Four rules that turn up in every repository here
None of this is a methodology. It is what falls out of writing tools you yourself have to run against production, on a system you cannot casually rebuild, at an hour when nobody is available to help.
-
01
Recover rather than restart
stalwart-migrator checkpoints every phase, so a run killed by a dropped SSH session resumes where it stopped instead of beginning again on a half-migrated store. Long operations get interrupted; that is a design input, not an accident to apologise for.
-
02
Refuse rather than guess
A destructive script in SysAdminAutomation with no terminal to ask on and no
--yesgiven refuses — it does not assume the answer is yes because it is convenient. Migrator preflight declines outright on the two situations it cannot fix for you: shared-tenant domains, and migrating as the built-in fallback admin. Everything destructive takes--dry-run, and it changes nothing. -
03
Own nothing you have to back up, if you can avoid it
Sometimes you cannot — durable state has to live somewhere, and the honest version of this rule is about not adding a second place it lives. ihasmail holds no database and no server-side state of its own; settings live in the account's own JMAP Files, not in the browser and not in a volume. With
IMMUTABLE=1the container has no writable filesystem at all. The mail still needs backing up, but the Stalwart server it already belongs to is the one thing backing it up — and nothing on the client side does, because there is nothing there to lose. -
04
Attach a number to the claim
stalwart-migrator took a live nine-domain, 2.4 GB RocksDB server from 0.15.5 to 0.16.19 with eight seconds of downtime and every phase green. An independent user has since reported runs at roughly 221 GB across 16 domains and 55 accounts — their machine, their numbers, which is why it is quoted separately from ours. All fifteen scripts run under
set -euo pipefailand are ShellCheck-linted on every push.
The corollary is stated where it costs something: recovery from a failed migration is your own snapshot. A tool that only documents its successes is a tool you will find the edges of yourself.
These rules are not free, and the reason they are worth the cost is on the company page: one person maintains all of this, and a tool that refuses rather than guesses is a tool that does not need a second engineer standing by while it runs.