matt/echo6-docs
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: Contabo rebuilt as edge1 (mail-only); edge2 = front door for all other services

Browse source 
- edge1 (5.189.158.149): Debian 12 + Proxmox 8.4.19, mail-only; Mailcow in CT 101 (10.10.10.2); mail-port DNAT; mail_crypt key in extra.conf; tailnet node contabo now 100.64.0.40
- edge2 (184.174.35.153): permanent front door for vault/forge/notes/auth/matrix/element/vpn/proxmox + idahomesh/intermountainmesh; forgejo-ssh-dnat.service is permanent systemd unit on edge2
- runbook: mail/host-in-place rebuild (M1-M10) + mail_crypt capture + dual-key load + decryption-gate + SOGo bootstrap/cache + reverse-proxy-Host + front-door co-location lessons
- credentials: edge1 SSH access note; Mailcow CT 101 location; mail_crypt key paths
- DNS split documented: mail/* -> edge1 (5.189.158.149); all other services -> edge2 (184.174.35.153)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt Johnson 2026-06-19 15:24:59 +00:00
commit 5236f3ba4c
5 changed files with 169 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

29
credentials
View file

@ -81,12 +81,29 @@ ECHO6_PORTAL_OIDC_ISSUER=https://auth.echo6.co/application/o/echo6-portal/
# Note: NordVPN token was entered interactively, re-login if needed
NORDVPN_LOCATION="CT 110 (media)"
# Contabo Mailcow VPS SSH Access
# Server: mail (contabo-mailcow-ypesiosi)
# Tailscale IP: 100.64.0.6
# Public IP: 5.189.158.149
CONTABO_MAILCOW_SSH_USER=root
CONTABO_MAILCOW_SSH_PASS=7redditGold
# edge1 SSH Access (rebuilt Contabo VPS, mail-only, 2026-06-19)
# Server: edge1 — Debian 12 + Proxmox 8.4.19, mail-only role
# Public IP: 5.189.158.149 | Tailscale: 100.64.0.40 (node: contabo)
# SSH key: ~/.ssh/contabo2_ed25519 (same key as before rebuild)
# Box password (unrotated): 7redditGold
# ssh -i ~/.ssh/contabo2_ed25519 root@5.189.158.149
EDGE1_SSH_USER=root
EDGE1_SSH_KEY=~/.ssh/contabo2_ed25519
EDGE1_SSH_PASS=7redditGold
EDGE1_PUBLIC_IP=5.189.158.149
EDGE1_TAILSCALE_IP=100.64.0.40
# Mailcow (mail.echo6.co) — now on edge1 CT 101 (10.10.10.2), updated commit 52a41b4d (SOGo 5.12.8)
# Deployed: 2026-06-19 rebuild (privileged LXC on edge1 Proxmox)
# Access: via host Caddy (mail/autodiscover/autoconfig.echo6.co) + host DNAT (ports 25/465/587/110/143/993/995/4190 → 10.10.10.2)
# Admin UI: https://mail.echo6.co (same as before)
# mail_crypt keys (dovecot crypt volume: data/conf/dovecot/):
# Primary key: ecprivkey.pem (original; must be preserved across rebuilds)
# Secondary key: ecprivkey.pem.fresh-20260619 (generated by restore; loaded alongside primary)
# Config: data/conf/dovecot/extra.conf (update-safe, not dovecot.conf)
# Both keys loaded — required to decrypt old mail encrypted with primary and new mail with secondary
MAILCOW_ADMIN_USER=admin
MAILCOW_ADMIN_PASS=7redditGold
# RECON Pipeline Email Alerts (recon@echo6.co)
# Deployed: 2026-02-01 on Media-Server for pipeline monitoring