Upgrade Debian 12 to 13

Hi Debian admins,

Debian 13 Trixie is out since 2025-08-09 and NS8 migration from Debian 12 to 13 should be possible now.
Please test the upgrade procedure on your Debian systems. Core 3.17 is required.

We would like to introduce a testing period until June for this upgrade procedure. In this period both, Debian 12 and 13 will be supported.

After the Testing phase, only Debian 13 will be supported. Support for 12 will be removed from the installer.

Migration steps from Debian 12 to 13

Don’t update during production time as services are restarted.

Upgrade NS8

Upgrade to NS8 core 3.17+ via Software Center.

Update the Debian OS

The sources need to be adapted for Debian 13 Trixie:

sed -i 's/bookworm/trixie/g' /etc/apt/sources.list /etc/apt/sources.list.d/*

Please check the sources in /etc/apt/sources.list and /etc/apt/sources.list.d/*. They should point to “trixie” instead of “bookworm”.

Start the OS upgrade:

apt update && apt full-upgrade -y

Following question can be answered with yes:

“Restart services during package upgrades without asking?”

Another question may come up:

“What do you want to do about modified configuration file sshd_config?”

In this case we “keep the local version currently installed”

Some cases were reported where exim4 was (re)installed due to the upgrade, creating a conflict with the Mail app. In that case exim4 must be disabled and removed:

systemctl disable exim4 --now
apt remove exim4 exim4-daemon-light

Update Python

To update Python from 3.11 to 3.13 you need to run the following: (the brackets are required)

(
    set -e -x
    core_dir=/usr/local/agent/pyenv
    mv -v ${core_dir} ${core_dir}.bak
    python3.13 -mvenv ${core_dir} --upgrade-deps --system-site-packages
    ${core_dir}/bin/pip3 install -r /etc/nethserver/pyreq3_13.txt
    echo "/usr/local/agent/pypkg" >$(${core_dir}/bin/python3 -c "import sys; print(sys.path[-1] + '/pypkg.pth')")
    rm -rf ${core_dir}.bak
)

Check python version, it should be 3.13.5 after the update:

runagent python3 --version # output should be 3.13.5

Modernize Debian source files

This is an optional step.

Debian introduced a new APT sources file format, see I Challenge Thee

To upgrade to the new file format:

apt modernize-sources

Reboot the server.

Now NS8 should run on Debian 13.

8 Likes

Thanks for this guide!

With upgrading from bookworm to trixie on my server following your guide today, exim4 was installed and activated. So Port 25 was already in use after system reboot and therefore the ns8 mail instance didn’t work anymore. Had to remove exim. Now everything works fine.

2 Likes

Hello MrMarkuz

I’ve tried the update from debian 12 to 13, but it looks like the Postfix is failing after the update

2026-05-03T10:19:19+02:00 [1:mail1:systemd] Starting postfix.service - Postfix MTA/MSA server... 2026-05-03T10:19:19+02:00 [1:mail1:postfix] time="2026-05-03T10:19:19+02:00" level=error msg="User-selected graph driver \"overlay\" overwritten by graph driver \"vfs\" from database - delete libpod local files (\"/home/mail1/.local/share/containers/storage\") to resolve. May prevent use of images created by other tools" 2026-05-03T10:19:19+02:00 [1:mail1:podman] 2026-05-03 10:19:19.905074743 +0200 CEST m=+0.104539899 container create c04739d5f3aea70214562ba76a3d2714bdeda1313b5e3d1ab2f5370b22d7ffdc (image=ghcr.io/nethserver/mail-postfix:1.7.11, name=postfix, PODMAN_SYSTEMD_UNIT=postfix.service, io.buildah.version=1.33.7) 2026-05-03T10:19:19+02:00 [1:mail1:podman] 2026-05-03 10:19:19.817456371 +0200 CEST m=+0.016921526 image pull fb540223b5e1cefd0dcc10f90384902391c8d1767ba5637dec6d033249ba5eab ghcr.io/nethserver/mail-postfix:1.7.11 2026-05-03T10:19:19+02:00 [1:mail1:podman] 2026-05-03 10:19:19.932359884 +0200 CEST m=+0.131825040 container start c04739d5f3aea70214562ba76a3d2714bdeda1313b5e3d1ab2f5370b22d7ffdc (image=ghcr.io/nethserver/mail-postfix:1.7.11, name=postfix, PODMAN_SYSTEMD_UNIT=postfix.service, io.buildah.version=1.33.7) 2026-05-03T10:19:21+02:00 [1:mail1:postfix/postfix-script] the Postfix mail system is not running 2026-05-03T10:19:21+02:00 [1:mail1:postfix/postfix-script] starting the Postfix mail system 2026-05-03T10:19:21+02:00 [1:mail1:postfix] postfix/postlog: starting the Postfix mail system 2026-05-03T10:19:21+02:00 [1:mail1:postfix/master] fatal: bind 0.0.0.0 port 25: Address in use 2026-05-03T10:19:22+02:00 [1:mail1:podman] 2026-05-03 10:19:22.675532591 +0200 CEST m=+0.018375308 container died c04739d5f3aea70214562ba76a3d2714bdeda1313b5e3d1ab2f5370b22d7ffdc (image=ghcr.io/nethserver/mail-postfix:1.7.11, name=postfix, PODMAN_SYSTEMD_UNIT=postfix.service, io.buildah.version=1.33.7) 2026-05-03T10:19:22+02:00 [1:mail1:systemd] postfix.service: Main process exited, code=exited, status=1/FAILURE 2026-05-03T10:19:22+02:00 [1:mail1:postfix] c04739d5f3aea70214562ba76a3d2714bdeda1313b5e3d1ab2f5370b22d7ffdc 2026-05-03T10:19:22+02:00 [1:mail1:systemd] postfix.service: Failed with result 'exit-code'. 2026-05-03T10:19:22+02:00 [1:mail1:systemd] postfix.service: Scheduled restart job, restart counter is at 5. 2026-05-03T10:19:22+02:00 [1:mail1:systemd] Starting get-certificate.service - Get TLS certificate from Traefik... 2026-05-03T10:19:24+02:00 [1:mail1:postfix] systemctl --user --quiet is-enabled clamav.service 2026-05-03T10:19:24+02:00 [1:mail1:podman] 2026-05-03 10:19:24.175401834 +0200 CEST m=+0.075045796 container create fcc1fdc38dcf466b9074f60a69ebf96f71b870df02a7a04fa9340c26158ac744 (image=ghcr.io/nethserver/mail-postfix:1.7.11, name=postfix, io.buildah.version=1.33.7, PODMAN_SYSTEMD_UNIT=postfix.service) 2026-05-03T10:19:24+02:00 [1:mail1:systemd] Started libpod-fcc1fdc38dcf466b9074f60a69ebf96f71b870df02a7a04fa9340c26158ac744.scope - libcrun container. 2026-05-03T10:19:24+02:00 [1:mail1:podman] 2026-05-03 10:19:24.11566473 +0200 CEST m=+0.015308699 image pull fb540223b5e1cefd0dcc10f90384902391c8d1767ba5637dec6d033249ba5eab ghcr.io/nethserver/mail-postfix:1.7.11 2026-05-03T10:19:24+02:00 [1:mail1:podman] 2026-05-03 10:19:24.215948558 +0200 CEST m=+0.115592530 container init fcc1fdc38dcf466b9074f60a69ebf96f71b870df02a7a04fa9340c26158ac744 (image=ghcr.io/nethserver/mail-postfix:1.7.11, name=postfix, PODMAN_SYSTEMD_UNIT=postfix.service, io.buildah.version=1.33.7) 2026-05-03T10:19:24+02:00 [1:mail1:postfix] fcc1fdc38dcf466b9074f60a69ebf96f71b870df02a7a04fa9340c26158ac744 2026-05-03T10:19:26+02:00 [1:mail1:postfix/postfix-script] the Postfix mail system is not running 2026-05-03T10:19:26+02:00 [1:mail1:postfix/postfix-script] starting the Postfix mail system 2026-05-03T10:19:26+02:00 [1:mail1:postfix] postfix/postlog: starting the Postfix mail system 2026-05-03T10:19:26+02:00 [1:mail1:postfix/master] fatal: bind 0.0.0.0 port 25: Address in use

Exim is running in Debian 13 which is indeed blocking postfix

ss -tlnp | grep :25
LISTEN 0 20 127.0.0.1:25 0.0.0.0:* users:((“exim4”,pid=1494,fd=5))
LISTEN 0 20 [::1]:25 [::]:* users:((“exim4”,pid=1494,fd=6))

Disable Exim

systemctl stop exim4
systemctl disable exim4
runagent -m mail1 bash -c "systemctl --user start postfix"

1 Like

Thanks guys, I updated the howto.

2 Likes

Hi Markus, excuse me if I sound a bit sharp, but I’d like to update the release notes accordingly.

I don’t understand: are these alternatives? If the package is removed, why would the service need to be disabled as well? Doesn’t apt remove already stop, disable, and remove exim4?

Is the absence of exim on the target server a system requirement?

Yes, it can be either removed or disabled, I updated the post.

It conflicts with the mail app.

2 Likes

I had the hunch… two mailservers on the same system need… Diplomacy and competence to make them cohexist.
However this does not answer my question

you cannot use the ports 25,587,465 both with exim and the mail module, hence exim must be removed IMO
Exim is here to send email for notifications, the mail module can do that also for you

2 Likes

Yes, it’s a system requirement, from the docs:

Install NS8 on a clean Linux server distribution, avoiding installation on desktop systems or servers already running other services.

2 Likes

Thank you for the help full gzide.

I thought I’d done the upgrade ages ago. That’s how you can get it wrong and lose track of things.

1 Like

My first attempt failed.
Before the upgrade, I had to rename the primary network interface from enp6s18 to ens18. Reason: During a previous, failed upgrade to Debian 13, udev changed the naming scheme (PCI path → PCI slot), which resulted in the interface becoming unreachable.

Problem

Debian 12 names the interface after the PCI path (enp6s18), Debian 13 after the PCI slot (ens18). After an upgrade, /etc/network/interfaces refers to the old name — the interface does not receive an IP address.

Solution

systemd .linkfile with MAC-based match — overrides any udev naming and works regardless of version:

# /etc/systemd/network/10-ens18.link

[Match]

MACAddress=<your MAC-Adress>

[Link]

Name=ens18
2 Likes

After sed runs, bookworm occurrences are still there:

root@dn2:~# grep bookworm /etc/apt/sources.list.d/debian.sources 
Suites: trixie bookworm-updates bookworm-backports

I think a “g” flag is needed:

sed -i 's/bookworm/trixie/g' /etc/apt/sources.list /etc/apt/sources.list.d/*
1 Like

I’m a little late to the party but did the update yesterday.

I followed the “howto” and checked if exim4 was installed. It wasn’t. Just to be safe, I did apt remove exim4 which said

Package ‘exim4’ is not installed, so not removed
Summary:
Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 0

I have rebooted the server a few times but noticed that I’ve not received any mail since I did the update to Mail 1.7.12. Further testing showed that I couldn’t connect to postfix. I have rebooted after the Debian update and before updating Mail. But I found that no email had arrived since the update.
I came back to this howto and rechecked the exim4. I would appear that despite the updates and not showing exim4 being installed, it was running via systemctl. I can’t figure one how the systemctl survived the reboot. But in any case, @MadPatrick ‘s command below finally fixed the problem and now postfix is running and email is moving.

systemctl stop exim4
systemctl disable exim4
runagent -m mail1 bash -c "systemctl --user start postfix"

I have to research how systemctl could survive the reboot. Perhaps I should have shutdown completely and started again to ensure that the systemctl processes were truly ended. Very strange.

1 Like

Can you please execute dpkg --get-selections | grep exim and post the output? I think you somehow still have exim installed, e.g. through a package like exim4-daemon-light.

Thanks for the suggestion @jaywalker . Here is the output from the command

# dpkg --get-selections | grep exim
exim4-base					install
exim4-config					install
exim4-daemon-light				install

I didn’t know this command but it looks to me like exim4 isn’t installed. Hmm. I’m still scratching my head why the systemd exim could survive the reboot. I’ll keep on researching.

1 Like

exim is installed. The package exim4-daemon-light brings you the exim server. I think that since some version of Debian, exim4-daemon-light is the default, hence the apt remove exim4 did not work as expected.

You have to remove this package as well with apt remove exim4-daemon-light to get rid of the smtp server on the Debian base install.

2 Likes

Thank you @nuke @jaywalker ! I edited Markus’ post with your new findings.

1 Like