I believe the main thing to consider beyond just correctness of your email server configuration is that large email providers evaluate the reputation of a sender’s infrastructure. So for example, if your mail server has an IP address associated with large-scale spammers, that would hurt reputation. And if you are your own ASN or something, you have to build your reputation from nothing. I believe I mostly dodge this problem by just putting my email server in Hetzner.

You mean by other email servers? I haven’t had any issues yet.

I also self-host email on a Hetzner VPS. I pay about 9 Euros/Month.

I sure hope you’re using that for a lot more than email.

1. Get cheap Hetzner VPS with redundant volume.
2. Get a domain name.
3. Run Stalwart for you mail server.
4. Run Bulwark for your inbox web app.
5. Run Kanidm for an identity provider.
6. Configure these DNS records: MX, SPF, DKIM and DMARC

There are more details, but those are the basics.

Wow small world. Have you played Spitzer?

Secrets

• Encrypted secrets file. All repo-managed credentials live in secrets/secrets.yaml, encrypted with SOPS/age.
• Encrypted OpenTofu state. State and plans are encrypted client-side (PBKDF2 + AES-GCM) with a passphrase from TF_VAR_state_passphrase.

Network perimeter

• Default-drop firewall on the router. I use a hand-written nftables ruleset with policy drop on both input and forward. Only lo, lan0 and wg0 are trusted. WAN accepts only established traffic, WireGuard UDP and HTTP/HTTPS.
• No SSH from the WAN. sshd on the router is not exposed to the internet at all.
• WireGuard for remote access.
• Forced DNS. NAT redirects all LAN and VPN port-53 traffic to the router’s AdGuard. AdGuard uses Quad9 over DoT upstream, with blocklists and safe search.
• Second-level ACL in nginx. Private .home vhosts and Grafana carry allow LAN; allow VPN; deny all;.
• TLS everywhere. Every public vhost sets forceSSL with recommendedTlsSettings. Certificates come from ACME DNS-01, so issuance needs no inbound port 80. Cloudflare is DNS-only with no proxy, so no third party sees plaintext.

Host access

• SSH hardening. Password and keyboard-interactive auth are off, PermitRootLogin = “no”, and logins are key-only.
• Dedicated deployer system user. It uses a CI-only keypair, separate from the interactive keys. Everything it does through sudo is logged with LOG_INPUT/LOG_OUTPUT to /var/log/sudo-deployer.log.

Thanks for sharing. I’m trying it out as a Google Keep replacement.

You should file an issue.

Doesn’t Matrix do everything you just listed?

Copyparty. Or any other web file server.

Yeah so at worst you could get sued by some random reddit users that don’t want their post history hosted on your site.

Given how little traction artists and authors have had with suing AI companies for blatant copyright infringement, I kinda doubt it would go anywhere.

Less than $100 is tricky, but I’ve been meeting all your criteria with a Beelink EQ14. I also use it as my router.

An issue which I aim to resolve using a self-hosted VPN.

I use dufs. Copyparty seems good too.

Why not use zipapp?

https://docs.python.org/3.13/library/zipapp.html

I’m perfectly happy to build my own NAS with NixOS and ZFS on it. I think it’s mostly a matter of getting the right hardware.

My biggest shortcoming at the moment is my NAS is also my gaming PC. It’s pretty inefficient to have that on all the time. But I haven’t had the time to build a dedicated NAS.

ntopng has all of that. I’m currently hosting it on my home router.

If you go this route I recommend installing Kodi + Jellyfin Plugin + Kore Android App. You can control everything from your phone or laptop.