Discussion
With DNS things out of the way, I'm gonna play with Aerogramme a little, see if I can use it for my stack (replacing dovecot).
It's EUPL-licensed (yay), by Deuxfleurs, makers of Garage (also yay), stores mail on Garage instead of the filesystem (also yay), encrypted (whee).
Very promising.
So far, so good. Now to see if it works with K9/Thunderbird and mbsync - those are the two uses of imap I care about really.
argasdasd-9121asasldk!#%!ASDA
For some reason, getting a certificate, with the same configuration as another domain (which succeeded earlier today), is failing.
Maybe dns-01 was a bad idea. It looks like lego can put the HTTP verification into an S3 bucket, so... I can technically use the HTTP challenge from behind WG.
Oh. Oh. I might know what's up.
The difference between this zone (where dns-01 didn't work) and the other, is that this zone has DNSSEC, while the other does not.
With DNSSEC, I need to set API-RECTIFY 1, to automatically do dnssec magic when changing the zone through the API.
Nevertheless, I'm trying to figure out how to use lego's S3 thingamajiggy. All I find in the docs is --http.s3-bucket string, which says the challenge will be written to the bucket.
Ok, fine, but... where in the bucket, and can I set the S3 endpoint and zone and whatnot? I assume credentials use the standard AWS credential env vrs, but... what about the endpoint and stuff?
AWS_ENDPOINT_URL=
AWS_DEFAULT_REGION=
That should do it. But with API-RECTIFY 1, the dns-01 challenge worked too, so we're good, don't need to mess with S3 buckets.
But it's good to know that's an option!
And yay, aerogramme works fine with mutt and K9/Thunderbird fine. Now to get the delivery part done too...
Opinion about Aerogramme so far: liking it a lot.
No AI slop, good license, developers who are on fedi, moves slowly, does pretty much just what I want and not much more.
Since the user database is static, and all data lives in Garage, I can host it on a different server than the data itself. No need to configure additional persistence. And files are encrypted at rest, too, a big win.
I like storing stuff on S3. It may not be the most efficient way to do things, but it sure is mighty convenient.
It does require using a dedicated bucket for each user, but: Garage supports bucket aliases, and bucket don't need to have a global alias.
Which means... I can create a key for each mail user, and have them all configured to use a bucket named "mailbox". I don't need to manually namespace the buckets like "aerogramme-algernon-174070135-xyz" or something silly like that. I can call it "mailbox", and the "aerogramme-algernon" key has read/write access to it, and sees it under that name.
Other keys don't see it, and if I need to mess with the bucket, I can use its unique, automatically generated ID, rather than an alias.
I can also use a single Garage key, and name the buckets after the users - this requires fewer secrets, but means that if the key leaks, every user's mail is accessible.
So I'm gonna go with per-user keys.
That also helps with having multiple users with the same name, on different domains (not that I have any such, but.. who knows?): I don't need to encode the user@domain into the bucket name! It's just "mailbox".
AND! Best of all! I CAN COMBINE BOTH APPROACHES!
I can have an algernon account, an algernon-archive account share the same key, because they both belong to me. I can also have mom with her key.
Oooh... I wonder if this would work: what if I wanted a kind-of-shared account? Like, lets say there's a shared@family.tld email address. I want both my wife and I to see it, but I don't want us to share passwords, nor do I wish to deliver mail to our inboxes and have two copies.
To support this, my theory is that I can set up a single bucket, call it "shared". I can have two keys, wife's and mine, which has access to the bucket, and see it under the "mailbox" name. I can then have two users in Aerogramme, with their different usernames (shared-wife, shared-husband), different passwords, accessing the same mailbox.
Hm. Except... nah, that wouldn't work, because data is encrypted with the user's password. And if our passwords are different, then we're fucked.
Install bonfire.cafe
Get the full app experience