microlog post 2026-07-06

before it is used in COMPOSE_CMD

README.md

@@ -8,44 +8,97 @@ To install:
 wget -O- https://git.joeac.net/joeac/joeac.net/raw/branch/main/install.sh | sh
 ```
 
-Structure:
+## DNS setup
+
+A/AAAA DNS records are added automatically by `make install`, but in order to
+get `mox` working as an email server, you'll have to manually add the following
+DNS records.
+
+Deliver mail for mail.joeac.net to mail.joeac.net:
 
 ```
-/
-├── gemini     My Gemini capsule
-├── smtp       A local SMTP server
-└── http       My Website
+mail.joeac.net. MX 10 mail.joeac.net.
 ```
 
-## Running with Podman
+All emails from the email server will be signed with two DKIM keys. So that
+clients can verify the authenticity of the messages, provide these keys as TXT
+records:
 
-These instructions will probably work with Docker, too: just substitute `podman`
-for `docker` in all the commands.
-
-To run with Podman, first set up your environment variables. Copy `example.env`
-to `.env` and edit the values accordingly.
-
-Then, create the `remote_smtp_password` secret, storing the password for the
-remote SMTP server which will send the contact emails on behalf of the website.
-
-```bash
-sudo podman secret create remote_smtp_password /path/to/remote/smtp/password
+```
+2026a._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvYfjrzmYgBtYofzBwI80aiW98+M2g6z+gd1Iwz9g0y30rPFNTctFn9GwBNuYBgZiZxB+sqjEbPMbr3li/R7i0A9t/KbNNJhkNC+4IjKJjk+jw1CXm4vXOUa4YSYWwy7NVYTH/QwZGz6fwjVM7YvDnnE4gG2NwrVx+AXlONt2R1G+qgV6HAIIvVi8T0yCjjqEc5B5bKlqk0XU9vSyUFJhhKnR/KNRe79C+H9GWJzcU7HUCmIHX04Xi0JeB/wm3weF1xjtGTsWyy5BmHHsfWGqSr2Dbg5o6AI5W0h4VkQ4QzdEYGVQ9ZBDyqFQwQFXLn0oHZjCD/vFzPOPdM5pxF/OgwIDAQAB
+2026b._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcrk9FUt6AdrvnAP3KawuOTLw7uL5SJ+ZYmShuz41zwM6bPQteGSSwddFXIxcqVlJrdFahrK4KvHX/sw/hWVfZoPLDdwsGN5eI8cqQjNDE+JDu9BbPlTituva4Hkve0hbAKDqA8jmbcZg6aU7b44Kzq8UpWAlPO273Rq2tsbCBcITt8B3NFoeY9CSsZU1LqGl855GUtaNyhlPaAvfab3Q9/4wyusPhCHlBYaRK+ZzuSMs5KEOG6n4kbZfMVi2+4c/bPU5PdTuyvbSIEqjNH4TpfatE0I9ubGv0WbAzr5EZbv5+xtukZ/dIisPPMjn1AbjpSJYNYr2OYgey6+WvzRmQIDAQAB
 ```
 
-Now build and start the containers:
+Specify the MX host is allowed to send for our domain and for itself (for DSNs).
+~all means softfail for anything else, which is done instead of -all to prevent
+older mail servers from rejecting the message because they never get to looking
+for a dkim/dmarc pass.
 
-```bash
-sudo podman-compose build && sudo podman-compose up -d
+```
+mail.joeac.net. TXT v=spf1 ip4:217.155.190.42 ip6:fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 mx ~all
 ```
 
-## Running on the host machine
+Emails that fail the DMARC check (without aligned DKIM and without aligned SPF)
+should be rejected, and request reports. If you email through mailing lists that
+strip DKIM-Signature headers and don't rewrite the From header, you may want to
+set the policy to p=none.
 
-To run on the host machine, first, as before, set up your environment variables
-by copying `example.env` to `.env` and editing the values as appropriate.
-
-```bash
-npm run start
+```
+_dmarc.mail.joeac.net. TXT v=DMARC1;p=reject;rua=mailto:dmarcreports@mail.joeac.net!10m
 ```
 
-Note that emails may not work locally without further setup. These instructions
-are of course woefully incomplete.
+Remote servers can use MTA-STS to verify our TLS certificate with the WebPKI
+pool of CA's (certificate authorities) when delivering over SMTP with
+STARTTLSTLS.
+
+```
+mta-sts.mail.joeac.net.  CNAME mail.joeac.net.
+_mta-sts.mail.joeac.net. TXT v=STSv1; id=20260705T153220
+```
+
+Request reporting about TLS failures.
+
+```
+_smtp._tls.mail.joeac.net. TXT v=TLSRPTv1; rua=mailto:tlsreports@mail.joeac.net
+```
+
+Client settings will reference a subdomain of the hosted domain, making it
+easier to migrate to a different server in the future by not requiring settings
+in all clients to be updated.
+
+```
+clientsettings.mail.joeac.net. CNAME mail.joeac.net.
+```
+
+Autoconfig is used by Thunderbird. Autodiscover is (in theory) used by
+Microsoft.
+
+```
+autoconfig.mail.joeac.net.         CNAME mail.joeac.net.
+_autodiscover._tcp.mail.joeac.net. SRV 0 1 443 mail.joeac.net.
+```
+
+For secure IMAP and submission autoconfig, point to mail host.
+
+```
+_imaps._tcp.mail.joeac.net.        SRV 0 1 993 mail.joeac.net.
+_submissions._tcp.mail.joeac.net.  SRV 0 1 465 mail.joeac.net.
+```
+
+Next records specify POP3 and non-TLS ports are not to be used. These are
+optional and safe to leave out (e.g. if you have to click a lot in a DNS admin
+web interface).
+
+```
+_imap._tcp.mail.joeac.net.         SRV 0 0 0 .
+_submission._tcp.mail.joeac.net.   SRV 0 0 0 .
+_pop3._tcp.mail.joeac.net.         SRV 0 0 0 .
+_pop3s._tcp.mail.joeac.net.        SRV 0 0 0 .
+```
+
+Optional: You could mark Let's Encrypt as the only Certificate Authority allowed
+to sign TLS certificates for your domain.
+
+```
+mail.joeac.net. CAA 0 issue "letsencrypt.org"
+```

common/microlog/2026-07-06.gmi

@@ -0,0 +1,3 @@
+I've been following Ink and Switch's blog for a while. They're working creatively with computers. This is a great discussion about LLMs which covers what they are, how they are being abused to de-humanise the world, and how things could be different, concluding in a call for 'punk computing.' Let's have it!
+
+=> https://www.inkandswitch.com/tangents/artificial/ Artificial | Ink and Switch

etherpad/install.mk

@@ -6,6 +6,7 @@ reinstall: $(ETHERPAD_DATA_DIR)
 
 $(ETHERPAD_DATA_DIR):
 	sudo mkdir -p $(ETHERPAD_DATA_DIR)
+	ETHERPAD_USER=$(whoami) && sudo chown $$ETHERPAD_USER:$$ETHERPAD_USER $(ETHERPAD_DATA_DIR)
 
 .PHONY: uninstall
 uninstall:

example.env

@@ -1,7 +1,3 @@
-# A prefix for remote container names
-# If you're running on ARM 32-bit CPU architecture, use 'armv7/', otherwise keep blank
-CONTAINER_PREFIX=
-
 # The hostname to use for the local SMTP server
 LOCAL_SMTP_HOST=smtp
 

gemini.Dockerfile

@@ -1,6 +1,6 @@
-FROM git.joeac.net/joeac/armv7/agate:3.3.20-alpine3.23 AS agate
-FROM git.joeac.net/joeac/armv7/comitium:1.8.2-alpine3.23 AS comitium
-FROM git.joeac.net/joeac/armv7/crond:1.37.0-r30-alpine3.23 AS final
+FROM git.joeac.net/joeac/${IMAGE_PREFIX}agate:3.3.20-alpine3.23 AS agate
+FROM git.joeac.net/joeac/${IMAGE_PREFIX}comitium:1.8.2-alpine3.23 AS comitium
+FROM git.joeac.net/joeac/${IMAGE_PREFIX}crond:1.37.0-r30-alpine3.23 AS final
 RUN apk --no-cache add gcc # dependency for agate
 COPY --from=agate /root/.cargo/bin/agate /usr/local/bin/agate
 COPY --from=comitium /usr/local/bin/comitium /usr/local/bin/comitium

gemini/install.mk

@@ -8,9 +8,11 @@ reinstall: $(GEMINI_CERTIFICATES_DIR) $(GEMINI_COMITIUM_DATA_FILES)
 
 $(GEMINI_CERTIFICATES_DIR):
 	sudo mkdir -p $(GEMINI_CERTIFICATES_DIR)
+	$(let gemini_user,$(shell whoami),sudo chown -R $(gemini_user):$(gemini_user) $(GEMINI_CERTIFICATES_DIR))
 
 $(GEMINI_COMITIUM_DATA_DIR)/%: comitium-data/% $(GEMINI_COMITIUM_DATA_DIR)
 	sudo cp $< $@
+	$(let gemini_user,$(shell whoami),sudo chown $(gemini_user):$(gemini_user) $@)
 
 $(GEMINI_COMITIUM_DATA_DIR):
 	sudo mkdir -p $(GEMINI_COMITIUM_DATA_DIR)

http/Makefile

@@ -40,12 +40,12 @@ default_layout_file = $(if \
 layout_file = $(if $(layout),share/layouts/$(layout).layout.upp$(ext),$(default_layout_file))
 
 define out_rule =
-out/%.$(ext): src/%$(if $(layout),.$(layout)).upp$(ext) $(layout_file) $(component_files)
+out/%.$(ext): src/%$(if $(layout),.$(layout)).upp$(ext) $(layout_file) $(component_files) bin/pp
 	./bin/mkws https://joeac.net "$$$$(realpath $$<)"
 endef
 
 define blog_rss_feed_rule =
-out/$(blog)/rss.xml: src/$(blog)/rss.uppxml $(blog_src) $(wildcard bin/*)
+out/$(blog)/rss.xml: src/$(blog)/rss.uppxml $(blog_src) $(wildcard bin/*) bin/pp
 	./bin/mkws https://joeac.net "$$(realpath src/$(blog)/rss.uppxml)"
 endef
 
@@ -64,7 +64,7 @@ $(blog_post_target): $(blog_post_src) $(let ext,html,$(layout_file) $(component_
 endef
 
 define blog_index_rule =
-out/$(blog).html: src/$(blog).upphtml $(blog_src) $(wildcard bin/*)
+out/$(blog).html: src/$(blog).upphtml $(blog_src) $(wildcard bin/*) bin/pp
 	./bin/mkws https://joeac.net "$$(realpath src/$(blog).upphtml)"
 endef
 
@@ -106,10 +106,10 @@ share/man/man1/pp.1:
 	cp pp/pp.1 share/man/man1/pp.1
 
 .PHONY: out
-out: bin/pp $(out_deps)
+out: $(out_deps)
 
 bin/pp:
-	cd pp && $(MAKE) && chmod +x pp && cp pp ../bin/pp
+	$(MAKE) --directory=pp && chmod +x pp/pp && cp pp/pp bin/pp
 
 $(foreach ext,$(sort $(out_deps_ext)),\
 	$(eval $(out_rule)))

install.sh

@@ -1,41 +1,77 @@
 #!/bin/sh
 
-DEPENDENCIES="podman podman-compose yq envsubst bash"
-for dep in ${DEPENDENCIES}
-do
-  if [ -z "$(which ${dep} 2>/dev/null)" ]
-  then
-    echo "Cannot install: missing required dependency ${dep}. Install ${dep}, then try again."
-    exit 1
-  fi
-done
+get_var_value()
+{
+  expr "$(env | grep "^${1}=")" : "${1}=\(.*\)\$"
+}
 
-set -e
+if [ -z "$(which podman 2>/dev/null)" ]
+then
+  sudo apk add podman
+fi
+
+if [ -z "$(which podman-compose 2>/dev/null)" ]
+then
+  sudo apk add podman-compose
+fi
+
+if [ -z "$(which yq 2>/dev/null)" ]
+then
+  YQ_PLATFORM="linux_$(expr "$(arch)" : "armv7" && echo arm || expr "$(arch)" : "x86_64" && echo amd64 || arch)"
+  sudo wget -O /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${YQ_PLATFORM}
+  sudo chmod +x /usr/local/bin/yq
+fi
+
+if [ -z "$(which envsubst 2>/dev/null)" ]
+then
+  if [ "$(arch)" = "x86_64" ] || [ "$(arch)" = "arm64" ]
+  then
+    ENVSUBST_VERSION=1.4.3
+    sudo wget -O /usr/local/bin/envsubst https://github.com/a8m/envsubst/releases/download/v${ENVSUBST_VERSION}/envsubst-Linux-$(arch)
+    sudo chmod +x /usr/local/bin/envsubst
+  else
+    sudo apk add go
+    go install github.com/a8m/envsubst/cmd/envsubst@latest
+  fi
+fi
+
+if [ -z "$(which bash 2>/dev/null)" ]
+then
+  sudo apk add bash
+fi
 
 if [ -z "$(grep "\bjoeac.net\b" /etc/group)" ]
 then
-  doas adduser -h /home/joeac.net joeac.net
+  sudo adduser -D -h /home/joeac.net joeac.net
+  sudo adduser joeac.net joeac.net
 fi
 
-cd /home/joeac.net
-if ! [ -d joeac.net/.git ]
+if ! ( expr "$(groups joeac.net)" wheel )
 then
-  sudo -u joeac.net git clone https://git.joeac.net/joeac.net.git joeac.net
+  sudo adduser joeac.net wheel
 fi
-cd joeac.net
 
-if ! [ -h /usr/local/lib/joeac.net ]
+su -l joeac.net
+if ! [ $(whoami) = "joeac.net" ]
 then
-  sudo ln -s /home/joeac.net/joeac.net /usr/local/lib/joeac.net
+  echo "Could not log in to user: joeac.net. Log in manually and re-run this script as joeac.net."
+  exit 1
 fi
 
+if ! [ -d /home/joeac.net/joeac.net/.git ]
+then
+  git clone https://git.joeac.net/joeac/joeac.net.git /home/joeac.net/joeac.net
+fi
+sudo chown joeac.net:joeac.net /home/joeac.net/joeac.net
+sudo chmod 770 /home/joeac.netjoeac.net
+
 if ! [ -f DIGITALOCEAN_TOKEN ]
 then
   if [ -z "${DIGITALOCEAN_TOKEN}" ]
   then
     read -sp "DIGITALOCEAN_TOKEN: " DIGITALOCEAN_TOKEN
   fi
-  echo ${DIGITALOCEAN_TOKEN} > DIGITALOCEAN_TOKEN
+  echo ${DIGITALOCEAN_TOKEN} > /home/joeac.net/joeac.net/DIGITALOCEAN_TOKEN
 fi
 
 if ! ( podman secret exists remote_smtp_password )
@@ -50,28 +86,28 @@ fi
 
 while read line
 do
-  if expr "${line}" : "^[[:alnum:]_]\+=" 1>/dev/null
+  if expr "${line}" : "[[:alnum:]_]\+=" 1>/dev/null
   then
-    var_name="$(expr "${line}" "^\([[:alnum:]_]\+\)=")"
+    var_name="$(expr "${line}" : "\([[:alnum:]_]\+\)=")"
 
-    if [ -n "$(grep "^${var_name}=" .env)" ]
+    if [ -n "$(grep "^${var_name}=" /home/joeac.net/joeac.net/.env)" ]
     then
       continue
     fi
 
-    if [ -z "${!var_name}" ]
+    if [ -z "$(get_var_value ${var_name})" ]
     then
-      default_value="$(expr "${line}" "^[[:alnum:]_]\+=\(.*\)\$")"
+      default_value="$(expr "${line}" : "[[:alnum:]_]\+=\(.*\)\$")"
       read -sp "${var_name}: " ${var_name}
-      if [ -z "${!var_name}" ]
+      if [ -z "$(get_var_value ${var_name})" ]
       then
         eval ${var_name}="${default_value}"
       fi
     fi
 
-    echo "${var_name}=${!var_name}" >> .env
+    echo "${var_name}=$(get_var_value ${var_name})" >> /home/joeac.net/joeac.net/.env
   fi
-done <example.env
+done </home/joeac.net/joeac.net/example.env
 
-sudo -u joeac.net make
-sudo -u joeac.net make install
+make --directory=/home/joeac.net/joeac.net
+make --directory=/home/joeac.net/joeac.net install

make/container.mk

@@ -1,16 +1,3 @@
-CPU_ARCH := $(if $(shell which arch 2>/dev/null),\
-	$(shell arch),\
-	$(shell lscpu | grep ^Architecture: | sed "s/^Architecture:[[:space:]]*\([[:alnum:][:punct:]]\+\).*/\1/"))
-IMAGE_PREFIX := $(if $(filter armv7%,$(CPU_ARCH)),armv7/)
-COMPOSE_CMD := \
-	IMAGE_PREFIX="$(IMAGE_PREFIX)" \
-	GEMINI_CERTIFICATES_DIR="$(GEMINI_CERTIFICATES_DIR)" \
-	GEMINI_COMITIUM_DATA_DIR="$(GEMINI_COMITIUM_DATA_DIR)" \
-	ETHERPAD_DATA_DIR="$(ETHERPAD_DATA_DIR)" \
-	VAULTWARDEN_DATA_DIR="$(VAULTWARDEN_DATA_DIR)" \
-	LOCAL_SMTP_PORT=$(PORT_smtp) \
-	$(foreach module,$(ALL_MODULES),$(call capitalise,$(module))_PORT=$(PORT_$(module))) \
-	podman-compose
 REGISTRY_DOMAIN := git.joeac.net
 REGISTRY_USER := joeac
 

make/dyndns.mk

@@ -5,7 +5,7 @@ dyndns_crontabs_to_remove = $(dyndns_subdomains_to_remove:%=/etc/periodic/daily/
 
 define install_dyndns_module_rule =
 .PHONY: install_dyndns_$(module)
-install_dyndns_module_$(module): $(if $(SUBDOMAIN_$(module)),/etc/periodic/daily/dyndns-$(SUBDOMAIN_$(module)).joeac.net install_dyndns)
+install_dyndns_module_$(module): $(if $(SUBDOMAIN_$(module)),/etc/periodic/daily/dyndns-$(SUBDOMAIN_$(module)).joeac.net)
 endef
 
 define reinstall_dyndns_module_rule =
@@ -29,10 +29,10 @@ $(foreach module,$(ALL_MODULES), $(eval $(uninstall_dyndns_module_rule)))
 remove_/etc/periodic/daily/dyndns-%.joeac.net:
 	rm -f $(@:remove_%=%)
 
-/etc/periodic/daily/dyndns-%joeac.net: /usr/local/bin/dyndns.sh ~/.config/dyndns/DIGITALOCEAN_TOKEN
+/etc/periodic/daily/dyndns-%joeac.net: ~/digitalocean_dyndns/dyndns.sh ~/.config/dyndns/DIGITALOCEAN_TOKEN
 	echo "#!/bin/sh" > crontab.tmp
-	echo "                      /usr/local/bin/dyndns.sh 4 $(*F)joeac.net" >> crontab.tmp
-	echo "CONN_DEVICE_NAME=eth0 /usr/local/bin/dyndns.sh 6 $(*F)joeac.net" >> crontab.tmp
+	echo "                      $(shell realpath ~)/digitalocean_dyndns/dyndns.sh 4 $(*F)joeac.net" >> crontab.tmp
+	echo "CONN_DEVICE_NAME=eth0 $(shell realpath ~)/digitalocean_dyndns/dyndns.sh 6 $(*F)joeac.net" >> crontab.tmp
 	sudo mv crontab.tmp $@
 	sudo chmod +x $@
 
@@ -42,23 +42,12 @@ reinstall_dyndns: $(addprefix remove_,$(dyndns_crontabs_to_remove))
 .PHONY: uninstall_dyndns
 uninstall_dyndns: $(foreach module,$(ALL_MODULES),$(uninstall_dyndns_$(module)))
 	sudo rm -rf \
-		/usr/local/bin/dyndns.sh \
-		/usr/local/bin/get_ip_addr.sh \
-		/usr/local/lib/digitalocean_dyndns/ \
+		~/digitalocean_dyndns/ \
 		~/.config/dyndns \
 		~/.cache/dyndns
 
-/usr/local/bin/dyndns.sh: /usr/local/lib/digitalocean_dyndns/dyndns.sh /usr/local/bin/get_ip_addr.sh
-	sudo rm -f /usr/local/bin/dyndns.sh
-	sudo cp /usr/local/lib/digitalocean_dyndns/dyndns.sh /usr/local/bin/dyndns.sh
-
-/usr/local/bin/get_ip_addr.sh: /usr/local/lib/digitalocean_dyndns/get_ip_addr.sh
-	sudo rm -f /usr/local/bin/get_ip_addr.sh
-	sudo cp /usr/local/lib/digitalocean_dyndns/get_ip_addr.sh /usr/local/bin/get_ip_addr.sh
-
-/usr/local/lib/digitalocean_dyndns/%:
-	cd /usr/local/lib \
-		&& sudo git clone https://git.joeac.net/joeac/digitalocean_dyndns.git
+~/digitalocean_dyndns/%:
+	git clone https://git.joeac.net/joeac/digitalocean_dyndns.git ~/digitalocean_dyndns
 
 ~/.config/dyndns/DIGITALOCEAN_TOKEN: DIGITALOCEAN_TOKEN
 	mkdir -p ~/.config/dyndns/

make/nginx.mk

@@ -28,12 +28,13 @@ endef
 
 define remove_nginx_site_rule =
 remove_$(site):
-	rm -f $(site)
+	sudo rm -f $(site)
 endef
 
 define nginx_module_config_rule =
 /etc/nginx/http.d/$(SUBDOMAIN_$(module)).joeac.net.conf: $(nginx_module_config_template) /etc/nginx/http.d /etc/nginx/nginx.conf
-	sudo $(nginx_module_config_template_args) envsubst -i $$< -o $$@
+	$(nginx_module_config_template_args) envsubst -i $$< -o $$(notdir $$@).tmp
+	sudo cp $$(notdir $$@).tmp $$@
 	sudo rc-service nginx restart
 endef
 

make/openrc.mk

@@ -6,7 +6,7 @@ define install_openrc_module_rule =
 install_openrc_$(module): $(if $(is_openrc_module),$(openrc_module_target) openrc_add_$(module) openrc_start_$(module))
 
 ~/.config/rc/init.d/joeac.net.$(module): ~/.config/rc/init.d/joeac.net ~/.config/rc/runlevels/default
-	rm -f ~/.config/rc/init.d/joeac.net
+	rm -f ~/.config/rc/init.d/joeac.net.$(module)
 	ln -s $(shell realpath ~)/.config/rc/init.d/joeac.net ~/.config/rc/init.d/joeac.net.$(module)
 endef
 
@@ -43,17 +43,18 @@ openrc_restart_$(module):
 	rc-service -U joeac.net.$(module) restart
 endef
 
-$(foreach module,$(MODULES),$(eval $(install_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(reinstall_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(uninstall_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(openrc_add_rule)))
-$(foreach module,$(MODULES),$(eval $(openrc_start_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(install_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(reinstall_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(uninstall_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(openrc_add_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(openrc_start_rule)))
 $(foreach module,$(MODULES),$(eval $(openrc_restart_rule)))
 
-~/.config/rc/init.d/joeac.net: openrc/init.d/joeac.net ~/.config/rc/init.d ~/.config/rc/runlevels/default /etc/init.d/user.$(USER) /etc/conf.d/user.$(USER)
+~/.config/rc/init.d/joeac.net: openrc/init.d/joeac.net.template ~/.config/rc/init.d ~/.config/rc/runlevels/default /etc/init.d/user.$(USER) /etc/conf.d/user.$(USER)
 	rm -f ~/.config/rc/init.d/joeac.net; \
 	mkdir -p ~/.config/rc/init.d; \
-	cp openrc/init.d/joeac.net ~/.config/rc/init.d/joeac.net
+	COMPOSECMD="$(COMPOSE_CMD)" envsubst -i openrc/init.d/joeac.net.template -o ~/.config/rc/init.d/joeac.net
+	chmod +x ~/.config/rc/init.d/joeac.net
 
 ~/.config/rc/init.d:
 	mkdir -p ~/.config/rc/init.d
@@ -65,7 +66,8 @@ $(foreach module,$(MODULES),$(eval $(openrc_restart_rule)))
 	sudo ln -s /etc/init.d/user /etc/init.d/user.$(USER)
 
 /etc/conf.d/user.$(USER): openrc/conf.d/user.template
-	sudo USER=$(USER) envsubst openrc/conf.d/user.template /etc/conf.d/user.$(USER)
+	USER=$(USER) envsubst -i openrc/conf.d/user.template -o openrc/conf.d/user.$(USER)
+	sudo mv openrc/conf.d/user.$(USER) /etc/conf.d/user.$(USER)
 	sudo rc-update add user.$(USER) default
 
 .PHONY: uninstall_joeac.net_service

make/vars.mk

@@ -3,10 +3,12 @@ capitalise = $(shell echo "$(1)" | tr '[:lower:]' '[:upper:]')
 USER := $(shell whoami)
 HOSTNAME := $(shell cat /etc/hostname)
 HOSTNAMES := pi-broughton blade-canongate
-MASTER_NODE := pi-broughton
+IP_ADDR_pi-broughton := 192.168.178.54
+IP_ADDR_blade-canongate := 192.168.178.75
+MASTER_NODE := blade-canongate
 IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME))
-MODULES_pi-broughton := http gemini smtp vaultwarden ln
-MODULES_blade-canongate := etherpad
+MODULES_pi-broughton := http smtp vaultwarden ln
+MODULES_blade-canongate := etherpad gemini mox mox_clientsettings mox_autoconfig mox_mta_sts
 ALL_NGINX_MODULES := http vaultwarden ln etherpad
 NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_NGINX_MODULES))
 MODULES := $(MODULES_$(HOSTNAME))
@@ -20,10 +22,17 @@ SUBDOMAIN_http := @
 SUBDOMAIN_vaultwarden := pwd
 SUBDOMAIN_etherpad := docs
 SUBDOMAIN_ln := ln
+SUBDOMAIN_mox := mail
+SUBDOMAIN_mox_autoconfig := autoconfig.mail
+SUBDOMAIN_mox_clientsettings := clientsettings.mail
+SUBDOMAIN_mox_mta_sts := mta-sts.mail
 
 PORT_etherpad := 9001
 PORT_http := 8080
 PORT_gemini := 1965
+PORT_mox := 81
+PORT_mox_autoconfig := $(PORT_mox)
+PORT_mox_mta_sts := $(PORT_mox)
 PORT_smtp := 2500
 PORT_vaultwarden := 9000
 
@@ -34,15 +43,18 @@ export GEMINI_CERTIFICATES_DIR := /var/joeac.net-gemini/certificates
 export GEMINI_COMITIUM_DATA_DIR := /var/joeac.net-gemini/comitium-data
 export VAULTWARDEN_DATA_DIR := /var/vaultwarden/data
 
+ALPINE_VERSION := 3.23
+ETHERPAD_VERSION := 3.3.2
+
 $(foreach module,$(ALL_MODULES),$(if $(PORT_$(module)),$(eval \
 	export $(call capitalise,$(module))_PORT := $(PORT_$(module)))))
 $(foreach hostname,$(HOSTNAMES),$(foreach module,$(MODULES_$(hostname)),$(eval \
-	export HOST_$(module) := $(hostname:$(HOSTNAME)=localhost))))
+	export HOST_$(module) := $(if $(filter $(HOSTNAME),$(hostname)),127.0.0.1,$(IP_ADDR_$(hostname))))))
 
 SUBDOMAINS := $(foreach module,$(MODULES),$(SUBDOMAIN_$(module)))
 NGINX_SUBDOMAINS := $(foreach module,$(NGINX_MODULES),$(SUBDOMAIN_$(module)))
 
-ENV_RULES := $(foreach module,$(MODULES),$(module)/.env)
+ENV_RULES := $(foreach module,$(MODULES),$(if $(shell test -d $(module) && echo 1),$(module)/.env))
 MAKE_RULES := $(foreach module,$(MAKE_MODULES),make_$(module))
 BUILD_RULES := $(foreach module,$(filter $(COMPOSE_SERVICES),$(MODULES)),build_$(module))
 PUSH_RULES := $(foreach module,$(filter $(COMPOSE_SERVICES),$(MODULES)),push_$(module))
@@ -50,6 +62,22 @@ INSTALL_RULES := $(foreach module,$(MODULES),install_$(module))
 REINSTALL_RULES := $(foreach module,$(MODULES),reinstall_$(module))
 UNINSTALL_RULES := $(foreach module,$(MODULES),uninstall_$(module))
 
+CPU_ARCH := $(if $(shell which arch 2>/dev/null),\
+	$(shell arch),\
+	$(shell lscpu | grep ^Architecture: | sed "s/^Architecture:[[:space:]]*\([[:alnum:][:punct:]]\+\).*/\1/"))
+IMAGE_PREFIX := $(if $(filter armv7%,$(CPU_ARCH)),armv7/)
+COMPOSE_CMD := \
+	ALPINE_VERSION="$(ALPINE_VERSION)" \
+	IMAGE_PREFIX="$(IMAGE_PREFIX)" \
+	GEMINI_CERTIFICATES_DIR="$(GEMINI_CERTIFICATES_DIR)" \
+	GEMINI_COMITIUM_DATA_DIR="$(GEMINI_COMITIUM_DATA_DIR)" \
+	ETHERPAD_DATA_DIR="$(ETHERPAD_DATA_DIR)" \
+	ETHERPAD_VERSION="$(ETHERPAD_VERSION)" \
+	VAULTWARDEN_DATA_DIR="$(VAULTWARDEN_DATA_DIR)" \
+	LOCAL_SMTP_PORT=$(PORT_smtp) \
+	$(foreach module,$(ALL_MODULES),$(call capitalise,$(module))_PORT=$(PORT_$(module))) \
+	podman-compose
+
 $(foreach module,$(ALL_NGINX_MODULES), \
 	$(if $(SUBDOMAIN_$(module)),, \
 		$(error $(module) is declared as an nginx module, but SUBDOMAIN_$(module) is not set)))

mox/.gitignore

@@ -0,0 +1,2 @@
+config/dkim
+config/adminpasswd

mox/README.md

@@ -0,0 +1,6 @@
+# mox
+
+There are three secrets required for mox. One is the admin password, which
+should be stored in config/adminpasswd. The other two are DKIM private keys,
+which should be stored in the config/dkim directory. The public parts of these
+keys should be exposed in DNS TXT records.

mox/config/domains.conf

@@ -0,0 +1,52 @@
+Domains:
+	mail.joeac.net:
+		ClientSettingsDomain: clientsettings.mail.joeac.net
+		LocalpartCatchallSeparator: +
+		DKIM:
+			Selectors:
+				2026a:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+				2026b:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+			Sign:
+				- 2026a
+		DMARC:
+			Localpart: dmarcreports
+			Account: me
+			Mailbox: DMARC
+		MTASTS:
+			PolicyID: 20260705T153220
+			Mode: enforce
+			MaxAge: 24h0m0s
+			MX:
+				- mail.joeac.net
+		TLSRPT:
+			Localpart: tlsreports
+			Account: me
+			Mailbox: TLSRPT
+Accounts:
+	me:
+		Domain: mail.joeac.net
+		Destinations:
+			me@mail.joeac.net: nil
+		SubjectPass:
+			Period: 12h0m0s
+		RejectsMailbox: Rejects
+		AutomaticJunkFlags:
+			Enabled: true
+			JunkMailboxRegexp: ^(junk|spam)
+			NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)
+		JunkFilter:
+			Threshold: 0.950000
+			Params:
+				Onegrams: true
+				MaxPower: 0.010000
+				TopWords: 10
+				IgnoreWords: 0.100000
+				RareWords: 2
+		NoCustomPassword: true
+MonitorDNSBLs:
+	- sbl.spamhaus.org
+	- bl.spamcop.net

mox/config/mox.conf

@@ -0,0 +1,74 @@
+DataDir: ../data
+LogLevel: debug
+User: mox
+Hostname: mail.joeac.net
+AdminPasswordFile: adminpasswd
+Listeners:
+	internal:
+		IPs:
+			- 127.0.0.1
+			- ::1
+		Hostname: localhost
+		AccountHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		AdminHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebmailHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebAPIHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		MetricsHTTP:
+			Enabled: true
+		AutoconfigHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		MTASTSHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		WebserverHTTP:
+			Enabled: true
+			Port: 81
+	public:
+		IPs:
+			- 192.168.178.75
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		NATIPs:
+			- 217.155.190.42
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		TLS:
+			KeyCerts:
+				-
+					CertFile: path/to/mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/mail.joeac.net.key.pem
+				-
+					CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/mta-sts.mail.joeac.net.key.pem
+				-
+					CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/autoconfig.mail.joeac.net.key.pem
+				-
+					CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem
+					KeyFile: path/to/clientsettings.mail.joeac.net.key.pem
+		SMTP:
+			Enabled: true
+		Submissions:
+			Enabled: true
+		IMAPS:
+			Enabled: true
+Postmaster:
+	Account: me
+	Mailbox: Postmaster
+HostTLSRPT:
+	Account: me
+	Mailbox: TLSRPT
+	Localpart: tlsreports

mox/dnssec.conf

@@ -0,0 +1,8 @@
+server:
+    auto-trust-anchor-file: /var/lib/unbound/root.key
+    qname-minimisation: yes
+    interface: 0.0.0.0
+    access-control: 192.168.0.0/16 allow
+
+remote-control:
+    control-enable: yes

mox/install.mk

@@ -0,0 +1,56 @@
+.PHONY: install
+install: install_unbound install_mox
+
+.PHONY: install_unbound
+install_unbound: /usr/sbin/unbound /etc/resolv.conf /var/lib/unbound/root.key install_unbound_anchor_crontab /etc/unbound/unbound.conf.d/dnssec.conf
+
+/usr/sbin/unbound:
+	sudo apk add unbound
+	sudo rc-update add unbound default
+	sudo rc-service unbound start
+
+/etc/resolv.conf: resolv.conf /etc/resolv.conf.joeac.net-backup
+	sudo cp resolv.conf /etc/resolv.conf
+
+/etc/resolv.conf.joeac.net-backup:
+	sudo mv /etc/resolv.conf /etc/resolv.conf.joeac.net-backup
+
+/var/lib/unbound/root.key:
+	sudo mkdir -p /var/lib/unbound && sudo unbound-anchor -a /var/lib/unbound/root.key
+
+UNBOUND_ANCHOR_CRONTAB_ENTRY := @reboot unbound-anchor -a /var/lib/unbound/root.key # managed by joeac.net
+IS_CRONTAB_UP_TO_DATE := $(sudo grep "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" /etc/crontabs/root)
+.PHONY: install_unbound_anchor_crontab
+install_unbound_anchor_crontab:
+	$(if $(IS_CRONTAB_UP_TO_DATE),,\
+		sudo crontab -l > crontab.tmp; \
+		sed -i "s/.*unbound-anchor.*# managed by joeac.net//" crontab.tmp; \
+		echo "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" >> crontab.tmp; \
+		sudo crontab crontab.tmp; \
+		rm crontab.tmp; \
+	)
+
+/etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf
+	sudo mkdir -p $(dir $@) && sudo cp $< $@
+
+DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B)
+.PHONY: install_mox
+install_mox: /usr/local/bin/mox ~/mox/config/mox.conf ~/mox/config/domains.conf ~/mox/config/adminpasswd $(DKIM_PRIVATE_KEYS)
+
+MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64)
+MOX_VERSION := 0.0.15
+MOX_GO_VERSION := 1.26.4
+MOX_CHECKSUM_amd64_v0.0.15_go1.26.4 := 09OE-1QkNVgmpoRj53mtX9gxoEmY
+MOX_CHECKSUM_arm_v0.0.15_go1.26.4 := 038X9nQx6hhai60Fk1BhcP3r6Mew
+MOX_CHECKSUM := $(MOX_CHECKSUM_$(MOX_PLATFORM)_v$(MOX_VERSION)_go$(MOX_GO_VERSION))
+MOX_URL_BASE := https://beta.gobuilds.org/github.com/mjl-/mox
+MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERSION)/$(MOX_CHECKSUM)
+/usr/local/bin/mox:
+	wget -O- $(MOX_URL) | gzip -d > mox
+	chmod +x mox
+	sudo mv mox /usr/local/bin/mox
+
+~/mox/config/%: config/%
+	mkdir -p $(dir $@) && cp $< $@

mox/resolv.conf

@@ -0,0 +1 @@
+nameserver: 127.0.0.1

nginx/http.d/static.conf.template

@@ -2,7 +2,7 @@ server {
     server_name ${DOMAIN};
     location / {
         root ${ROOT};
-        try_files $uri $uri.html $uri/index.html =404;
+        try_files $$uri $$uri.html $$uri/index.html =404;
         error_page 404 /index.html;
     }
     listen 443 ssl;
@@ -18,5 +18,5 @@ server {
     } # managed by Certbot
     server_name ln.joeac.net;
     listen 80;
-    return 404; # managed by Certbot
+    return 404;
 }

openrc/init.d/joeac.net

@@ -1,65 +0,0 @@
-#!/sbin/openrc-run
-# credits:
-# https://gist.github.com/itzwam/2069e935385193207f7e5bea7156e21d
-# https://github.com/0x17de/dockerservice-openrc
-
-: ${MODULENAME:=${RC_SVCNAME##*.}}
-: ${SRCDIR:=/usr/local/lib/joeac.net}
-DOCKER_COMPOSE_UP_ARGS=${DOCKER_COMPOSE_UP_ARGS-"--no-build --no-recreate --no-deps"}
-
-[ -z "${MODULENAME}" ] && exit 1
-: ${COMPOSEFILE:="${SRCDIR}/compose.yml"}
-: ${MAKEFILE:="${SRCDIR}/Makefile"}
-COMPOSECMD="/usr/bin/podman-compose"
-export COMPOSE_HTTP_TIMEOUT=300
-
-description="Manage dockerservices defined in ${COMPOSEFILE}"
-extra_commands="configtest"
-description_configtest="Check configuration via \"podman-compose -f ${COMPOSEFILE} config\""
-
-configtest() {
-  if ! [ -f "${COMPOSEFILE}" ]; then
-    eerror "The docker-compose file ${COMPOSEFILE} does not exist!"
-    return 1
-  fi
-  if "${COMPOSECMD}" -f "${COMPOSEFILE}" config >&/dev/null; then
-    einfo "config: ok"
-  else
-    eerror "config: error"
-    return 1
-  fi
-}
-
-start() {
-  configtest || return 1
-  ebegin "Starting ${MODULENAME}"
-  "${COMPOSECMD}" -f "${COMPOSEFILE}" up -d ${DOCKER_COMPOSE_UP_ARGS} ${MODULENAME}
-  eend $?
-}
-
-stop() {
-  ebegin "Stopping ${MODULENAME}"
-  "${COMPOSECMD}" -f "${COMPOSEFILE}" down --timeout=5 ${MODULENAME}
-  eend $?
-}
-
-status() {
-  pods=0
-  started=0
-  while read pod; do
-	pod_service="$(podman inspect $pod | jq .[0].Config.Labels.[\"com.docker.compose.service\"])"
-	if ! [ "$pod_service" = "\"${MODULENAME}\"" ]; then
-		continue
-	fi
-        pods=$(($pods+1))
-        if podman top $pod &>/dev/null; then
-                einfo "status: [$pod] started"
-		exit 0
-        else
-                einfo "status: [$pod] stopped"
-		exit 3
-        fi
-  done < <("${COMPOSECMD}" -f "${COMPOSEFILE}" ps --quiet)
-  einfo "status: no container found for ${MODULENAME}"
-  exit 3
-}

openrc/init.d/joeac.net.template

@@ -0,0 +1,65 @@
+#!/sbin/openrc-run
+# credits:
+# https://gist.github.com/itzwam/2069e935385193207f7e5bea7156e21d
+# https://github.com/0x17de/dockerservice-openrc
+
+: $${HOME:=/home/joeac.net}
+: $${MODULENAME:=$${RC_SVCNAME##*.}}
+: $${SRCDIR:=$$HOME/joeac.net}
+DOCKER_COMPOSE_UP_ARGS=$${DOCKER_COMPOSE_UP_ARGS-"--no-build --no-recreate --no-deps"}
+
+[ -z "$${MODULENAME}" ] && exit 1
+: $${COMPOSEFILE:="$${SRCDIR}/compose.yml"}
+: $${MAKEFILE:="$${SRCDIR}/Makefile"}
+export COMPOSE_HTTP_TIMEOUT=300
+
+description="Manage dockerservices defined in $${COMPOSEFILE}"
+extra_commands="configtest"
+description_configtest="Check configuration via \"podman-compose -f $${COMPOSEFILE} config\""
+
+configtest() {
+  if ! [ -f "$${COMPOSEFILE}" ]; then
+    eerror "The docker-compose file $${COMPOSEFILE} does not exist!"
+    return 1
+  fi
+  if ${COMPOSECMD} -f "$${COMPOSEFILE}" config >&/dev/null; then
+    einfo "config: ok"
+  else
+    eerror "config: error"
+    return 1
+  fi
+}
+
+start() {
+  configtest || return 1
+  ebegin "Starting $${MODULENAME}"
+  ${COMPOSECMD} -f "$${COMPOSEFILE}" up -d $${DOCKER_COMPOSE_UP_ARGS} $${MODULENAME}
+  eend $$?
+}
+
+stop() {
+  ebegin "Stopping $${MODULENAME}"
+  ${COMPOSECMD} -f "$${COMPOSEFILE}" down --timeout=5 $${MODULENAME}
+  eend $$?
+}
+
+status() {
+  pods=0
+  started=0
+  while read pod; do
+	pod_service="$$(podman inspect $$pod | jq .[0].Config.Labels.[\"com.docker.compose.service\"])"
+	if ! [ "$$pod_service" = "\"$${MODULENAME}\"" ]; then
+		continue
+	fi
+        pods=$$(($$pods+1))
+        if podman top $$pod &>/dev/null; then
+                einfo "status: [$$pod] started"
+		exit 0
+        else
+                einfo "status: [$$pod] stopped"
+		exit 3
+        fi
+  done < <(${COMPOSECMD} -f "$${COMPOSEFILE}" ps --quiet)
+  einfo "status: no container found for $${MODULENAME}"
+  exit 3
+}

update.sh

@@ -1,5 +1,10 @@
 #!/bin/sh
 
+if [ -z "${XDG_RUNTIME_DIR}" ]
+then
+  export XDG_RUNTIME_DIR=/tmp/xdg/$(id -u joeac.net)-xdg-runtime-dir
+fi
+
 cd /home/joeac.net/joeac.net \
   && sudo -u joeac.net git pull \
   && sudo -u joeac.net make \

vaultwarden/install.mk

@@ -6,6 +6,7 @@ reinstall: $(VAULTWARDEN_DATA_DIR)
 
 $(VAULTWARDEN_DATA_DIR):
 	sudo mkdir -p $(VAULTWARDEN_DATA_DIR)
+	VAULTWARDEN_USER=$(whoami) && sudo chown $$VAULTWARDEN_USER:$$VAULTWARDEN_USER $(VAULTWARDEN_DATA_DIR)
 
 .PHONY: uninstall
 uninstall: