Comment by ebrahimh
4 days ago
Good article. I have many of the same services in my setup.
Self-hosting email fully is tedious/unnecessary, but what you can do is mirror your various inboxes (Gmail, iCloud, proton, non-corporate outlook) with mbsync and use roundcube or some other frontend to view emails and compose.
I use this to easily access mail from different services, and I can also send from any of them.
I also have a seperate service that watches the mail directory and sends a ntfy.sh notification for new emails.
It’s a bit complicated cause theres so many services but here are the quadlets: https://github.com/ebrahim37/infra-template/tree/main/homela...
I implemented this about a month ago because the iphone Mail app was increasingly buggy.
> Self-hosting email fully is tedious/unnecessary
Certainly not unnecessary if you care about privacy and Google not reading your mail.
Is it tedious? Not really for someone with a basic command of Linux and computer networking. Even in the pre-AI days, it only took me an afternoon to set up Postfix/Dovecot, and a few more days to refine various aspects of the setup and to write a bash script that can rebuild the whole thing on a new machine. There is basically no ongoing maintenance at all. The Dovecot syntax changed in Debian 13, and Claude translated the old config file in less than a minute. If you are willing to use a Dockerized solution, it's even less work, but I personally like to run this kind of thing bare metal and control every aspect of the setup.
> Certainly not unnecessary if you care about privacy and Google not reading your mail.
Fastmail exists
"Self-hosting email fully is tedious/unnecessary"
If you IT, why do you particularly consider self hosting email as tedious?
I self-host e-mail, because I am stubborn - I have done it for 20 years. I would not recommend anyone do it if they aren't already, or if they well-and-truly want to be on call for their homelab.
So as not to reiterate, here's an HN comment where I described the most recent trial I endured with it: https://news.ycombinator.com/item?id=46297991
In the last 20 years, I've also run into problems like:
* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.
* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.
* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.
I host my email, my isp blocked mail ports too, my simple and reliant solution is to use 2 quite cheap VPS on different zones as front email servers, with haproxy and postfix forwarding, took some time to setup but works great and not dependent on isp rules.
I've never tried to set it up even though I know it can easily be done with things like mailcow.
The downside is never really knowing if your email reached your recipient (maybe it got blocked by Gmail because of your IP, maybe some other reason). If I use Gmail/proton etc, then I can be pretty sure that the other person got my email.
You'll know from bounced email and logs, which you should have monitoring setup on.
It's not trivial to run your own email stack, but it's not hard either. It's more tedious than anything. Once it's up and running, it's low-maintenance. And it's fairly trivial to avoid spam. I get vastly more spam in my Gmail than I do on my self-hosted domains.
The biggest challenge with self-hosted email is getting an IP address that's not blocked or carrying low reputation. Most VPS IPs from e.g. Digital Ocean, Linode, Hetzner, AWS, etc. are going to get blocked from Google (the strictest) and Yahoo, Hotmail/Live/MS, etc. Cloud providers often block incoming and outgoing mail ports, too. I have a Digital Ocean VPS and my account is old enough to be grandfathered into the old policy, which means my email ports aren't blocked. I used to have no trouble sending email anywhere from my VPS, until I downsized it and got stuck with an IP in a bad reputation CIDR. Now I use smtp2go for relaying outbound mail, but still handle all inbound mail. 10/10 score on mail-tester.com, and I never have any problems or need to do any maintenance.
4 replies →
Because it's not about setting it up, it's about not getting outgoing mail perceived as spam by someone. Borderline impossible without scale. Even doing everything correct is not enough.
and yet I manage to do it for multiple domains, for over 20 years in the UK.
1 reply →
You can do this with Proton?? How does it handle decryption/encryption, etc?
Would absolutely love to do this, proton frontend annoys me at times.
I actually don't use protonmail but you should be able to access your mail with IMAP (both iCloud and Gmail support it so proton should as well).
If by encryption you mean PGP etc, that's handled in roundcube I believe.
mbsync mirrors your protonmail inbox to disk, dovecot shares that mail folder through IMAP, and roundcube or some other frontend connects to dovecot.
For gmail/icloud IMAP, you can't use your regular account password, you have to create an "app password" and use that password for mbsync.
Yeah they have integrated end to end encryption, this made me go digging, and I found they have a bridge app that handles it.
https://proton.me/support/bridge-for-linux
Excited to set this up, I had assumed it wasn't a possibility.
I'm mostly consume proton via proton-bridge, which is running in a dedicated VM. Then all my IMAP clients connect to that single instance.
Also, for email sending I use smtp2go free tier - primarily because I use random emails on my own domains to see who's leaking, and I don't want to set them up separately proton-side.
In that setup, proton itself is kinda unnecessary - I keep that path mostly as an insurance, just in case of acatastrophic homelab failure.