Post-Migration Checklist: Legacy → Docker

Post-Migration Checklist: Legacy → Docker

Run these steps after scripts/migrate_legacy_to_docker.sh completes. The migration restores the databases and portable data (encryption key, TLS certs, DKIM signing keys), migrates admin users to LDAP, and — at the end of its run — invokes system_rehost.sh to rewire the host identity and re-render the Docker-managed service configs. This checklist covers what remains.

Scope: validated for migrating from legacy build 240815 (relay topology) to the current Docker release. The migration script rejects any other source build.

What the migration already did for you

• Restored hermes (schema-forwarded to the current baseline), djigzo, opendmarc, Syslog; created authelia and nextcloud.
• Copied portable data: hermes.key (DB-secret encryption key), Let's Encrypt certs, DKIM signing keys.
• Migrated Authelia users into LDAP as one-factor admins.
• Ran system_rehost.sh, which rewired host identity (server_ip, console.host, Postfix myhostname/myorigin, nginx server_name, Authelia cookie domain) and re-rendered postfix, amavis, authelia, nginx, and mailname from the restored database, then restarted those containers.

Settings Postfix reads through MySQL maps — Domains, Relay Recipients, Virtual Recipients, sender/recipient rules — are live directly from the restored database and need no action.

If you skipped host rewiring during the migration, run it now: sudo scripts/system_rehost.sh --force (auto-detects this host's IP/hostname; override with --to-hostname= / --to-ip= if needed).

1. Log in and sanity-check

1. Log into the admin console (see step 4 if all admins show as one-factor).
2. Sidebar → Domains and Relay Recipients — confirm the migrated data.
3. Sidebar → System Status — confirm all containers are healthy.

2. Regenerate mail authentication (DKIM, SPF, DMARC)

system_rehost.sh does not cover these. Each regenerates its own service config from the database; their TrustedHosts lists must carry the Docker subnet. The DKIM signing keys are already migrated (opt/hermes/dkim/keys).

All three live under the Content Checks section of the sidebar.

1. Content Checks → DKIM Settings → Save & Apply Settings — regenerates OpenDKIM KeyTable / SigningTable / TrustedHosts referencing the migrated keys. Confirm each domain's published DNS TXT record still matches.
2. Content Checks → SPF Settings → Save & Apply Settings — regenerates policyd-spf.
3. Content Checks → DMARC Settings → Save & Apply Settings — regenerates OpenDMARC.

3. Verify Relay Networks (mynetworks)

1. Sidebar → Relay Networks — confirm the customer's allowed sending networks carried over and the Docker subnet is present; Save & Apply if you change anything.
2. Sidebar → Relay Host — verify the upstream smarthost and credentials; re-enter the relay password if the field is blank.

4. Reconfigure admin two-factor authentication

Every migrated admin is in the one-factor group; legacy TOTP / WebAuthn devices were not carried over (Authelia moved SQLite → MySQL).

1. Verify each admin can log in with their existing (legacy) password.
2. Sidebar → System Users — move each admin who should use 2FA to the two_factor group; have them re-enroll an authenticator on next login.

Important: review every admin account — all are password-only until you do this.

5. Reactivate the Pro license (Pro editions)

The Pro license is bound to the server's hardware UUID, which changed on the new Docker host, so it shows invalid / pending.

1. Email support with the license serial number to request reactivation.
2. Support deactivates the old activation so it can re-bind to the new host.
3. Reactivate, then log out and back in to re-validate.

Important: until reactivated, the system runs as Community Edition.

6. Verify TLS certificates

The Let's Encrypt certificates were copied to the Docker cert path.

1. Sidebar → System Certificates — confirm the console and mail certificates are present and selected (not the bootstrap_hermes.pem placeholder).
2. Confirm HTTPS (console) and SMTP STARTTLS work.

7. Email archive (deferred)

Message History metadata is restored, but message bodies live in the separate archive backup (hermes-archive-<build>-…tar.gz). Restore it when convenient — it needs no gateway downtime.

• Sidebar → Content Checks → Message History — entries appear; bodies are viewable only after the archive is restored.

8. Final end-to-end test

1. Send a test message inbound and outbound.
2. Verify: delivery, DKIM = pass, spam scoring, and TLS on both legs.