Post #3012828

2026-02-21 19:26 UTC

@mattj@floss.social For me, it is mostly about control and stack transparency. I already have Caddy doing the certificate management, I'd prefer if I didn't have to keep in mind some certificates exist elsewhere. From purely technical standpoint... It makes it really hard to deploy in airgapped environments. Plus I don't want to get rate limited by Let's Encrypt if I misconfigure the setup. And there's the whole digital sovereignity thing, with Let's Encrypt being a US company. It is fine for now, but what about in a year or two?

Replies (1)

@latenightowl@social.linux.pizza 2026-02-21 19:58

@mattj@floss.social I... have just unblocked myself. Basically, the cause was here: https://hg.prosody.im/docker/file/tip/entrypoint.sh#l6 I use many Podman hardening features, so in the volume mount, I have configured without thinking > Volume=/home/prosody/data/:/var/lib/prosody/:rw,U,Z without realizing the 'U' changes the ownership of the directory. So I'd run 'chown' by hand and rootful Podman would overwrite it every time I restarted the container to try the fix out. Sorry for shitting on your software, I know how hard vertical integration is. I feel bad every time I complain and the maintainers come to help me :|

Open ##3012829