2022-01-03 15:56:24 +00:00
|
|
|
---
|
|
|
|
|
title: "Email!"
|
|
|
|
|
---
|
2020-11-24 22:46:02 +00:00
|
|
|
|
|
|
|
|
## Email sucks
|
|
|
|
|
|
|
|
|
|
It really does, and yet we still need it. I've been hosting my own for over a
|
|
|
|
|
decade now, although for the bulk of the time I outsourced most of the mail
|
|
|
|
|
server smarts necessary to do so to the excellent Symbiosis virtual hosting
|
|
|
|
|
package, although I switched to `@tomav`'s docker-mailserver about six months
|
|
|
|
|
ago.
|
|
|
|
|
|
|
|
|
|
=> https://symbiosis.bytemark.co.uk Symbiosis
|
|
|
|
|
=> https://github.com/tomav/docker-mailserver docker-mailserver
|
|
|
|
|
|
|
|
|
|
Today, I finally switched to running my own mail server, directly on the server
|
|
|
|
|
with no third-party configuration or any docker. "But why?!" cried a friend
|
|
|
|
|
desperately, pointing out the existence of Mailcow and Libre.sh,
|
|
|
|
|
in addition to the options I'd already tried.
|
|
|
|
|
|
|
|
|
|
=> https://libre.sh, Libre.sh
|
|
|
|
|
|
|
|
|
|
The mail server setup I wanted had two requirements:
|
|
|
|
|
|
|
|
|
|
* Use as few system resources as possible
|
|
|
|
|
* Be as unobtrusive to the rest of the system as possible
|
|
|
|
|
|
|
|
|
|
Both of these requirements are tightly linked to *where* I self-host my
|
|
|
|
|
email. Normally, servers are hosted in datacentres with big, fast Internet
|
|
|
|
|
connections. About 2 years ago, I noticed that home Internet connections are
|
|
|
|
|
quite fast enough, thank you very much; since then, I've mostly been running
|
|
|
|
|
email on servers sat at home. In York, I used a standard rack-mounted server
|
|
|
|
|
that hid in the larder!
|
|
|
|
|
|
|
|
|
|
In Shetland (more on that another time), I've switched to an
|
|
|
|
|
APU2, which also happens to be my router, website, and everything else as well.
|
|
|
|
|
Yes, this post was served from Shetland!
|
|
|
|
|
|
|
|
|
|
=> https://pcengines.ch/apu2.htm APU2
|
|
|
|
|
|
|
|
|
|
Being tiny and multi-purpose, a heavyweight mail server solution wasn't an
|
|
|
|
|
option. In particular, no Docker. It would be absurd to install Docker on a
|
|
|
|
|
machine acting as a router. And in any case, I was always terrible about
|
|
|
|
|
rebuilding the containers to get fixes for security issues - I'm too used to
|
|
|
|
|
`unattended-upgrades`.
|
|
|
|
|
|
|
|
|
|
The good thing about docker-based mail server setups is that they are very
|
|
|
|
|
self-contained - it's just a few files in `/var/lib/docker`, in the end.
|
|
|
|
|
non-docker mail server solutions like Symbiosis or Mailcow have an unfortunate
|
|
|
|
|
tendency to try to take over the whole machine. They come with piles of
|
|
|
|
|
dependencies, maybe a database and web interface you have to hook up, config
|
|
|
|
|
files modified or added across the system. It's not pretty. You also tend to
|
|
|
|
|
be stuck on older OS versions for an extended period as the vendor takes a while
|
|
|
|
|
to port their octopus-like solution to the updated system.
|
|
|
|
|
|
|
|
|
|
## Make it better?
|
|
|
|
|
|
|
|
|
|
I use Debian on all my personal hardware. It's rock-solid and comes with lots of
|
|
|
|
|
useful software, with very useful default configurations. I also have a set of
|
|
|
|
|
Ansible recipes I use to automate setting things up on those machines - you can
|
|
|
|
|
view them on the link below.
|
|
|
|
|
|
|
|
|
|
=> https://debian.org
|
|
|
|
|
=> https://ansible.com
|
|
|
|
|
=> https://code.ur.gs/lupine/ansible-personal
|
|
|
|
|
|
|
|
|
|
So, I resolved to create a minimal set of Ansible recipes that would get email
|
|
|
|
|
working simply by installing Debian packages and modifying their configuration,
|
|
|
|
|
with as light a touch as possible. You can view what I ended up with in the
|
|
|
|
|
`mail` role, so I won't document them in detail, but here's a brief overview:
|
|
|
|
|
|
|
|
|
|
* Exim4 SMTP server
|
|
|
|
|
* Dovecot IMAP server
|
|
|
|
|
* amavisd-new + spam-assassin
|
|
|
|
|
|
|
|
|
|
Everything gets solid TLS support, using certificates issued by LetsEncrypt.
|
|
|
|
|
It's quite rare to have a mail server with valid certificates! In any case, if
|
|
|
|
|
someone wants *my* email archive, they'll have to serve the warrant on *me* to
|
|
|
|
|
get it. And the APU2 is small enough to hide under a floorboard or so, if I
|
|
|
|
|
turned out to be really paranoid...
|
|
|
|
|
|
|
|
|
|
=> https://letsencrypt.org LetsEncrypt
|
|
|
|
|
|
|
|
|
|
## TODO
|
|
|
|
|
|
|
|
|
|
The anti-spam setup is extremely rudimentary, and will likely need a lot of
|
|
|
|
|
extra work. I'll see how much spam comes in and adjust accordingly. Ultimately,
|
|
|
|
|
this was the most disappointing part of the setup - it's Perl-heavy and it took
|
|
|
|
|
a lot of head-scratching to work out how the different parts even fit together.
|
|
|
|
|
|
|
|
|
|
There's no webmail. I'm OK with that.
|
|
|
|
|
|
|
|
|
|
Dovecot has solr and lucene search engine integration. I doubt either will fit
|
|
|
|
|
onto the APU2, but I'll evaluate it.
|
|
|
|
|
|
|
|
|
|
A long-term ambition of mine is to put together a vertical slice of email
|
|
|
|
|
functionality as a single, neat daemon that's optimised for the small, single
|
|
|
|
|
domain use case - a sort of Caddy for email. It could even use JMAP and database
|
|
|
|
|
storage instead of IMAP and Maildir, ship a HTTP server, and handle the tricky
|
|
|
|
|
DNS parts too.
|
|
|
|
|
|
|
|
|
|
One day. Until then, this setup is working well enough. Give it a try!
|
|
|
|
|
|
|
|
|
|
=> https://caddyserver.com Caddy
|
