Domain codycodez.com (Namecheap). All service names route through Nginx Proxy Manager at 192.168.86.201.
| Name | Backend | Auth in front? |
|---|---|---|
| auth.codycodez.com | Authentik .213 | — (is the IdP) |
| blog.codycodez.com | Ghost .210:2368 | no |
| www.codycodez.com | Ghost (blog) | no |
| frigate.codycodez.com | Frigate .212:8971 | Frigate's own auth |
| homepage.codycodez.com | Homepage .204:3000 | check |
| immich.codycodez.com | Immich .203:2283 | Immich auth |
| jellyfin.codycodez.com | Jellyfin .6:8096 | Jellyfin auth |
| n8n.codycodez.com | n8n .200:5678 | n8n auth |
| odysseus.codycodez.com | Odysseus .208:7000 | Authentik outpost (observed in NPM config) |
| project.codycodez.com | OpenProject .214:8080 | OpenProject auth |
| storj.codycodez.com | Storj dashboard .211:14002 | Authentik outpost (observed in NPM config) |
Tailnet MagicDNS names (*.tailbacb1d.ts.net) are listed on the Tailscale page.
TODO: confirm which NPM hosts have the Authentik forward-auth include enabled (two were observed in the nginx configs: the blocks following odysseus and storj) and whether public DNS uses A records to a static WAN IP or DDNS.
Bypasses NPM entirely; these point straight at Stalwart (LXC 103, .150). Confirmed live 2026-09-24 — now managed two ways: MX/SPF/DKIM/DMARC are hand-maintained in Namecheap (Stalwart's automatic DNS sync is deliberately scoped to CAA-only for this domain, to avoid it overwriting the Mailgun SPF include it doesn't know about); CAA is auto-published by Stalwart.
| Record | Value |
|---|---|
codycodez.com MX |
mail.codycodez.com (priority 10) |
mail.codycodez.com A |
72.81.141.19 |
codycodez.com TXT (SPF) |
v=spf1 mx include:mailgun.org ~all |
_dmarc.codycodez.com TXT |
v=DMARC1; p=none; pct=100; ... (reports to Mailgun + onDMARC — note: postmaster@codycodez.com is now an alias of admin@codycodez.com) |
email.codycodez.com A |
72.81.141.19 — Roundcube webmail (via NPM → 192.168.86.150:8081). Replaced the old Mailgun tracking CNAME on 2026-09-25 |
| DKIM (Stalwart) | v1-ed25519-20260815._domainkey, v1-rsa-20260815._domainkey — now published (auto-managed by Stalwart since 2026-09-25) |
| Mailgun leftovers | krs._domainkey, mailo._domainkey, include:mailgun.org in SPF — still needed while outbound relays through Mailgun |
| Other senders | contact.codycodez.com (Resend/SES records) and www/apex → Vercel. Not mail-server related; leave alone |
| Certificate | Real Let's Encrypt cert as of 2026-09-24 (was self-signed before — see Stalwart page for why enabling "Automatic" alone didn't fix this) |
Note: the A record above (
72.81.141.19) doesn't match the WAN IP last recorded in infra notes (68.33.104.54, as of 2026-08-15) — this connection's public IP has changed at least once with no DDNS observed keeping the record in sync. Still not resolved — both domains now depend on this IP staying current.
Live as of 2026-09-24. Uses its own hostname (mail.hanna.properties), not shared with codycodez.com — deliberate choice, see the Stalwart page's Known Issues for the one thing that still does share (outbound EHLO identity, not yet resolved). Fully auto-managed by Stalwart except MX/SRV/hostname-derived records. Mail is still relayed outbound through Mailgun — the SPF here (mx -all) passes for Mailgun-sent mail only through DKIM alignment; see the Stalwart page (kept off auto-sync so they don't get overwritten back to the shared default hostname).
| Record | Value |
|---|---|
hanna.properties apex A |
216.198.79.1 — this is a Vercel record, not mail-related. Got accidentally wiped once during setup (assumed to be a Namecheap parking placeholder) and restored — leave alone. |
mail.hanna.properties A |
72.81.141.19 |
email.hanna.properties A |
72.81.141.19 — Roundcube webmail (via NPM), added 2026-09-25 |
hanna.properties MX |
mail.hanna.properties (priority 10) |
hanna.properties TXT (SPF) |
v=spf1 mx -all |
| DKIM selectors | v1-ed25519-20260923._domainkey, v1-rsa-20260923._domainkey — auto-rotating, auto-published (unlike codycodez.com, DNS sync for DKIM is on here) |
_dmarc.hanna.properties TXT |
v=DMARC1; p=reject; rua=mailto:postmaster@hanna.properties — Stalwart-published (it re-set my earlier p=none). postmaster@ is now an alias of admin@ |
mta-sts, autoconfig, autodiscover, ua-auto-config |
CNAMEs → mail.hanna.properties |
| Not present: SRV records | _imaps._tcp, _submissions._tcp, _pop3s._tcp, _jmap._tcp, _caldavs._tcp, _carddavs._tcp — Namecheap's API does not support SRV records at all (confirmed via Stalwart's own error log, not a format issue). Cosmetic/autodiscovery only; add manually via Namecheap's web UI if wanted, not required for mail to work. |
| Certificate | Real Let's Encrypt wildcard cert (*.hanna.properties), issued automatically the moment cert management was turned on |
Mailbox: admin@hanna.properties (IMAP-tested working). No postmaster@ alias.
Record-editing safety (2026-09-25): Namecheap
setHostsreplaces the entire zone. Edit only through/root/nc_dns.pyon the SuperPC (dry-run diff, exact-match verification, snapshots in/root/dns-snapshots/). Both zones:www/apex are Vercel; every homelabArecord is hard-coded to the current WAN IP with no DDNS yet.
No CAA records on either domain (removed 2026-09-25). Stalwart's auto-published CAA was bound to its own Let's Encrypt account and blocked NPM's certbot from issuing/renewing certificates for every
*.codycodez.comhost. Do not re-enablecaain Stalwart's DNS publishing.