hetzner-infra/mail, branch master

Move forward proxy from Squid to Caddy (port 80/443)

2026-07-02T14:08:58+00:00

Replace standalone Squid container with caddy-forwardproxy plugin so the
proxy shares Caddy's existing ports and TLS. HTTP on :80 and HTTPS on :443.
Auth is read from the same vpn/users.conf at Caddy startup via entrypoint.sh.
DNS: add proxy to setup-route53.py WEB_SUBDOMAINS.

Co-Authored-By: Claude Sonnet 4.6

Add strongSwan IKEv2 VPN service

2026-06-30T13:29:07+00:00

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6

Add microblog service

2026-06-19T06:19:00+00:00

- Caddy: route blog.yyamashita.com → microblog-app:3000
- git: add microblog post-receive hook and update work tree path to /app/microblog
- DNS: add blog subdomain to Route 53 WEB_SUBDOMAINS

Co-Authored-By: Claude Sonnet 4.6

Rename hetzner-admin domain and use CNAME for web subdomains

2026-06-19T05:03:22+00:00

- caddy/Caddyfile: admin.yyamashita.com → hetzner-admin.yyamashita.com
- mail/dns/setup-route53.py: add A record for primary, CNAME records for
  all web service subdomains pointing to hetzner.yyamashita.com
- CLAUDE.md: update access URL

Co-Authored-By: Claude Sonnet 4.6

Switch mail container from SES relay to direct delivery

2026-06-08T16:34:02+00:00

Port 25 outbound is no longer blocked on Hetzner, so SES relay is
unnecessary. Remove relayhost, SASL auth config, and libsasl2-modules.
Postfix now delivers directly to recipient MX; inet_protocols=ipv4
already present to avoid IPv6 PTR issues.

Co-Authored-By: Claude Sonnet 4.6

Add libsasl2-modules to mail container for Postfix SASL auth

2026-06-01T12:44:29+00:00

Required for smtp_sasl_auth_enable with Amazon SES.

Co-Authored-By: Claude Sonnet 4.6

Configure Amazon SES relay for Postfix (port 25 blocked by Hetzner)

2026-06-01T12:42:57+00:00

SES credentials are injected via .env file (not committed). entrypoint.sh
creates sasl_passwd at runtime from SES_ACCESS_KEY_ID / SES_SMTP_PASSWORD.

Co-Authored-By: Claude Sonnet 4.6

entrypoint: copy resolv.conf etc into Postfix chroot before start

2026-06-01T12:33:02+00:00

smtp プロセスは chroot 環境で動くため /etc/resolv.conf が見えず
MX ルックアップが失敗していた。chroot (/var/spool/postfix/etc/) に
resolv.conf / hosts / services / nsswitch.conf をコピーして解決。

Co-Authored-By: Claude Sonnet 4.6

entrypoint: fix DNS via cat-to-bind-mount (no python3/sed needed)

2026-06-01T12:30:03+00:00

Co-Authored-By: Claude Sonnet 4.6

entrypoint: use python3 for resolv.conf edit (sed -i fails on bind mount)

2026-06-01T12:28:55+00:00

Co-Authored-By: Claude Sonnet 4.6