I followed the general outline of the ispmail tutorials at https://workaround.org/ispmail . Debian based, postfix, dovecot, mysql, postgray (spam mitigation), catchall for the entire domain and only access it from imap clients or ssh'ing in. Doing webmail seemed like too much work to keep things secure. I self signed all my certs since it's just for me and very easy to set up and maintain (unlike letsencrypt over the same time span).