All pull requests

Pull requests

• Build the install-time kexec image from our pinned nixpkgs

  #48·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Make greylisting configurable and document what it delays

  #47·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Document encryption at rest as an accepted risk, with options

  #46·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Pin GitHub Actions to commit SHAs

  #45·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Reject executable attachments; make virus scanning a setting

  #44·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Restrict the Rspamd controller socket to root and the mail user

  #43·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Document repository privacy and secret rotation after a key leak

  #42·byjpr opened Oct 9, 2026Owner·

  ·
  1

• First-install checklist, just status, robust relay credential permissions

  #41·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Make inbound DMARC enforcement switchable; document rejected mail

  #40·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Test outbound port 25 from the server in just check

  #39·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Refuse to create DNS records next to conflicting existing ones

  #37·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Verify and pin the stock image's host key during install

  #36·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Limit fail2ban lockouts: cap at a day, per jail, with an allow-list

  #35·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Default mailbox quota and a free-space floor for the mail queue

  #33·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Keep the netcup token encrypted; add operator security checklist

  #32·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Add encrypted off-site backups with restic

  #30·byjpr opened Oct 9, 2026Owner·

  ·
  1

• Build update PRs before opening them; detect pending reboots

  #28·byjpr opened Oct 9, 2026Owner·

  ·
  1