wayne/tailwart
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
vaguely official, slightly unfortunate
8 Commits 3 Branches 0 Tags 147 KiB
Shell 84.4%
Vim Snippet 9.6%
Dockerfile 6%
34422ba2b1
Go to file
Wayne Hayes 34422ba2b1 mailbox: give sidecar netns real IPv6 egress; resolve AAAA trap; DNS notes 
Add enable_ipv6 + a ULA subnet to tailwart_default so the Stalwart
container (sharing the ts-stalwart netns) gets working IPv6 egress.
Because only egress is needed (inbound arrives via the edge/tailnet),
a ULA + Docker masquerade suffices -- no routable prefix, ndppd, or
host sysctl changes (Docker 29 enables ip6tables by default; host
forwarding was already on). Verified: ping6 + TCP/443 to v6 literals
from inside the netns; zero ENETUNREACH since boot.

LESSONS: mark #8/#9 resolved with the ULA-masquerade recipe, and add
#13 -- Spaceship's DNS API is RRSet-upsert (not zone-replace), so
Stalwart/ACME did not eat custom AAAA records; a vanished AAAA is a
provider-side loss, not Stalwart. Includes the safe read/verify flow
and the "don't publish mail AAAA before edge v6 listeners" caveat.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-11 23:53:28 +01:00
caddy Harden mail edge: PG-race healthcheck gate, :443 SNI fan-out, docs 2026-06-11 05:15:34 +01:00
config stalwart: migrate to v0.16 config model; fix stores, listeners, persistence 2026-06-10 23:36:46 -04:00
.env.example docs: capture outbound-relay lessons (IPv6/AAAA trap, SMTP port block, sidecar ACL) 2026-06-11 22:43:21 +01:00
.gitignore Harden mail edge: PG-race healthcheck gate, :443 SNI fan-out, docs 2026-06-11 05:15:34 +01:00
acl-snippet.hujson docs: capture outbound-relay lessons (IPv6/AAAA trap, SMTP port block, sidecar ACL) 2026-06-11 22:43:21 +01:00
CLAUDE.md docs: capture outbound-relay lessons (IPv6/AAAA trap, SMTP port block, sidecar ACL) 2026-06-11 22:43:21 +01:00
docker-compose.yml mailbox: give sidecar netns real IPv6 egress; resolve AAAA trap; DNS notes 2026-06-11 23:53:28 +01:00
LESSONS.md mailbox: give sidecar netns real IPv6 egress; resolve AAAA trap; DNS notes 2026-06-11 23:53:28 +01:00
README.md caddy: build via caddyserver.com download URL, not local xcaddy 2026-06-03 22:39:33 -04:00

README.md

tailwart

Tailscale × Stalwart. A mailbox with no WAN presence, fronted by a layer-4 proxy that can live on another machine entirely.

A deliberately over-engineered playground: Stalwart mail server wired into Postgres + Redis + Garage S3 at once, deployed as a Tailscale sidecar, with a separate caddy-l4 edge that pipes the raw mail ports over the tailnet. For infinidim.net.

See CLAUDE.md for the architecture and the gotchas.

Layout

tailwart/
├── docker-compose.yml      # the mailbox: ts-stalwart sidecar + stalwart
├── config/config.toml      # Stalwart config — PG + Redis + S3 wiring (strawman)
├── caddy/                  # the edge: custom Caddy (caddy-l4) layer-4 mail proxy
│   ├── Dockerfile          #   pulls prebuilt caddy-l4 binary (caddyserver.com, no local build)
│   ├── caddy.json          #   :25/465/587/143/993 → stalwart over the tailnet
│   ├── docker-compose.yml  #   deploy on any public-IP, tailnet, tag:reverse-proxy host
│   └── README.md
├── acl-snippet.hujson      # tag:stalwart owner + grants to merge into your policy
├── .env.example            # operator surface — copy to .env
└── .gitignore

Quickstart

cp .env.example .env && $EDITOR .env        # fill secrets (see CLAUDE.md prereqs)

# 1. create the stalwart role/db in shared Postgres + the Garage bucket
#    (one-off; see CLAUDE.md "Prerequisites")
# 2. admin console: assign tag:stalwart to the OAuth client + paste acl-snippet
# 3. bring up the mailbox (tailnet-only)
docker compose up -d
# 4. bring up the edge (binds public mail ports; can be a different host)
cd caddy && docker compose up -d --build

Then point infinidim.net's MX at the edge host, add SPF/DKIM/DMARC, and finish configuration in Stalwart's web admin (mail.infinidim.net).

Status

Scaffold / strawman. The Stalwart config.toml keys need verifying against a pinned image version before first real boot — treat it as a starting shape, not a turnkey config.