jcoffey-dev
08f12fa158
John, 2026-09-20: "SMTP and JMAP should be shown with the selector locked, we want to prevent those two protocols from being shutdown for now." The selector lists every mail protocol the server speaks, so the operator sees the whole surface at once; SMTP and JMAP sit in it named and visibly not switchable. JMAP was never closeable -- closing it locks everyone out of their mail and the operator out of INBUXA Admin, with no way back but the host -- and is now visibly so. SMTP is locked whole. LP-3 already spared inbound on 25; this extends that to submission on 465 and 587, which LP-1 would otherwise have closed by default. So closeSubmission has no effect while the lock stands, and is forced to false. A client that asks for true is not refused: the value is recorded, overruled, and the overrule reported, because the field is specified and the lock is meant to be temporary. is_locked() is consulted before anything else in closes(), so no phrasing of a request reaches past it. This costs the feature nothing. Submission's ports stay open and sign-in over them is still refused once LP-6 lands, which is the case acceptance test 2 already described: a mail app reaching 465 is told it cannot sign in rather than finding nothing listening. The operator also keeps a port they may well be forwarding, which is the LP-20 problem in miniature. The locked set is a server constant the front ends read, not a list they carry, so unlocking later is a server change and no admin release. The LP-3 tests stay as they are, to keep it covered if the lock is lifted. Recorded as LP-21, with acceptance tests 17 and 18.
A complete mail and collaboration server, every feature included, under the AGPL
INBUXA is a mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV, in one Rust binary, with ihasmail as its web front end. It is a fork of Stalwart. Project site: inbuxa.org. Documentation: docs.inbuxa.org.
Stalwart ships some features only in a paid Enterprise Edition: multi-tenancy, masked email, undelete and others. INBUXA ships everything to everybody under the AGPL-3.0, rebuilding those features independently and without using any of Stalwart's Enterprise code.
What's different from Stalwart
- Every feature, one edition. No license key, no edition checks, no
upsell. See
docs/spec/SPEC.md§4 for the features being rebuilt, anddocs/spec/features/for each one's specification. - Webmail and administration by ihasmail, as a separate service that can run beside the server or elsewhere. Stalwart's own web interface is removed, so there's no web front end on the mail host.
- Clean-room rebuilds. Enterprise-only code is stripped from every
upstream release before it's imported. The rebuilt features are written
from specifications that use only public sources (
docs/spec/SPEC.md§3).
How the fork is kept
Upstream releases arrive as stripped snapshots, never with upstream's git
history, which contains Enterprise code. tools/fork/strip.py builds each
snapshot on top of upstream's own ossify.py, then verifies it independently.
The report for every import is in docs/fork/strip-reports/. See
docs/spec/SPEC.md §2.
Building
cargo build --release -p inbuxa # the binary is target/release/inbuxa
docker build -t inbuxa . # or the container image
Settings are read from INBUXA_* environment variables. An existing Stalwart
install's STALWART_* variables still work, with a warning to rename them.
New installs keep their data in /var/lib/inbuxa and logs in
/var/log/inbuxa. Existing installs keep the paths their configuration
already names, so none of their data moves.
License and credits
INBUXA is free software under the GNU Affero General Public License, version 3.
It is a fork of Stalwart, copyright © Stalwart Labs LLC, modified by Coffey Labs in 2026. Upstream's copyright notices are kept on every file they cover, and every upstream file this fork changed says so in its header, under the notice it came with. Stalwart's files are dual-licensed AGPL-3.0-only or Stalwart's Enterprise License, and INBUXA takes them under the AGPL-3.0 only. A few of those files also carry code from other projects under MIT or BSD licenses, which stays under those licenses; THIRD-PARTY.md lists it with its notices. "Stalwart" is Stalwart Labs' name. INBUXA isn't affiliated with or endorsed by Stalwart Labs.
The INBUXA mark reuses ihasmail's cat-and-envelope artwork.