- systemd service running as dedicated kanban user on SSD (zroot)
- nginx reverse proxy at kanban.lassul.us with basic auth via clan vars
- DNS record for kanban.lassul.us
- binary-patch claude-code version for claude 4.6 support
- backup of vibe-kanban state

nixos-mailserver mkForces the virtualMail user without homeMode,
causing NixOS activation to reset /var/vmail to 0700 on every deploy.
Override at the same priority to set homeMode=2770, replacing the
chmod workaround in ExecStartPost.

SnappyMail PHP webmail served via nginx + php-fpm.
Data stored in /var/lib/snappymail.
Admin panel at mail.lassul.us/?admin after first deploy.

- Enable posixacl on zroot ZFS pool for /var/vmail
- Set POSIX ACL default granting lass rwX on mail dir (new files inherit)
- Fix /var/vmail permissions after dovecot pre-start resets to 0700
- Fix dovecot-acl-sync to skip cur/new/tmp/.notmuch subdirs
- Change recursive tmpfiles rule to non-recursive to avoid setgid on files