feat: support externally managed TLS via tls_external_cert_and_key option by hpk42 · Pull Request #860 · chatmail/relay

hpk42 · 2026-02-19T13:41:34Z

Add tls_external_cert_and_key config option for chatmail servers that manage their own TLS certificates outside of ACME. When set, the deployer verifies the cert and key files exist on the server and installs a systemd path unit that watches the certificate via inotify — when it changes, dovecot and nginx are automatically reloaded (postfix reads certs per handshake so needs no reload). Includes unit tests, an e2e test script, docs, and a CI workflow.

this is based on the prior work of self-signed TLS certs in #855

PR replaces and closes #662

chatmaild/src/chatmaild/ini/chatmail.ini.f

chatmaild/src/chatmaild/tests/test_config.py

chatmaild/src/chatmaild/config.py

cmdeploy/src/cmdeploy/external/deployer.py

link2xt · 2026-02-22T01:04:49Z

cmdeploy/src/cmdeploy/deployers.py

        )


+def get_tls_deployer(config, mail_domain):


High-level problem with this is that if you have a server with acmetool and want to reconfigure with external certificate, acmetool does not get uninstalled.

I think what we need is not selecting one deployer, but run all deployers with some option like enabled=... that tells the deployer if it should deploy or un-deploy acme or tls-cert-reload services.

this is addressed in the separate #869 (the first commit, the second does some follow up refactoring)

all other review comments were fixed in the branch here.

hpk42 · 2026-02-23T03:41:51Z

.github/workflows/test-and-deploy-ipv4only.yaml

-      domain: staging-ipv4.testrun.org
-    secrets:
-      STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
-


didn't want to further debug the workflow. Thorough TLS-mode testing is better done whne we have a more flexible provisioning of VPS and DNS for PRs.

hpk42 · 2026-02-23T12:39:08Z

cmdeploy/src/cmdeploy/tests/plugin.py

@@ -381,10 +381,12 @@ def iter_output(self, logcmd=""):
        while 1:
            line = self.popen.stdout.readline()
            res = line.decode().strip().lower()
-            if res:
-                yield res
-            else:
+            if not res:
                break
+            if ready is not None:
+                ready()
+                ready = None
+            yield res


this is a test fix on the side for a flaky test, took me a while to figure out. There are concurrency issues with getting log lines and triggering the send message. I think this is now reliable.

hpk42 · 2026-02-23T12:40:35Z

cmdeploy/src/cmdeploy/tests/setup_tls_external.py

+server via SCP, runs ``cmdeploy run``, and then probes all TLS-enabled
+ports (nginx, postfix, dovecot) to verify the certificate is actually
+served.  After probing, checks remote service logs for errors.
+


this test is only manually run, and partially machine generated.

j4n

Testing some more, it looks good, though there is one problem: the oneshot trigger reload fails on fresh deploys as services are not running yet.

j4n · 2026-02-23T16:30:22Z

cmdeploy/src/cmdeploy/external/deployer.py

+        )
+        # Trigger the oneshot service so services pick up the current cert.
+        # The path unit handles future changes via inotify.
+        systemd.service(


On a fresh deploy (or Docker container start), those services aren't running yet, so the reload fails. We can probably just remove this as dovecot/nginx read the cert on startup, and the .path watcher handles live cert changes via inotify.

j4n · 2026-02-23T17:41:04Z

One caveat turned up: inotify doesn't cross bind-mount boundaries and if certificates are modified outside of the container, the reload must be triggered explicitly.

j4n

since its a simple remove of the system reload section, I guess I should still approve.

hpk42 · 2026-02-23T23:12:55Z

@j4n i addressed your three comments in 3f05a9a

…tion Adds a new tls_external_cert_and_key config option for chatmail servers that manage their own TLS certificates (e.g. via an external ACME client or a load balancer). A systemd path unit (tls-cert-reload.path) watches the certificate file via inotify and automatically reloads dovecot and nginx when it changes. Postfix reads certs per TLS handshake so needs no reload. Also extracts openssl_selfsigned_args() so cert generation parameters are shared between SelfSignedTlsDeployer and the e2e test.

…ved leftovers

…ded if we can run it from work flows

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 13:41 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 13:41 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 13:41 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-external branch from 70d3d07 to 8b64d97 Compare February 19, 2026 13:45

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 13:46 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 13:46 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 13:46 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-external branch from 8b64d97 to a31ae26 Compare February 19, 2026 13:58

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 14:00 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 14:00 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 14:00 — with GitHub Actions Inactive

link2xt reviewed Feb 19, 2026

View reviewed changes

chatmaild/src/chatmaild/ini/chatmail.ini.f Outdated Show resolved Hide resolved

hpk42 force-pushed the hpk/tls-external branch from a31ae26 to 2d31eb0 Compare February 19, 2026 15:40

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 15:40 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 15:40 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 15:40 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-external branch from 2d31eb0 to edcf9bf Compare February 19, 2026 18:26

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 18:26 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 19, 2026 18:26 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 19, 2026 18:26 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-external branch from edcf9bf to 9258c8c Compare February 19, 2026 18:29

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 18:29 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging2.testrun.org February 19, 2026 18:29 — with GitHub Actions Error

hpk42 had a problem deploying to staging-ipv4.testrun.org February 19, 2026 18:29 — with GitHub Actions Error

hpk42 force-pushed the hpk/tls-external branch from 9258c8c to e8288ea Compare February 19, 2026 18:31

hpk42 had a problem deploying to staging-ipv4.testrun.org February 19, 2026 18:31 — with GitHub Actions Error

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 18:31 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging2.testrun.org February 19, 2026 18:32 — with GitHub Actions Error

hpk42 force-pushed the hpk/tls-external branch from e8288ea to 12b57c0 Compare February 19, 2026 18:33

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 19, 2026 18:33 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 20, 2026 18:45 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging-ipv4.testrun.org February 20, 2026 18:45 — with GitHub Actions Failure

hpk42 force-pushed the hpk/tls-external branch from 9cfc6bc to 48b738e Compare February 20, 2026 18:50

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 20, 2026 18:50 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 20, 2026 18:50 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 20, 2026 18:50 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging-ipv4.testrun.org February 20, 2026 19:05 — with GitHub Actions Failure

hpk42 had a problem deploying to staging2.testrun.org February 20, 2026 19:07 — with GitHub Actions Failure

hpk42 force-pushed the hpk/tls-external branch from 48b738e to 9a67be9 Compare February 20, 2026 22:35

hpk42 temporarily deployed to staging.chatmail.at/doc/relay/ February 20, 2026 22:35 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging2.testrun.org February 20, 2026 22:35 — with GitHub Actions Inactive

hpk42 temporarily deployed to staging-ipv4.testrun.org February 20, 2026 22:35 — with GitHub Actions Inactive

hpk42 had a problem deploying to staging-ipv4.testrun.org February 20, 2026 22:43 — with GitHub Actions Failure

hpk42 temporarily deployed to staging2.testrun.org February 20, 2026 22:48 — with GitHub Actions Inactive

hpk42 force-pushed the hpk/tls-external branch from 9a67be9 to 890fb3f Compare February 20, 2026 23:05

link2xt reviewed Feb 22, 2026

View reviewed changes

hpk42 mentioned this pull request Feb 23, 2026

WIP: reorganize TLS deployment and refactor deployers to use new helpers #869

Draft

hpk42 commented Feb 23, 2026

View reviewed changes

j4n requested changes Feb 23, 2026

View reviewed changes

j4n approved these changes Feb 23, 2026

View reviewed changes

hpk42 added 6 commits February 24, 2026 08:54

addressed link2xt comments except tls cleanup and fixed linting, remo…

fb9c25f

…ved leftovers

tests: fix potential hang in test_exceed_quota

fc3e08d

revert pure whitespace chagnes

12d6cbb

remove tls extrernal test file, it's too large, and should only be ad…

5036c36

…ded if we can run it from work flows

simplify cert loading and triggering, add a note for cross-bind mounts

cf7e9fd

Uh oh!

Conversation

hpk42 commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

link2xt Feb 22, 2026

Choose a reason for hiding this comment

Uh oh!

hpk42 Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hpk42 Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

hpk42 Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hpk42 Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

j4n left a comment

Choose a reason for hiding this comment

Uh oh!

j4n Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

j4n commented Feb 23, 2026

Uh oh!

j4n left a comment

Choose a reason for hiding this comment

Uh oh!

hpk42 commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

hpk42 commented Feb 19, 2026 •

edited

Loading

hpk42 Feb 23, 2026 •

edited

Loading

hpk42 Feb 23, 2026 •

edited

Loading

hpk42 commented Feb 23, 2026 •

edited

Loading