Summary
- encrypt all persisted mail state in LUKS2 on a dedicated Hetzner volume, with external AWS KMS/Secrets Manager key custody and an independent Keychain recovery slot
- add verified local and Restic backups, restores, health monitoring, header escrow, and reusable recovery/migration commands
- adopt canonical Maildir++ folders and deterministic RFC 5228 Sieve forwarding
- track current Zig 0.17-dev and pin TLS to the canonical zig-utils/zig-tls compatibility revision instead of a divergent vendored snapshot
Production validation
- rebooted into the expected locked state, then unlocked through AWS; mail is active
- recovery key verified against the live LUKS header
- customer-KMS encryption verified on secrets, buckets, and the latest header backup
- latest Restic backup and full restore check passed (725 messages; SQLite quick_check passed)
- 31 mailboxes / 67 folders migrated to Maildir++; ownership and permissions verified
- live hi@ and socials@ forwarding probes passed and probe messages were removed
- SMTP/SMTPS/submission/IMAP/IMAPS ports verified after reboot
Local validation
- exact official Zig 0.17.0-dev.1476+
91a29d7 - zig fmt --check src/
- zig build test
- zig build -Doptimize=ReleaseFast
- shell syntax checks and git diff --check
Companion TLS fix: zig-utils/zig-tls#8