Let’s Encrypt (ACME) automation

Manually managing TLS certificates is a perennial source of outages. Pro Edition
automates issuance and renewal of free Let’s Encrypt certificates for both the
Hermes administrator console and per-domain mail TLS. Certificates are renewed
on a schedule well before expiry, deployed to the relevant services, and the
affected daemons are reloaded without operator action.

For organizations that prefer commercial certificates or run an internal PKI, the
existing Community Edition third-party SSL certificate support is unchanged.
Pro’s ACME automation is opt-in per domain.

Email disclaimers

Per-domain outbound disclaimer templates — the standard
“this communication is confidential” footers that compliance, legal, or marketing
teams want appended to every outgoing message. Disclaimers are applied at the
milter level on the Postfix pipeline, which means they’re applied to every outbound
message regardless of which mail client or system generated it. No client-side
configuration, no missed messages.

Templates support placeholder substitution — sender name, sender email,
date, organization name — so a single template covers the whole domain.
Different domains can have different disclaimers; you don’t need separate Hermes
installs to serve multiple brands.

Organizational signatures

Centrally-managed, per-domain employee signature templates with placeholder
substitution. Community Edition includes personal email signatures — users
manage their own signature from a template gallery. Pro adds the organizational
tier: an administrator defines a domain-wide template (with fields like name,
title, phone, organization), and the system substitutes per-user values from
the directory at send time.

Combined with email disclaimers and DKIM signing at the milter level, this lets
organizations enforce branding, contact-info accuracy, and legal text on every
outbound message without depending on mail clients to behave.

Intrusion Prevention (IPS)

A web UI for managing the Fail2ban jails that protect a Hermes deployment. Set
ban thresholds, ban durations, and whitelist trusted source networks from the
admin console rather than editing config files on the host. View live and
historical ban lists. Tune jail aggressiveness without an SSH session.

The default Fail2ban configuration that ships with Community Edition continues
to provide baseline protection — SSH, SMTP, IMAP, and admin-console
brute-force protection are active out of the box. Pro adds the operational layer
for organizations that need to tune jails on a schedule or in response to incidents.

Console firewall

A web UI for managing the host firewall protecting the Hermes admin console.
Restrict console access by source IP or network, manage exceptions, and audit the
current rule set from the admin console itself. Common operational requirements
— allowing access only from corporate VPN ranges, or temporarily opening
a maintenance window from a vendor IP — become a UI workflow instead of a
shell session.

LDAP RemoteAuth

Per-domain pass-through authentication to one or more external LDAP servers,
including Active Directory. Users authenticate against your existing corporate
directory; Hermes never stores or sees their primary password, but they still
get access to mailbox hosting, webmail, Nextcloud, and the end-user portal.

Different domains on the same Hermes install can authenticate against different
directories. A multi-tenant MSP deployment can serve a dozen customers, each with
their own Active Directory, from one Hermes install — without provisioning
and syncing user accounts into Hermes’s local OpenLDAP.