3 ms·

I've been self-hosting email for 25 years also. I think of it as a process of punctuated equilibrium. Every several years (or ten), it requires a flurry of ac

I've been self-hosting email for 25 years also. I think of it as a process of punctuated equilibrium. Every several years (or ten), it requires a flurry of activity to update to new preferred daemons, or new hardware. Between these brief periods, everything is stable and solid. I don't have to think about it at all. In 25 years, I've rebuilt things 5 or 6 times. After the first few times, it has been more of a chore than an adventure, but it's still worth it to me, for now. One development that might change my mind about that: Ubiquitous and non-vendor-dependent MFA. If email was not the security mechanism of last resort (or the skeleton key), then I might consider outsourcing it. ... Re: Rspamd: It works well, but I did not enjoy the configuration effort. And yes, I never wanted Redis on my mailserver, but there it is -- along with an astonishing amount of RAM usage, which offends me in theory even if it has no practical impact. On the positive side, after the initial few hours of effort to get things set up, I have spent zero hours maintaining any of it, so I can't reasonably complain. Re: letsencrypt: I use dehydrated for certificate renewal, and I run a temporary webserver as you describe. Not a full dedicated webserver package, just python (or ruby) which is already installed. It's launched from the same script that automates the license renewal. Not elegant, but adequate. You could probably get away with netcat. Of course you can validate by DNS instead of HTTP. But that's not always convenient either.

rsync 6y ago
"Every several years (or ten), it requires a flurry of activity to update to new preferred daemons, or new hardware." I think you are correct and this is a decent description of how this has worked. I don't begrudge the every 5-10 year burst of activity/implementation. What I begrudge is the increased complexity. We're both talking about Redis as a hard requirement for rspamd which is the typical recipe for implementing DKIM which is required for email. That's a lot of moving parts.
- gog 6y ago
  I've been running amavisd-new for ~10 years (it runs spamassassing and clamav) and have been DKIM signing with it the whole time. Never had the need to switch to rspamd. You can also sign emails with OpenDKIM.
icedchai 6y ago
I've also been self-hosting email for 25 years. I see these exact patterns you describe. Currently I'm using postfix, dovecot, and rspamd, with several users using pine and mutt locally. Every time I do a major server upgrade, I re-evaluate the configuration. My mail server also runs a web server for some static sites, so the letsencrypt part was simple.

rsync 6y ago

"Every several years (or ten), it requires a flurry of activity to update to new preferred daemons, or new hardware." I think you are correct and this is a decent description of how this has worked. I don't begrudge the every 5-10 year burst of activity/implementation. What I begrudge is the increased complexity. We're both talking about Redis as a hard requirement for rspamd which is the typical recipe for implementing DKIM which is required for email. That's a lot of moving parts.

gog 6y ago
I've been running amavisd-new for ~10 years (it runs spamassassing and clamav) and have been DKIM signing with it the whole time. Never had the need to switch to rspamd. You can also sign emails with OpenDKIM.

icedchai 6y ago

I've also been self-hosting email for 25 years. I see these exact patterns you describe. Currently I'm using postfix, dovecot, and rspamd, with several users using pine and mutt locally. Every time I do a major server upgrade, I re-evaluate the configuration. My mail server also runs a web server for some static sites, so the letsencrypt part was simple.