61 lines
2.4 KiB
Markdown
61 lines
2.4 KiB
Markdown
# ihasmail
|
||
|
||
|
||
|
||
A polished, FastAPI + HTMX/Jinja webmail for Stalwart, with JMAP mail/contacts/calendar, Sieve UI, DAV browsing, and reverse-proxy friendly deploy.
|
||
|
||
A production-leaning, **FastAPI** + **HTMX/Jinja** webmail for [Stalwart Mail Server](https://stalw.art/), using **JMAP** for mail, contacts, and calendar, plus simple **WebDAV/CalDAV** helpers. Authenticates with the user's Stalwart mailbox (like Roundcube). Designed to run behind a reverse proxy.
|
||
|
||
## Features
|
||
- Login with Stalwart mailbox (HTTP Basic against JMAP session or bearer token if provided)
|
||
- Inbox listing, read messages (plain text), compose & send via JMAP (`Email`, `EmailSubmission`)
|
||
- Contacts/Directory via JMAP `Contact`
|
||
- Calendar view via JMAP `CalendarEvent`
|
||
- WebDAV browser (read-only sample) and CalDAV endpoints (external DAV clients)
|
||
- CSRF on POST, signed session cookie, proxy-friendly
|
||
- Dockerfile + docker-compose for easy deploy
|
||
|
||
> HTML rendering and attachment streaming are stubbed—extend using the JMAP `downloadUrl` and sanitize HTML before display.
|
||
|
||
## Quick Start (Docker)
|
||
|
||
```bash
|
||
# 1) Configure environment
|
||
cp .env.example .env
|
||
# Edit JMAP_BASE, CALDAV_BASE, WEBDAV_BASE, APP_SECRET
|
||
|
||
# 2) Build & run
|
||
docker compose up --build -d
|
||
|
||
# 3) Reverse proxy (Nginx/Caddy) to http://127.0.0.1:8080
|
||
```
|
||
|
||
## Environment Variables
|
||
- `APP_SECRET` – random string for signing cookies (required)
|
||
- `JMAP_BASE` – e.g., `https://mail.example.com/jmap`
|
||
- `CALDAV_BASE` – e.g., `https://mail.example.com/caldav/`
|
||
- `WEBDAV_BASE` – e.g., `https://mail.example.com/webdav/`
|
||
- `COOKIE_NAME` – cookie name (default: `stalwart_webmail`)
|
||
- `TRUST_PROXY` – `1` to honor `X-Forwarded-*` (default: `1`)
|
||
- `UPSTREAM_TIMEOUT` – seconds for upstream HTTP (default: `15`)
|
||
|
||
## Dev
|
||
```bash
|
||
python -m venv .venv && source .venv/bin/activate
|
||
pip install -e ".[dev]"
|
||
uvicorn app.main:app --reload
|
||
pytest
|
||
```
|
||
|
||
## Security & Hardening
|
||
- Prefer **bearer tokens** if Stalwart issues them; update `jmap_session()` to store `accessToken`
|
||
- Set explicit `accountId` from the JMAP session `primaryAccounts`
|
||
- Add mailbox/folder navigation via `Mailbox/query` + `Mailbox/get`
|
||
- Sanitize HTML bodies (e.g., `bleach`) before rendering
|
||
- Add Sieve UI via `urn:ietf:params:jmap:sieve`
|
||
- Consider rate limiting and security headers in the reverse proxy
|
||
- Serve static assets via proxy/CDN
|
||
|
||
## License
|
||
GPL-3.0-or-later
|