Email Hosting for Associations with Virtualmin: Setting Up Postfix, Dovecot, and Roundcube in a GDPR-Compliant Way and Synchronizing with JVerein and Nextcloud

Learn how to set up a GDPR-compliant email server with Postfix, Dovecot, and Roundcube for your association on Virtualmin and synchronize it with JVerein and Nextcloud.

virtualminnextcloudgdpremail hostingassociation

Email Hosting for Associations: GDPR-Compliant with Virtualmin

Associations often face the challenge of operating a cost-effective yet privacy-compliant email solution. Virtualmin provides a powerful platform to combine Postfix, Dovecot, and Roundcube. In this article, we show you step by step how to build a GDPR-compliant email infrastructure for your association and synchronize it with JVerein and Nextcloud.

Why Virtualmin for Associations?

Virtualmin is an open-source web hosting and server management software based on Webmin. It enables easy management of domains, email accounts, databases, and more. For associations, Virtualmin is ideal because it:

  • Is free and open source
  • Offers a user-friendly interface
  • Enables GDPR-compliant email services
  • Is scalable and can be integrated with JVerein and Nextcloud

For professional hosting without your own server, we recommend our Web Hosting or Virtual Servers.

Step 1: Install Virtualmin

First, you need a server (VPS or dedicated). Install a supported operating system such as Ubuntu 22.04 or Debian 12. Then run the Virtualmin installation script:

wget https://software.virtualmin.com/gpl/scripts/virtualmin-install.sh
sudo sh virtualmin-install.sh

After installation, you can access Virtualmin at https://your-domain:10000.

Step 2: Configure Postfix and Dovecot

Postfix is the Mail Transfer Agent (MTA), Dovecot is the IMAP/POP3 server. Virtualmin installs and configures both automatically. However, you should make some GDPR-relevant settings:

Postfix: Enforce TLS

In the Postfix configuration (/etc/postfix/main.cf), ensure that TLS is used:

smtpd_tls_security_level = may
smtpd_tls_cert_file = /etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-cert-snakeoil.key

Better is a Let's Encrypt certificate, which Virtualmin obtains automatically.

Dovecot: Encryption and Authentication

In /etc/dovecot/conf.d/10-ssl.conf set:

ssl = required
ssl_cert =

For authentication, auth_mechanisms = plain login in combination with TLS is recommended.

Step 3: Set Up Roundcube as Webmail

Roundcube is a popular webmail client. Virtualmin provides an installation script:

virtualmin install-script roundcube --domain your-domain.de

Configure Roundcube to establish a secure connection to Dovecot and Postfix. Ensure that the database connection is encrypted.

Ensure GDPR Compliance

The following measures are particularly important for associations:

  • Data Processing Agreement (DPA): If you use a hosting provider, conclude a DPA.
  • Data Minimization: Store only the necessary data.
  • Encryption: Use TLS for all connections and encrypt sensitive data at rest.
  • Access Control: Restrict access to email accounts and servers.
  • Deletion Policy: Define when emails are deleted.

More tips can be found in our Knowledge Base.

Integration with JVerein

JVerein is an open-source association management software. It can send emails via your Postfix server, e.g., for membership dues invoices or invitations. In JVerein, under Settings > Email, configure the SMTP server (Postfix) with port 587 and TLS.

For sending bulk emails, you should create a dedicated SMTP user and limit the rate to avoid blacklisting.

Synchronization with Nextcloud

Nextcloud offers an email app that can integrate IMAP accounts. Synchronize your association emails with Nextcloud by entering the IMAP data (Dovecot) and SMTP data (Postfix) in the settings of the email app. This way, all board members have access to shared mailboxes.

Additionally, you can synchronize Nextcloud calendars and contacts with JVerein to keep appointments and member data up to date.

Security and Maintenance

Regular updates of Virtualmin, Postfix, Dovecot, and Roundcube are essential. Set up automatic backups and monitor the logs for suspicious activities. Use Fail2ban to defend against brute-force attacks.

For professional support or managed hosting, contact us via Contact.

Conclusion

With Virtualmin, Postfix, Dovecot, and Roundcube, you can build a GDPR-compliant email solution for your association. The integration with JVerein and Nextcloud facilitates management and communication. Pay attention to regular updates and security measures to protect your data.