
Keeping the Old Addresses Alive
Nobody migrates email in one day. Fetchmail, a receive-only alias domain, and permanent redirects bridge the old world into the new one.

Making Roundcube Not Look Like 2012
Webmail is the face of the platform, so it got a Gmail-shaped skin, real calendar and contacts integration, and some money spent on polish.

Email for a Nine-Year-Old
Family accounts on self-hosted infrastructure: onboarding, self-service passwords, 2FA, and what parental visibility looks like in Sieve.

One Login for Everything: lldap and Authelia
Building the identity layer before there was much to identify against, and the OIDC decision I got to make twice.

Traefik as the Front Door
One reverse proxy design for the whole fleet, with its routing table in Valkey and its certificates feeding the mail server.

A Mesh of My Own: Headscale and Container Sidecars
Private networking between data centers with a self-hosted control plane, and a Tailscale sidecar for every container.

SPF, DKIM, DMARC: Getting Mail Delivered
Running a mail server is easy. Convincing Gmail that your mail server exists legitimately is the actual work.

One Binary for All of Email
Deploying Stalwart across two nodes, with every piece of state pushed out into managed backends.

LUKS on Every Data Volume
Full-disk encryption for servers I will never physically see, and why the unlock step stays manual.
