boohoomoo
I do have hourly backups of the entire VM running Mailcow. So the mails should still be “somewhere”. My other question, therefore, is where can I find the actual mails (the “maildir”?) in my VM in Docker so I know where to look in the backup?
The volume your mails reside in is (on the default config) mail-vmail-vol-1. If you run a default configured docker on Debian (or Ubuntu), the volume should be in /var/lib/docker/volumes/mail-vmail-vol-1/_data.
You can find the actions performed in a mailbox by checking the logs of mail-dovecot-mailcow-1 (inside the mailcow-folder: docker-compose logs dovecot-mailcow). You’ll see lines like that:
Delete a message
mail-dovecot-mailcow-1 | Nov 25 12:09:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<69859><h/ZmG/gKHqasFgH4>: copy from INBOX: box=Trash, uid=2244, msgid=<EG.1183.190739.93803.9236d320@example.com>, size=367553
mail-dovecot-mailcow-1 | Nov 25 12:09:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<69859><h/ZmG/gKHqasFgH4>: delete: box=INBOX, uid=13708, msgid=<EG.1183.190739.93803.9236d320@example.com>, size=367553
# ------------------------------------------------------------------| IMAP USERNAME |---------------------------------------------------------------| MESSAGE ID |---------------------
Move message to a folder
mail-dovecot-mailcow-1 | Nov 25 12:11:57 c4e857f4d6b7 dovecot: imap(henning@example.com)<70016><kUQcI/gKxumsFgH4>: copy from INBOX: box=INBOX/Test-Folder, uid=1, msgid=<EG.1224.190740.93803.d25fb00e@example.com>, size=259925
# ------------------------------------------------------------------| IMAP USERNAME |------------------------------------| SRC |-----| TARGET |--------------| MESSAGE ID |-------------
mail-dovecot-mailcow-1 | Nov 25 12:11:57 c4e857f4d6b7 dovecot: imap(henning@example.com)<70016><kUQcI/gKxumsFgH4>: expunge: box=INBOX, uid=13707, msgid=<EG.1224.190740.93803.d25fb00e@example.com>, size=259925
remove a folder
mail-dovecot-mailcow-1 | Nov 25 12:12:48 c4e857f4d6b7 dovecot: imap(henning@example.com)<70067><5aopJvgK+sysFgH4>: Mailbox renamed: INBOX/Test-Folder -> Trash/Test-Folder
# ------------------------------------------------------------------| IMAP USERNAME |-------------------------------------------| SRC |--| TARGET |
To limit the output, the docker-compose logs command also allows arguments:
--since string Show logs since timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
--until string Show logs before a timestamp (e.g. 2013-01-02T13:23:37Z) or relative (e.g. 42m for 42 minutes)
So you can just review a timeframe the action should have happened:
docker-compose logs --since '2023-11-01T00:00:00Z' --until '2023-11-14T23:59:59Z' dovecot-mailcow
The limitation here is, that the logs are not stored outside docker (as far as I can see), so you loose your logs if you update mailcow and it rebuilds the dovecot container.