Roundcube and Baikal for me. I used Mutt for email today 😂

No, and if there was an option for a 20-year certificate I would have taken it.

Don’t know man, Matrix has been pretty much set and forget for me since 2017 or 2018.

It’s well known

It is their practice but it’s not a law of nature, or even a law of any kind. As an American company they could have shown balls and ignored Trump shenanigan. Expectedly, they didn’t.

Ah, interesting. Looks like using grants does resemble what I envision and probably easier to set up that mTLS. I’ll certainly explore that!

Ah, thanks for the idea. I’ll look into Traefik, I’ve heard of it, but wasn’t sure what it could do.

I’m already running Headscale, and it works great. But to expose individual services to individual devices it feels like an overkill. I don’t actually need all these devices to connect to the tailnet all the time, and some of these devices I don’t even want to be able to access the entire tailnet.

My thinking is to put Immich, Matrix, and CalDAV/CardDAV behind mTLS. So the clients practically do connect via native mobile apps rather than a browser. The devices belong to a small number of users, I don’t manage them, but can distribute the keystores, and plan on doing the PKI manually as it’s really not a lot to keep track of.

Not an authentication replacement for sure, just an extra layer of protection. The goal is mostly so that if there’s a new critical exploit, I don’t have to drop everything I’m doing and immediately mitigate.

So hard to pick a favourite. I’m especially proud of having the mail server.