M8SH — Email evolved

Work in progress

A heavily extended Gitea fork with federated GPG-based auth, email-with-messenger-upgrade, any media streaming, and later — clients for secure interaction with the network (child control).

---

M8SH is what email should have evolved into. Now it is.

What email got right was simplicity alongside decentralization: anyone could run a server and communicate freely, without a central controlling institution. What it got catastrophically wrong was everything else — cryptography, security, protocols, user experience.

In M8SH the naming convention stays the same — name@example.com — but it provides a full-fledged modernized API for different forms of interaction between users on the network: sharing music, videos, subscribing to each other, posting articles, sending private messages, all reusing that simple email naming — neo@m8sh.su. Of course, backwards compatible with traditional email, just in case it's required, since it's much easier when there is no need for: 1 - email, 2 - messenger, 3 - audio/video conference.

Roadmap

1. GPG-based registration, auth and authentication — federated by design
2. Integrated email messenger with audio and video calls/conferences, cross-domain
3. Fillable with any media from any source VLC server, compatible with all VLC applications
4. Federated search — indexed across M8SH nodes, accessible via API
5. Posts, articles, videos, reels, music, reactions, comments

---

Deployment Guide

Prerequisites

1. A domain name — e.g. example.com
2. A server — Linux (Arch, Debian, Ubuntu, etc.) with a public IP
3. Go 1.26+ — for building from source
4. Ports 25, 80, 443 — must be open/reachable (check with your ISP/VPS provider)

Step 1: Build M8SH

git clone https://m8sh.su/x/m8sh.git
cd m8sh
make generate
TAGS="bindata sqlite sqlite_unlock_notify" make build

This produces a gitea binary (~125 MB).

Step 2: Generate DKIM Keys & Print Setup Guide

./gitea m8sh prepare --domain example.com

This prints:

• DKIM public key DNS record (auto-generated, copy-paste into your DNS)
• MX, SPF, DMARC DNS records for your domain
• iptables firewall rules to open ports
• Minimal app.ini config template pre-filled with your domain

Step 3: Configure DNS

At your DNS provider, add these records:

Type	Name	Value
A	@	YOUR.SERVER.IP
MX	@	10 example.com.
TXT	@	v=spf1 mx a -all
TXT	m8sh._domainkey	v=DKIM1; k=rsa; p=<key from prepare>
TXT	_dmarc	v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com

Wait 5-60 minutes for DNS propagation. Verify with:

dig MX example.com
dig TXT m8sh._domainkey.example.com

Step 4: Configure Firewall

If running on a VPS / cloud server:

iptables -A INPUT -p tcp --dport 25 -j ACCEPT   # SMTP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT   # HTTP/ACME
iptables -A INPUT -p tcp --dport 443 -j ACCEPT   # HTTPS
iptables -A INPUT -p tcp --dport 22 -j ACCEPT    # SSH

If running at home behind a router:

• Forward ports 25, 80, 443 from your router to this server's local IP
• Note: most home ISPs block port 25 outbound — check with your ISP. If blocked, you can still receive mail but may not send to Gmail/Yahoo.

Step 5: Create User & Set Up

# Create a system user
useradd -r -m -s /bin/bash gitea

# Copy binary
cp gitea /home/gitea/gitea
chown gitea:gitea /home/gitea/gitea

# Allow binding to low ports (25, 80, 443)
setcap 'CAP_NET_BIND_SERVICE=+eip' /home/gitea/gitea

Step 6: Create Minimal Config

Create /home/gitea/app.ini:

APP_NAME = M8SH
RUN_USER = gitea
WORK_PATH = /home/gitea

[server]
DOMAIN = example.com
PROTOCOL = https
HTTP_ADDR = 0.0.0.0
HTTP_PORT = 443
REDIRECT_OTHER_PORT = true
PORT_TO_REDIRECT = 80
ENABLE_ACME = true
ACME_ACCEPTTOS = true
ACME_DIRECTORY = /home/gitea/https
ACME_EMAIL = postmaster@example.com
ROOT_URL = https://example.com/
LOCAL_ROOT_URL = https://example.com/

[database]
DB_TYPE = sqlite3
PATH = /home/gitea/gitea.db

[repository]
ROOT = /home/gitea/repos

[mail_server]
ENABLED = true
USER_QUOTA = 4294967296  ; 4 GB per user, 0 = unlimited, admins always unlimited

Step 7: Set Up systemd

Create /etc/systemd/system/gitea.service:

[Unit]
Description=M8SH
After=network.target

[Service]
Type=simple
User=gitea
WorkingDirectory=/home/gitea
ExecStart=/home/gitea/gitea web -c /home/gitea/app.ini
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

Step 8: Launch

systemctl daemon-reload
systemctl enable gitea
systemctl start gitea

Check logs:

journalctl -u gitea -f

Visit https://example.com/ — your M8SH instance is live.

---

Configuration Reference

[mail_server] section

Setting	Default	Description
ENABLED	true	Enable the built-in SMTP server (port 25). HTTPS chat works regardless; this controls email delivery only. Set to false to disable.
DKIM_PRIVATE_KEY	auto-generated	Base64 PEM RSA key for DKIM signing
HEALTHCHECK_INTERVAL	5m	Interval for mail server health checks
USER_QUOTA	4294967296 (4 GB)	Storage quota per user in bytes. Admins always unlimited. Set to 0 for unlimited.

Updating DKIM keys

To regenerate the DKIM key:

1. Stop Gitea
2. Remove DKIM_PRIVATE_KEY from app.ini
3. Start Gitea — a new key will be auto-generated
4. Run ./gitea m8sh prepare --domain example.com to print the new DNS record
5. Update your DNS TXT record for m8sh._domainkey

---

Licensing

Project is published under GPLv3 license. If you modify GPLv3 code and distribute the resulting software, your entire application must also be licensed under GPLv3.