jcoffey-dev
2d64e30cb2
Ports .github/workflows/release.yml after the GitHub account was suspended: tag-driven, reproducible tarballs, the same refusal to release a tag that is not an ancestor of the default branch, with the assets going to the generic package registry and a Release created from them. e2e.yml is not ported. e2e/public.sh publishes 25, 80, 443, 465, 993, 995 and 4190 on the machine it runs on. On Actions that was a throwaway VM; the runner here is Web_Host, where 80 and 443 are nginx serving every live site. It stays a manual check on a disposable host. The Actions workflows stay in the tree as the reference.
ihasmail-oneshot
One command that turns a Linux Docker host into a working mail server with webmail. It deploys a fresh Stalwart mail server and a fresh ihasmail webmail, links them together, gets them certificates, and hands you the administrator password and the DNS records to publish.
ihasmail-oneshot deploy --domain example.com --user alice
Documentation
| 📘 Step-by-step guide | Start here. On docs.ihasmail.org: DNS, ports, deploying, publishing records, signing in, upgrading and backups |
| 📋 Reference | Requirements, every command and flag, the deployment directory, upgrading, backing up, removing |
| ⚙️ How it works | Why it exists, the deploy sequence, Stalwart setup without its wizard, shared certificates, IP bans behind a proxy |
| 🔒 Security model | What is exposed, where secrets live, the trust decisions it makes |
| 🧰 Troubleshooting | Problems by message or symptom, and known limits |
| 🧪 Contributing | Building, the unit and end-to-end tests, the code layout, releases |
What you get
- A mail server for
example.com, with webmail athttps://webmail.example.comand Stalwart's admin UI athttps://mail.example.com/admin. - A mailbox for each
--user, and an administrator, with generated passwords incredentials.txt. - Certificates for the webmail and for Stalwart's mail ports.
dns-records.zone: every DNS record to publish, DKIM keys included.- An ordinary
docker composeproject, managed with the usual commands and not tied to this tool. ihasmail runs read-only with no volume; everything durable is in Stalwart's volume.
Requirements
- Linux (amd64 or arm64) with Docker Engine and the compose plugin.
- For a mail host: a domain whose DNS you control, a static public IP, ports 25, 80, 443, 465, 993, 995 and 4190 open, outbound port 25 allowed by your provider, and reverse DNS for the host's address naming the mail host.
The full list is in docs/reference.md.
Install
ARCH=amd64 # or arm64
curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/ihasmail-oneshot-linux-$ARCH.tar.gz
curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
tar -xzf ihasmail-oneshot-linux-$ARCH.tar.gz
sudo install -m 0755 ihasmail-oneshot /usr/local/bin/
Or build from source with Go 1.26.8 or newer:
go build -o ihasmail-oneshot ./cmd/ihasmail-oneshot.
Use
Try ihasmail against a real Stalwart on your own machine, with no domain and nothing reachable from outside:
ihasmail-oneshot deploy --local --user alice
ihasmail-oneshot destroy --dir ihasmail-example-test # when you're done
Deploy a real mail host, after pointing mail.example.com and
webmail.example.com at it:
ihasmail-oneshot deploy --domain example.com --email [email protected] --user alice
It checks the host, shows the plan with the exact ihasmail release it will use,
and asks before changing anything. Then publish dns-records.zone, and mail
flows.
Versions
Releases are tagged by date (v2026.9.15). Each pins the Stalwart and Caddy
versions it was tested with. ihasmail is the newest release at deploy time,
written into compose.yaml by its dated tag, and checked by an end-to-end test
every Monday. Nothing upgrades by itself afterwards. Details in
CONTRIBUTING.md.
Security
To report a vulnerability, see SECURITY.md. Please don't open a public issue.
License
AGPL-3.0-or-later, the same as ihasmail. See LICENSE.
Running the tool to deploy your own mail host places no obligations on you. The license matters if you modify the tool and offer it to others, including as a hosted service that deploys on their behalf: then your modified source must be available to them.