Debian 12 ("Bookworm") is the lighter-weight cousin to Ubuntu 24.04 — same Linux family tree, fewer pre-installed surprises, longer security support cycle (Debian 12 LTS runs to 2028, with Freexian extended security to 2033). For AcelleMail specifically, the only meaningful differences from the Ubuntu 24.04 install guide are: (a) Debian doesn't ship the Ondrej PHP PPA — you use the equivalent Sury repo, (b) mysql-server is no longer in Debian's main repos as of Bookworm, so MariaDB 11 is the practical default, and (c) ufw isn't installed by default — you'll either install it or fall back to iptables.
This guide covers each delta explicitly; for steps that are identical to Ubuntu, the cross-reference link saves you re-reading the same content.
Step 0 — Pre-flight#
Same as the Ubuntu pre-flight: a 2 vCPU / 4 GB Debian 12 droplet with a public IPv4, a domain mail.example.com with an A record pointed at the droplet, and a sudo user. The acellemail-latest.zip from CodeCanyon and your purchase code, ready to paste during the web installer.
If you're on Hetzner, the pre-built Debian 12 image is the cleanest start. DigitalOcean, Linode, and Vultr all offer Debian 12 in their image dropdowns.
Step 1 — Base packages#
sudo apt update && sudo apt upgrade -y
sudo apt install -y curl wget unzip ca-certificates apt-transport-https \
lsb-release gnupg2 software-properties-common
The apt-transport-https package is a Debian carryover that's no longer needed in Ubuntu 24.04 but is still useful here for repos served over HTTPS.
Step 2 — PHP 8.3 via Sury#
Debian's main repo only carries PHP 8.2 in Bookworm. AcelleMail needs 8.2 or newer — 8.2 will work, but the Sury repo gives 8.3 and faster security updates:
curl -fsSL https://packages.sury.org/php/apt.gpg | \
sudo gpg --dearmor -o /usr/share/keyrings/sury-php.gpg
echo "deb [signed-by=/usr/share/keyrings/sury-php.gpg] https://packages.sury.org/php/ \
$(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/sury-php.list
sudo apt update
sudo apt install -y php8.3 php8.3-fpm php8.3-mysql php8.3-mbstring \
php8.3-xml php8.3-curl php8.3-zip php8.3-gd php8.3-intl \
php8.3-imap php8.3-gmp php8.3-sqlite3 php8.3-mailparse php8.3-bcmath \
php8.3-redis php8.3-soap
Apply the AcelleMail-specific php.ini tweaks (same numbers as the Ubuntu guide — these are about workload, not OS):
sudo sed -i 's/^memory_limit = .*/memory_limit = 512M/' /etc/php/8.3/fpm/php.ini
sudo sed -i 's/^upload_max_filesize = .*/upload_max_filesize = 300M/' /etc/php/8.3/fpm/php.ini
sudo sed -i 's/^post_max_size = .*/post_max_size = 300M/' /etc/php/8.3/fpm/php.ini
sudo sed -i 's/^max_execution_time = .*/max_execution_time = 300/' /etc/php/8.3/fpm/php.ini
sudo sed -i 's/^memory_limit = .*/memory_limit = 512M/' /etc/php/8.3/cli/php.ini
sudo systemctl enable --now php8.3-fpm
Step 3 — MariaDB 11 (Debian's MySQL replacement)#
MySQL Server 8.0 is no longer in Debian's main repos as of Bookworm — Debian preferred MariaDB. MariaDB 11 is wire-compatible with MySQL 8 for AcelleMail's purposes:
sudo apt install -y mariadb-server mariadb-client
sudo mysql_secure_installation
Answer the prompts the same way as Ubuntu (no validation policy, remove anonymous users, no remote root, drop test DB). Then create the database + DB user:
sudo mysql <<SQL
CREATE DATABASE acellemail
CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'acellemail'@'localhost' IDENTIFIED BY '$(openssl rand -base64 24)';
GRANT ALL PRIVILEGES ON acellemail.* TO 'acellemail'@'localhost';
FLUSH PRIVILEGES;
SQL
If you need MySQL specifically (organizational mandate, etc.), Oracle's MySQL APT repo for Debian works, but the package layout differs from Ubuntu's — see Oracle's docs.
Step 4 — Redis 7#
Bookworm ships Redis 7.0 in the main repo, no PPA needed:
sudo apt install -y redis-server
sudo sed -i 's/^supervised .*/supervised systemd/' /etc/redis/redis.conf
sudo systemctl restart redis-server && sudo systemctl enable redis-server
Step 5 — Nginx vhost#
sudo apt install -y nginx
sudo systemctl enable --now nginx
Debian doesn't ship ufw by default. Either install it (sudo apt install -y ufw && sudo ufw allow OpenSSH && sudo ufw allow 'Nginx Full' && sudo ufw enable) or use plain iptables; check with your hosting provider whether they already block ports at the network edge.
The vhost is identical to the Ubuntu version — drop this at /etc/nginx/sites-available/acellemail:
server {
listen 80;
server_name mail.example.com;
root /var/www/acellemail/public;
index index.php index.html;
client_max_body_size 300M;
location / { try_files $uri $uri/ /index.php?$query_string; }
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php8.3-fpm.sock;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_read_timeout 300;
}
location ~ /\.(?!well-known).* { deny all; }
}
sudo ln -sf /etc/nginx/sites-available/acellemail /etc/nginx/sites-enabled/
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx
Steps 6-10 — same as Ubuntu#
The remaining steps — drop in the bundle, TLS via certbot, supervisor for the queue, cron, web installer — are byte-for-byte identical to the Ubuntu 24.04 guide. The www-data user, paths, and command names are all the same on Debian and Ubuntu (Ubuntu inherits from Debian here).
Debian-specific gotchas#
apt vs apt-get#
Both work. The apt command is friendlier (progress bars, sane defaults), but apt-get is the stable scriptable interface. Mixing them in scripts is harmless; use apt-get if you're writing a provisioner.
No add-apt-repository by default#
The software-properties-common install in Step 1 brings it. If you forgot, the Sury install in Step 2 gives a clear error pointing to the missing package.
nginx package version#
Bookworm ships nginx 1.22, slightly older than Ubuntu 24.04's 1.24. AcelleMail doesn't use any 1.24-only features, so this is fine. If you want 1.24, the official nginx repo (http://nginx.org/packages/debian/) carries it.
imap-utils is named differently#
Some old AcelleMail install guides reference php8.3-imap-utils — the real package name in both Debian + Ubuntu is php8.3-imap. The -utils variant has never existed.
Verification#
The same five-check sweep from the Ubuntu guide:
php -v | head -1 # PHP 8.3.x
sudo supervisorctl status acellemail-worker:* # both workers RUNNING
sudo -u www-data crontab -l | grep schedule:run # the schedule line
cd /var/www/acellemail && sudo -u www-data php artisan migrate:status | head -5
sudo -u www-data touch /var/www/acellemail/storage/test && rm /var/www/acellemail/storage/test
Related reading#
FAQ#
Will Debian 11 (Bullseye) work?#
Yes, but Bullseye's PHP is 7.4 — too old for AcelleMail 4.2+. You'd need Sury for PHP 8.2/8.3. Bullseye reaches end of LTS in mid-2026 anyway, so plan to migrate to Bookworm soon. New installs should start on 12.
Can I use MySQL 8 instead of MariaDB?#
Yes, via Oracle's MySQL APT repo. The connection details are identical. Verify utf8mb4 is the default charset before importing — some MySQL 8 installs default to utf8mb3.
Why no apparmor profile in this guide?#
AppArmor is a Debian/Ubuntu native security layer; AcelleMail doesn't ship a custom profile, and the default nginx + php-fpm profiles are permissive enough. If you have organizational policy requiring confinement, write a profile against the standard nginx/php-fpm policies and test against the /admin URL.
Do I need to disable Postfix?#
Bookworm doesn't install Postfix by default, but DigitalOcean's "Marketplace" Debian image does. AcelleMail talks SMTP outbound via configured sending servers (SES, Mailgun, etc.) — it doesn't need a local MTA. If Postfix is running on port 25, disable it: sudo systemctl disable --now postfix.
What about LXC/LXD vs full VM?#
Both work. AcelleMail has no kernel dependencies, so an unprivileged LXC container on a Debian/Proxmox host gets you ~95 % of the resource efficiency of bare-metal with snapshot-based rollback. The only caveat: certbot's --nginx plugin needs the LXC container to be reachable on port 80 from the public internet, which means port-forwarding from the host. Otherwise, use the DNS challenge (certbot --dns-cloudflare or whichever provider plugin matches your DNS host).
Cockpit for browser-based admin#
Debian's cockpit package gives you a browser-based system console at https://server:9090 — useful for the operators on your team who don't live in SSH. Install with sudo apt install cockpit cockpit-pcp and add a firewall rule for port 9090 (or restrict it to a VPN-only interface). It's not a substitute for the AcelleMail admin UI; it's a sysadmin overlay.
Backports — when you actually need them#
The Debian Backports repo carries newer versions of base packages (kernel, nginx, etc.) backported from the next Debian release. For AcelleMail you almost never need it — Bookworm's defaults are recent enough. The one exception is if a critical CVE patch lands in nginx and Backports has it before Stable: sudo apt install -y -t bookworm-backports nginx.
Why not the official Sury PHP packages on Debian's main repo?#
Debian's main repo carries php8.2 for Bookworm and the security team backports CVE fixes — that's a perfectly safe choice. The reason this guide picks Sury instead is consistency: a fleet of mixed Ubuntu + Debian hosts running the same php8.3 packages from the same upstream is operationally simpler than tracking two different package vendors. If you only ever run Debian, the main-repo php8.2 is fine and saves one repo configuration.
