Setup MTA-STS

[missytake]

fix #71

validators are passing: https://mxtoolbox.com/SuperTool.aspx?action=mta-sts%3ac1.testrun.org&run=toolpage

[hpk42]

On Tue, Nov 21, 2023 at 02:06 -0800, missytake wrote: @missytake commented on this pull request. > @@ -8,13 +9,22 @@ EMAIL="root@$CHATMAIL_DOMAIN" ACME_ACCOUNT_URL="$($SSH -- acmetool account-url)" cat <<EOF -$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_DOMAIN. -$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_DOMAIN -all" +$CHATMAIL_DOMAIN. MX 10 $CHATMAIL_SERVER. +$CHATMAIL_DOMAIN. TXT "v=spf1 a:$CHATMAIL_SERVER -all" Those changes are related to supporting the case where the A and AAAA records for `CHATMAIL_DOMAIN` point to a different server, where the website is hosted, while the chatmail server itself is deployed on `CHATMAIL_SERVER`.

For now, the model is website==mxsite -- i'd prefer this question/issue to stay out of the PR. If we want, then a dedicated separate PR with docs that introduces the possible split between http and mx servers even though i am not in favor of that right now as we are trying to stabilize, not add "todo's" into the code and docs. next week i'd like to go live, resolve existing issues, and get it ready, not introduce TODOs implicitely.

[missytake]

For now, the model is website==mxsite -- i'd prefer this question/issue to stay out of the PR. If we want, then a dedicated separate PR with docs that introduces the possible split between http and mx servers even though i am not in favor of that right now as we are trying to stabilize, not add "todo's" into the code and docs. next week i'd like to go live, resolve existing issues, and get it ready, not introduce TODOs implicitely.

alright, I removed all related changes from this PR. This is only about MTA-STS now.

[link2xt]

alright, I removed all related changes from this PR. This is only about MTA-STS now.

But nginx config is still changed and has duplicate server entry.

[missytake]

alright, I removed all related changes from this PR. This is only about MTA-STS now.

But nginx config is still changed and has duplicate server entry.

yes, because the mta-sts.$CHATMAIL_DOMAIN HTTPS route needs to serve a different TLS certificate than the $CHATMAIL_DOMAIN HTTPS route - one server entry in the nginx config is not enough unfortunately.