Ubuntu or Debian x64
Use systemd, root or sudo, at least 3 GiB RAM and 20 GiB free root-disk space.
Verified release channel
Install the latest signed release
The public bootstrap verifies signed metadata, requests a short-lived device-bound download grant, then retrieves the commercial package. A valid license key is required before package bytes are released.
Latest release
Loading release metadata
Install command
Run on a clean x64 Linux server
curl -fsSL https://download.mfimail.eu/install.sh | sudo bash
LoadingBefore you run the command
Complete the Linux preflight
The installer is interactive and expects a clean, reachable server. It stops before infrastructure changes when the host, license or DNS preflight fails.
Point the panel domain first
The A record must resolve to this server. Correct or remove an unreachable AAAA record.
Open the required paths
Allow outbound HTTPS and inbound SSH, TCP 80 and TCP 443. Port 8090 stays private.
Keep the license key, administrator email, 8-64 character no-whitespace password, panel hostname and TLS email ready. The installer prints a summary and requires the exact word INSTALL.
Automatic mode
No separate database setup required
The standard installer provisions PostgreSQL, Redis, gateway services, browser sign-in workers, Nginx, Let's Encrypt and firewall rules. When it finishes, open the printed HTTPS panel and add provider accounts.
Windows + WSL2 preview
Install a Windows-local preview
This path supports Ubuntu 22.04 or 24.04 under WSL2 with systemd and opens a local panel on Windows. It does not configure a public domain or TLS and remains preview until clean-host WSL2 acceptance is complete.
$p="$env:TEMP\mfi-install-wsl.ps1"; irm https://download.mfimail.eu/install-wsl.ps1 -OutFile $p; & $p
Release trust chain
Three checks before execution
Verify release metadata
The client accepts metadata only when the vendor signature is valid.
Reject incomplete downloads
The downloaded archive must match the exact signed byte count.
Reject altered packages
The local archive checksum must match the value inside the signed release record.