Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| services:stalwart [2025/02/17 14:31] – [Autostart] willy | services:stalwart [Unknown date] (current) – removed - external edit (Unknown date) 127.0.0.1 | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Stalwart Mail Server ====== | ||
| - | |||
| - | [[https:// | ||
| - | |||
| - | I choose Stalwart because it's a new approach to serving mail. Instead of a bunch of interconnected tools, which are often a mess to setup, it's a one piece written from the ground up with a modern approach to email. | ||
| - | |||
| - | Please check [[selfhost: | ||
| - | |||
| - | ===== Installation ===== | ||
| - | |||
| - | Gentoo ships with a reasonably recent release of Stalwart, but i prefer to have finer control over it, so i prefer to install on bare-metal manually. The project also offer a bare-metal install approach which (see [[https:// | ||
| - | |||
| - | I have downloaded the script (and i suggest you do the same) and inspected it, so the following instructions are directly taken from the install script, but adapted to my setup. | ||
| - | |||
| - | **Note:** //we are installing on the external server, not on the home server!// | ||
| - | |||
| - | As usual, first of all create the user: | ||
| - | <code bash> | ||
| - | useradd -m stalwart | ||
| - | </ | ||
| - | |||
| - | Then download the latest release from [[https:// | ||
| - | <code bash> | ||
| - | su - stalwart | ||
| - | mkdir bin etc logs | ||
| - | chmod -R 755 / | ||
| - | wget ' | ||
| - | wget ' | ||
| - | cd bin | ||
| - | tar xvf ../ | ||
| - | tar xvf ../ | ||
| - | chmod +x stalwart-mail stalwart-cli | ||
| - | setcap ' | ||
| - | </ | ||
| - | |||
| - | The **setcap** is necessary to let stalwart open ports in the reserved range (<1024). | ||
| - | |||
| - | Well, it's time to initialize Stalwart: | ||
| - | <code bash> | ||
| - | / | ||
| - | ✅ Configuration file written to / | ||
| - | 🔑 Your administrator account is ' | ||
| - | chmod 700 / | ||
| - | </ | ||
| - | Note the //chmod// to ensure the config file is not readable by anybody | ||
| - | |||
| - | |||
| - | Take note of the password! You will never see it again. | ||
| - | |||
| - | Now, start the server for the first time: | ||
| - | <code bash> | ||
| - | su - stalwart # ensure you are stalwart user! | ||
| - | / | ||
| - | </ | ||
| - | |||
| - | Open up your browser and go to **http://< | ||
| - | |||
| - | ===== Configuration ===== | ||
| - | |||
| - | How to configure Stalwart can be found [[https:// | ||
| - | |||
| - | You need to setup the proper **hostname** in the server configuration. | ||
| - | |||
| - | You should **disable** the listeners for services you don't need (like POP3!). | ||
| - | |||
| - | You need to create at least one domain. This will also provide you with a full DNS setup that you **must** setup in your DNS provider. | ||
| - | |||
| - | You need to create email accounts for the domain. | ||
| - | |||
| - | TLS (SSL) certificates are mandatory, and you have a few ways to get them from Let's Encrypt. I use the standard HTTP challenge, which only requires a webserver. | ||
| - | |||
| - | ===== Certificates ===== | ||
| - | |||
| - | TLS certificates are mandatory for correct email operations. | ||
| - | |||
| - | There are three challenges that you can use to generate your certs and none fit my bill: | ||
| - | * The DNS challenge cannot be used because my DNS provider does not support APIs | ||
| - | * The other two challenges both require a web server with open ports (80 + 443), which i do have, but it points to the home, internal, server and not the external server. | ||
| - | |||
| - | The solution is to generate the certificate on the internal server using the classic HTTP Challenge, then move the certs to the external server. For this i have edited the internal server crontab to tar& | ||
| - | |||
| - | Internal server crontab: | ||
| - | < | ||
| - | 47 5 * * * / | ||
| - | 31 16 * * * / | ||
| - | </ | ||
| - | |||
| - | External server crontab: | ||
| - | < | ||
| - | 10 6 * * * sftp user@10.0.0.1:/ | ||
| - | 50 16 * * * sftp user@10.0.0.1:/ | ||
| - | </ | ||
| - | |||
| - | For this to work, you need user to be able to ssh into the wireguard tunnel without password. 10.0.0.1 is the wireguard tunnel between the external and the internal server. See [[networking: | ||
| - | |||
| - | In Stalwart, setup the certs like this: | ||
| - | < | ||
| - | %{file:/ | ||
| - | %{file:/ | ||
| - | </ | ||
| - | |||
| - | |||
| - | ===== Autostart ===== | ||
| - | |||
| - | Since i love the simplicity of OpenRC, create the following script under **/ | ||
| - | <file - stalwart> | ||
| - | # | ||
| - | # Copyright 2025 Gentoo Authors | ||
| - | # Distributed under the terms of the GNU General Public License v2 | ||
| - | |||
| - | name=" | ||
| - | description=" | ||
| - | pidfile="/ | ||
| - | command_background=true | ||
| - | command="/ | ||
| - | command_args=" | ||
| - | command_user=" | ||
| - | |||
| - | depend() { | ||
| - | need net | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | make it executable and add to default runlevel: | ||
| - | <code bash> | ||
| - | chmod +x / | ||
| - | rc-update add stalwart default | ||
| - | </ | ||
| - | |||
| - | |||
| - | |||
| - | |||