Set Up grommunio Archive 2026: Archive, Search and Restore Email

Overview

The validated baseline is the openSUSE-based grommunio appliance 2026.06.1. The examples consistently use the neutral appliance domain https://mail.example.test; paths such as /web/, /admin/, /auth/, /chat/, /meet/ and /files/ live on the same appliance.This article shows how to set up grommunio Archive on an existing grommunio 2026 appliance and validate the mail flow through search and restore.

The guide walks through components, services, archiving, search UI, results, restore, retention basics, permissions, logs and final validation.

Tested environment

• grommunio 2026 on the openSUSE-based grommunio appliance.

• All appliance commands are run directly on the grommunio appliance.

• Public examples consistently use the neutral appliance domain https://mail.example.test.

1. Starting point & prerequisites

The starting point is a grommunio installation with working DNS, TLS, admin access and a clean baseline validation. Each article covers exactly the building block required for a complete collaboration platform.

2. Step-by-step guide

This article puts grommunio platform into a practical context and explains the decisions that matter for a reliable implementation. By the end, you should know what to prepare, how to recognize a working state and what the next useful step is.

Prerequisites

An existing or planned grommunio environment, matching DNS names, TLS, administrative access and a clear target for mail, collaboration or operations.

This guide shows you how to set up grommunio Archive on a grommunio 2026.06.1 appliance, validate it technically, and prove a complete archiving and restore workflow. It is intentionally practical: install the package, prepare database and storage, connect the mail flow, enable users, search, restore, back up and monitor the service.

This article covers technical email archiving and a robust retention-compliance building block. Legal requirements such as retention periods, export obligations or evidential value must always be agreed with your own organization and legal advisers.

What we are building

Archive is not a decorative add-on next to groupware in this setup. The appliance accepts a message into the mailbox and creates an additional archive copy through the Postfix BCC path. grommunio Archive stores the message, writes metadata to the database, indexes it through Sphinx and provides search and restore through the Archive web UI.

• Package: grommunio-archive
• Version used: 1.4.9 on grommunio 2026.06.1
• Daemons: grommunio-archive, grommunio-archive-smtp and searchd
• Database: groarchive in MariaDB
• Data path: /var/lib/grommunio-archive
• Web path: https://mail.example.test/archive/
• Login: grommunio user with IMAP/POP and Archive privilege
• Restore: from Archive back into the user mailbox.

Architecture and mail flow

The tested flow is simple but important: an incoming or locally generated message is delivered to the mailbox and copied to an internal Archive address. Postfix routes that address locally to the Archive SMTP service on 127.0.0.1:2693. The Archive daemon remains internal; users only see the HTTPS interface under /archive/.

• Mail flow
• Postfix / gromox
• Mailbox
• recipient_bcc_maps
• archive@archive.example.test
• smtp:[127.0.0.1]:2693
• grommunio Archive
• groarchive database
• Sphinx search index
• Archive web UI
• Restore into the mailbox

Check prerequisites

Start from a working grommunio 2026 base system. DNS, TLS, time synchronization, admin access, working user mailboxes and IMAP must already work. If you are following the article series, the installation from part 1 is the base.

cat /etc/os-release
hostname -f
rpm -qa | grep -Ei 'grommunio|gromox|archive' | sort
zypper search -s grommunio-archive
systemctl list-unit-files | grep -Ei 'archive|grommunio'
ss -lntup

Install Archive

The package comes from the grommunio repositories. Before installing, check the offered version, then install the real package only. In our test, grommunio-archive 1.4.9-lp160.3.32 was available.

zypper refresh
zypper search -s grommunio-archive
zypper --non-interactive install grommunio-archive
rpm -q grommunio-archive

Prepare database and storage

grommunio Archive uses its own database. In the tested setup it is named groarchive. Create the user and database with a strong password that is not exposed in shell history, import the provided schema and store the password in a file readable only by root and the Archive group.

install -d -m 0750 -o root -g groarchive /etc/grommunio-archive
openssl rand -base64 36 > /etc/grommunio-archive/db.secret
chown root:groarchive /etc/grommunio-archive/db.secret
chmod 0640 /etc/grommunio-archive/db.secret

mariadb -uroot <<'SQL'
CREATE DATABASE IF NOT EXISTS groarchive CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'groarchive'@'localhost' IDENTIFIED BY '<strong-password>';
GRANT ALL PRIVILEGES ON groarchive.* TO 'groarchive'@'localhost';
FLUSH PRIVILEGES;
SQL

mariadb groarchive < /usr/share/grommunio-archive/db-mysql.sql

Data, temporary files, index data and error queues live below /var/lib/grommunio-archive. For production, plan that path like mail data: dedicated storage, monitoring, backup, capacity planning and clear restore tests.

rpm -ql grommunio-archive | sort
du -sh /var/lib/grommunio-archive
find /var/lib/grommunio-archive -maxdepth 1 -type d -printf '%p\n' | sort

Configure Archive

Do not blindly paste complete sample configurations. Set the values that actually match your environment: hostname, database, storage, Sphinx, internal SMTP port, IMAP backend and public URL. In the lab, the external URL was https://mail.example.test/archive/.

cp -n /etc/grommunio-archive/grommunio-archive.conf.dist /etc/grommunio-archive/grommunio-archive.conf
cp -n /etc/grommunio-archive/config-site.dist.php /etc/grommunio-archive/config-site.php
cp -n /etc/grommunio-archive/sphinx.conf.dist /etc/sphinx/sphinx.conf

# Then set deliberately:
# hostid=mail.example.test
# listen_addr=127.0.0.1
# listen_port=2693
# mysqldb=groarchive
# mysqluser=groarchive
# queuedir=/var/lib/grommunio-archive/store
# workdir=/var/lib/grommunio-archive/tmp
# sphxhost=127.0.0.1
# sphxport=9306

Enable services and ports

After configuration, start Archive, Archive SMTP, Sphinx, PHP-FPM and nginx. The important security check: piler-smtp listens locally on 127.0.0.1:2693. Users should only reach HTTPS from outside.

systemctl enable --now searchd grommunio-archive grommunio-archive-smtp
systemctl restart php-fpm nginx
systemctl is-active searchd grommunio-archive grommunio-archive-smtp php-fpm nginx
ss -lntup | grep -Ei '2693|9306|:443|:80'

Reverse proxy for /archive/

The web interface runs under /archive/ in this setup. nginx passes PHP files to the grommunio Archive PHP-FPM pool. The application rewrite rules for search, login, message and restore routes must also work.

location ^~ /archive/ {
 alias /usr/share/grommunio-archive/archive/;
 index index.php;

 location ~ \.php$ {
 include fastcgi_params;
 fastcgi_param SCRIPT_FILENAME $request_filename;
 fastcgi_param SCRIPT_NAME $fastcgi_script_name;
 fastcgi_pass unix:/run/php-fpm/php-grommunio-archive-fpm.sock;
 }
}

nginx -t
systemctl reload nginx
curl -kI https://mail.example.test/archive/

Grant user privileges

A user needs IMAP/POP and the Archive privilege. grommunio documents this path for Archive login and IMAP-based restore. For a test user it looks like this:

grommunio-admin user modify alice@example.test --pop3-imap true --privArchive true
grommunio-admin user query username pop3_imap privArchive --filter username=alice@example.test

https://mail.example.test/admin/

Validate Archive login

Log in with an enabled user under /archive/. In the lab, the path was tested through https://mail.example.test/archive/. Use the real target URL of your appliance in the guide and screenshots, not local port forwards.

Send a test mail and prove archiving

For the technical proof, send a test message to the user. Postfix copies it through recipient_bcc_maps to the internal Archive address. Then check three layers: delivery to Archive SMTP, row in groarchive and discoverability in the Sphinx index.

/usr/sbin/sendmail -t <<'MAIL'
From: Archive Sender <sender@example.test>
To: alice@example.test
Subject: ForgeOne Archive Search Validation 20260908140826
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8

This message validates search and restore in grommunio Archive.
MAIL

postmap -q alice@example.test mysql:/etc/postfix/grommunio-bcc-forwards.cf
postmap -q archive.example.test lmdb:/etc/postfix/transport
mariadb groarchive -e "SELECT id, CAST(subject AS CHAR(255)) AS subject_text FROM metadata ORDER BY id DESC LIMIT 5;"

The delta indexer runs by cron during normal operation. For immediate lab validation, you can rotate the delta index manually and query Sphinx directly afterwards.

runuser -u groarchive -- indexer --rotate --config /etc/sphinx/sphinx.conf delta1
mariadb -h127.0.0.1 -P9306 -e "SELECT id FROM main1,dailydelta1,delta1 WHERE MATCH('ForgeOne');"

https://mail.example.test/web/

Search and open the message

In Archive, search for a unique marker from the subject. The result must show date, sender, recipient, subject and size. Open the message and verify headers, body and restore action.

Delete from mailbox and restore from Archive

A real restore test is more than seeing the message in Archive. First delete it from the mailbox, verify that it is gone, trigger Restore to mailbox in Archive and check the mailbox again.

On the production browser path, open grommunio Web afterwards, sign in as the same user and search the inbox for the unique subject. For automated acceptance, the IMAP check is more reproducible because it validates the same mailbox without browser-session side effects.

python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826"
python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826" delete
# Then in the Archive web interface: Restore to mailbox
python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826"

Check export, attachments and user isolation

After the basic restore, also test export and permission boundaries. A normal user should be able to find, open, download as EML and restore their own archived messages. They should not see other mailboxes. Attachments must be traceable in the opened message and must not disappear during export.

• Search as Alice for an Alice message.
• Search as Bob for the same Alice message and expect no result.
• Open a message with an attachment and check display and EML download.
• Document roles for helpdesk, auditors or administrators separately from normal users.

Back up and restore the Archive platform

For Archive you do not back up the database only. You need at least the database dump, /var/lib/grommunio-archive, Archive configuration, Sphinx configuration, nginx route and the related key or secret files. Those files belong in the backup, but never in the article, screenshots or tickets.

mariadb-dump --single-transaction groarchive | gzip -c > /root/archive-backup-validation/groarchive.sql.gz
tar -C / -czf /root/archive-backup-validation/grommunio-archive-config-data.tar.gz \
 etc/grommunio-archive \
 etc/sphinx/sphinx.conf \
 etc/grommunio-common/nginx/locations.d/grommunio-archive.conf \
 var/lib/grommunio-archive

gzip -t /root/archive-backup-validation/groarchive.sql.gz
tar -tzf /root/archive-backup-validation/grommunio-archive-config-data.tar.gz | head

Monitoring and logs

Do not monitor HTTP 200 only. For Archive, watch service state, local SMTP port, Sphinx port, database access, index age, incoming archive messages, search function and a synthetic restore test.

systemctl status grommunio-archive grommunio-archive-smtp searchd --no-pager
journalctl -u grommunio-archive -u grommunio-archive-smtp -u searchd --since "1 hour ago" --no-pager
du -sh /var/lib/grommunio-archive
mariadb groarchive -e "SELECT COUNT(*) AS archived_messages FROM metadata;"

Result Validation / Technical Acceptance

End-to-end test in the user workflow

The end-to-end test sends a mail from user A to user B, checks delivery in grommunio Web, waits for archiving, searches the message in Archive and verifies subject, sender, recipient and timestamp.

Result Validation / Technical Acceptance

Typical issues & troubleshooting

If the validated flow does not work, move from symptom to cause: check service state, read relevant logs, verify URL and redirects, then change configuration and repeat the user workflow.

Conclusion & next step

This completes the component in the grommunio 2026 series and places it in the overall appliance path. The next article in the series builds on this validated baseline.