This guide shows you how to set up grommunio Archive on a grommunio 2026.06.1 appliance, validate it technically, and prove a complete archiving and restore workflow. It is intentionally practical: install the package, prepare database and storage, connect the mail flow, enable users, search, restore, back up and monitor the service.

This article covers technical email archiving and a robust retention-compliance building block. Legal requirements such as retention periods, export obligations or evidential value must always be agreed with your own organization and legal advisers.

grommunio 2026 step by step

  • Part 1: install grommunio 2026: /en/tech/grommunio-2026-install
  • Part 2: grommunio-antispam with Rspamd: /en/tech/grommunio-antispam-rspamd-2026-step-by-step
  • Part 3: grommunio-auth with Keycloak: /en/tech/grommunio-auth-keycloak-2026-step-by-step
  • Part 4: grommunio Meet: /en/tech/grommunio-meet-2026-step-by-step
  • Part 5: grommunio Chat: /en/tech/grommunio-chat-2026-step-by-step
  • Part 6: grommunio Files and Office: /en/tech/grommunio-files-office-2026-step-by-step
  • Part 7: grommunio Archive: you are here.

What we are building

Archive is not a decorative add-on next to groupware in this setup. The appliance accepts a message into the mailbox and creates an additional archive copy through the Postfix BCC path. grommunio Archive stores the message, writes metadata to the database, indexes it through Sphinx and provides search and restore through the Archive web UI.

  • Package: grommunio-archive
  • Tested version: 1.4.9 on grommunio 2026.06.1
  • Daemons: grommunio-archive, grommunio-archive-smtp and searchd
  • Database: groarchive in MariaDB
  • Data path: /var/lib/grommunio-archive
  • Web path: https://mail.example.test/archive/
  • Login: grommunio user with IMAP/POP and Archive privilege
  • Restore: from Archive back into the user mailbox.

Architecture and mail flow

The tested flow is simple but important: an incoming or locally generated message is delivered to the mailbox and copied to an internal Archive address. Postfix routes that address locally to the Archive SMTP service on 127.0.0.1:2693. The Archive daemon remains internal; users only see the HTTPS interface under /archive/.

markdown
Mail flow
  -> Postfix / gromox
  -> Mailbox
  -> recipient_bcc_maps
  -> archive@archive.example.test
  -> smtp:[127.0.0.1]:2693
  -> grommunio Archive
  -> groarchive database
  -> Sphinx search index
  -> Archive web UI
  -> Restore into the mailbox

Check prerequisites

Start from a working grommunio 2026 base system. DNS, TLS, time synchronization, admin access, working user mailboxes and IMAP must already work. If you are following the article series, the installation from part 1 is the base.

bash
cat /etc/os-release
hostname -f
rpm -qa | grep -Ei 'grommunio|gromox|archive' | sort
zypper search -s grommunio-archive
systemctl list-unit-files | grep -Ei 'archive|grommunio'
ss -lntup

Install Archive

The package comes from the grommunio repositories. Before installing, check the offered version, then install the real package only. In our test, grommunio-archive 1.4.9-lp160.3.32 was available.

bash
zypper refresh
zypper search -s grommunio-archive
zypper --non-interactive install grommunio-archive
rpm -q grommunio-archive
app.example.com

Prepare database and storage

grommunio Archive uses its own database. In the tested setup it is named groarchive. Create the user and database with a strong password that is not exposed in shell history, import the provided schema and store the password in a file readable only by root and the Archive group.

bash
install -d -m 0750 -o root -g groarchive /etc/grommunio-archive
openssl rand -base64 36 > /etc/grommunio-archive/db.secret
chown root:groarchive /etc/grommunio-archive/db.secret
chmod 0640 /etc/grommunio-archive/db.secret


mariadb -uroot <<'SQL'
CREATE DATABASE IF NOT EXISTS groarchive CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'groarchive'@'localhost' IDENTIFIED BY '<strong-password>';
GRANT ALL PRIVILEGES ON groarchive.* TO 'groarchive'@'localhost';
FLUSH PRIVILEGES;
SQL


mariadb groarchive < /usr/share/grommunio-archive/db-mysql.sql

Data, temporary files, index data and error queues live below /var/lib/grommunio-archive. For production, plan that path like mail data: dedicated storage, monitoring, backup, capacity planning and clear restore tests.

bash
rpm -ql grommunio-archive | sort
du -sh /var/lib/grommunio-archive
find /var/lib/grommunio-archive -maxdepth 1 -type d -printf '%p\n' | sort

Configure Archive

Do not blindly paste complete sample configurations. Set the values that actually match your environment: hostname, database, storage, Sphinx, internal SMTP port, IMAP backend and public URL. In the lab, the external URL was https://mail.example.test/archive/.

bash
cp -n /etc/grommunio-archive/grommunio-archive.conf.dist /etc/grommunio-archive/grommunio-archive.conf
cp -n /etc/grommunio-archive/config-site.dist.php /etc/grommunio-archive/config-site.php
cp -n /etc/grommunio-archive/sphinx.conf.dist /etc/sphinx/sphinx.conf


# Then set deliberately:
# hostid=mail.example.test
# listen_addr=127.0.0.1
# listen_port=2693
# mysqldb=groarchive
# mysqluser=groarchive
# queuedir=/var/lib/grommunio-archive/store
# workdir=/var/lib/grommunio-archive/tmp
# sphxhost=127.0.0.1
# sphxport=9306

Enable services and ports

After configuration, start Archive, Archive SMTP, Sphinx, PHP-FPM and nginx. The important security check: piler-smtp listens locally on 127.0.0.1:2693. Users should only reach HTTPS from outside.

bash
systemctl enable --now searchd grommunio-archive grommunio-archive-smtp
systemctl restart php-fpm nginx
systemctl is-active searchd grommunio-archive grommunio-archive-smtp php-fpm nginx
ss -lntup | grep -Ei '2693|9306|:443|:80'
app.example.com

Reverse proxy for /archive/

The web interface runs under /archive/ in this setup. nginx passes PHP files to the grommunio Archive PHP-FPM pool. The application rewrite rules for search, login, message and restore routes must also work.

nginx
location ^~ /archive/ {
    alias /usr/share/grommunio-archive/archive/;
    index index.php;


    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $request_filename;
        fastcgi_param SCRIPT_NAME $fastcgi_script_name;
        fastcgi_pass unix:/run/php-fpm/php-grommunio-archive-fpm.sock;
    }
}
bash
nginx -t
systemctl reload nginx
curl -kI https://127.0.0.1/archive/

Grant user privileges

A user needs IMAP/POP and the Archive privilege. grommunio documents this path for Archive login and IMAP-based restore. For a test user it looks like this:

bash
grommunio-admin user modify alice@example.test --pop3-imap true --privArchive true
grommunio-admin user query username pop3_imap privArchive --filter username=alice@example.test
app.example.com

Validate Archive login

Log in with an enabled user under /archive/. In the lab, the path was tested through https://mail.example.test/archive/. Use the real target URL of your appliance in the guide and screenshots, not local port forwards.

app.example.com

Send a test mail and prove archiving

For the technical proof, send a test message to the user. Postfix copies it through recipient_bcc_maps to the internal Archive address. Then check three layers: delivery to Archive SMTP, row in groarchive and discoverability in the Sphinx index.

bash
/usr/sbin/sendmail -t <<'MAIL'
From: Archive Sender <sender@example.test>
To: alice@example.test
Subject: ForgeOne Archive Search Validation 20260908140826
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8


This message validates search and restore in grommunio Archive.
MAIL


postmap -q alice@example.test mysql:/etc/postfix/grommunio-bcc-forwards.cf
postmap -q archive.example.test lmdb:/etc/postfix/transport
mariadb groarchive -e "SELECT id, CAST(subject AS CHAR(255)) AS subject_text FROM metadata ORDER BY id DESC LIMIT 5;"

The delta indexer runs by cron during normal operation. For immediate lab validation, you can rotate the delta index manually and query Sphinx directly afterwards.

bash
runuser -u groarchive -- indexer --rotate --config /etc/sphinx/sphinx.conf delta1
mariadb -h127.0.0.1 -P9306 -e "SELECT id FROM main1,dailydelta1,delta1 WHERE MATCH('ForgeOne');"
app.example.com

Search and open the message

In Archive, search for a unique marker from the subject. The result must show date, sender, recipient, subject and size. Open the message and verify headers, body and restore action.

app.example.com
app.example.com

Delete from mailbox and restore from Archive

A real restore test is more than seeing the message in Archive. First delete it from the mailbox, verify that it is gone, trigger Restore to mailbox in Archive and check the mailbox again.

On the production browser path, open grommunio Web afterwards, sign in as the same user and search the inbox for the unique subject. For automated acceptance, the IMAP check is more reproducible because it validates the same mailbox without browser-session side effects.

bash
python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826"
python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826" delete
# Then in the Archive web interface: Restore to mailbox
python3 archive_imap_check_20260908.py "ForgeOne Archive Search Validation 20260908140826"
app.example.com
app.example.com

Check export, attachments and user isolation

After the basic restore, also test export and permission boundaries. A normal user should be able to find, open, download as EML and restore their own archived messages. They should not see other mailboxes. Attachments must be traceable in the opened message and must not disappear during export.

  • Search as Alice for an Alice message.
  • Search as Bob for the same Alice message and expect no result.
  • Open a message with an attachment and check display and EML download.
  • Document roles for helpdesk, auditors or administrators separately from normal users.

Back up and restore the Archive platform

For Archive you do not back up the database only. You need at least the database dump, /var/lib/grommunio-archive, Archive configuration, Sphinx configuration, nginx route and the related key or secret files. Those files belong in the backup, but never in the article, screenshots or tickets.

bash
mariadb-dump --single-transaction groarchive | gzip -c > /root/archive-backup-validation/groarchive.sql.gz
tar -C / -czf /root/archive-backup-validation/grommunio-archive-config-data.tar.gz \
  etc/grommunio-archive \
  etc/sphinx/sphinx.conf \
  etc/grommunio-common/nginx/locations.d/grommunio-archive.conf \
  var/lib/grommunio-archive


gzip -t /root/archive-backup-validation/groarchive.sql.gz
tar -tzf /root/archive-backup-validation/grommunio-archive-config-data.tar.gz | head
app.example.com

Monitoring and logs

Do not monitor HTTP 200 only. For Archive, watch service state, local SMTP port, Sphinx port, database access, index age, incoming archive messages, search function and a synthetic restore test.

bash
systemctl status grommunio-archive grommunio-archive-smtp searchd --no-pager
journalctl -u grommunio-archive -u grommunio-archive-smtp -u searchd --since "1 hour ago" --no-pager
du -sh /var/lib/grommunio-archive
mariadb groarchive -e "SELECT COUNT(*) AS archived_messages FROM metadata;"

Troubleshooting

  • Login fails: check IMAP/POP and privArchive for the user.
  • No search result: check mail flow, metadata table and delta indexer.
  • Restore does not arrive: check IMAP backend, user privileges and Archive logs.
  • 404 under /archive/: check nginx location, rewrite rules and PHP-FPM socket.
  • Port 2693 is publicly reachable: correct listen_addr and firewall rules.

Production checklist

  • Define production FQDN, TLS and /archive/ path.
  • Bind Archive SMTP internally only.
  • Agree the retention concept with stakeholders and document the technical mapping.
  • Test the user and role model before rollout.
  • Practice backup and restore with a real recovery.
  • Monitor mail flow, index and restore.
  • Prepare operating documentation and support handover.

Conclusion

With grommunio Archive, you add a technical archiving and restore building block to the groupware platform. The decisive proof is the complete workflow: mail is archived, found, opened, deleted from the mailbox, restored from Archive and visible in the mailbox again. That exact flow was tested in the lab against grommunio 2026.06.1.

Deploy grommunio professionally

Are you evaluating grommunio, planning licenses or looking for support with implementation, migration, operations or support? ForgeOne can help with architecture, licensing, professional services, integration, monitoring and ongoing operations.

Discuss your grommunio project