Bootstrapping a Gentoo Server from Zero

This post maps the full path from a fresh Gentoo installation to a production server running mail, web applications, and infrastructure services. It ties together every Gentoo-specific post in this series into a single build order with notes on Portage configuration, USE flags, and service dependencies.

Starting Point

You have a Gentoo system with:

• A working stage3 installation
• Network connectivity
• Root access (local or SSH)

If you're starting from bare metal or a VPS provider's base image, the Gentoo Handbook covers the initial installation. This guide picks up after the first boot.

Phase 1: Base System

Server Preparation

Follow Preparing a New Server to establish the foundation:

• Set the hostname and timezone
• Sync the Portage tree
• Update @world
• Remove unnecessary packages
• Install base utilities: bash, nano, git, curl, htop
• Configure .bashrc with a sane prompt and aliases

Cross-Distribution Baseline

Base Server Setup covers configurations common across distributions. On Gentoo, the key steps are:

• Configure /etc/locale.gen and run locale-gen
• Set /etc/env.d/02locale for system-wide locale
• Configure NTP via net-misc/chrony or net-misc/ntp
• Set up syslog (app-admin/sysklogd or app-admin/syslog-ng)
• Configure logrotate for log management

SSH Hardening

Hardening SSH secures remote access:

• Deploy SSH public keys
• Disable password authentication
• Disable root login
• Configure AllowUsers or AllowGroups
• Set up sudo for the admin user

After this phase, the server is secure, up-to-date, and remotely manageable.

Phase 2: Infrastructure Services

These services support everything that follows. Install them in order.

DNS Resolver

Unbound provides a local caching DNS resolver:

emerge -av net-dns/unbound

Configure /etc/unbound/unbound.conf with DNSSEC validation and caching. Point /etc/resolv.conf to 127.0.0.1. A local resolver improves performance for all DNS-dependent services (Postfix, Rspamd RBL queries, Let's Encrypt validation).

MySQL

MySQL is the database backend for virtual mailboxes, PostfixAdmin, Roundcube, Nextcloud, and Matomo:

echo "dev-db/mysql server" > /etc/portage/package.use/mysql
emerge -av dev-db/mysql

Initialize the data directory, set the root password, and configure character encoding to utf8mb4.

Redis

Redis stores Rspamd statistics, Nextcloud file locking, and PHP session data:

echo "dev-db/redis jemalloc" > /etc/portage/package.use/redis
emerge -av dev-db/redis

Configure memory limits, persistence, and bind to localhost only.

Apache

Apache serves PostfixAdmin, Roundcube, Nextcloud, and Matomo:

emerge -av www-servers/apache

Configure APACHE2_OPTS in /etc/conf.d/apache2 to load required modules: rewrite, ssl, proxy, proxy_fcgi. Set up PHP-FPM integration.

nginx (Proxy Server)

If you're running a separate proxy server, install nginx with wildcard TLS:

emerge -av www-servers/nginx

Obtain wildcard certificates via lego with DNS-01 validation. Configure per-service server blocks.

Phase 3: Web Applications

With Apache, MySQL, and Redis running, deploy web applications.

Matomo

Matomo provides self-hosted analytics:

• Create the MySQL database
• Deploy to Apache's document root
• Configure the GeoIP database
• Set up the archive cron job

Nextcloud

Nextcloud provides file synchronization and sharing:

cat > /etc/portage/package.use/nextcloud << 'EOF'
www-apps/nextcloud mysql vhosts
EOF
emerge -av www-apps/nextcloud

Deploy with webapp-config, configure Redis for caching and file locking, and set trusted proxies if behind nginx.

Syncthing

Syncthing provides peer-to-peer file sync:

emerge -av net-p2p/syncthing

Configure the OpenRC init script, generate device keys, and set up the Apache reverse proxy for the web UI.

Binary Package Host

Gentoo binary package hosting accelerates builds across multiple servers:

• Configure Portage for binary package generation (FEATURES="buildpkg")
• Set up nginx to serve packages over HTTP
• Configure rsyncd for Portage tree distribution
• Write build and sync scripts for each server profile
• Point client servers to the binhost in make.conf

Phase 4: Mail Server

The mail server is the most complex deployment, requiring all infrastructure services plus its own stack of seven components.

Prerequisites

Before starting the mail build, ensure:

• MySQL is running with root access
• Redis is running on localhost
• Apache is running with PHP-FPM
• DNS is fully configured (MX, A, PTR records)

Build Sequence

Follow Building a Complete Mail Server for the detailed architecture. The installation order:

1. DNS and TLS certificates — MX records, SAN certificate via lego
2. Postfix — MTA with virtual mailbox MySQL lookups

echo "mail-mta/postfix mysql sasl ssl" > /etc/portage/package.use/postfix
emerge -av mail-mta/postfix

3. Dovecot — IMAP, LMTP, SASL, Sieve

echo "net-mail/dovecot mysql sieve managesieve lmtp" > /etc/portage/package.use/dovecot
emerge -av net-mail/dovecot

4. DKIM, SPF, DMARC — email authentication

emerge -av mail-filter/opendkim

5. Rspamd — spam filtering

emerge -av mail-filter/rspamd

6. ClamAV — antivirus scanning

emerge -av app-antivirus/clamav

7. PostfixAdmin — web management

echo "www-apps/postfixadmin mysql vhosts" > /etc/portage/package.use/postfixadmin
emerge -av www-apps/postfixadmin

8. Roundcube — webmail

echo "mail-client/roundcube mysql change-password fileinfo spell vhosts zip" > /etc/portage/package.use/roundcube
emerge -av mail-client/roundcube

9. Testing and verification — end-to-end smoke tests

Portage Configuration Summary

Across all phases, the following USE flag files are created in /etc/portage/package.use/:

The vhosts flag is common across web applications — it enables webapp-config deployment to virtual host directories instead of a single document root.

Service Start Order

OpenRC services should be added to the default runlevel in dependency order:

# Infrastructure
rc-update add syslog-ng default
rc-update add chronyd default
rc-update add unbound default
rc-update add mysql default
rc-update add redis default
rc-update add apache2 default

# Mail
rc-update add postfix default
rc-update add dovecot default
rc-update add opendkim default
rc-update add rspamd default
rc-update add clamd default
rc-update add freshclam default

OpenRC resolves dependencies automatically, but adding them in order ensures the dependency chain is correct. MySQL must start before Postfix (which queries it), Redis must start before Rspamd (which stores data in it), and Dovecot must start before Postfix activates LMTP and SASL sockets.

Maintenance

System Updates

Update the Portage tree and rebuild packages:

emerge --sync
emerge -avuDN @world

After updates, restart affected services. Use eselect news to check for important upgrade notes.

Binary Package Updates

If running a binary package host, rebuild binaries after Portage tree sync:

/usr/local/bin/binhost-build.sh
/usr/local/bin/binhost-sync.sh

Client servers then pull updated binaries instead of compiling from source.

Certificate Renewal

TLS certificates (both wildcard and mail SAN certificates) are renewed automatically via cron. Verify renewal is working:

openssl x509 -in /etc/lego/example.com/certificates/example.com.crt -noout -dates
openssl x509 -in /etc/lego/example.com/certificates/mail.example.com.crt -noout -dates

Log Monitoring

Key log files to monitor:

/var/log/mail.log           # Postfix, Dovecot, OpenDKIM
/var/log/clamav/clamd.log   # ClamAV scanning
/var/log/clamav/freshclam.log  # Signature updates
/var/log/roundcube/errors.log  # Roundcube application errors
/var/log/apache2/*_error.log   # Apache virtual host errors

Summary

A complete Gentoo server build follows four phases:

1. Base system — updates, SSH hardening, admin user
2. Infrastructure — Unbound, MySQL, Redis, Apache, nginx
3. Web applications — Matomo, Nextcloud, Syncthing, binary package host
4. Mail server — Postfix, Dovecot, DKIM/SPF/DMARC, Rspamd, ClamAV, PostfixAdmin, Roundcube

Each phase builds on the previous one. The result is a self-hosted server running mail, web applications, and file synchronization — all on Gentoo with Portage, OpenRC, and full control over every configuration detail.