Let's see how this goes. In my ever-growing fear of getting locked out of my life from losing access to my Google and/or Apple accounts, I threw together a few things for self-hosting my own e-mail.

I purchased the lifetime 10GB storage, unlimited domains/emails deal from #MXRoute for $99. I installed getmail, dovecot-imapd, and dovecot-submissiond on my home server.

getmail uses POP-SSL to check for new e-mails every 5 minutes, retrieve them, and delete them from MXRoute's mailbox. I have a separate getmailrc file for each mailbox. These are transformed into Maildir structure/format in a ZFS pool. The 10GB storage in MXRoute is now just a receiving buffer and should be plenty in the case of local downtime.

Meanwhile, dovecot serves IMAP-SSL and SMTP-SSL using certificates generated by Caddy for my other services. The IMAP piece retrieves passwords by invoking pass, but submissiond (the SMTP-SSL relay submission server added to Dovecot in 2.3) seems not to have the same password_command functionality as Dovecot's other features (yet?), so that's unfortunately in permissed plaintext for a relay e-mail account only used for sending (no inbox).

Next step are a few management scripts as there's some duplication between configurations, but overall I'm happy with how quick it was to set up.

I just received a 1Password popup in the macOS app that my secret key or password had recently changed and I'd need to re-enter my password. The secret key was autofilled correctly and, after restarting the app, my normal password still works.

I haven't changed either in years. Anyone else encounter this?

@0x00string Tailscale is built on Wireguard so it should process traffic faster than OpenVPN. The inability to set Tailscale as "Always On" on iOS spoiled it for me, but you can do that with OpenVPN and the Wireguard app (and AFAIK you can't use the Wireguard app with a Tailscale deployment).

It'll definitely seem sketchy to have their software automatically generate, manage, and ship your keys. Effectively, it's Wireguard with a great user experience. They promise that private keys never leave devices and your e2e encrypted traffic never touches their servers.

You can read about its past CVEs. Despite their promises, I don't like the wording on the impact of CVE-2022-41924. I wonder what logs they ship that enables them to guarantee it was never seen in the wild.