Figure out how to interact with DNS and HTTPS

[emersion]

Things like DKIM, MTA-STS are tightly coupled with DNS and HTTPS.

Should we become tiny DNS/HTTPS servers too?

[foxcpp]

I don't like the idea of having an embedded DNS server. That's too much for maddy IMO, DNS is hard to get right.
For DKIM, we can generate keypair and zone file with public key (somewhere in /var/maddy/, perhaps) so it can be included from user's main zone file.
RFC 1035 does have a $INCLUDE directive for this.

[emersion]

Yeah, that's probably a better idea.

[emersion]

That still leaves the question of TLS: where do we get certs from?

It would be nice to be able to have automatic TLS. Maybe we can use https://github.com/mholt/certmagic (maybe it requires having an HTTP server)

MTA-STS involves serving an HTTPS document btw.

[foxcpp]

Well, I guess we can then start net/http server and bind on 127.0.0.1:some_probably_unused_port to serve just this file. Note that it is important to be able to change the port or fully disable this feature.

[emersion]

MTA-STS requires port 443. And I think it's the same for ACME challenges…

[foxcpp]

Leave the job of HTTPS to reverse proxy then? I never liked this automagic with TLS, right now it just increases complexity by restricting use-cases (separate domain for mail) and requiring more actions to be taken to work in existing environments (clashes with caddy and manual TLS configuration).

[foxcpp]

Issue #67 had some discussion related to the HTTP endpoint module starting at #67 (comment). I guess we are going with approach outlined in #67 (comment).

[MFAshby]

Just FYI caddy server has some code for interacting with a variety of DNS providers' APIs, so that it can automatically create DNS entries: https://github.com/caddyserver/dnsproviders

[foxcpp]

Closing as a too broad ticket. ACME TLS autoconfiguration is discussed in #3, considerations for static webserver for autoconfiguration and other purposes are mentioned in #67 and idea with builtin DNS server is discarded as not useful enough for its complexity.