Linux binaries
Static binaries for x86_64 and aarch64. Each has a SHA-256 checksum published on this page.
No published releases yet
Download Postwind
Pre-release: no published builds yet.
Postwind will be published as ready-made packages: static Linux binaries, a container image, a Helm chart and a Docker Compose file. None is published yet. You will not need to build anything.
Packages
The first release will carry four packages.
Container image
Runs as a non-root user (UID 65532) on gcr.io/distroless/static-debian13:nonroot. Listens on 8080, 8081, 443 and 25.
Helm chart
For Kubernetes 1.25 or newer, over an external ClickHouse. The chart does not deploy ClickHouse.
Docker Compose
Postwind and ClickHouse with Keeper on one Linux host.
Requirements
ClickHouse 26.8 or newer
- CPU
-
x86_64: AES-NI, PCLMULQDQ, AVX, AVX2, BMI1, ADX (Intel since Broadwell, AMD since Zen, roughly 2014 onward)
aarch64: NEON, AES, PMULL, SHA-2 (Graviton, Ampere, Apple M, Raspberry Pi 5)
Ports
| Port | What | Reachable from |
|---|---|---|
8080 |
API, MCP (/mcp), /healthz, /readyz, /metrics |
Your services and agents; keep it internal |
8081 |
Public web over HTTP: unsubscribe, confirmation, tracking | Recipients, through your proxy or Ingress |
443 |
Public web over HTTPS when web.tls.mode is files or acme |
The internet (ACME TLS-ALPN-01 arrives here) |
25 |
Inbound SMTP: bounces (DSN), complaints (ARF), mailto unsubscribe | The internet, at the host of web.public_url |
ClickHouse must be reachable over HTTP (8123), with a user that may create the database and tables. https:// to ClickHouse is not supported yet: keep it on a private network. For more than one node: ClickHouse Keeper and keeper_map_path_prefix. No Redis, ZooKeeper, etcd or message broker.
CPU. Outbound TLS and DKIM signing use the graviola cryptography library, which needs the CPU instructions listed above. Without them postwind serve starts, but the direct transport, DKIM signing and the built-in TLS of the public web are unavailable; the log says so with level = error.
Network for direct delivery. Outbound TCP 25 to recipients’ MX hosts must be open (most clouds block it by default; ask your provider). Every IP in every pool needs a PTR record pointing at its hostname and an A record pointing back. Behind NAT a pool has exactly one address with public_ip. Inbound TCP 25 on the host of web.public_url receives bounces; port 443 must be reachable from the internet when web.tls.mode = "acme". Using a relay instead (delivery.default_transport = "relay:<name>") needs only the relay’s port (587 or 465).
Next steps
Read the documentation of the interface you will use, and go through the deliverability checklist before the first campaign.
HTTP API documentation MCP documentation Deliverability checklist