zen, not sbl, .spamhaus.org

Makefile

@@ -17,19 +17,19 @@ endef
 
 define install_module_rule =
 .PHONY: install_$(module)
-install_$(module): install_openrc_$(module) install_dyndns_$(module) $(install_submake_file)
+install_$(module): install_openrc_$(module) install_dyndns_$(module) $(if $(SUBDOMAIN_$(module)),install_tls_$(SUBDOMAIN_$(module))) $(install_submake_file)
 	$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) install)
 endef
 
 define reinstall_module_rule =
 .PHONY: reinstall_$(module)
-reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) $(install_submake_file)
+reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) $(if $(SUBDOMAIN_$(module)),reinstall_tls_$(SUBDOMAIN_$(module))) $(install_submake_file)
 	$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) reinstall)
 endef
 
 define uninstall_module_rule =
 .PHONY: uninstall_$(module)
-uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module)
+uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module) $(if $(SUBDOMAIN_$(module)),install_tls_$(SUBDOMAIN_$(module)))
 	$(if $(install_submake_file),\
 		$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory $(dir $(install_submake_file)) uninstall
 	)
@@ -42,13 +42,13 @@ $(foreach module,$(ALL_MODULES),$(eval $(call make_module_rule)))
 $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule)))
 
 .PHONY: install
-install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab
+install: install_nginx install_tls $(ENV_RULES) $(INSTALL_RULES) install_crontab
 
 .PHONY: reinstall
-reinstall: reinstall_nginx reinstall_dyndns $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
+reinstall: reinstall_nginx reinstall_dyndns reinstall_tls $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
 
 .PHONY: uninstall
-uninstall: uninstall_nginx uninstall_dyndns uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
+uninstall: uninstall_nginx uninstall_dyndns uninstall_tls uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
 
 $(foreach module,$(ALL_MODULES),$(eval $(install_module_rule)))
 $(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule)))
@@ -63,3 +63,4 @@ include make/openrc.mk
 include make/nginx.mk
 include make/crontab.mk
 include make/dyndns.mk
+include make/tls.mk

README.md

@@ -7,3 +7,98 @@ To install:
 ```sh
 wget -O- https://git.joeac.net/joeac/joeac.net/raw/branch/main/install.sh | sh
 ```
+
+## DNS setup
+
+A/AAAA DNS records are added automatically by `make install`, but in order to
+get `mox` working as an email server, you'll have to manually add the following
+DNS records.
+
+Deliver mail for mail.joeac.net to mail.joeac.net:
+
+```
+mail.joeac.net. MX 10 mail.joeac.net.
+```
+
+All emails from the email server will be signed with two DKIM keys. So that
+clients can verify the authenticity of the messages, provide these keys as TXT
+records:
+
+```
+2026a._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvYfjrzmYgBtYofzBwI80aiW98+M2g6z+gd1Iwz9g0y30rPFNTctFn9GwBNuYBgZiZxB+sqjEbPMbr3li/R7i0A9t/KbNNJhkNC+4IjKJjk+jw1CXm4vXOUa4YSYWwy7NVYTH/QwZGz6fwjVM7YvDnnE4gG2NwrVx+AXlONt2R1G+qgV6HAIIvVi8T0yCjjqEc5B5bKlqk0XU9vSyUFJhhKnR/KNRe79C+H9GWJzcU7HUCmIHX04Xi0JeB/wm3weF1xjtGTsWyy5BmHHsfWGqSr2Dbg5o6AI5W0h4VkQ4QzdEYGVQ9ZBDyqFQwQFXLn0oHZjCD/vFzPOPdM5pxF/OgwIDAQAB
+2026b._domainkey.mail.joeac.net. TXT v=DKIM1;h=sha256;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzcrk9FUt6AdrvnAP3KawuOTLw7uL5SJ+ZYmShuz41zwM6bPQteGSSwddFXIxcqVlJrdFahrK4KvHX/sw/hWVfZoPLDdwsGN5eI8cqQjNDE+JDu9BbPlTituva4Hkve0hbAKDqA8jmbcZg6aU7b44Kzq8UpWAlPO273Rq2tsbCBcITt8B3NFoeY9CSsZU1LqGl855GUtaNyhlPaAvfab3Q9/4wyusPhCHlBYaRK+ZzuSMs5KEOG6n4kbZfMVi2+4c/bPU5PdTuyvbSIEqjNH4TpfatE0I9ubGv0WbAzr5EZbv5+xtukZ/dIisPPMjn1AbjpSJYNYr2OYgey6+WvzRmQIDAQAB
+```
+
+Specify the MX host is allowed to send for our domain and for itself (for DSNs).
+~all means softfail for anything else, which is done instead of -all to prevent
+older mail servers from rejecting the message because they never get to looking
+for a dkim/dmarc pass.
+
+```
+mail.joeac.net. TXT v=spf1 ip4:217.155.190.42 ip6:fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17 mx ~all
+```
+
+Emails that fail the DMARC check (without aligned DKIM and without aligned SPF)
+should be rejected, and request reports. If you email through mailing lists that
+strip DKIM-Signature headers and don't rewrite the From header, you may want to
+set the policy to p=none.
+
+```
+_dmarc.mail.joeac.net. TXT v=DMARC1;p=reject;rua=mailto:dmarcreports@mail.joeac.net!10m
+```
+
+Remote servers can use MTA-STS to verify our TLS certificate with the WebPKI
+pool of CA's (certificate authorities) when delivering over SMTP with
+STARTTLSTLS.
+
+```
+mta-sts.mail.joeac.net.  CNAME mail.joeac.net.
+_mta-sts.mail.joeac.net. TXT v=STSv1; id=20260705T153220
+```
+
+Request reporting about TLS failures.
+
+```
+_smtp._tls.mail.joeac.net. TXT v=TLSRPTv1; rua=mailto:tlsreports@mail.joeac.net
+```
+
+Client settings will reference a subdomain of the hosted domain, making it
+easier to migrate to a different server in the future by not requiring settings
+in all clients to be updated.
+
+```
+clientsettings.mail.joeac.net. CNAME mail.joeac.net.
+```
+
+Autoconfig is used by Thunderbird. Autodiscover is (in theory) used by
+Microsoft.
+
+```
+autoconfig.mail.joeac.net.         CNAME mail.joeac.net.
+_autodiscover._tcp.mail.joeac.net. SRV 0 1 443 mail.joeac.net.
+```
+
+For secure IMAP and submission autoconfig, point to mail host.
+
+```
+_imaps._tcp.mail.joeac.net.        SRV 0 1 993 mail.joeac.net.
+_submissions._tcp.mail.joeac.net.  SRV 0 1 465 mail.joeac.net.
+```
+
+Next records specify POP3 and non-TLS ports are not to be used. These are
+optional and safe to leave out (e.g. if you have to click a lot in a DNS admin
+web interface).
+
+```
+_imap._tcp.mail.joeac.net.         SRV 0 0 0 .
+_submission._tcp.mail.joeac.net.   SRV 0 0 0 .
+_pop3._tcp.mail.joeac.net.         SRV 0 0 0 .
+_pop3s._tcp.mail.joeac.net.        SRV 0 0 0 .
+```
+
+Optional: You could mark Let's Encrypt as the only Certificate Authority allowed
+to sign TLS certificates for your domain.
+
+```
+mail.joeac.net. CAA 0 issue "letsencrypt.org"
+```

common/microlog/2026-07-06.gmi

@@ -0,0 +1,3 @@
+I've been following Ink and Switch's blog for a while. They're working creatively with computers. This is a great discussion about LLMs which covers what they are, how they are being abused to de-humanise the world, and how things could be different, concluding in a call for 'punk computing.' Let's have it!
+
+=> https://www.inkandswitch.com/tangents/artificial/ Artificial | Ink and Switch

gemini/install.mk

@@ -8,11 +8,11 @@ reinstall: $(GEMINI_CERTIFICATES_DIR) $(GEMINI_COMITIUM_DATA_FILES)
 
 $(GEMINI_CERTIFICATES_DIR):
 	sudo mkdir -p $(GEMINI_CERTIFICATES_DIR)
-	GEMINI_USER=$(whoami) && sudo chown $$GEMINI_USER:$$GEMINI_USER $(GEMINI_CERTIFICATES_DIR)
+	$(let gemini_user,$(shell whoami),sudo chown -R $(gemini_user):$(gemini_user) $(GEMINI_CERTIFICATES_DIR))
 
 $(GEMINI_COMITIUM_DATA_DIR)/%: comitium-data/% $(GEMINI_COMITIUM_DATA_DIR)
 	sudo cp $< $@
-	GEMINI_USER=$(whoami) && sudo chown $$GEMINI_USER:$$GEMINI_USER $(GEMINI_CERTIFICATES_DIR)
+	$(let gemini_user,$(shell whoami),sudo chown $(gemini_user):$(gemini_user) $@)
 
 $(GEMINI_COMITIUM_DATA_DIR):
 	sudo mkdir -p $(GEMINI_COMITIUM_DATA_DIR)

make/dyndns.mk

@@ -5,7 +5,7 @@ dyndns_crontabs_to_remove = $(dyndns_subdomains_to_remove:%=/etc/periodic/daily/
 
 define install_dyndns_module_rule =
 .PHONY: install_dyndns_$(module)
-install_dyndns_module_$(module): $(if $(SUBDOMAIN_$(module)),/etc/periodic/daily/dyndns-$(SUBDOMAIN_$(module)).joeac.net install_dyndns)
+install_dyndns_module_$(module): $(if $(SUBDOMAIN_$(module)),/etc/periodic/daily/dyndns-$(SUBDOMAIN_$(module)).joeac.net)
 endef
 
 define reinstall_dyndns_module_rule =

make/nginx.mk

@@ -6,6 +6,7 @@ nginx_module_config_template = \
 	$(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \
 	$(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template)
 nginx_module_config_template_args = \
+	CERTNAME=$(SUBDOMAIN_$(module)).joeac.net \
 	DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \
 	$(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \
 	$(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))")

make/openrc.mk

@@ -43,11 +43,11 @@ openrc_restart_$(module):
 	rc-service -U joeac.net.$(module) restart
 endef
 
-$(foreach module,$(MODULES),$(eval $(install_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(install_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(reinstall_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(reinstall_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(uninstall_openrc_module_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(uninstall_openrc_module_rule)))
-$(foreach module,$(MODULES),$(eval $(openrc_add_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(openrc_add_rule)))
-$(foreach module,$(MODULES),$(eval $(openrc_start_rule)))
+$(foreach module,$(ALL_MODULES),$(eval $(openrc_start_rule)))
 $(foreach module,$(MODULES),$(eval $(openrc_restart_rule)))
 
 ~/.config/rc/init.d/joeac.net: openrc/init.d/joeac.net.template ~/.config/rc/init.d ~/.config/rc/runlevels/default /etc/init.d/user.$(USER) /etc/conf.d/user.$(USER)

make/tls.mk

@@ -0,0 +1,88 @@
+installed_tls_crontabs = $(wildcard /etc/periodic/daily/tls-*.joeac.net)
+installed_tls_crontab_subdomains = $(installed_tls_crontabs:/etc/periodic/daily/tls-%.joeac.net=%)
+tls_crontab_subdomains_to_remove = $(filter-out $(SUBDOMAINS),$(installed_tls_crontab_subdomains))
+tls_crontabs_to_remove = $(tls_crontab_subdomains_to_remove:%=/etc/periodic/daily/tls-%.joeac.net)
+
+installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net)
+installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%)
+tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains))
+
+tls_crontab = /etc/periodic/daily/tls-$(subdomain).joeac.net
+tls_cert = /etc/letsencrypt/live/$(subdomain).joeac.net/fullchain.pem
+
+define install_tls_subdomain_rule =
+.PHONY: install_tls_$(subdomain)
+install_tls_$(subdomain): $(tls_crontab) $(tls_cert)
+endef
+
+define reinstall_tls_subdomain_rule =
+.PHONY: reinstall_tls_$(subdomain)
+reinstall_tls_$(subdomain): $(tls_crontab) renew_$(tls_cert)
+endef
+
+define uninstall_tls_subdomain_rule =
+.PHONY: uninstall_tls_$(subdomain)
+uninstall_tls_$(subdomain): delete_cert_$(subdomain).joeac.net
+	$(if $(shell [ -f $(tls_crontab) ] && echo 1),\
+		sudo rm -f $(tls_crontab)
+	)
+endef
+
+define obtain_or_renew_cert_cmd =
+sudo certbot certonly \
+	--nginx \
+	--cert-name $(subdomain).joeac.net \
+	--domain $(subst @.,,$(subdomain).)joeac.net \
+	&& sudo chown -R joeac.net:joeac.net $(dir $(tls_cert))
+endef
+
+is_cert_expired = $(shell sudo certbot certificates --cert-name $(subdomain).joeac.net \
+	| grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)")
+define cert_rule =
+$(tls_cert):
+	$(obtain_or_renew_cert_cmd)
+
+.PHONY: renew_$(tls_cert)
+renew_$(tls_cert):
+	$$(if $$(is_cert_expired),$(obtain_or_renew_cert_cmd))
+endef
+
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(install_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(reinstall_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(uninstall_tls_subdomain_rule)))
+$(foreach subdomain,$(ALL_SUBDOMAINS), $(eval $(cert_rule)))
+
+.PHONY: remove_/etc/periodic/daily/tls-%.joeac.net
+remove_/etc/periodic/daily/tls-%.joeac.net:
+	rm -f $(@:remove_%=%)
+
+.PHONY: delete_cert_%
+delete_cert_%:
+	sudo certbot delete --cert-name $(@:delete_cert_%=%).joeac.net --non-interactive
+
+/etc/periodic/daily/tls-%joeac.net:
+	echo "#!/bin/sh" > crontab.tmp
+	echo "$(obtain_or_renew_cert_cmd)" >> crontab.tmp
+	sudo mv crontab.tmp $@
+	sudo chmod +x $@
+
+certs_to_renew = $(foreach subdomain,$(filter $(SUBDOMAINS),$(installed_tls_cert_subdomains)),$(tls_cert))
+tls_crontabs_to_install = $(foreach subdomain,$(SUBDOMAINS),$(tls_crontab))
+tls_certs_to_install = $(foreach subdomain,$(SUBDOMAINS),$(tls_cert))
+.PHONY: install_tls
+install_tls: $(tls_crontabs_to_install) $(tls_certs_to_install) $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(addprefix renew_,$(certs_to_renew))
+
+.PHONY: reinstall_tls
+reinstall_tls: install_tls
+
+.PHONY: uninstall_tls
+uninstall_tls: $(foreach subdomain,$(ALL_SUBDOMAINS),$(uninstall_tls_$(subdomain)))
+
+.PHONY: install_certbot
+install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx
+
+/usr/bin/certbot /usr/bin/python:
+	sudo apk add certbot
+
+/usr/lib/python%/certbot_nginx:
+	sudo apk add certbot-nginx

make/vars.mk

@@ -8,7 +8,7 @@ IP_ADDR_blade-canongate := 192.168.178.75
 MASTER_NODE := blade-canongate
 IS_MASTER_NODE := $(filter $(MASTER_NODE),$(HOSTNAME))
 MODULES_pi-broughton := http smtp vaultwarden ln
-MODULES_blade-canongate := etherpad gemini
+MODULES_blade-canongate := etherpad gemini mox mox_clientsettings mox_autoconfig mox_mta_sts
 ALL_NGINX_MODULES := http vaultwarden ln etherpad
 NGINX_MODULES := $(if $(IS_MASTER_NODE),$(ALL_NGINX_MODULES))
 MODULES := $(MODULES_$(HOSTNAME))
@@ -22,10 +22,17 @@ SUBDOMAIN_http := @
 SUBDOMAIN_vaultwarden := pwd
 SUBDOMAIN_etherpad := docs
 SUBDOMAIN_ln := ln
+SUBDOMAIN_mox := mail
+SUBDOMAIN_mox_autoconfig := autoconfig.mail
+SUBDOMAIN_mox_clientsettings := clientsettings.mail
+SUBDOMAIN_mox_mta_sts := mta-sts.mail
 
 PORT_etherpad := 9001
 PORT_http := 8080
 PORT_gemini := 1965
+PORT_mox := 81
+PORT_mox_autoconfig := $(PORT_mox)
+PORT_mox_mta_sts := $(PORT_mox)
 PORT_smtp := 2500
 PORT_vaultwarden := 9000
 
@@ -44,10 +51,11 @@ $(foreach module,$(ALL_MODULES),$(if $(PORT_$(module)),$(eval \
 $(foreach hostname,$(HOSTNAMES),$(foreach module,$(MODULES_$(hostname)),$(eval \
 	export HOST_$(module) := $(if $(filter $(HOSTNAME),$(hostname)),127.0.0.1,$(IP_ADDR_$(hostname))))))
 
-SUBDOMAINS := $(foreach module,$(MODULES),$(SUBDOMAIN_$(module)))
+ALL_SUBDOMAINS := $(foreach module,$(ALL_MODULES),$(SUBDOMAIN_$(module)))
+SUBDOMAINS := $(if $(IS_MASTER_NODE),$(ALL_SUBDOMAINS))
 NGINX_SUBDOMAINS := $(foreach module,$(NGINX_MODULES),$(SUBDOMAIN_$(module)))
 
-ENV_RULES := $(foreach module,$(MODULES),$(module)/.env)
+ENV_RULES := $(foreach module,$(MODULES),$(if $(shell test -d $(module) && echo 1),$(module)/.env))
 MAKE_RULES := $(foreach module,$(MAKE_MODULES),make_$(module))
 BUILD_RULES := $(foreach module,$(filter $(COMPOSE_SERVICES),$(MODULES)),build_$(module))
 PUSH_RULES := $(foreach module,$(filter $(COMPOSE_SERVICES),$(MODULES)),push_$(module))

mox/.gitignore

@@ -0,0 +1,2 @@
+config/dkim
+config/adminpasswd

mox/README.md

@@ -0,0 +1,6 @@
+# mox
+
+There are three secrets required for mox. One is the admin password, which
+should be stored in config/adminpasswd. The other two are DKIM private keys,
+which should be stored in the config/dkim directory. The public parts of these
+keys should be exposed in DNS TXT records.

mox/config/domains.conf

@@ -0,0 +1,52 @@
+Domains:
+	mail.joeac.net:
+		ClientSettingsDomain: clientsettings.mail.joeac.net
+		LocalpartCatchallSeparator: +
+		DKIM:
+			Selectors:
+				2026a:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+				2026b:
+					Expiration: 72h
+					PrivateKeyFile: dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+			Sign:
+				- 2026a
+		DMARC:
+			Localpart: dmarcreports
+			Account: me
+			Mailbox: DMARC
+		MTASTS:
+			PolicyID: 20260705T153220
+			Mode: enforce
+			MaxAge: 24h0m0s
+			MX:
+				- mail.joeac.net
+		TLSRPT:
+			Localpart: tlsreports
+			Account: me
+			Mailbox: TLSRPT
+Accounts:
+	me:
+		Domain: mail.joeac.net
+		Destinations:
+			me@mail.joeac.net: nil
+		SubjectPass:
+			Period: 12h0m0s
+		RejectsMailbox: Rejects
+		AutomaticJunkFlags:
+			Enabled: true
+			JunkMailboxRegexp: ^(junk|spam)
+			NeutralMailboxRegexp: ^(inbox|neutral|postmaster|dmarc|tlsrpt|rejects)
+		JunkFilter:
+			Threshold: 0.950000
+			Params:
+				Onegrams: true
+				MaxPower: 0.010000
+				TopWords: 10
+				IgnoreWords: 0.100000
+				RareWords: 2
+		NoCustomPassword: true
+MonitorDNSBLs:
+	- zen.spamhaus.org
+	- bl.spamcop.net

mox/config/mox.conf

@@ -0,0 +1,74 @@
+DataDir: ../data
+LogLevel: debug
+User: mox
+Hostname: mail.joeac.net
+AdminPasswordFile: adminpasswd
+Listeners:
+	internal:
+		IPs:
+			- 127.0.0.1
+			- ::1
+		Hostname: localhost
+		AccountHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		AdminHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebmailHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		WebAPIHTTP:
+			Enabled: true
+			Port: 1080
+			Forwarded: true
+		MetricsHTTP:
+			Enabled: true
+		AutoconfigHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		MTASTSHTTPS:
+			Enabled: true
+			Port: 81
+			NonTLS: true
+		WebserverHTTP:
+			Enabled: true
+			Port: 81
+	public:
+		IPs:
+			- 192.168.178.75
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		NATIPs:
+			- 217.155.190.42
+			- fdc9:6aec:7a18:0:2e0:4cff:fe61:9b17
+		TLS:
+			KeyCerts:
+				-
+					CertFile: /etc/letsencrypt/live/mail.joeac.net/fullchain.pem
+					KeyFile: /etc/letsencrypt/live/mail.joeac.net/privkey.pem
+				-
+					CertFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem
+					KeyFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/privkey.pem
+				-
+					CertFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem
+					KeyFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/privkey.pem
+				-
+					CertFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem
+					KeyFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/privkey.pem
+		SMTP:
+			Enabled: true
+		Submissions:
+			Enabled: true
+		IMAPS:
+			Enabled: true
+Postmaster:
+	Account: me
+	Mailbox: Postmaster
+HostTLSRPT:
+	Account: me
+	Mailbox: TLSRPT
+	Localpart: tlsreports

mox/dnssec.conf

@@ -0,0 +1,8 @@
+server:
+    auto-trust-anchor-file: /var/lib/unbound/root.key
+    qname-minimisation: yes
+    interface: 0.0.0.0
+    access-control: 192.168.0.0/16 allow
+
+remote-control:
+    control-enable: yes

mox/install.mk

@@ -0,0 +1,63 @@
+.PHONY: install
+install: install_unbound install_mox
+
+.PHONY: reinstall
+reinstall: install_unbound install_mox
+
+.PHONY: install_unbound
+install_unbound: /usr/sbin/unbound /etc/resolv.conf /var/lib/unbound/root.key install_unbound_anchor_crontab /etc/unbound/unbound.conf.d/dnssec.conf
+
+/usr/sbin/unbound:
+	sudo apk add unbound
+	sudo rc-update add unbound default
+	sudo rc-service unbound start
+
+/etc/resolv.conf: resolv.conf /etc/resolv.conf.joeac.net-backup
+	sudo cp resolv.conf /etc/resolv.conf
+
+/etc/resolv.conf.joeac.net-backup:
+	sudo mv /etc/resolv.conf /etc/resolv.conf.joeac.net-backup
+
+/var/lib/unbound/root.key:
+	sudo mkdir -p /var/lib/unbound && sudo unbound-anchor -a /var/lib/unbound/root.key
+
+UNBOUND_ANCHOR_CRONTAB_ENTRY := @reboot unbound-anchor -a /var/lib/unbound/root.key # managed by joeac.net
+IS_CRONTAB_UP_TO_DATE := $(sudo grep "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" /etc/crontabs/root)
+.PHONY: install_unbound_anchor_crontab
+install_unbound_anchor_crontab:
+	$(if $(IS_CRONTAB_UP_TO_DATE),,\
+		sudo crontab -l > crontab.tmp; \
+		sed -i "s/.*unbound-anchor.*# managed by joeac.net//" crontab.tmp; \
+		echo "$(UNBOUND_ANCHOR_CRONTAB_ENTRY)" >> crontab.tmp; \
+		sudo crontab crontab.tmp; \
+		rm crontab.tmp; \
+	)
+
+/etc/unbound/unbound.conf.d/dnssec.conf: dnssec.conf
+	sudo mkdir -p $(dir $@) && sudo cp $< $@
+
+DKIM_PRIVATE_KEY_A := ~/mox/config/dkim/2026a._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEY_B := ~/mox/config/dkim/2026b._domainkey.mail.joeac.net.20260705T163220.rsa2048.privatekey.pkcs8.pem
+DKIM_PRIVATE_KEYS := $(DKIM_PRIVATE_KEY_A) $(DKIM_PRIVATE_KEY_B)
+MOX_TLS_CERTS := /etc/letsencrypt/live/mail.joeac.net/fullchain.pem /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem
+.PHONY: install_mox
+install_mox: /usr/local/bin/mox ~/mox/config/mox.conf ~/mox/config/domains.conf ~/mox/config/adminpasswd ~/mox/data $(DKIM_PRIVATE_KEYS) $(MOX_TLS_CERTS)
+
+MOX_PLATFORM := $(if $(filter armv7% arm32%,$(CPU_ARCH)),arm,amd64)
+MOX_VERSION := 0.0.15
+MOX_GO_VERSION := 1.26.4
+MOX_CHECKSUM_amd64_v0.0.15_go1.26.4 := 09OE-1QkNVgmpoRj53mtX9gxoEmY
+MOX_CHECKSUM_arm_v0.0.15_go1.26.4 := 038X9nQx6hhai60Fk1BhcP3r6Mew
+MOX_CHECKSUM := $(MOX_CHECKSUM_$(MOX_PLATFORM)_v$(MOX_VERSION)_go$(MOX_GO_VERSION))
+MOX_URL_BASE := https://beta.gobuilds.org/github.com/mjl-/mox
+MOX_URL := $(MOX_URL_BASE)@v$(MOX_VERSION)/linux-$(MOX_PLATFORM)-go$(MOX_GO_VERSION)/$(MOX_CHECKSUM)
+/usr/local/bin/mox:
+	wget -O- $(MOX_URL) | gzip -d > mox
+	chmod +x mox
+	sudo mv mox /usr/local/bin/mox
+
+~/mox/config/%: config/%
+	mkdir -p $(dir $@) && cp $< $@
+
+~/mox/data:
+	mkdir -p $@

mox/resolv.conf

@@ -0,0 +1 @@
+nameserver: 127.0.0.1

nginx/http.d/static.conf.template

@@ -6,8 +6,8 @@ server {
         error_page 404 /index.html;
     }
     listen 443 ssl;
-    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/${CERTNAME}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${CERTNAME}/privkey.pem;
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 }