Notes

• pounce should be signalled with SIGUSR1 when you generate new TLS certificates, so that they are reloaded.
• building neomutt with unbundled deps:

cmake.deps/CMakeLists.txt has the URLs and hashes to download. DESTDIR must not be set for build step because deps are installed to .deps/usr during build, and need to be used from there

• Static Tcl

For the sake of use in CGI with sqlite3. Download the Tcl sources:

curl -L https://downloads.sourceforge.net/sourceforge/tcl/tcl8.6.13-src.tar.gz | tar xz
cd tcl*/unix
./configure --disable-shared
make

edit #include "tcl.h" to <tcl8.6/tcl.h>.
you want tclAppInit.c, libtcl*.a, pkgs/sqlite*/sqlite*.o <- ar -rcs this into an .a
edit Tcl_AppInit in tclAppInit.c to call Sqlite3_Init and add that function prototype:
int Sqlite3_Init(Tcl_Interp *interp);

compile:

cc -static tclAppInit.c libtcl*.a libsqlite*.a -I/usr/local/include -lz -lm -lpthread

when running, set the env TCL_LIBRARY to the directory containing init.tcl. If this is not loaded, sqlite3 will not be loaded.