website/content/post/email.md

+++
title = "Email!"
date = "2017-11-16"
tags = ["technical", "Email"]
+++

#### Email sucks

It really does, and yet we still need it. I've been hosting my own for over a
decade now, although for the bulk of the time I outsourced most of the mail
server smarts necessary to do so to the excellent [Symbiosis](https://symbiosis.bytemark.co.uk)
virtual hosting package, although I switched to [@tomav's docker-mailserver](https://github.com/tomav/docker-mailserver) about six months ago.

Today, I finally switched to running my own mail server, directly on the server
with no third-party configuration or any docker. "But why?!" cried a friend
desperately, pointing out the existence of [Mailcow]() and [Libre.sh](https://libre.sh),
in addition to the options I'd already tried.

The mail server setup I wanted had two requirements:

* Use as few system resources as possible
* Be as unobtrusive to the rest of the system as possible

Both of these requirements are tightly linked to *where* I self-host my
email. Normally, servers are hosted in datacentres with big, fast Internet
connections. About 2 years ago, I noticed that home Internet connections are
quite fast enough, thank you very much; since then, I've mostly been running
email on servers sat at home. In York, I used a standard rack-mounted server
that hid in the larder!

In Shetland (more on that another time), I've switched to an
[APU2](https://pcengines.ch/apu2.htm), which also happens to be my router,
website, and everything else as well. Yes, this post was served from Shetland!

Being tiny and multi-purpose, a heavyweight mail server solution wasn't an
option. In particular, no Docker. It would be absurd to install Docker on a
machine acting as a router. And in any case, I was always terrible about
rebuilding the containers to get fixes for security issues - I'm too used to
`unattended-upgrades`.

The good thing about docker-based mail server setups is that they are very
self-contained - it's just a few files in `/var/lib/docker`, in the end.
non-docker mail server solutions like Symbiosis or Mailcow have an unfortunate
tendency to try to take over the whole machine. They come with piles of
dependencies, maybe a database and web interface you have to hook up, config
files modified or added across the system. It's not pretty. You also tend to
be stuck on older OS versions for an extended period as the vendor takes a while
to port their octopus-like solution to the updated system.

#### Make it better?

I use [Debian](https://debian.org) on all my personal hardware. It's rock-solid
and comes with lots of useful software, with very useful default configurations.
I also have a set of [Ansible](https://ansible.com) recipes I use to automate
setting things up on those machines - you can view them [here](https://gitlab.com/lupine/ansible-personal).

So, I resolved to create a minimal set of Ansible recipes that would get email
working simply by installing Debian packages and modifying their configuration,
with as light a touch as possible. You can view what I ended up with in the
[`mail` role](https://gitlab.com/lupine/ansible-personal/tree/master/roles/mail),
so I won't document them in detail, but here's a brief overview:

* Exim4 SMTP server
* Dovecot IMAP server
* amavisd-new + spam-assassin

Everything gets solid TLS support, using certificates issued by [LetsEncrypt](https://letsencrypt.org).
It's quite rare to have a mail server with valid certificates! In any case, if
someone wants **my** email archive, they'll have to serve the warrant on **me**
to get it. And the APU2 is small enough to hide under a floorboard or so, if I
turned out to be really paranoid...

#### TODO

The anti-spam setup is extremely rudimentary, and will likely need a lot of
extra work. I'll see how much spam comes in and adjust accordingly. Ultimately,
this was the most disappointing part of the setup - it's Perl-heavy and it took
a lot of head-scratching to work out how the different parts even fit together.

There's no webmail. I'm OK with that.

Dovecot has solr and lucene search engine integration. I doubt either will fit
onto the APU2, but I'll evaluate it.

A long-term ambition of mine is to put together a vertical slice of email
functionality as a single, neat daemon that's optimised for the small, single
domain use case - a sort of [Caddy](https://caddyserver.com) for email. It could
even use JMAP and database storage instead of IMAP and Maildir, ship a
HTTP server, and handle the tricky DNS parts too.

One day. Until then, this setup is working well enough. Give it a try!