How to Load Balance SSL IMAP, POP3, and SMTP with HAProxy and Dovecot / Postfix

Load balancing encrypted email traffic (IMAPS on port 993, POP3S on port 995, and SMTPS on port 465) using HAProxy requires two critical mechanisms: SSL offloading at the load balancer and the PROXY protocol to preserve the client's real public IP address in Dovecot and Postfix logs.

Architecture: Encrypted Client → HAProxy (SSL Termination & send-proxy) → Dovecot / Postfix (Real IP Preserved)

1. HAProxy Configuration (haproxy.cfg)

frontend imaps_in
    bind *:993 ssl crt /etc/ssl/certs/mail.pem
    mode tcp
    default_backend dovecot_imaps

backend dovecot_imaps
    mode tcp
    server mail1 10.0.0.1:10143 send-proxy check

2. Dovecot PROXY Protocol Support (/etc/dovecot/dovecot.conf)

Configure Dovecot to accept the PROXY protocol header to log the real client IP:

service imap-login {
    inet_listener imap_haproxy {
        port = 10143
        haproxy = yes
    }
}
haproxy_trusted_networks = 10.0.0.0/24

High-Availability Outbound Email: Postfix smtp_fallback_relay with HAProxy SMTP Balancing

For organizations operating mail infrastructure in restrictive networks or corporate subnets with unreliable direct port 25 connectivity, combining HAProxy as an SMTP proxy relay with Postfix's smtp_fallback_relay directive guarantees reliable email delivery without dropped messages.

Flow: Primary MTA → Direct MX Delivery Failure → smtp_fallback_relay → HAProxy Relay VPS → Destination MX

1. HAProxy TCP Relay Configuration (haproxy.cfg)

listen smtp-relay
    bind *:2525
    mode tcp
    option tcplog
    timeout connect 5s
    timeout client 1m
    timeout server 1m
    server mta-out 10.0.0.1:25 check

2. Postfix Fallback Configuration (/etc/postfix/main.cf)

Instruct Postfix to attempt direct MX delivery first, but automatically route through the HAProxy relay if destination mail servers are unreachable:

# Automatic fallback routing to HAProxy relay on port 2525
smtp_fallback_relay = [relay.example.com]:2525

How to Build a Dedicated WireGuard VPN Wi-Fi Gateway and LAN Router

Rather than manually configuring WireGuard client software on every smartphone, laptop, and smart TV in your home, you can configure a dedicated Linux machine (such as a Raspberry Pi, Orange Pi, or spare PC) as a standalone VPN Wi-Fi Gateway. Any device connecting to the designated Wi-Fi access point or Ethernet LAN automatically has all its traffic encrypted and tunneled through your remote WireGuard VPS.

Topology: Wi-Fi Clients → Access Point Router → Linux Gateway (dnsmasq + NAT) → Encrypted WireGuard Tunnel (wg0) → Cloud VPS Gateway

1. Cloud Server Configuration (/etc/wireguard/wg0.conf)

[Interface]
Address = 10.200.200.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = GATEWAY_PUBLIC_KEY
AllowedIPs = 10.200.200.2/32

2. Linux Gateway Router Setup (wg0.conf)

[Interface]
Address = 10.200.200.2/24
PrivateKey = GATEWAY_PRIVATE_KEY
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = VPS_PUBLIC_IP:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

3. Routing and NAT Masquerading

Enable IPv4 packet forwarding and route traffic arriving on your local LAN NIC (e.g. eth1) through the WireGuard interface (wg0):

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
iptables -A FORWARD -i eth1 -o wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

How to Install Aegisub Subtitle Editor on Ubuntu 18.10 and 19.04

Aegisub is the industry-standard open-source tool for creating, styling, and timing Advanced SubStation Alpha (.ass) subtitles. When Ubuntu temporarily removed Aegisub from official distribution archives in versions 18.10 and 19.04, users could maintain full access via the verified Anton multimedia PPA repository.

Compatibility: Ubuntu 18.10 (Cosmic Cuttlefish) • Ubuntu 19.04 (Disco Dingo) • Linux Mint

Installation via PPA

sudo add-apt-repository ppa:anton+/photo-video-apps -y
sudo apt-get update
sudo apt-get install aegisub -y

How to Install and Configure the Xymon Monitoring Client on CentOS 7 and Debian 9

The Xymon infrastructure monitoring system (formerly Hobbit / Big Brother) provides lightweight, low-overhead system health tracking for servers. While Debian repositories package xymon-client directly via APT, Enterprise Linux distributions like CentOS 7 require building from source.

Supported Platforms: CentOS 7 (Source compilation) • Debian 9 (APT package)

1. Compiling on CentOS 7

# 1. Create dedicated system user
groupadd xymon
useradd -g xymon -m xymon

# 2. Install build dependencies
yum install gcc make fping pcre-devel openssl-devel openldap-devel rrdtool-devel libtirpc-devel -y

# 3. Download and compile client
cd /usr/src
wget https://sourceforge.net/projects/xymon/files/Xymon/4.3.30/xymon-4.3.30.tar.gz
tar -zxf xymon-4.3.30.tar.gz
cd xymon-4.3.30
./configure --client

make && make install

# 4. Install system service script
cp rpm/xymon-client.init /etc/init.d/xymon-client
cp rpm/xymon-client.default /etc/default/xymon-client
chmod +x /etc/init.d/xymon-client

# Configure server IP in /etc/default/xymon-client:
# XYMONSERVERS="YOUR.XYMON.SERVER.IP"

service xymon-client start
chkconfig xymon-client on

2. Installation on Debian 9 / Ubuntu

sudo apt-get update
sudo apt-get install xymon-client -y