jcoffey-dev
4054f82c37
Browsers subscribed to Email changes, so every read or move on any client arrived as a push the worker could only show as "New mail". They now subscribe to EmailDelivery, which changes only on delivery; Stalwart sends a delivery to a subscription with an emailPush filter as an EmailPush alone. The payload now names id and threadId, which Stalwart sends only when asked, so notifications carry their actions and open the message. The worker stays quiet while a focused window is open, and the page leaves notifications to the worker where push is on. Every renewal registered a new subscription, on the belief that a repeated deviceClientId replaces the old one. Stalwart keeps both and allows fifteen per account, which filled up. A browser now extends its subscription, clears its own duplicates, replaces them only when its endpoint changed, and on overQuota makes room among other browsers' subscriptions. The server names its subscriptions by installation and removes what its previous process registered, and extends rather than re-creates. Checked live on 0.16.22; the mock now keeps duplicates, enforces the limit and accepts an expiry update. Fixes #375.
Try the demo
A working copy with an invented mailbox behind it — no sign-up, nothing real, nothing kept.
ihasmail
Immutable webmail for Stalwart Mail Server. Mail, calendars, contacts, files and filters in one app that works as well on a phone as on a desktop — and a container with nothing to persist.
ihasmail talks only JMAP to Stalwart. There is no database, no IMAP or SMTP,
and with IMMUTABLE=1 no writable filesystem either: everything durable,
settings included, belongs to Stalwart, so the container is disposable.
| 🌐 ihasmail.org | What it is, what it looks like, the full feature list |
| 📘 docs.ihasmail.org | Installing · Configuring · Using it · Shortcuts · Rebranding · Troubleshooting |
| 📋 FEATURES.md | Everything it does, feature by feature, with the capability each one needs |
| 🧪 KNOWN-ISSUES.md | What was verified live, and where Stalwart departs from a spec |
| 🛣 ROADMAP.md | What ihasmail does not do, and why |
Screenshots
Inbox & conversation (dark)  |
Inbox & conversation (light)  |
Composer  |
Calendar  |
Contacts  |
Sieve filter builder  |
Taken against the built-in mock with sample data. More, including the phone layout, on ihasmail.org.
What's in it
- Mail — conversations, labels, search operators, keyboard shortcuts, scheduled and undo send, invitations and RSVP, filters made from a message
- Calendar — month, week, day and agenda views, recurrence, attendees and free-busy
- Contacts — address books, groups, vCard import and export
- Files — browse, upload, move, share
- Signature checking — S/MIME signed mail verified as you read it
- Settings that follow the account, kept in the account's own storage on Stalwart
- On a phone — swipe to archive or delete, pull to refresh, hold to select
- Administration — a dashboard, accounts, groups, mailing lists, roles, tenants and domains, each shown only when the Stalwart role allows it
- Ten interface languages and twelve themes — the nine translations are marked Beta until a native speaker has read them
- Platform — installable PWA, Web Push,
mailto:handler, no credentials in the browser, strict CSP
The long version is FEATURES.md and ihasmail.org.
Requirements
Stalwart 0.16 or newer — sign-in refuses anything older, by name. Tested against 0.16.22; what changed in each release is in KNOWN-ISSUES.md.
- No Stalwart yet? ihasmail-oneshot deploys a new Stalwart and ihasmail together on one host, in one command.
- On Stalwart 0.15? stalwart-migrator upgrades it in place, or stay on the
stalwart-0.15-supportrelease.
Quick start (Docker)
cp .env.example .env
# edit: STALWART_URL=https://mail.example.com and APP_SECRET=$(openssl rand -base64 48)
docker compose up --build -d
# → http://localhost:8080 — put a reverse proxy in front for TLS
Or pull the published image, ghcr.io/coffey-labs/ihasmail. Releases are
weekly, so it is usually a few days behind main.
People sign in with their Stalwart mailbox credentials. An account with two-factor authentication needs an app password, created in Stalwart's own settings.
Everything else — TLS, running immutably, several Stalwart servers, settings the installation decides, every environment variable — is in Installing and Configuring.
Development
npm install
npm run dev:mock # built-in mock Stalwart ([email protected] / demo)
npm test
Architecture, the mock's switches and how versions are numbered are in CONTRIBUTING.md.
Contributing
CONTRIBUTING.md · CODE_OF_CONDUCT.md · SECURITY.md — please report vulnerabilities privately.
License
Copyright (C) 2026 Coffey Labs — AGPL-3.0-or-later. See LICENSE.
If you run a modified ihasmail, set SOURCE_URL to your own repository: the
sign-in page and Settings › About both show it. See
Rebranding.