Ah ok, thanks for the clarification. In the end I also use Sunshine for game streaming, but for pure remote desktop access RustDesk is far nicer, since I can also quickly move files back and forth. RDP is even nicer in that regard, where I can remote-mount local devices.

Where does rustdesk not have a good reputation? I see it being recommended regularly and also use it myself heavily. Never had issues or heard about issues (that I would attribute to reputation).

True. The default rocksdb is completely unusable on HDDs. For me it runs pretty good with PostgreSQL. Dovecot was certainly easier to handle with its file based storage and was super fast. But Postfix was a pain and I can’t count how often it bit me over the years (and since it’s SMTP, that means something broke in receiving, delivery or was suddenly a spam vector, which all sucks quite hard).

Stalwart

Written in rust, contains SMTP, IMAP, JMAP, Sieve, CalDAV, CardDAV, WebDAV. Has an admin web ui. Sane defaults, minimal foot guns. No zoo of containers needed.

Half off-topic, sorry: if you have some spare time on the weekend, you might want to take a look at nftables. AFAIK iptables is also just using nftables under the hood, so you are basically using a deprecated technology.

nftables is so much nicer to work with. In the end I have my custom rules (which are much saner to define than in iptables) in /etc/nftables.conf, then I have a very simple systemd unit:

[Unit]
Description=Restore nftables firewall rules
Before=network-pre.target

[Service]
Type=oneshot
ExecStart=/usr/sbin/nft -f /etc/nftables.conf
ExecStop=/usr/sbin/nft flush table inet filter
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target

and finally if I push updates via ansible I simply replace the file and run nft -f /etc/nftables.conf (via ansible; on-change event).

Edit: oh and as an example how the actual rules file looks like:

#!/usr/bin/nft -f

add table inet filter
flush table inet filter

table inet filter {
  chain input {
    type filter hook input priority 0;

    # allow established/related connections
    ct state {established, related} accept

    # early drop of invalid connections
    ct state invalid drop

    # allow from loopback
    iifname lo accept

    # allow icmp
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    # core services
    tcp dport {80, 443} accept comment "allow http(s)"
    udp dport 443 accept comment "allow http3"

    # everything else
    reject with icmpx type port-unreachable
  }

}

and with that I have my ipv4+6 firewall that allows pings and http