MailStack

KO | EN

gitlite — search

#monitoring #proxy #go #agent #automation #cli #llm #video #golang #electron

(★ 9)

Self-hosted open-source team email server with Django, Postfix, Dovecot, MariaDB, Nginx, team mailbox management, and one-click VPS installation.

파일 탐색기

ZIP 다운로드

- - bug_report.yml
  - config.yml
  - feature_request.yml
  - question.yml
- - ci.yml
  - release.yml
- CODEOWNERS
- dependabot.yml
- pull_request_template.md
- mailstack-logo.svg
- README.md
- DESIGN_MANIFEST.json
- README.md
- - 00_OFFICIAL_BASELINE_FREEZE.md
  - 01_PRODUCTION_READINESS_FORENSIC_REPORT.md
  - 02_TWO_PHASE_A_TO_Z_ROADMAP.md
  - 03_UPDATE_PHASE_COMPLETION_LOG.md
  - 04_ERROR_HANDLING_REGISTER_AND_PLAN.md
  - 05_ACTUAL_IMPLEMENTATION_STATUS.md
  - 06_UI_DESIGN_REFERENCE_AND_DEFECT_MATRIX.md
  - 07_PRODUCTION_ACCEPTANCE_GATE.md
  - 08_CHANGE_CONTROL_AND_SCOPE_LOCK.md
  - 09_RELEASE_AND_UPDATE_EXECUTION_POLICY.md
  - 10_TEST_AND_ACCEPTANCE_MATRIX.md
  - 11_EXISTING_MESSAGE_REPAIR_AND_BACKFILL_PLAN.md
  - README.md
- API_REFERENCE.md
- ARCHITECTURE.md
- BACKUP_RESTORE.md
- BRANDING.md
- BUILD.md
- CODING_STANDARDS.md
- CONFIGURATION.md
- DEPENDENCY_REVIEW.md
- DEVELOPMENT.md
- DNS_AND_DELIVERABILITY.md
- FAQ.md
- FEATURE_MATRIX.md
- FIRST_COMMIT_WINDOWS.md
- FOLDER_STRUCTURE.md
- FORENSIC_AUDIT_REPORT.md
- FORENSIC_FILE_INVENTORY.json
- GITHUB_REPOSITORY_METADATA.md
- INSTALLATION.md
- KNOWN_LIMITATIONS.md
- LEGACY_COMPATIBILITY.md
- LICENSING.md
- MAILSTACK_BOOTSTRAP_AUDIT.md
- MAINTENANCE.md
- OPERATIONS.md
- PERFORMANCE_REVIEW.md
- PRIVACY_AND_RETENTION.md
- PUBLIC_RELEASE_CHECKLIST.md
- PUBLISHING.md
- QUICKSTART.md
- REBRAND_COMPATIBILITY.md
- RELEASE_NOTES_1.3.0.md
- RELEASE_NOTES_1.3.1.md
- RELEASE_NOTES_1.3.2.md
- RELEASE_NOTES_1.3.3.md
- RELEASE_NOTES_1.3.4.md
- RELEASE_PROCESS.md
- SCREENSHOTS.md
- SECURITY_REVIEW.md
- TEST_REPORT.md
- THREAT_MODEL.md
- TROUBLESHOOTING.md
- UPGRADE.md
- - ACCESSIBILITY_SPECIFICATION.md
  - COMPONENT_MATRIX.md
  - FUTURE_UI_ROADMAP.md
  - IMPLEMENTATION_STATUS.md
  - RESPONSIVE_SPECIFICATION.md
  - SCREEN_CATALOG.md
  - UI_FOUNDATION.md
- - PHASE-000-BASELINE.md
  - PHASE-001-UI-DESIGN-INTAKE-BASELINE.md
  - PHASE-002-SHARED-UI-FOUNDATION-AND-APPLICATION-SHELL.md
  - PHASE-003-INSTALLATION-RECOVERY-AND-INBOUND-DELIVERY-RELIABILITY.md
  - PHASE-004-RELEASE-UPGRADE-AND-OPERATIONAL-RELIABILITY.md
  - PHASE-005-UI-NAVIGATION-RELIABILITY-AND-COMPACT-MAILBOX-READER.md
  - PHASE-006-READER-INTEGRITY-DATA-REPAIR-AND-RUNTIME-ERROR-CLOSURE.md
- ADMIN_GUIDE.md
- BASELINE.md
- DOCUMENTATION_MANIFEST.json
- DOCUMENTATION_POLICY.md
- HOW_TO_USE.md
- README.md
- USER_MANUAL.md
- - __init__.py
- - __init__.py
  - asgi.py
  - urls.py
  - wsgi.py
- - ADMIN_GUIDE.md
  - ARCHITECTURE.md
  - BACKUP_RESTORE.md
  - CONFIGURATION.md
  - INSTALLATION.md
  - MAILDIR_INGESTION.md
  - PHASE2_DEPLOYMENT_HANDOFF.md
  - POSTFIX_INTEGRATION.md
  - SECURITY_OPERATIONS.md
  - THREAT_MODEL.md
  - TROUBLESHOOTING.md
  - V1_2_0_ZERO_FREEDOM_SPECIFICATION.md
  - V1_2_1_ACCEPTANCE_CHECKLIST.md
  - V1_2_1_ARCHITECTURE.md
  - V1_2_1_LIVE_NOTIFICATIONS.md
  - V1_2_1_ROLLBACK_GUIDE.md
  - V1_2_1_SECURITY_HOTFIX.md
  - V1_2_1_SERVER_BASELINE.md
  - V1_2_1_UPGRADE_GUIDE.md
  - V1_2_1_USER_GUIDE.md
  - V1_2_1_USER_MANAGEMENT_GUIDE.md
- - base.txt
  - constraints.txt
  - development.txt
  - locked.txt
  - production.txt
- - audit_dependencies_v1_2_1.sh
  - backup.sh
  - create_admin.sh
  - deploy_application.sh
  - health_check.sh
  - install_dependencies.sh
  - preflight_v1_2_1.sh
  - restore.sh
  - rollback.sh
  - rollback_upgrade.sh
  - upgrade.sh
  - upgrade_v1_2_1.sh
  - verify_application.sh
  - verify_release_manifest.py
  - verify_upgrade_archive.py
  - verify_v1_2_1.sh
- - base.html
  - pagination.html
- - __init__.py
  - conftest.py
- .bandit
- .env.example
- .gitignore
- CHANGELOG.md
- gunicorn.conf.py
- LICENSES.md
- manage.py
- pyproject.toml
- README.md
- SECURITY.md
- - contact_app.py
  - README.md
  - test_contact_app.py
- - contact.env.template
  - DEPLOYMENT_NOTES.md
  - vibmail-public-contact.service
  - vibmail.my.bootstrap.conf
  - vibmail.my.conf
- - 404.html
  - index.html
  - robots.txt
  - site.webmanifest
  - sitemap.xml
- - 404.html
  - index.html
  - robots.txt
  - site.webmanifest
  - sitemap.xml
- requirements.txt
- build_release.py
- check_docs.py
- check_documentation_policy.py
- forensic_audit.py
- generate_inventory.py
- manage_designs.py
- manage_documents.py
- release_gate.py
- render_public_site.py
- render_template.py
- shell_runtime.py
- test_designs.py
- test_documents.py
- test_installer.py
- test_operations.py
- test_release_workflow.py
- test_ui_foundation.py
- test_upgrade.py
- validate_templates.py
- verify_release.py
.editorconfig
.env.example
.gitattributes
.gitignore
CHANGELOG.md
CITATION.cff
CODE_OF_CONDUCT.md
CONTRIBUTING.md
install.sh
LICENSE
NOTICE.md
README.md
ROADMAP.md
SECURITY.md
SUPPORT.md
VERSION

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

### Open-source self-hosted mail server and shared team inbox for secure business email

[![CI](https://github.com/vibtools/MailStack/actions/workflows/ci.yml/badge.svg)](https://github.com/vibtools/MailStack/actions/workflows/ci.yml)
[![Release](https://img.shields.io/github/v/release/vibtools/MailStack?include_prereleases&sort=semver)](https://github.com/vibtools/MailStack/releases)
[![License](https://img.shields.io/github/license/vibtools/MailStack)](https://raw.githubusercontent.com/vibtools/MailStack/main/LICENSE)
[![Python](https://img.shields.io/badge/Python-3.12-3776AB?logo=python&logoColor=white)](https://raw.githubusercontent.com/vibtools/MailStack/main/mailbox-app/pyproject.toml)
[![Django](https://img.shields.io/badge/Django-5.2-0C4B33?logo=django&logoColor=white)](https://www.djangoproject.com/)
[![Ubuntu](https://img.shields.io/badge/Ubuntu_Server-24.04-E95420?logo=ubuntu&logoColor=white)](https://raw.githubusercontent.com/vibtools/MailStack/main/docs/INSTALLATION.md)
[![Stars](https://img.shields.io/github/stars/vibtools/MailStack?style=flat)](https://github.com/vibtools/MailStack/stargazers)
[![Forks](https://img.shields.io/github/forks/vibtools/MailStack?style=flat)](https://github.com/vibtools/MailStack/forks)
[![Issues](https://img.shields.io/github/issues/vibtools/MailStack)](https://github.com/vibtools/MailStack/issues)

**Postfix · Dovecot LMTP · Django · MariaDB · Maildir · Nginx · Ubuntu 24.04**

[Quick start](#quick-start) · [Architecture](#architecture) · [Documentation](#documentation) · [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [Roadmap](ROADMAP.md)

</div>

## Overview

**MailStack** is an open-source, self-hosted mail server and shared team inbox for organizations that need controlled, receive-only business email on infrastructure they manage.

It combines **Postfix**, **Dovecot LMTP**, **Django**, **MariaDB**, **Maildir**, **Gunicorn**, and **Nginx** in a hardened single-node reference deployment. MailStack provides a private browser-based inbox, administrator-managed users, object-level mailbox access, safe email rendering, protected attachments, live inbox updates, operational audit logs, backup and restore tooling, a public website, and an isolated contact service.

> **Release status:** `v1.3.1` remains the current published, deterministic source/release baseline. PHASE-005A is being corrected as `1.3.3` after the failed `1.3.2` qualification attempt; it hardens the live-update UI boundary, preserves legacy cached-poller compatibility, and delivers the compact mailbox/unified message reader. The existing VPS has not yet been upgraded to this development line; live upgrade acceptance remains a separate post-release operational gate.

## Why MailStack

MailStack is designed for teams that need:

- self-hosted business inboxes without public mailbox registration;
- shared mailbox access with per-user authorization;
- a receive-only mail security model;
- durable Maildir storage and recoverable indexing;
- protected attachment delivery and unified sanitized-HTML/plain-text message reading;
- auditable administration and operational recovery;
- reproducible installation and release tooling.

MailStack is **not** intended to be a complete replacement for Gmail, Microsoft 365, or a general-purpose outbound email marketing platform.

## Key features

### Shared team inbox

- Administrator and ordinary-user accounts
- Object-level mailbox isolation
- Shared mailbox memberships
- Mailbox create, enable, disable, and soft-delete lifecycle
- Compact webmail-style inbox with search, pagination, read/unread state, attachment filters, and message previews
- Live inbox polling and browser notification support

### Receive-only mail stack

- Postfix virtual recipient validation
- Dovecot LMTP delivery
- Maildir as the authoritative received-message source
- Unknown-recipient and disabled-mailbox rejection
- No public SMTP submission, IMAP, POP3, or open relay in the reference deployment

### Secure message processing

- Idempotent Maildir ingestion
- Duplicate-delivery protection
- Restart-safe ingestion worker
- MIME parsing with malformed-message recovery
- Allowlist-based HTML sanitization
- Remote and active content blocking
- Confined, protected attachment storage
- Authorized attachment download routes

### Operations and release engineering

- Ubuntu Server 24.04 installer
- MariaDB, Postfix, Dovecot, Nginx, Gunicorn, and systemd templates
- Health and readiness endpoints
- Structured security audit logging
- Backup, restore, rollback, and verification tooling
- Deterministic source ZIP and SHA-256 generation
- CI quality, security, test, and release gates

## Architecture

```text
Internet email
    │
    ▼
Postfix — receive-only SMTP and recipient validation
    │
    ▼
Dovecot LMTP
    │
    ▼
/var/vmail/<domain>/<mailbox>/Maildir
    │
    ▼
Maildir ingestion worker
    │
    ├──► MariaDB message metadata
    └──► Protected attachment storage
             │
             ▼
Browser ──HTTPS──► Nginx ──Unix socket──► Gunicorn / Django
                  ├──────────────────────► Protected files
                  └──────────────────────► Public site and contact service
```

See [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for component responsibilities, trust boundaries, and data flow.

## Supported deployment model

The reference deployment is:

- single-node;
- receive-only for hosted team mailboxes;
- designed for a clean Ubuntu Server 24.04 LTS VPS;
- dependent on public DNS and reachable ports `25`, `80`, and `443`;
- built around MariaDB, Postfix, Dovecot LMTP, Maildir, Nginx, and systemd.

The reference deployment intentionally excludes:

- IMAP and POP3;
- remote SMTP submission;
- public user registration;
- outbound campaigns;
- multi-node or high-availability deployment;
- a public administrative API.

Any expansion of those trust boundaries requires a separate architecture and security review.

## Quick start

### Requirements

- Clean Ubuntu Server 24.04 LTS VPS
- Root or `sudo` access
- Public IPv4 or IPv6 address
- DNS records for the public, application, and mail hostnames
- Reachable inbound ports `25`, `80`, and `443`
- A provider that permits inbound SMTP on port `25`

### Validate the installation plan

```bash
chmod +x install.sh

./install.sh \
  --domain example.com \
  --admin-email admin@example.com \
  --server-ip 203.0.113.10 \
  --non-interactive \
  --plan
```

The `--plan` mode validates inputs and shows the intended deployment without modifying the server.

### Install

```bash
sudo ./install.sh \
  --domain example.com \
  --admin-email admin@example.com \
  --server-ip 203.0.113.10 \
  --non-interactive
```

The installer provisions the mail stack, application services, TLS configuration, public site, contact service, strong generated credentials, and required system mailboxes.

Read [docs/INSTALLATION.md](docs/INSTALLATION.md), [docs/QUICKSTART.md](docs/QUICKSTART.md), and [docs/DNS_AND_DELIVERABILITY.md](docs/DNS_AND_DELIVERABILITY.md) before internet-facing deployment.

## Development

```bash
cd mailbox-app

python3.12 -m venv .venv
. .venv/bin/activate

python -m pip install -r requirements/development.txt

pytest --cov=apps --cov-report=term-missing --cov-fail-under=85
ruff check .
bandit -c .bandit -q -r apps config
```

Synchronize and validate user documentation before the complete repository gate:

```bash
python scripts/manage_documents.py sync
python scripts/manage_documents.py check
python scripts/test_documents.py
python scripts/check_documentation_policy.py --base HEAD^ --head HEAD
```

Run the complete repository gate from the project root:

```bash
python scripts/manage_designs.py --root . check
python scripts/test_designs.py
python scripts/test_ui_foundation.py
python scripts/forensic_audit.py --root . --full
```

Build and verify a deterministic source release:

```bash
python scripts/build_release.py --root .
python scripts/verify_release.py \
  dist/mailstack-1.3.3-source.zip \
  --checksum dist/mailstack-1.3.3-source.zip.sha256
```

## Security

MailStack uses a receive-only reference architecture with layered controls:

- object-scoped mailbox and message authorization;
- CSRF protection and secure production cookies;
- Argon2 password hashing;
- login throttling;
- safe redirect validation;
- HTML sanitization and restricted content security policy;
- attachment path confinement;
- least-privilege database access;
- Postfix recipient maps with no remote relay;
- systemd service confinement;
- protected environment files;
- fail-closed installer, backup, restore, and release checks.

Do not publish credentials, database dumps, Maildir data, attachments, logs, backups, certificates, or private keys. Report vulnerabilities privately through the process in [SECURITY.md](SECURITY.md).

## Screenshots

The repository does not include screenshots containing real mailbox data, production domains, credentials, or user information. Publish only sanitized screenshots created with synthetic fixtures.

See [docs/SCREENSHOTS.md](docs/SCREENSHOTS.md) for the approved screenshot set and sanitization rules.

## Documentation

| Area | Document |
|---|---|
| User documentation | [documents/README.md](documents/README.md) |
| User manual | [documents/USER_MANUAL.md](documents/USER_MANUAL.md) |
| How to use | [documents/HOW_TO_USE.md](documents/HOW_TO_USE.md) |
| Administrator guide | [documents/ADMIN_GUIDE.md](documents/ADMIN_GUIDE.md) |
| Quick start | [docs/QUICKSTART.md](docs/QUICKSTART.md) |
| Installation | [docs/INSTALLATION.md](docs/INSTALLATION.md) |
| Configuration | [docs/CONFIGURATION.md](docs/CONFIGURATION.md) |
| Architecture | [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) |
| Operations | [docs/OPERATIONS.md](docs/OPERATIONS.md) |
| Backup and restore | [docs/BACKUP_RESTORE.md](docs/BACKUP_RESTORE.md) |
| DNS and deliverability | [docs/DNS_AND_DELIVERABILITY.md](docs/DNS_AND_DELIVERABILITY.md) |
| Security review | [docs/SECURITY_REVIEW.md](docs/SECURITY_REVIEW.md) |
| Threat model | [docs/THREAT_MODEL.md](docs/THREAT_MODEL.md) |
| API and routes | [docs/API_REFERENCE.md](docs/API_REFERENCE.md) |
| Troubleshooting | [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) |
| Release process | [docs/RELEASE_PROCESS.md](docs/RELEASE_PROCESS.md) |
| Branding | [docs/BRANDING.md](docs/BRANDING.md) |
| Rebrand compatibility | [docs/REBRAND_COMPATIBILITY.md](docs/REBRAND_COMPATIBILITY.md) |
| Bootstrap audit | [docs/MAILSTACK_BOOTSTRAP_AUDIT.md](docs/MAILSTACK_BOOTSTRAP_AUDIT.md) |
| GitHub metadata | [docs/GITHUB_REPOSITORY_METADATA.md](docs/GITHUB_REPOSITORY_METADATA.md) |
| First commit from Windows | [docs/FIRST_COMMIT_WINDOWS.md](docs/FIRST_COMMIT_WINDOWS.md) |
| UI design intake | [design/README.md](design/README.md) |
| UI foundation | [documents/design/UI_FOUNDATION.md](documents/design/UI_FOUNDATION.md) |
| UI screen catalog | [documents/design/SCREEN_CATALOG.md](documents/design/SCREEN_CATALOG.md) |

## Roadmap

Current priorities are release-candidate qualification, clean Ubuntu 24.04 acceptance, external SMTP/LMTP verification, dependency advisory checks, reproducible release provenance, operator observability, and long-running reliability tests.

See [ROADMAP.md](ROADMAP.md) for the maintained roadmap and compatibility rules.

## Compatibility policy

The MailStack repository bootstrap changes public product identity and canonical repository metadata without renaming established runtime contracts.

The following identifiers remain temporarily unchanged for backward compatibility:

- `VIBMAIL_*` environment variables;
- `vibmail-*` systemd service names;
- `/etc/vibmail` and related runtime paths;
- established database and deployment identifiers;
- the `vibmail.my` legacy deployment contract.

See [docs/REBRAND_COMPATIBILITY.md](docs/REBRAND_COMPATIBILITY.md). Any runtime identifier migration must be handled as a separately tested, reversible migration rather than a search-and-replace rename.

## Project identity

- **Project:** MailStack
- **Publisher:** Vib Tools
- **Canonical repository:** `vibtools/MailStack`
- **Source:** https://github.com/vibtools/MailStack
- **Open-source hub:** https://dev.vib.tools/
- **Company:** https://vib.tools/
- **Optional free subdomain service:** https://ygit.net/

## Contributing

Contributions must preserve existing features, migrations, deployment compatibility, data integrity, and authorization boundaries unless a breaking change is explicitly designed and approved.

Read [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [SUPPORT.md](SUPPORT.md) before opening an issue or pull request.

## License

MailStack source code is licensed under the **GNU Affero General Public License v3.0 or later** (`AGPL-3.0-or-later`). The complete license text is in [LICENSE](LICENSE).

Third-party components remain under their respective licenses. Product names, logos, and visual identity are not automatically licensed as trademarks by the AGPL; see [NOTICE.md](NOTICE.md) and [docs/BRANDING.md](docs/BRANDING.md).

MailStack

파일 탐색기

# CDN으로 사용하기

Was this content helpful?

Recent Feedback

Download README