I own a small business, 20-30 devices only. But they’re a mix of all possible platforms (Windows, MacOS, Android, iOS). Would like to force disk encryption, strong password policy, automatically install/update/configure corporate VPN/mail/etc., prevent use of blacklisted programs, remote wipe of lost/stolen/otherwise compromised devices. I know it’s not feasible with any selfhosted solution, sadly.
Any MDM solution. All self-hosted options that were available (onemdm, flyve) are dead. I’m my own employer, so we definitely agree everything should be self-hosted :)
InfluxDB is just a storage. If you have a service that saves metrics to InfluxDB (IIRC, Proxmox can do that), Grafana can read it from there. Grafana can aggregate data from many sources, Prometheus+Loki+InfluxDB+even queries to arbitrary JSON APIs etc.
No, they serve different purposes. Loki is for logs, Prometheus is for metrics. Grafana helps to visualize data from both.
Alerts are much more important than fancy dashboards. You won’t be staring at your dashboard 24/7 and you probably won’t be staring at it when bad things happen.
Creating your alert set not easy. Ideally, every problem you encounter should be preceded by corresponding alert, and no alert should be false positive (require no action). So if you either have a problem without being alerted from your monitoring, or get an alert which requires no action - you should sit down and think carefully what should be changed in your alerts.
As for tools - I recommend Prometheus+Grafana. No need for separate AletrManager, as many guides recommend, recent versions of Grafana have excellent built-in alerting. Don’t use those ready-to-use dashboards, start from scratch, you need to understand PromQL to set everything up efficiently. Start with a simple dashboard (and alerts!) just for generic server health (node exporter), then add exporters for your specific services, network devices (snmp), remote hosts (blackbox), SSL certs etc. etc. Then write your own exporters for what you haven’t found :)
You call it “webmail client”, but if it stores email and serves it to other clients - it’s already server anyway :)
And you mentioned you need to “check/send email from any device/mobile”. You’re probably not going to use webmail from mobile (it must be a disappointing experience)… so you need IMAP on this “client-server” too. At least you can keep SMTP part unchanged on your VPS and send via it directly… But if you have something like ActiveSync (SoGo etc.) - things get more interesting. Even without ActiveSync, CalDAV/CardDAV also can be an additional problem if you need to archive old calendars as well as mail… etc.
Considering all these nuances that may arise in course of implementing your idea, I’ve suggested an easier way.
IMO, you’re overcomplicating things a lot. You already have a working mail server, which is not easy to setup and maintain. Adding another mail server and redistributing mail storage / routing mail between the two will drastically decrease stability and may affect deliverability of your mail as well.
Why not just add storage to the existing VPS? If your hosting provider doesn’t provide such option, you can mount third-party S3-compatible storage (rclone mount works great, a few hundred Gb on Backblaze cost virtually nothing) and store your mail there.
Estonia is known for it’s e-Residency program. You can pay 100-150 € and get your own Estonian ID instead of paying monthly fee to the registrar (and depending upon it’s reliability). I don’t know all the details of this process and whether it suits your needs, but, IMHO, this opportunity is worth investigating further.
Heh, it’s a valuable OSINT source of information indeed :) Even if it was just one time a sysadmin issued a single certificate for multiple domains that were not meant to look connected to each other, CT logs show that these domains’ owners are actually affiliated.