ihasmail

A polished, FastAPI + HTMX/Jinja webmail for Stalwart, with JMAP mail/contacts/calendar, Sieve UI, DAV browsing, and reverse-proxy friendly deploy.

A production-leaning, FastAPI + HTMX/Jinja webmail for Stalwart Mail Server, using JMAP for mail, contacts, and calendar, plus simple WebDAV/CalDAV helpers. Authenticates with the user's Stalwart mailbox (like Roundcube). Designed to run behind a reverse proxy.

Features

Login with Stalwart mailbox (HTTP Basic against JMAP session or bearer token if provided)
Inbox listing, read messages (plain text), compose & send via JMAP (Email, EmailSubmission)
Contacts/Directory via JMAP Contact
Calendar view via JMAP CalendarEvent
WebDAV browser (read-only sample) and CalDAV endpoints (external DAV clients)
CSRF on POST, signed session cookie, proxy-friendly
Dockerfile + docker-compose for easy deploy

HTML rendering and attachment streaming are stubbed—extend using the JMAP downloadUrl and sanitize HTML before display.

Quick Start (Docker)

# 1) Configure environment
cp .env.example .env
# Edit JMAP_BASE, CALDAV_BASE, WEBDAV_BASE, APP_SECRET

# 2) Build & run
docker compose up --build -d

# 3) Reverse proxy (Nginx/Caddy) to http://127.0.0.1:8080

Environment Variables

APP_SECRET – random string for signing cookies (required)
JMAP_BASE – e.g., https://mail.example.com/jmap
CALDAV_BASE – e.g., https://mail.example.com/caldav/
WEBDAV_BASE – e.g., https://mail.example.com/webdav/
COOKIE_NAME – cookie name (default: stalwart_webmail)
TRUST_PROXY – 1 to honor X-Forwarded-* (default: 1)
UPSTREAM_TIMEOUT – seconds for upstream HTTP (default: 15)

Dev

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"
uvicorn app.main:app --reload
pytest

Security & Hardening

Prefer bearer tokens if Stalwart issues them; update jmap_session() to store accessToken
Set explicit accountId from the JMAP session primaryAccounts
Add mailbox/folder navigation via Mailbox/query + Mailbox/get
Sanitize HTML bodies (e.g., bleach) before rendering
Add Sieve UI via urn:ietf:params:jmap:sieve
Consider rate limiting and security headers in the reverse proxy
Serve static assets via proxy/CDN

License

GPL-3.0-or-later

2.4 KiB Raw Blame History Unescape Escape