After years of running as a bare-metal Ubuntu install, Hermes Secure Email Gateway has been rebuilt from the ground up as a containerized stack. Today we’re announcing v260612, the first public release of Hermes SEG’s Docker era.
If you’ve run Hermes before, you know it as a custom installer that laid down host-level Postfix, Amavis, Dovecot, Lucee, and OpenLDAP and wired them together with systemd. v260612 replaces all of that with a single coherent, shipping product: a 19-container stack you stand up with one docker compose up -d.
Why Docker
The bare-metal installer served Hermes well for years, but it tied the whole stack to one host’s package versions and made upgrades a careful, manual affair. The Docker rewrite makes Hermes reproducible, portable, and isolated: every service is a pinned image, the whole deployment is described by one Compose file, and updates are a single orchestrated command. Your mail and data still live on your hardware, under your control, that part never changes.
What’s in v260612
A complete, self-hosted stack: free and open source
The entire gateway and mail server run in containers: anti-spam (SpamAssassin, postscreen, RBLs), anti-malware (ClamAV with managed feeds), full encryption (SMTP TLS, S/MIME, PGP, encrypted-PDF, at-rest mail-crypt), and email authentication (SPF, DKIM, DMARC, ARC). It’s AGPLv3, the Community Edition is the complete stack, no feature held back, deployable in front of Microsoft 365 / Google Workspace or as your full mail backend.
Time-of-click Link Guard (Pro)
Modern phishing weaponizes links after delivery, a URL that scanned clean on arrival points to a payload by the time someone clicks. Link Guard closes that gap: inbound links are rewritten through a Hermes redirect and the destination’s reputation is checked at the moment of the click, with layered verdicts (heuristics + URLhaus / OpenPhish + optional Google Safe Browsing / VirusTotal), per-tier admin actions, and transparent restoration of links on reply/forward. It’s the kind of protection you’d normally pay Proofpoint or Mimecast for, self-hosted.
Backup, disaster recovery & re-host
Docker-aware tooling for hot backups, cross-host restore with storage-topology remap and credential reconciliation, and a full host-identity rewire, so moving Hermes to new hardware is a procedure, not an ordeal.
Single sign-on and MFA, everywhere
Authelia provides unified MFA (TOTP, WebAuthn, Duo Push) across the admin console, the user self-service portal, and Nextcloud via OIDC. And because most mail clients still speak plain IMAP/SMTP rather than OIDC, app passwords give users per-device credentials for their desktop and mobile mail and DAV apps, so those clients keep working without weakening the MFA protecting the main account.
Nextcloud, built in
Webmail, file sync, calendars (CalDAV), and contacts (CardDAV) ship with the stack and are pre-provisioned on first login.
Dovecot 2.4 mailbox hosting
A full Email Server admin UI, domains, mailboxes, aliases, mailbox rules, shared folders, Sieve filters, vacation auto-reply, and a mobile-device setup wizard, on top of a Dovecot 2.4 image.
One-command updates
A five-phase update orchestrator pulls code and images, applies per-release artifacts, and runs post-upgrade hooks, resolving the latest release automatically from the GitHub Releases API.
Community vs Pro
Hermes is honestly open-core. The Community Edition (AGPLv3) is the full mail gateway and server, security, encryption, mailbox hosting, Nextcloud, and SSO, all included and free. Pro adds operational and security extras on top: Link Guard, outbound disclaimers, organizational signatures, an intrusion-prevention UI, console firewall management, and LDAP pass-through auth. Nothing is removed from Community to sell Pro. Pro only adds. (How Hermes compares · Pricing.)
An honest note for production users
v260612 is an early-adopter release. It’s feature-complete and validated end-to-end on our DEV and Test environments, but if you run a production gateway, stand it up in parallel and put it through your own acceptance tests, real send/receive, relay flows, quarantine release, DKIM/SPF/DMARC alignment, and your backup/restore plan, before cutting over. It’s also fresh-install only for now; legacy bare-metal → Docker migration tooling exists in skeletal form but isn’t yet end-to-end. Early-adopter feedback directly shapes the next release.
Get started
Images are published at ghcr.io/deeztek/hermes-<service>:<tag>, releases live on GitHub, and step-by-step install instructions are in the project README.