Stalwart - Revision history

Eliasp: /* Auto update TLSA records */ correct typo

2026-07-19T16:39:25Z

Auto update TLSA records: correct typo

← Older revision		Revision as of 16:39, 19 July 2026
Line 294:		Line 294:
	Stalwart [https://github.com/stalwartlabs/stalwart/issues/1664 does not yet] automatically update the TLSA record if your ACME certificate changes.		Stalwart [https://github.com/stalwartlabs/stalwart/issues/1664 does not yet] automatically update the TLSA record if your ACME certificate changes.

	Following script is a possible ~~workaounrd~~. It extracts the ACME cert every five minute, calculates the TLSA hash and compares it with the upstream record. If it doesn't match, it uses [https://github.com/Stenstromen/gotlsaflare gotlsaflare] to update the TLSA record on Cloudflare.		Following script is a possible workaround. It extracts the ACME cert every five minute, calculates the TLSA hash and compares it with the upstream record. If it doesn't match, it uses [https://github.com/Stenstromen/gotlsaflare gotlsaflare] to update the TLSA record on Cloudflare.

	<syntaxhighlight lang="nixos">systemd.services.tlsa-cloudflare-update = {		<syntaxhighlight lang="nixos">systemd.services.tlsa-cloudflare-update = {

Zevisert: Note about this page documenting the process for stalwart <0.16, link to upstream docs

2026-07-05T00:21:13Z

Note about this page documenting the process for stalwart <0.16, link to upstream docs

← Older revision		Revision as of 00:21, 5 July 2026
Line 1:		Line 1:
	[https://stalw.art Stalwart] is an open-source, all-in-one mail server solution that supports JMAP, IMAP4, and SMTP protocols. It's designed to be secure, fast, robust, and scalable, with features like built-in DMARC, DKIM, SPF, and ARC support for message authentication. It also provides strong transport security through DANE, MTA-STS, and SMTP TLS reporting. Stalwart is written in Rust, ensuring high performance and memory safety.		[https://stalw.art Stalwart] is an open-source, all-in-one mail server solution that supports JMAP, IMAP4, and SMTP protocols. It's designed to be secure, fast, robust, and scalable, with features like built-in DMARC, DKIM, SPF, and ARC support for message authentication. It also provides strong transport security through DANE, MTA-STS, and SMTP TLS reporting. Stalwart is written in Rust, ensuring high performance and memory safety.

			{{Notice
			\|icon=ⓘ
			\|color=var(--border-color-warning)
			\|background=var(--background-color-warning-subtle)
			\|The content of this page are in reference to versions of Stalwart prior to v0.16. Later versions of Stalwart have adopted a new configuration format clearly described (and with examples for NixOS) in the upstream documentation: [https://stalw.art/docs/management/cli/apply/#nixos Stalwart Declarative bulk operations].
			}}


	== Setup ==		== Setup ==

Onny: Fix credentials syntax

2026-07-03T07:59:53Z

Fix credentials syntax

← Older revision		Revision as of 07:59, 3 July 2026
Line 15:		Line 15:
	openFirewall = true;		openFirewall = true;
	credentials = {		credentials = {
	mail-pw1 = /etc/stalwart/mail-pw1;		mail-pw1 = "/etc/stalwart/mail-pw1";
	mail-pw2 = /etc/stalwart/mail-pw2;		mail-pw2 = "/etc/stalwart/mail-pw2";
	acme-secret = /etc/stalwart/acme-secret;		acme-secret = "/etc/stalwart/acme-secret";
	admin-pw = /etc/stalwart/admin-pw;		admin-pw = "/etc/stalwart/admin-pw";
	};		};
	settings = {		settings = {

Onny: Add missing credential from credentials attribute set

2026-07-03T07:55:13Z

Add missing credential from credentials attribute set

← Older revision		Revision as of 07:55, 3 July 2026
Line 18:		Line 18:
	mail-pw2 = /etc/stalwart/mail-pw2;		mail-pw2 = /etc/stalwart/mail-pw2;
	acme-secret = /etc/stalwart/acme-secret;		acme-secret = /etc/stalwart/acme-secret;
			admin-pw = /etc/stalwart/admin-pw;
	};		};
	settings = {		settings = {

Zevisert: Presumably the effort of setting up the value for a secondary password in `environment.etc."stalwart/mail-pw2"` is not meant to be for nothing. The value of `environment.etc."stalwart/mail-pw1"` is used for both of the two example users, while `pw2` was unused.

2026-06-19T06:12:25Z

Presumably the effort of setting up the value for a secondary password in `environment.etc."stalwart/mail-pw2"` is not meant to be for nothing. The value of `environment.etc."stalwart/mail-pw1"` is used for both of the two example users, while `pw2` was unused.

← Older revision		Revision as of 06:12, 19 June 2026
Line 83:		Line 83:
	class = "individual";		class = "individual";
	name = "postmaster";		name = "postmaster";
	secret = "%{file:/run/credentials/stalwart.service/mail-~~pw1~~}%";		secret = "%{file:/run/credentials/stalwart.service/mail-pw2}%";
	email = [ "postmaster@example.org" ];		email = [ "postmaster@example.org" ];
	}		}

Debtquity: change references in nix configuration examples from `stalwart-mail` to `stalwart`

2026-04-02T23:28:33Z

change references in nix configuration examples from `stalwart-mail` to `stalwart`

Show changes

Onny: Use stalwart-mail.credentials for secrets handling

2026-03-21T14:57:03Z

Use stalwart-mail.credentials for secrets handling

← Older revision		Revision as of 14:57, 21 March 2026
Line 14:		Line 14:
	enable = true;		enable = true;
	openFirewall = true;		openFirewall = true;
			credentials = {
			mail-pw1 = /etc/stalwart/mail-pw1;
			mail-pw2 = /etc/stalwart/mail-pw2;
			acme-secret = /etc/stalwart/acme-secret;
			};
	settings = {		settings = {
	server = {		server = {
Line 57:		Line 62:
	domains = [ "example.org" "mx1.example.org" ];		domains = [ "example.org" "mx1.example.org" ];
	provider = "cloudflare";		provider = "cloudflare";
	secret = "%{file:/~~etc~~/stalwart/acme-secret}%";		secret = "%{file:/run/credentials/stalwart-mail.service/acme-secret}%";
	};		};
	session.auth = {		session.auth = {
Line 72:		Line 77:
	class = "individual";		class = "individual";
	name = "User 1";		name = "User 1";
	secret = "%{file:/~~etc~~/stalwart/mail-pw1}%";		secret = "%{file:/run/credentials/stalwart-mail.service/mail-pw1}%";
	email = [ "user1@example.org" ];		email = [ "user1@example.org" ];
	}		}
Line 78:		Line 83:
	class = "individual";		class = "individual";
	name = "postmaster";		name = "postmaster";
	secret = "%{file:/~~etc~~/stalwart/mail-pw1}%";		secret = "%{file:/run/credentials/stalwart-mail.service/mail-pw1}%";
	email = [ "postmaster@example.org" ];		email = [ "postmaster@example.org" ];
	}		}
Line 85:		Line 90:
	authentication.fallback-admin = {		authentication.fallback-admin = {
	user = "admin";		user = "admin";
	secret = "%{file:/~~etc~~/stalwart/admin-pw}%";		secret = "%{file:/run/credentials/stalwart-mail.service/admin-pw}%";
	};		};
	};		};
Line 256:		Line 261:
	class = "individual";		class = "individual";
	name = "User 1";		name = "User 1";
	secret = "%{file:/~~etc~~/stalwart/mail-pw1}%";		secret = "%{file:/run/credentials/stalwart-mail.service/mail-pw1}%";
	email = [ "user1@example.org" "user1real@example.org ];		email = [ "user1@example.org" "user1real@example.org ];
	}		}

Onny: Instruction mail sender address blocking

2026-03-18T13:25:51Z

Instruction mail sender address blocking

@@ Line 263: / Line 263: @@
    };
 };}}
 == Tips and tricks ==

Cameo007: Auto update TLSA records: add https://codeberg.org/Cameo007/dyndns-tlsa-desec for deSEC.io

2026-03-13T14:57:49Z

Auto update TLSA records: add https://codeberg.org/Cameo007/dyndns-tlsa-desec for deSEC.io

← Older revision		Revision as of 14:57, 13 March 2026
Line 361:		Line 361:

	Adapt the variables <code>DOMAIN</code>, <code>SUBDOMAIN</code>, and <code>PORT</code> according to your needs. The variable <code>ACME_PROVIDER_ID</code> corresponds to the ACME profile name you've setup in the Stalwart webadmin interface. <code>EnvironmentFile</code> points to a file containing the secret Cloudflare api token in the format: TOKEN=12345678[...].		Adapt the variables <code>DOMAIN</code>, <code>SUBDOMAIN</code>, and <code>PORT</code> according to your needs. The variable <code>ACME_PROVIDER_ID</code> corresponds to the ACME profile name you've setup in the Stalwart webadmin interface. <code>EnvironmentFile</code> points to a file containing the secret Cloudflare api token in the format: TOKEN=12345678[...].

			==== deSEC.io ====

			In case you want to update your TLSA records at deSEC you can use [https://codeberg.org/Cameo007/dyndns-tlsa-desec dyndns-tlsa-desec] ('''install via flake''') which checks your existing records and updates them if necessary. The certificate and key are taken from the specified directory (like your [[ACME]] directory)

			It defaults to <code>3 1 1</code> but you can choose other values as described [[wikipedia:DNS-based_Authentication_of_Named_Entities#RR_data_fields\|here]].<syntaxhighlight lang="nixos">
			services.dyndns-tlsa-desec = {
			enable = true;
			api_token_file = config.age.secrets.dyndns-tlsa-desec-api-key.path;

			tlsa_zones."example.com" = {
			cert_path = "/var/lib/acme/example.com/";
			records."_25._tcp.mail" = { };
			};
			};

			</syntaxhighlight>The program is executed hourly per default but you can set the <code>interval</code> option to any [https://www.freedesktop.org/software/systemd/man/latest/systemd.time.html#Calendar%20Events systemd calendar event].<syntaxhighlight lang="nixos">
			services.dyndns-tlsa-desec.interval = "5m"; # Every 5 minutes
			</syntaxhighlight>

	=== Sending from subaddresses ===		=== Sending from subaddresses ===

Golbinex: Add hardenize.com online tool

2026-02-20T16:42:14Z

Add hardenize.com online tool

← Older revision		Revision as of 16:42, 20 February 2026
Line 378:		Line 378:

	* [https://en.internet.nl/test-mail en.internet.nl/test-mail]: Test your mail server configuration for validity and security.		* [https://en.internet.nl/test-mail en.internet.nl/test-mail]: Test your mail server configuration for validity and security.
			* [https://www.hardenize.com/ hardenize.com]: Test your mail server configuration for validity and security. Checks DANE validity even when not all MX servers support DANE.
	* [https://www.mail-tester.com mail-tester.com]: Send a mail to this service and get a rating about the "spaminess" of your mail server.		* [https://www.mail-tester.com mail-tester.com]: Send a mail to this service and get a rating about the "spaminess" of your mail server.
	* Send a mail to the echo server <code>echo@univie.ac.at</code>. You should receive a response containing your message in several seconds.		* Send a mail to the echo server <code>echo@univie.ac.at</code>. You should receive a response containing your message in several seconds.