0016. Mail runs on the control plane behind an edge server
Status: accepted, 2026-10-10. Refines 0009 (its own IP).
Context
ADR 0009 puts mail on a node whose IP does nothing else. The platform's lifecycle (databases, sign-in
through id, Caddy, updates from home) lives on the control plane; a second server with its own Caddy,
database and OIDC client would duplicate all of it. The server with a clean IP and settable reverse DNS
often already runs other software on 80/443, and many hosting providers block port 25 on the control plane.
Decision
- maild is an ordinary platform service on the control plane (panel at
mail.<d>, its database, id,
updates through home). Its mail ports listen on high ones (10025, 5587, 4465, 1143, 1993).
- An edge server owns mail's address:
mx.<d> points at it and its reverse DNS is mx.<d>.
xvii-node edge <control plane IP> relays 25, 587, 465, 143 and 993 there with a PROXY protocol v1 line,
which maild trusts from the edge only (TRUSTED_PROXIES), so SPF, greylisting and block lists see the
real client.
- Outgoing mail leaves from the edge's address through its SOCKS5 egress (
OUTBOUND_PROXY), which only
the control plane may use.
- The hostname's certificate comes by DNS-01 through Cloudflare (
CLOUDFLARE_TOKEN), since the edge's
port 80 isn't the platform's; maild terminates TLS itself, the edge only relays bytes.
Consequences
- Mail keeps a dedicated address and reverse DNS while everything else stays in one place.
- The edge is small (a relay and an egress in xvii-node) and needs no database or Caddy; it can run on a
server that hosts other things.
- The path between edge and control plane carries SMTP before STARTTLS in the clear, as the internet
does; TLS is end to end between the client (or the remote MX) and maild.
- A server of its own is still possible: maild can take the real ports when it runs there.