Stalwart - Revision history

O5-J: /* */ Fix typo

2026-10-08T11:36:38Z

: Fix typo

← Older revision		Revision as of 11:36, 8 October 2026
Line 5:		Line 5:
	\|color=var(--border-color-warning)		\|color=var(--border-color-warning)
	\|background=var(--background-color-warning-subtle)		\|background=var(--background-color-warning-subtle)
	\|The content of this page are in reference to versions of Stalwart starting from v0.16. For legacy setup and migration instructions please refer ~~follwing~~ [[Stalwart/Legacy_setup]] page.}}		\|The content of this page are in reference to versions of Stalwart starting from v0.16. For legacy setup and migration instructions please refer following [[Stalwart/Legacy_setup]] page.}}

	== Setup ==		== Setup ==
	{{Warning\|1=The Stalwart module for version the version >= 0.16 is not yet upstream and will be available in the upcoming NixOS 26.11 release.}}The following example enables the Stalwart mail server for the domain ''example.org'', listening on mail delivery SMTP/Submission (<code>25, 465</code>), IMAPS (<code>993</code>) and JMAP ports (8080/443) for mail clients to connect to. Mailboxes for the accounts <code>postmaster@example.org</code> and <code>info@example.org</code> get created if they don't exist yet.		{{Warning\|1=The Stalwart module for version the version >= 0.16 is not yet upstream and will be available in the upcoming NixOS 26.11 release.}}The following example enables the Stalwart mail server for the domain ''example.org'', listening on mail delivery SMTP/Submission (<code>25, 465</code>), IMAPS (<code>993</code>) and JMAP ports (8080/443) for mail clients to connect to. Mailboxes for the accounts <code>postmaster@example.org</code> and <code>info@example.org</code> get created if they don't exist yet.

Eliasp: Typo (unsecure → insecure)

2026-10-05T06:09:20Z

Typo (unsecure → insecure)

← Older revision		Revision as of 06:09, 5 October 2026
Line 330:		Line 330:
	* Send a mail to the echo server <code>echo@univie.ac.at</code>. You should receive a response containing your message in several seconds.		* Send a mail to the echo server <code>echo@univie.ac.at</code>. You should receive a response containing your message in several seconds.

	=== ~~Unsecure~~ setup for testing environments ===		=== Insecure setup for testing environments ===
	The following minimal configuration example is ~~unsecure~~ and for testing purpose only. It will run the Stalwart mail server on <code>localhost</code>, listening on port <code>143</code> (IMAP) and <code>587</code> (Submission). Users <code>alice@localhost.localdomain</code> and <code>bob@localhost.localdomain</code> are configured with the password <code>Dev-Mail-Test-2026!</code>.{{file\|\|\|3=environment.etc."stalwart-admin-password".text = "test123";		The following minimal configuration example is insecure and for testing purpose only. It will run the Stalwart mail server on <code>localhost</code>, listening on port <code>143</code> (IMAP) and <code>587</code> (Submission). Users <code>alice@localhost.localdomain</code> and <code>bob@localhost.localdomain</code> are configured with the password <code>Dev-Mail-Test-2026!</code>.{{file\|\|\|3=environment.etc."stalwart-admin-password".text = "test123";

	services.stalwart = {		services.stalwart = {

Onny: /* Unsecure setup for testing environments */

2026-10-03T09:52:05Z

Unsecure setup for testing environments

Show changes

Onny: Fix example config

2026-09-28T09:56:59Z

Fix example config

← Older revision		Revision as of 09:56, 28 September 2026
Line 48:		Line 48:
	username = "admin";		username = "admin";
	};		};
	credentials.~~fallback_admin~~ = "/etc/stalwart-admin-password";		credentials.admin = "/etc/stalwart-admin-password";
	url = "https://mail.example.org";		url = "https://mail.example.org";
	stateVersion = "26.11";		stateVersion = "26.11";

Onny: Update config according to upstream

2026-09-28T08:36:12Z

Update config according to upstream

← Older revision		Revision as of 08:36, 28 September 2026
Line 43:		Line 43:
	enable = true;		enable = true;
	package = pkgs.stalwart_0_16;		package = pkgs.stalwart_0_16;
			openFirewall = true;
	admin = {		admin = {
	enable = true;		enable = true;
	username = "admin";		username = "admin";
	~~passwordFile = "/etc/stalwart-admin-password";~~
	};		};
			credentials.fallback_admin = "/etc/stalwart-admin-password";
	url = "https://mail.example.org";		url = "https://mail.example.org";
	stateVersion = "26.11";		stateVersion = "26.11";
	~~recovery.port = 8081;~~
	provision =		provision =
	let		let
Line 216:		Line 216:
	'';		'';
	};		};
	};		};\|name=/etc/nixos/configuration.nix\|lang=nix}}

	~~# FIXME will get implemented as stalwart.openFirewall~~
	~~networking.firewall.allowedTCPPorts = [~~
	25
	~~465~~
	~~587~~
	~~993~~
	];\|name=/etc/nixos/configuration.nix\|lang=nix}}

	Change the user and password of your DNS provider. The password for the <code>info@</code> mailbox and admin user is stored in plain-text here for demonstration purpose, please consider using a secret-management tool [[Comparison of secret managing schemes\|such as agenix or sops-nix]].		Change the user and password of your DNS provider. The password for the <code>info@</code> mailbox and admin user is stored in plain-text here for demonstration purpose, please consider using a secret-management tool [[Comparison of secret managing schemes\|such as agenix or sops-nix]].

Onny: rdns setup

2026-09-25T10:05:30Z

rdns setup

← Older revision		Revision as of 10:05, 25 September 2026
Line 251:		Line 251:
	\| Mail host		\| Mail host
	\|}		\|}

			=== rDNS setup ===
			Configure rDNS in your VPS provider configuration dashbord to the IPv4 and IPv6 addresses, used in the DNS records above.

	=== DNSSEC ===		=== DNSSEC ===

Onny: Update DNS records table

2026-09-25T09:53:43Z

Update DNS records table

@@ Line 229: / Line 229: @@
 === DNS records ===
-Review the list of which DNS records are required including their values for the mail server to work at https://webadmin.example.org/manage/directory/domains/tuxtux.com.co/view. Especially following records are essential:
+Following DNS records need to be configured manually since they are not managed by Stalwart.
 {| class="wikitable"
 ! Record Type
@@ Line 245: / Line 245: @@
 | ''IPv6 address of the mail server''
 | Required
 |-
 | CNAME
@@ Line 260: / Line 250: @@
 | example.org
 | Mail host
 |}

Onny: Note on caa

2026-09-25T09:49:04Z

Note on caa

← Older revision		Revision as of 09:49, 25 September 2026
Line 145:		Line 145:
	"autoConfig"		"autoConfig"
	"autoDiscover"		"autoDiscover"
			# FIXME: Currently disabled since the CAA config
			# is very strict and would conflict with Caddy ACME
			# "caa"
	];		];
	};		};

Onny at 09:41, 25 September 2026

2026-09-25T09:41:59Z

← Older revision		Revision as of 09:41, 25 September 2026
Line 328:		Line 328:

	For example, check if DNSSEC is working correctly for your new TLSA record		For example, check if DNSSEC is working correctly for your new TLSA record
	# nix shell nixpkgs#dnsutils --command delv _25._tcp.~~mx1~~.example.org TLSA @1.1.1.1		# nix shell nixpkgs#dnsutils --command delv _25._tcp.mail.example.org TLSA @1.1.1.1
	; fully validated		; fully validated
	_25._tcp.~~mx1~~.example.org. 10800 IN TLSA 3 1 1 7f59d873a70e224b184c95a4eb54caa9621e47d48b4a25d312d83d96 e3498238		_25._tcp.mail.example.org. 10800 IN TLSA 3 1 1 7f59d873a70e224b184c95a4eb54caa9621e47d48b4a25d312d83d96 e3498238
	_25._tcp.~~mx1~~.example.org. 10800 IN RRSIG TLSA 13 5 10800 20230601000000 20230511000000 39688 example.org. He9VYZ35xTC3fNo8GJa6swPrZodSnjjIWPG6Th2YbsOEKTV1E8eGtJ2A +eyBd9jgG+B3cA/jw8EJHmpvy/buCw==		_25._tcp.mail.example.org. 10800 IN RRSIG TLSA 13 5 10800 20230601000000 20230511000000 39688 example.org. He9VYZ35xTC3fNo8GJa6swPrZodSnjjIWPG6Th2YbsOEKTV1E8eGtJ2A +eyBd9jgG+B3cA/jw8EJHmpvy/buCw==

	=== Running behind reverse proxy ===		=== Running behind reverse proxy ===

Onny: Update legacy setup note

2026-09-25T09:37:03Z

Update legacy setup note

← Older revision		Revision as of 09:37, 25 September 2026
Line 5:		Line 5:
	\|color=var(--border-color-warning)		\|color=var(--border-color-warning)
	\|background=var(--background-color-warning-subtle)		\|background=var(--background-color-warning-subtle)
	\|The content of this page are in reference to versions of Stalwart ~~prior to~~ v0.16. ~~Later versions of Stalwart have adopted a new configuration format clearly described (~~and ~~with examples for NixOS) in the upstream documentation:~~ [~~https:~~/~~/stalw.art/docs/management/cli/apply/#nixos Stalwart Declarative bulk operations~~].		\|The content of this page are in reference to versions of Stalwart starting from v0.16. For legacy setup and migration instructions please refer follwing [[Stalwart/Legacy_setup]] page.}}
	}}


	== Setup ==		== Setup ==
	The following example enables the Stalwart mail server for the domain ''example.org'', listening on mail delivery SMTP/Submission (<code>25, 465</code>), IMAPS (<code>993</code>) and JMAP ports (8080/443) for mail clients to connect to. Mailboxes for the accounts <code>postmaster@example.org</code> and <code>info@example.org</code> get created if they don't exist yet.		{{Warning\|1=The Stalwart module for version the version >= 0.16 is not yet upstream and will be available in the upcoming NixOS 26.11 release.}}The following example enables the Stalwart mail server for the domain ''example.org'', listening on mail delivery SMTP/Submission (<code>25, 465</code>), IMAPS (<code>993</code>) and JMAP ports (8080/443) for mail clients to connect to. Mailboxes for the accounts <code>postmaster@example.org</code> and <code>info@example.org</code> get created if they don't exist yet.

	Most of the DNS entries are managed by Stalwart including TLS key generation. In this example we configure INWX as domain provider. For supported protocols and hosts see [https://github.com/stalwartlabs/dns-update upstream documentation].		Most of the DNS entries are managed by Stalwart including TLS key generation. In this example we configure INWX as domain provider. For supported protocols and hosts see [https://github.com/stalwartlabs/dns-update upstream documentation].