# IceWarp

IceWarp is a business collaboration platform for email, WebClient, TeamChat, video conferencing, file sharing, and document collaboration. The ZCP image runs IceWarp Server with its supporting database and cache services on Ubuntu 24.04.

## Software included

| Component | Version |
| --- | --- |
| IceWarp Server | 14.3.0.9 |
| Laforge | 2.2.3 |
| IceWarp container | 14.3.0.9 |
| MariaDB | 10.6 |
| Redis | 7 Alpine |
| Docker | Latest stable |
| Docker Compose plugin | Latest stable |
| Ubuntu | 24.04 LTS |

The image uses the pinned container image `icewarptechnology/icewarp-server:14.3.0.9`.

## Requirements

| Resource | Minimum | Recommended |
| --- | --- | --- |
| vCPU | 2 | 4 |
| RAM | 4 GB | 8 GB |
| Storage | 80 GB | 200 GB+ |

IceWarp is stateful. Mailboxes, calendars, uploaded files, MariaDB data, Redis data, logs, cache, configuration, and collaboration state can grow over time.

## Environment variables

If deployment variable fields are available in your launch flow, use them there. Otherwise, provide the same values through user data that writes `/etc/zmi/deploy.env`, or configure them after first boot. Leave password fields blank to have secure random values generated where supported.

| Variable | Description |
| --- | --- |
| `ICEWARP_PUBLIC_HOSTNAME` | Public hostname for WebClient/Admin, such as `mail.example.com` |
| `ICEWARP_DOMAIN` | Primary mail domain, such as `example.com` |
| `ICEWARP_ADMIN_USER` | Initial IceWarp admin username. Defaults to `admin` |
| `ICEWARP_ADMIN_PASS` | Initial IceWarp admin password |
| `ICEWARP_ADMIN_PASSWORD` | Compatibility alias for `ICEWARP_ADMIN_PASS` |
| `ICEWARP_LICENSE` | IceWarp license key, or blank if using the trial flow |
| `ICEWARP_GENERATE_LETSENCRYPT` | `0` or `1`; enable only after DNS points to the VM |
| `ICEWARP_USE_HTTPS` | `0` or `1`; enables HTTPS after DNS and TLS are configured |
| `MARIADB_ROOT_PASSWORD` | Internal MariaDB root password |

## Getting started

### 1. Connect to your VM

```bash
ssh ubuntu@<your-vm-ip>
```

### 2. Wait for first-boot configuration

On first boot, IceWarp reads `/etc/zmi/deploy.env`, starts the Docker Compose stack, configures the domain and admin account, and writes credentials to a root-only file. Track progress:

```bash
sudo journalctl -u icewarp-first-boot.service -f
```

### 3. Retrieve credentials

```bash
sudo cat /etc/icewarp/credentials.txt
```

### 4. Open IceWarp securely

For first login, use an SSH tunnel from your workstation:

```bash
ssh -L 8080:127.0.0.1:80 ubuntu@<your-vm-ip>
```

Then open the WebClient or admin interface at:

```text
http://127.0.0.1:8080/
http://127.0.0.1:8080/admin/
```

Do not submit administrator credentials to a public HTTP URL. For direct public access, first point `ICEWARP_PUBLIC_HOSTNAME` DNS to the VM, configure a valid TLS certificate, set `ICEWARP_USE_HTTPS=1`, then use `https://<your-public-hostname>/` or `https://<your-public-hostname>/admin/`.

## Managing IceWarp

IceWarp runs as a Docker Compose stack in `/opt/icewarp`.

```bash
# Check status
cd /opt/icewarp && sudo docker compose ps


# Restart
cd /opt/icewarp && sudo docker compose restart


# View logs
cd /opt/icewarp && sudo docker compose logs -f
```

Important paths:

| Path | Purpose |
| --- | --- |
| `/opt/icewarp/docker-compose.yml` | Compose stack |
| `/opt/icewarp/.env` | Root-only runtime secrets |
| `/etc/icewarp/credentials.txt` | Root-only generated credentials |
| `/etc/icewarp/info.txt` | Setup and operation notes |
| `/data/icewarp` | Preferred persistent app data |
| `/var/lib/icewarp` | Fallback persistent app data |

## Ports

The VM firewall allows common IceWarp service ports. Expose only the ports you need at the ZCP network or port-forward layer.

| Port | Protocol | Purpose |
| --- | --- | --- |
| 22 | TCP | SSH |
| 80 | TCP | HTTP WebClient/Admin |
| 443 | TCP | HTTPS WebClient/Admin |
| 25 | TCP | SMTP |
| 465 | TCP | SMTPS |
| 587 | TCP | SMTP submission |
| 110 | TCP | POP3 |
| 995 | TCP | POP3S |
| 143 | TCP | IMAP |
| 993 | TCP | IMAPS |
| 1080 | TCP | SOCKS/control service |
| 5222, 5223 | TCP | XMPP client access |
| 5229 | TCP | Collaboration service |
| 5269 | TCP | XMPP server federation |
| 5060 | TCP/UDP | SIP |
| 5061 | UDP | SIP TLS |
| 10000-10010 | UDP | Media/RTP range |

## DNS and licensing

Production mail and collaboration require DNS planning:

- `A` or `AAAA` record for the public hostname
- `MX` record for the mail domain
- SPF, DKIM, and DMARC records
- PTR/rDNS for the sending IP
- TLS certificate after DNS points to the VM

Port 25 may be restricted by the cloud provider or upstream network policy. If outbound mail is blocked, use an approved relay or request the required policy exception through your provider.

IceWarp requires a valid license or successful trial activation. If trial activation is unavailable, provide a valid `ICEWARP_LICENSE` during deployment and retry on a fresh VM.

## Security

Change generated credentials after first login and do not reuse them across VMs. For production, serve IceWarp through a DNS name with TLS and expose only the mail and web ports you need.

## Next steps

- [IceWarp product site](https://www.icewarp.com/)
- [IceWarp server installation on Linux](https://academy.icewarp.com/academy/en/admin/icewarp-server-installation-on-linux)
- [IceWarp license administration](https://docs.icewarp.com/Content/IceWarp-Server/Administration-Console/Licenses.htm)