add SOGo (calendar/contacts) and a two-instance postgres model #112

Merged

lament merged 1 commit from sogo-cal into main 2026-07-25 18:11:56 -05:00

Conversation 0 Commits 1 Files changed 10 +391 -19

lament commented 2026-07-25 12:40:23 -05:00

Owner

Copy link

cal.lament.gay - SOGo webmail/calendar/contacts/dav on verdandi.

• postgres role splits into postgres.identity (verdandi) / postgres.apps (minerva). enableTCPIP + a WG-scoped pg_hba rule so a tenant can live off-host; sogo is an identity tenant
• caddy generator gains two hooks: proxyConfig (splices into the generated reverse_proxy, for sogod's x-webobjects-*) and assets (serves a package off the edge - sogod 404s its own css/js). pkgs.sogo-webresources copies the tree out to drop references: 51M vs pkgs.sogo's 2.3G closure
• auth is LDAP-bind. OIDC was tried and backed out - SOGo holds no user password under OIDC and hands IMAP the raw keycloak access token, and this build has no XOAUTH2. keycloak's sogo client stays registered but inert
• managesieve on athena for server-side filters, reached over WG. mailserver.stateVersion 4 -> 5 is the assertion gating it; nothing to migrate

`cal.lament.gay` - SOGo webmail/calendar/contacts/dav on verdandi. - postgres role splits into `postgres.identity` (verdandi) / `postgres.apps` (minerva). `enableTCPIP` + a WG-scoped `pg_hba` rule so a tenant can live off-host; sogo is an `identity` tenant - caddy generator gains two hooks: `proxyConfig` (splices into the generated `reverse_proxy`, for sogod's `x-webobjects-*`) and `assets` (serves a package off the edge - sogod 404s its own css/js). `pkgs.sogo-webresources` copies the tree out to drop references: 51M vs `pkgs.sogo`'s 2.3G closure - auth is LDAP-bind. OIDC was tried and backed out - SOGo holds no user password under OIDC and hands IMAP the raw keycloak access token, and this build has no XOAUTH2. keycloak's `sogo` client stays registered but inert - managesieve on athena for server-side filters, reached over WG. `mailserver.stateVersion` 4 -> 5 is the assertion gating it; nothing to migrate

lament added 1 commit 2026-07-25 12:40:23 -05:00

add SOGo (calendar/contacts) and generalize the postgres role into two named instances ... 31c01a9d55

SOGo lands as a directory-driven web service (verdandi backend): OIDC login
against keycloak for the webmail UI, LDAP-bound Basic auth for CalDAV/CardDAV
(no DAV client speaks OAuth redirect flows, so this is the ceiling anywhere,
not a SOGo shortfall), IMAP/SMTP against athena's mailserver. Caddy proxies
straight to sogod - nginx (the upstream module's own vhost) never actually
starts.

The postgres role stops being an untyped bool and becomes two named shared
instances (`identity` on verdandi, `apps` on minerva) addressed via the
existing roleHost path mechanism, with TCP + pg_hba scoped to the WG subnet
so a consumer doesn't have to be same-host as its backing db.

lament added the

security

service

labels 2026-07-25 12:40:29 -05:00

lament force-pushed sogo-cal from 31c01a9d55 to cd9bbc1397 2026-07-25 12:47:17 -05:00 Compare

lament force-pushed sogo-cal from cd9bbc1397 to b304f0b998 2026-07-25 12:49:32 -05:00 Compare

lament force-pushed sogo-cal from b304f0b998 to 04bd58500d 2026-07-25 12:56:45 -05:00 Compare

lament force-pushed sogo-cal from 04bd58500d to 8e86a3500e 2026-07-25 13:01:40 -05:00 Compare

lament force-pushed sogo-cal from 8e86a3500e to 234be5395f 2026-07-25 13:46:40 -05:00 Compare

lament force-pushed sogo-cal from 234be5395f to 22ced032cc 2026-07-25 13:50:28 -05:00 Compare

lament force-pushed sogo-cal from 22ced032cc to b8d9491224 2026-07-25 13:52:37 -05:00 Compare

lament force-pushed sogo-cal from b8d9491224 to 8d87f495ec 2026-07-25 13:56:44 -05:00 Compare

lament force-pushed sogo-cal from 8d87f495ec to 6bebe64a1d 2026-07-25 14:15:32 -05:00 Compare

lament force-pushed sogo-cal from 6bebe64a1d to d187c35347 2026-07-25 14:39:03 -05:00 Compare

lament force-pushed sogo-cal from d187c35347 to f287e0e15c 2026-07-25 14:41:29 -05:00 Compare

lament force-pushed sogo-cal from f287e0e15c to 2a8c56bf17 2026-07-25 14:44:54 -05:00 Compare

lament force-pushed sogo-cal from 2a8c56bf17 to 129d34872f 2026-07-25 15:03:39 -05:00 Compare

lament force-pushed sogo-cal from 129d34872f to c3da118fa4 2026-07-25 15:31:17 -05:00 Compare

lament force-pushed sogo-cal from c3da118fa4 to 50e44314b7 2026-07-25 15:38:24 -05:00 Compare

lament force-pushed sogo-cal from 50e44314b7 to e5250ed190 2026-07-25 15:46:54 -05:00 Compare

lament force-pushed sogo-cal from e5250ed190 to 631d06a3ee 2026-07-25 15:57:21 -05:00 Compare

lament force-pushed sogo-cal from 631d06a3ee to a5a31db570 2026-07-25 16:01:40 -05:00 Compare

lament force-pushed sogo-cal from a5a31db570 to e58f686bfd 2026-07-25 16:25:28 -05:00 Compare

lament force-pushed sogo-cal from e58f686bfd to 0a27b4d9a7 2026-07-25 16:28:55 -05:00 Compare

lament force-pushed sogo-cal from 0a27b4d9a7 to 69d93eb867 2026-07-25 18:06:46 -05:00 Compare

lament merged commit 69d93eb867 into main 2026-07-25 18:11:56 -05:00

lament deleted branch sogo-cal 2026-07-25 18:11:57 -05:00

lament referenced this pull request 2026-07-25 21:06:33 -05:00

cal's sieve leg never had a chance: dovecot wants STARTTLS first #113

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

chore

lockfile bumps, CI, reorg, docs, formatting

  

desktop

niri, theming, browser, WM/terminal, gaming

  

dropped

This is a dropped feature

  

fix

This fixes a problem

  

fleet

This is a fleet issue

  

networking

WG, DNS/kresd, NAT, firewall, site-mesh

  

security

auth, identity, secrets, hardening

  

service

new or changed app services

No labels

chore

desktop

dropped

fix

fleet

networking

security

service

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

lament/pantheon!112

No description provided.