Good article. I have many of the same services in my setup.
Self-hosting email fully is tedious/unnecessary, but what you can do is mirror your various inboxes (Gmail, iCloud, proton, non-corporate outlook) with mbsync and use roundcube or some other frontend to view emails and compose.
I use this to easily access mail from different services, and I can also send from any of them.
I also have a seperate service that watches the mail directory and sends a ntfy.sh notification for new emails.
Certainly not unnecessary if you care about privacy and Google not reading your mail.
Is it tedious? Not really for someone with a basic command of Linux and computer networking. Even in the pre-AI days, it only took me an afternoon to set up Postfix/Dovecot, and a few more days to refine various aspects of the setup and to write a bash script that can rebuild the whole thing on a new machine. There is basically no ongoing maintenance at all. The Dovecot syntax changed in Debian 13, and Claude translated the old config file in less than a minute. If you are willing to use a Dockerized solution, it's even less work, but I personally like to run this kind of thing bare metal and control every aspect of the setup.
I self-host e-mail, because I am stubborn - I have done it for 20 years. I would not recommend anyone do it if they aren't already, or if they well-and-truly want to be on call for their homelab.
In the last 20 years, I've also run into problems like:
* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.
* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.
* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.
I host my email, my isp blocked mail ports too, my simple and reliant solution is to use 2 quite cheap VPS on different zones as front email servers, with haproxy and postfix forwarding, took some time to setup but works great and not dependent on isp rules.
I've never tried to set it up even though I know it can easily be done with things like mailcow.
The downside is never really knowing if your email reached your recipient (maybe it got blocked by Gmail because of your IP, maybe some other reason). If I use Gmail/proton etc, then I can be pretty sure that the other person got my email.
You'll know from bounced email and logs, which you should have monitoring setup on.
It's not trivial to run your own email stack, but it's not hard either. It's more tedious than anything. Once it's up and running, it's low-maintenance. And it's fairly trivial to avoid spam. I get vastly more spam in my Gmail than I do on my self-hosted domains.
The biggest challenge with self-hosted email is getting an IP address that's not blocked or carrying low reputation. Most VPS IPs from e.g. Digital Ocean, Linode, Hetzner, AWS, etc. are going to get blocked from Google (the strictest) and Yahoo, Hotmail/Live/MS, etc. Cloud providers often block incoming and outgoing mail ports, too. I have a Digital Ocean VPS and my account is old enough to be grandfathered into the old policy, which means my email ports aren't blocked. I used to have no trouble sending email anywhere from my VPS, until I downsized it and got stuck with an IP in a bad reputation CIDR. Now I use smtp2go for relaying outbound mail, but still handle all inbound mail. 10/10 score on mail-tester.com, and I never have any problems or need to do any maintenance.
A few major vendors (I want to say Microsoft was among them) were infamous for silently dropping email without bounce backs. They'd perform then whole protocol sequence as if they accepted the email, then simply never actually put it in that user's inbox or even spam folder.
People should read the parent post and stop spreading FUD about email. The only part that isn't easy is the IP requirement. If you don't have a fixed public IP, preferably v4, then self-hosting email is out of reach, but so is hosting other things like game servers. It's the main cost of self-hosting, and one that isn't big relative to all the benefits. Privacy is the biggest one I think, and so is the ability to create unlimited aliases, one for each company/website.
Dynamic DNS clients are a thing. I host a bunch of stuff on my domain, the only issues I have are related to having a local address when I'm at home. I don't host game servers much, but I hosted terraria (tshock) for few a few years.
You can't really host email with dynamic DNS. At least not well. You need stable MX records, you need various other DNS records for SPF/DMARC/DKIM, and most of all you need an IP address with a positive reputation. If you go changing your MX record constantly, you're not going to be receiving email reliably, if at all.
Because it's not about setting it up, it's about not getting outgoing mail perceived as spam by someone. Borderline impossible without scale. Even doing everything correct is not enough.
I'm mostly consume proton via proton-bridge, which is running in a dedicated VM. Then all my IMAP clients connect to that single instance.
Also, for email sending I use smtp2go free tier - primarily because I use random emails on my own domains to see who's leaking, and I don't want to set them up separately proton-side.
In that setup, proton itself is kinda unnecessary - I keep that path mostly as an insurance, just in case of acatastrophic homelab failure.
I’m setting up 3-2-1-ish backups for my infra of 3 hosts, and definitely leaning towards Restic + Backrest.
All my hosts run the same CoreOS setup (https://github.com/ebrahim37/infra-template), where container volumes are placed in one central volumes/ folder and that is the only thing I have to backup.
I plan to implement it like this:
vps1:
- restic container with custom sh entrypoint that will backup volumes/ to homelab every 24 hours
homelab:
- backrest container, to back up volumes/, do prune/check, replicate repo to offsite
- rest-server container, will store backups from vps1, homelab, offsite
offsite:
- restic container, backs up volumes/ to homelab every 24 hours
- rest-server container, store copy of backups from homelab
Only caveat is backing up databases, will either have to do: stop container, backup volume/database-data, start container; or use pg dump etc.
The deduplication is nice, you can have a snapshot for each week of the past year without crazy storage cost
I've been trying to find a solution for this too! I was considering using Rclone but too many things are using SQLite for me to trust rsync. I was also going to go with CoreOS but I'm leaning towards Fedora Cloud now in case I need to manage things a bit more (and "auto updating" is not something I want as that suggests auto rebooting).
Your secrets.yaml makes me nervous though - too easy to miss a key and leave something exposed. Why not just add the whole file to the vault?
I like CoreOS because of the fact that all config, etc files, sysctls are in one place.
Previously, I was using artix and had this “etc” directory[1] checked in to keep track of system configuration, but there was no good way to keep track of config drift (other than remembering to update this dir).
Haven’t gone through a CoreOS update yet (been using for ~2 months), but doubtful it would break anything. I’ve tested to make sure all my containers shutdown gracefully etc.
The SOPS (secrets.yaml) pattern is more common in NixOS configs, and I found it works nicely here too. In the artix setup, I had a bunch of .example files strewn around [2], which I had to remember to sync with the real versions.
Encrypting a key is just prefixing it with “enc_priv_”, SOPS will encrypt and decrypt it automatically. I keep “public” values plaintext to maybe help someone setting this up for themselves. Just have to double-check git diff before committing.
If your system has a way to take consistent snapshots in the filesystem (btrfs, zfs) or volume manager (lvm2, perhaps with a bit of filesystem support to obtain fs consistency), that can be used to avoid database downtime, if desired.
Self-hosting email fully is tedious/unnecessary, but what you can do is mirror your various inboxes (Gmail, iCloud, proton, non-corporate outlook) with mbsync and use roundcube or some other frontend to view emails and compose.
I use this to easily access mail from different services, and I can also send from any of them.
I also have a seperate service that watches the mail directory and sends a ntfy.sh notification for new emails.
It’s a bit complicated cause theres so many services but here are the quadlets: https://github.com/ebrahim37/infra-template/tree/main/homela...
I implemented this about a month ago because the iphone Mail app was increasingly buggy.
reply