mailu: pin exactly what phase 1 verified #75

2026-09-25T21:34:21Z

jschoubben commented

2026-09-25 21:34:21 +00:00

Phase 1's lessons as pins: every image is the digest running and verified tonight — webmail under the name 2024.06 actually uses (the draft's roundcube pin misled a whole hop), antivirus on upstream clamav/clamav-debian with its DB in its own directory (the mailu-built image ended at 2.0), REAL_IP_FROM set to what the live config actually trusts, welcome texts for parity, and a data/clamav directory resource.

TLS_FLAVOR stays letsencrypt deliberately where live .env says cert: those cert files are copies whose HAL-era renewal hook died with HAL (they expire Nov 27); mailu managing its own issuance through the existing ACME passthrough is the fix, with the files on disk as the fallback flavor if first issuance misbehaves in the window.

Phase 1's lessons as pins: every image is the digest running and verified tonight — `webmail` under the name 2024.06 actually uses (the draft's `roundcube` pin misled a whole hop), antivirus on upstream `clamav/clamav-debian` with its DB in its own directory (the mailu-built image ended at 2.0), `REAL_IP_FROM` set to what the live config actually trusts, welcome texts for parity, and a `data/clamav` directory resource. `TLS_FLAVOR` stays `letsencrypt` deliberately where live `.env` says `cert`: those cert files are copies whose HAL-era renewal hook died with HAL (they expire Nov 27); mailu managing its own issuance through the existing ACME passthrough is the fix, with the files on disk as the fallback flavor if first issuance misbehaves in the window.

jschoubben added 1 commit 2026-09-25 21:34:21 +00:00

mailu: pin exactly what phase 1 verified 75f993e92b

Phase 1 (MAILU-CUTOVER.md) upgraded the live stack 1.9→2024.06 and its
lessons land here as pins: every image is the digest running and
verified tonight — webmail under the name 2024.06 actually uses (the
draft's roundcube pin misled a whole hop), antivirus on the upstream
clamav image with the signature DB in its own directory (the mailu-built
image ended at 2.0), and the front trusting the proxy address the live
config actually names. The welcome-mail texts ride along for parity.

TLS_FLAVOR stays letsencrypt deliberately where the live .env says cert:
the cert files are copies whose HAL-era renewal hook died with HAL
(expiry Nov 27); mailu managing its own issuance through the existing
ACME passthrough is the fix, and the files remain on disk as the
fallback flavor if first issuance misbehaves during the window.

jschoubben merged commit 4863eef586 into main

2026-09-25 21:34:26 +00:00

jschoubben deleted branch fix/mailu-pins-what-phase-one-verified

2026-09-25 21:34:26 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#75