phd59fr/mailbox-aggregator repository overview

⁠Mailbox Aggregator

Bring your IMAP inboxes and SMTP senders together in one self-hosted webmail. Mailbox Aggregator provides a browser interface for reading, organizing and sending email through your existing providers, with encrypted account settings and isolated user profiles.

Built with Go and Vue 3. The image includes the backend and web interface, runs as an unprivileged user, and requires no external database.

⁠Features

• Multiple IMAP mailboxes and independent SMTP sending identities.
• Live inbox updates with IMAP IDLE and polling fallback.
• Provider search, folders, message flags, copy/move and Trash actions.
• Rich text and Markdown composition, replies, forwarding and attachments.
• Optional copies in your provider's Sent folder.
• Browser-encrypted settings, OPAQUE authentication and automatic vault locking.
• Sanitized HTML reading and external images blocked by default.
• Optional IMAPS/SMTPS gateways for external mail clients.
• Structured HTTP, IMAP and SMTP logs without passwords or message contents.

⁠Quick start on localhost

Pull the image:

docker pull phd59fr/mailbox-aggregator

Start the webmail with a persistent Docker volume:

docker run -d --name mailbox-aggregator \
  --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  -v mailbox-aggregator-data:/app/data \
  -e APP_DATA_DIR=/app/data \
  phd59fr/mailbox-aggregator:latest

Open http://localhost:8080⁠, create an account, then add your IMAP mailboxes and SMTP senders in Settings.

On a new installation, the authentication setup is generated automatically. No .env file or manually generated key is required.

⁠Production and external mail clients

For a new deployment with both mail gateways, use this command instead of the localhost example:

docker run -d --name mailbox-aggregator \
  --restart unless-stopped \
  -p 127.0.0.1:8080:8080 \
  -p 993:1993 \
  -p 465:1465 \
  -v mailbox-aggregator-data:/app/data \
  -e APP_DATA_DIR=/app/data \
  -e APP_ENV=production \
  -e SESSION_COOKIE_SECURE=true \
  -e IMAP_PROXY_ENABLED=true \
  -e SMTP_PROXY_ENABLED=true \
  -e MAIL_PROXY_HOSTNAME=mail.example.com \
  phd59fr/mailbox-aggregator:latest

Replace mail.example.com with the hostname used by your mail clients. Serve the web interface through an HTTPS reverse proxy on the Docker host, forwarding to 127.0.0.1:8080. Remote browser access requires HTTPS.

The gateways generate and reuse a local TLS certificate in /app/data/proxy-certs when no certificate paths are supplied. Trust that certificate in your mail clients, or configure your own certificate and key. In the webmail Settings, enable external client access and set a dedicated proxy password for each user.

⁠Persistent data

Keep and back up the complete /app/data volume. It contains encrypted profiles, authentication records and keys, and generated gateway certificates. Reuse the same volume when replacing the container.

For a bind mount such as -v "$PWD/data:/app/data", prepare the directory for UID/GID 1000:1000, the user used by the published image.

If an existing deployment uses an explicit OPAQUE_SERVER_SETUP, continue supplying its original value. A lost main password cannot be recovered by an administrator.

Email content is fetched from providers and processed in memory. The application does not keep a local mailbox archive; the running backend can access activated provider credentials and message content while handling mail.

⁠Logs and configuration

docker logs -f mailbox-aggregator

LOG_LEVEL=info includes HTTP requests and IMAP/SMTP connections and operations. Failures include the operation, result, duration and connection stage where available. LOG_LEVEL=debug also includes routine cancellations.

Passwords, login names, subjects, message bodies, sender/recipient addresses and attachment names are excluded from mail logs. Operational server/client addresses remain visible. An SMTP send with status=unknown has an unconfirmed outcome: check the provider before retrying.

Useful environment variables include APP_DATA_DIR, APP_ENV, SESSION_COOKIE_SECURE, LOG_LEVEL and REGISTRATION_DISABLED. Set REGISTRATION_DISABLED=true after creating the intended users to close new registrations.

⁠Image and documentation

• Architecture: linux/amd64.
• Tags: latest, sha-<commit>, and version tags when published.
• License: MIT.
• Source code and README⁠
• Deployment guide⁠
• Security model⁠

The project is under active development. See the README for implemented features and current limitations.