Notes

After self-hosting Mail-in-a-Box for a few months, I ended my experiment and moved to Migadu so as to let more experienced folks manage this critical infrastructure for me. As part of that migration, I learnt that MIAB sets up an MTA-STS policy and Migadu, by default, doesn’t guide you to do that. That led to Gmail failing to send emails to me because it was caching the older but no longer valid policy. ...

Here are some good, self-hostable and all-in-one email server projects I’ve encountered. Mail-in-a-Box: too opinionated out of the box. Posteo. Docker based: Docker mail-server: Decent number of maintainers, decently lightweight (for e.g., 2GB RAM), secure enough etc. No web UIs. Mailcow. Requires ~8 GB RAM though. Mailu. Modoboa. The following look interesting but are maintained by a single maintainer (something that I’d like to avoid): Maddy. Mox - looks lightweight. Stalwart - again, lightweight plus modern. However, in my limited experience of couple of months, there is a lot that can go wrong while self-hosting email, especially things that aren’t in your control. So, apart from intellectual curiosity or if you are getting paid, there is no good reason to go this route.

I self-host Step CA alongside Traefik in my home environment. Last weekend, I tried setting up mTLS using the two for additional security. Helpful commands: # I got the certificate fingerprint by running the following inside the Step CA Docker container: step certificate fingerprint certs/root_ca.crt # Bootstrap Step CA CLI on my MacOS (which is a different device than the one that hosts the CA): step ca bootstrap \ --ca-url https://web-server.lan:9000 \ --fingerprint=foo # Generate a new client certificate: step ca certificate \ ketan-ios ketan-ios.crt ketan-ios.key \ --ca-url=https://web-server.lan:9000 \ --provisioner='admin' \ # There is a command to list provisioners inside the Step CA container. --not-after=87600h # Convert the client cert and key into a file format that can be imported into an iOS device. step certificate p12 ketan-ios.p12 ketan-ios.crt ketan-ios.key With all this, I was able to connect through Curl: ...

Here are some mental models that I am building while reading The Kubernetes Book: Pods are the smallest building block. They are a collection of containers that are created, destroyed, deployed etc. together. Kubernetes is a generic control plane that allows you to run applications using these pods. For example: how to make sure X pods are running all the time, how to automatically recover from pod failures, how to deploy or rollabck safely, how to route traffic to these pods etc.? On the surface, the idea seems powerful. For e.g., the AWS service that I am currently part of manages its own control plane which takes care of Docker containers for customers. That’s pretty similar to what Kubernetes would have provided us. However, I haven’t operated Kubernetes myself, so my knowledge is theoretical and I don’t know how it works in practice. Kubernetes provides an imperative interface: users define what end state they want and Kubernetes figures out how to get there.

I recently setup a private CA, i.e. certificate authority, using Step CA. Here are a few things I learnt: Step CA generates the following at the start: Root certificate and corresponding private key. Former should be distributed to required client devices. Latter is super-secret and should ideally be kept offline. Intermediate certificate and corresponding private key. Latter is a secret but not super-secret and supposed to be kept online. These two are used to generate the end certificates that services should use. These certificates will have short expiry (such as 1 to 90 days). If compromised, can be thrown away and a new {certificate, private-key} pair can be generated using the root pair. The {certificate, private-key} pair generates new certificates that are used by the service. On the client side, the chain of trust, all the way back to the root certificate, allows it to setup a proper TLS connection with the service. Why Step CA and not regular X.509 certificates? ...

Causality: Transaction A could happen before B, after or concurrently. In the first 2 cases, there is said to be causal connection between the transactions. Cross channel timing dependencies: if there are 2 communication channels between 2 systems, one slow channel can break causality. Causal order is not equal to total order. Linearizability, by definition,gives the latter because it makes the system behave as if there is a single copy of the data. However, has a performance penalty and many systems that pretend to require linearizability, in reality, only require causality. Lamport clocks. How are they different from version vectors?

Nice tool(s) for verifying blacklist/spamlist status for an IP address or domain: https://multirbl.valli.org/lookup/5.78.92.211.html

Follow these steps, if on Oracle. Follow: https://repo.powerdns.com/ to add official distribution repo. If port 53 is in use, free that up before proceeding. Similar to this, run: sudo sed -r -i.orig 's/#?DNSStubListener=yes/DNSStubListener=no/g' /etc/systemd/resolved.conf sudo systemctl restart systemd-resolved sudo apt-get install -y pdns-server pdns-backend-sqlite3 sqlite3 Allow ingress traffic for DNS - port 53 for both TCP/UDP - on the cloud provider. Now, follow steps here to setup a Sqlite backend. (Config file is present here: /etc/powerdns.) Follow this if you want to setup an ALIAS record. The value of resolver should be one that is able to make recursive DNS queries to upstream. Check /etc/resolv.conf: on Oracle, I had to put: resolver=169.254.169.254. On the domain registrar, put DNS glue records as: ns1.tw.in.eu.org -> 155.248.213.202 Helpful commands: ...

At least for SMTP: TLS: Forced TLS connection from the start. Port: 465. STARTTLS: Starts off with an unencrypted connection and upgrades to TLS right after. Port: 587. Usually preferred to TLS.

Play it again sports, Lynnwood. $50 for daily. Technically, it’s for the whole weekend because I can pick today, any time, and return the day after by noon. $135 weekly. $239 annually. Westra: Don’t do rentals. Not sure why their website says otherwise. Bothell ski and bike: $55 per day. Again, it’s almost 3 days actually. $300 annual for used gear, 400 for new items. Seattle Ski and Snowboard.