webyhomelab/docker-mailserver-gui repository overview

⁠🌟 Why This Project?

The original docker-mailserver is incredibly robust but intentionally lacks a graphical user interface (GUI) or database to minimize the attack surface.

However, users often need a Webmail interface to check emails without configuring a desktop client. Attempting to force a Webmail client (like Roundcube or SOGo) into the same Docker container violates containerization best practices and introduces severe security risks.

docker-mailserver-gui solves this by introducing a microservices-based, Zero Trust architecture.

⁠🛡️ Architecture & Security Model

We strictly adhere to a Zero Fallback Credentials mandate. This project is orchestrated using Docker Compose to ensure strict container isolation.

Below is a visual representation of how traffic flows securely through the system:

⁠Components Breakdown:

1. dms-core (The Core Engine): The hardened docker-mailserver. It only exposes standard email ports (25, 587, 993) to the outside world. IMAPS (993) is strictly protected by certificates synced from Traefik.
2. dms-traefik (The Shield): A Traefik v3.1+ reverse proxy. It automatically provisions Let's Encrypt certificates and enforces HTTPS. It is the only entry point for web traffic.
3. dms-snappymail (The GUI): A blazing-fast, DB-less PHP webmail client (SnappyMail⁠). It is completely isolated from the public internet.
4. dms-cert-dumper (The Bridge): A specialized sidecar that monitors Traefik's acme.json and automatically injects valid certificates into the Postfix/Dovecot engine, ensuring mobile clients never see "Invalid Certificate" errors.

⁠🚀 Quick Start

Deploying your secure mail server takes less than 5 minutes.

⁠1. Clone the repository

git clone https://github.com/weby-homelab/docker-mailserver-gui.git
cd docker-mailserver-gui/secure-stack

⁠2. Initialize the Environment

Run the setup script to create necessary volumes and set strict permissions:

chmod +x setup-gui.sh
./setup-gui.sh

⁠3. Configure Your Domains

Edit the generated .env file:

MAIL_HOSTNAME=mail.yourdomain.com
WEBMAIL_HOSTNAME=webmail.yourdomain.com
[email protected]

⁠4. Deploy and Automate

docker compose up -d
# Wait 30s for SSL to generate, then:
./setup-snappymail.sh

⁠5. Create Your First Account

docker exec -ti dms-core setup email add [email protected] <password>

⁠🛠 Advanced Features & Security Fixes

• Instant Inbound: Postgrey (greylisting) is disabled by default to allow immediate email delivery without the standard 10-minute delay.
• Docker 29+ Compatibility: Explicitly configured Traefik with DOCKER_API_VERSION=1.41 to support modern container engines.
• No Hardcoded Passwords: The Supervisor UNIX socket credentials have been removed to prevent local privilege escalation.
• Automatic Sync: SSL certificates are reloaded automatically by the dumper without stopping the mail server.

Built in Ukraine under air raid sirens & blackouts ⚡
© 2026 Weby Homelab