# Guided setup and configuration

Run `bongo-setup` (or `bongo-config wizard`) as root for a new installation.
The curses wizard asks deployment-level questions: server identity and hosted
domains, Web reverse proxy type, optional HAProxy mail frontend, enabled mail
protocols, internal port 26 relay, LDAP, legacy TLS compatibility, and local
mail scanners. Individual protocol limits retain safe defaults.

The admin password and generated configuration bundle are passed to
`bongo-config` through inherited anonymous file descriptors. They do not
appear in process arguments and no named password file is created.

The wizard probes clamd and spamd without modifying either service. A scanner
is enabled only after the expected `PONG` response. Loopback-only example
fragments are installed below `share/bongo/examples/antispam`; reverse proxy
examples are installed below `share/bongo/examples/reverse-proxy`.

For an installed server, use `bongo-admin config` to edit every Store, Web, and
LDAP configuration document. `bongo-admin config check` performs the same
cross-document plausibility checks without opening curses. Save validates all
documents together, serializes concurrent admin changes with a lock, uses
atomic replacement for local files, and rolls back prior writes if a later
write fails.

Store document names such as `smtp`, `imap`, `antispam`, and `antivirus` have
no `.json` suffix, although their contents are JSON. The source and installed
template names follow the same convention.