install mox config

7 files changed, 236 insertions, 4 deletions

diff --git a/Makefile b/Makefile
index c996e09..8da5087 100644
--- a/Makefile
+++ b/Makefile
@@ -39,7 +39,7 @@ endef
 all: $(ENV_RULES) $(MAKE_RULES) $(BUILD_RULES) $(PUSH_RULES)
 
 $(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule)))
-$(foreach module,$(ALL_MODULES),$(if $(shell test -d $(module) && echo 1),$(eval $(call module_env_rule))))
+$(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule)))
 
 .PHONY: install
 install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab
diff --git a/README.md b/README.md
index 1f1ab14..c7faac2 100644
--- a/README.md
+++ b/README.md
@@ -7,3 +7,98 @@ To install:
 ```sh
 wget -O- https://git.joeac.net/joeac/joeac.net/raw/branch/main/install.sh | sh
 ```
+
+## DNS setup
+
+A/AAAA DNS records are added automatically by `make install`, but in order to
+get `mox` working as an email server, you'll have to manually add the following
+DNS records.
+
+Deliver mail for mail.joeac.net to mail.joeac.net:
+
+```
+mail.joeac.net. MX 10 mail.joeac.net.
+```
+
+All emails from the email server will be signed with two DKIM keys. So that
+clients can verify the authenticity of the messages, provide these keys as TXT
+records:
+
+```
+2026a._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvYfjrzmYgBtYofzBwI80aiW98+M2g6z+gd1Iwz9g0y30rPFNTctFn9GwBNuYBgZiZxB+sqjEbPMbr3li/R7i0A9t/KbNNJhkNC+4IjKJjk+jw1CXm4vXOUa4YSYWwy7NVYTH/QwZGz6fwjVM7YvDnnE4gG2NwrVx+AXlONt2R1G+qgV6HAIIvVi8T0yCjjqEc5B5bKlqk0XU9vSyUFJhhKnR/KNRe79C+H9GWJzcU7HUCmIHX04Xi0JeB/wm3weF1xjtGTsWyy5BmHHsfWGqSr2Dbg5o6AI5W0h4VkQ4QzdEYGVQ9ZBDyqFQwQFXLn0oHZjCD/vFzPOPdM5pxF/OgwIDAQAB
+2026b._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcrk9FUt6AdrvnAP3KawuOTLw7uL5SJ+ZYmShuz41zwM6bPQteGSSwddFXIxcqVlJrdFahrK4KvHX/sw/hWVfZoPLDdwsGN5eI8cqQjNDE+JDu9BbPlTituva4Hkve0hbAKDqA8jmbcZg6aU7b44Kzq8UpWAlPO273Rq2tsbCBcITt8B3NFoeY9CSsZU1LqGl855GUtaNyhlPaAvfab3Q9/4wyusPhCHlBYaRK+ZzuSMs5KEOG6n4kbZfMVi2+4c/bPU5PdTuyvbSIEqjNH4TpfatE0I9ubGv0WbAzr5EZbv5+xtukZ/dIisPPMjn1AbjpSJYNYr2OYgey6+WvzRmQIDAQAB
+```
+
+Specify the MX host is allowed to send for our domain and for itself (for DSNs).
+~all means softfail for anything else, which is done instead of -all to prevent
+older mail servers from rejecting the message because they never get to looking
+for a dkim/dmarc pass.
+
+```
+mail.joeac.net. TXT v=spf1 ip4:217.155.190.42 ip6:fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 mx ~all
+```
+
+Emails that fail the DMARC check (without aligned DKIM and without aligned SPF)
+should be rejected, and request reports. If you email through mailing lists that
+strip DKIM-Signature headers and don't rewrite the From header, you may want to
+set the policy to p=none.
+
+```
+_dmarc.mail.joeac.net. TXT v=DMARC1;p=reject;rua=mailto:dmarcreports@mail.joeac.net!10m
+```
+
+Remote servers can use MTA-STS to verify our TLS certificate with the WebPKI
+pool of CA's (certificate authorities) when delivering over SMTP with
+STARTTLSTLS.
+
+```
+mta-sts.mail.joeac.net.  CNAME mail.joeac.net.
+_mta-sts.mail.joeac.net. TXT v=STSv1; id=20260705T153220
+```
+
+Request reporting about TLS failures.
+
+```
+_smtp._tls.mail.joeac.net. TXT v=TLSRPTv1; rua=mailto:tlsreports@mail.joeac.net
+```
+
+Client settings will reference a subdomain of the hosted domain, making it
+easier to migrate to a different server in the future by not requiring settings
+in all clients to be updated.
+
+```
+clientsettings.mail.joeac.net. CNAME mail.joeac.net.
+```
+
+Autoconfig is used by Thunderbird. Autodiscover is (in theory) used by
+Microsoft.
+
+```
+autoconfig.mail.joeac.net.         CNAME mail.joeac.net.
+_autodiscover._tcp.mail.joeac.net. SRV 0 1 443 mail.joeac.net.
+```
+
+For secure IMAP and submission autoconfig, point to mail host.
+
+```
+_imaps._tcp.mail.joeac.net.        SRV 0 1 993 mail.joeac.net.
+_submissions._tcp.mail.joeac.net.  SRV 0 1 465 mail.joeac.net.
+```
+
+Next records specify POP3 and non-TLS ports are not to be used. These are
+optional and safe to leave out (e.g. if you have to click a lot in a DNS admin
+web interface).
+
+```
+_imap._tcp.mail.joeac.net.         SRV 0 0 0 .
+_submission._tcp.mail.joeac.net.   SRV 0 0 0 .
+_pop3._tcp.mail.joeac.net.         SRV 0 0 0 .
+_pop3s._tcp.mail.joeac.net.        SRV 0 0 0 .
+```
+
+Optional: You could mark Let's Encrypt as the only Certificate Authority allowed
+to sign TLS certificates for your domain.
+
+```
+mail.joeac.net. CAA 0 issue "letsencrypt.org"
+```
diff --git a/mox/.gitignore b/mox/.gitignore
new file mode 100644
index 0000000..b5c26c3
--- /dev/null
+++ b/mox/.gitignore
@@ -0,0 +1,2 @@
+config/dkim
+config/adminpasswd
diff --git a/mox/README.md b/mox/README.md
new file mode 100644
index 0000000..86a609c
--- /dev/null
+++ b/mox/README.md
@@ -0,0 +1,6 @@
+# mox
+
+There are three secrets required for mox. One is the admin password, which
+should be stored in config/adminpasswd. The other two are DKIM private keys,
+which should be stored in the config/dkim directory. The public parts of these
+keys should be exposed in DNS TXT records.
diff --git a/mox/config/domains.conf b/mox/config/domains.conf
new file mode 100644
index 0000000..7901311
--- /dev/null
+++ b/mox/config/domains.conf
@@ -0,0 +1,52 @@
+Domains:
+	mail.joeac.net:
+		ClientSettingsDomain: clientsettings.mail.joeac.net
+		LocalpartCatchallSeparator: +
+		DKIM:
+			Selectors:
+				2026a:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+				2026b:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+			Sign:
+				- 2026a
+		DMARC:
+			Localpart: dmarcreports
+			Account: me
+			Mailbox: DMARC
+		MTASTS:
+			PolicyID: 20260705T153220
+			Mode: enforce
+			MaxAge: 24h0m0s
+			MX:
+				- mail.joeac.net
+		TLSRPT:
+			Localpart: tlsreports
+			Account: me
+			Mailbox: TLSRPT
+Accounts:
+	me:
+		Domain: mail.joeac.net
+		Destinations:
+			me@mail.joeac.net: nil
+		SubjectPass:
+			Period: 12h0m0s
+		RejectsMailbox: Rejects
+		AutomaticJunkFlags:
+			Enabled: true
+			JunkMailboxRegexp: ^(junk|spam)
+			NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)
+		JunkFilter:
+			Threshold: 0.950000
+			Params:
+				Onegrams: true
+				MaxPower: 0.010000
+				TopWords: 10
+				IgnoreWords: 0.100000
+				RareWords: 2
+		NoCustomPassword: true
+MonitorDNSBLs:
+	- sbl.spamhaus.org
+	- bl.spamcop.net
diff --git a/mox/config/mox.conf b/mox/config/mox.conf
new file mode 100644
index 0000000..1ca60ff
--- /dev/null
+++ b/mox/config/mox.conf
@@ -0,0 +1,74 @@
+DataDir: ../data
+LogLevel: debug
+User: mox
+Hostname: mail.joeac.net
+AdminPasswordFile: adminpasswd
+Listeners:
+	internal:
+		IPs:
+			- 127.0.0.1
+			- ::1
+		Hostname: localhost
+		AccountHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		AdminHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebmailHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebAPIHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		MetricsHTTP:
+			Enabled: true
+		AutoconfigHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		MTASTSHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		WebserverHTTP:
+			Enabled: true
+			Port: 81
+	public:
+		IPs:
+			- 192.168.178.75
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		NATIPs:
+			- 217.155.190.42
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		TLS:
+			KeyCerts:
+				-
+					CertFile: path/to/mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/mail.joeac.net.key.pem
+				-
+					CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/mta-sts.mail.joeac.net.key.pem
+				-
+					CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/autoconfig.mail.joeac.net.key.pem
+				-
+					CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/clientsettings.mail.joeac.net.key.pem
+		SMTP:
+			Enabled: true
+		Submissions:
+			Enabled: true
+		IMAPS:
+			Enabled: true
+Postmaster:
+	Account: me
+	Mailbox: Postmaster
+HostTLSRPT:
+	Account: me
+	Mailbox: TLSRPT
+	Localpart: tlsreports
diff --git a/mox/install.mk b/mox/install.mk
index 8f0c7dd..f175812 100644
--- a/mox/install.mk
+++ b/mox/install.mk
@@ -33,8 +33,11 @@ install_unbound_anchor_crontab:
 /etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf
 	sudo mkdir -p $(dir $@) && sudo cp $< $@
 
+DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B)
 .PHONY: install_mox
-install_mox: /usr/local/bin/mox /home/mox/config/domains.conf
+install_mox: /usr/local/bin/mox ~/mox/config/adminpasswd $(DKIM_PRIVATE_KEYS)
 
 MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64)
 MOX_VERSION := 0.0.15
@@ -49,5 +52,5 @@ MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERS
 	chmod +x mox
 	sudo mv mox /usr/local/bin/mox
 
-/home/mox/config/domains.conf:
-	$(error Now configure mox for mail.joeac.net. To get started, create a user 'mox' if there isn't one already, cd to /home/mox, and run 'mox -hostname mail.joeac.net -existing-webserver quickstart me@mail.joeac.net'. See https://www.xmox.nl for more information on how to configure mox.)
+~/mox/config/%: config/%
+	mkdir -p $(dir $@) && cp $< $@