firewall:
- Incoming and outgoing traffic
- Allow traffic: any-to-HIN Gateway and HIN Gateway-to-any
-
DHCP access should be available. For more information see "Installation Guidelines".
-
Backup requirements - see "Annex 1 - Backing up and restoring the appliance settings".
Info
Backup requirements is only for customers moving from existing MGW to a new HIN Gateway
- Confirmation that the existing MGW will not be deleted until acceptance has been completed.
Info
Keeping the existing MGW available till acceptance report have been completed is only for customers moving from existing MGW to a new HIN Gateway
- Access to DNS, mail server connectors, transport rules, and relay settings.
Deployment Information¶
Installation Options¶
- VM image installation:
🖨️
You can get this documentation printed or saved as PDF, please visit our Print page view.
Exchange Integration¶
- Exchange integration - Configure Microsoft Exchange (Online and On-Premises) connectors and transport rules to route mail through Stargate
Server Requirements¶
| Minimum | Recommended | |
|---|---|---|
| CPU, Cores | 4 | 6 |
| RAM, GB | 8 | 12 |
| SSD, GB | 60 | 60 |
Common Requirements¶
- Root access: Must be run as root or with
sudo - Supported distributions:
- RHEL 8, 9 and 10 compatible distributions such as Alma Linux, Rocky Linux, CentOS Stream
- Ubuntu 22 and 24
- Debian 11, 12 and 13
- Real IPv4 address
- Valid DNS records. Your domain must have:
- MX records pointing to your mail servers
- SPF record defining allowed sending networks
- Server must be able to resolve DNS (MX, SPF, A records)
- Used for mail routing and SPF-based network allowlisting
Inbound Network Access (firewall must allow)¶
| Port | Protocol | Purpose |
|---|---|---|
25 | TCP | SMTP - receiving mail from external servers |
19818 | UDP+TCP | WireGuard - encrypted tunnel for agent-to-agent communication. Read our Security Assessment WireGuard |
Inbound VM Access (your administrative machine to the HIN Gateway VM)¶
Info
These firewall rules should be applied only between your administrative machine and the HIN Gateway VM. There is no need to expose these ports to the Internet.
| Port | Protocol | Purpose |
|---|---|---|
80 | TCP | Redirects HTTP traffic to HTTPS |
443 | TCP | Used to manage the HIN Gateway through the web dashboard |
8180 | TCP | Used by Keycloak to authenticate users for the HIN Gateway dashboard |
8190 | TCP | Optional. Required for troubleshooting and viewing logs |
22 | TCP | Optional. Required for troubleshooting and modifying configuration |
Outbound Network Access (server must reach)¶
| Destination | Port | Protocol | Purpose |
|---|---|---|---|
registry-1.docker.io, auth.docker.io, production.cloudflare.docker.com | 443 | TCP | Docker Hub image registry |
quay.io | 443 | TCP | Container registry (Keycloak, oauth2-proxy) |
github.com | 443 | TCP | Policy repository (policy-sync) |
| Your own Loki endpoint (e.g. loki.example.com) | 443 | TCP | Optional. Only needed if you provide your own Loki instance the stack should ship logs to (Alloy → Loki) |
| Update Server of alpine, almalinux, etc. | 80 | TCP | Various Update servers |
| Destination mail servers | 25 | TCP | Outbound mail delivery (via MX lookup) |
| Standard DNS queries and responses | 53 | UDP + TCP | DNS resolve |
| NTP servers | 123 | UDP | NTP synchronizes the clocks of computers, servers, network devices, and virtual machines with accurate time sources |
| WireGuard peers (HIN network) | 19818 | UDP+TCP | WireGuard - encrypted tunnel for agent-to-agent communication |
witness-{1,2,3}.verify-mail.hin-infra.ch | 443 | TCP | HIN KERI witness pool - required for agent identity verification (idagent / watcher) |
app.hin.ch | 443 | TCP | HIN member / mail-domain list (mxengine) |
apisix.verify-mail.hin-infra.ch | 443 | TCP | HIN gateway registration during onboarding (dashboard) |
Firewall note
Depending on your firewall or NAT configuration, you may need to explicitly allow traffic for the required ports. Refer to your firewall and NAT documentation for details.
The VM must be able to accept incoming connections on the required service ports and send responses back to the requester. With a stateful firewall (such as iptables using conntrack), return traffic is automatically allowed by the ESTABLISHED,RELATED rules.
Example iptables configuration:
# Allow return traffic for established connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow inbound TCP connections to the open ports
iptables -A INPUT -p tcp -m multiport --dports 25,19818 -j ACCEPT
# Allow outbound TCP connections to the open ports
iptables -A OUTPUT -p tcp -m multiport --dports 25,19818 -j ACCEPT
# Allow inbound UDP port 19818 for Wireguard
iptables -A INPUT -p udp --dport 19818 -j ACCEPT
# Allow outbound UDP port 19818 for Wireguard
iptables -A OUTPUT -p udp --dport 19818 -j ACCEPT
# Additional Services that VM shall be able to reach
# DNS
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
# NTP
iptables -A OUTPUT -p udp --dport 123 -j ACCEPT
# HTTP
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
# HTTPS
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
Contact us¶
Support
For any questions or issues related to the deployment and operation of the HIN Mail (Stargate) appliance, please contact HIN support.
Please include relevant information such as the customer name, appliance version, and screenshots/logs where applicable, to help us process your request efficiently.
