jcoffey-dev
08f29926d4
Cluster rehearsal 3: with PostgreSQL paused (docker pause, so its kernel still answered TCP keepalives), requests on connections already checked out hung until it came back, and /healthz/ready stayed 200 through the outage. #41 bounded getting a connection, not using one. Client-side query limits (store::backend::query_timeout). Every operation on a PostgreSQL or MySQL connection now runs under a time limit. A server-side statement_timeout (or MySQL's MAX_EXECUTION_TIME, which covers SELECTs only) can't do this: the server that would enforce it is the one not answering. When an operation runs out, its connection is closed instead of pooled, since a query may still be in flight on it or a transaction open: deadpool's Object::take on PostgreSQL; Conn::disconnect on MySQL, which marks the connection closed before it sends anything, so the pool discards it even when the server never answers. - query, 2 minutes: reads, writes (the whole transaction with its retries), blobs, SQL lookups, search queries and indexing. These take milliseconds; two minutes leaves room for a large blob over a slow link and still ends a hang. - maintenance, 30 minutes: range deletes (account removal, purges), unindexing, purge_store, and creating tables and indexes at startup, which can legitimately run long in one statement. Their existing chunked fallback for server-side statement timeouts is unchanged. - iterate (exports, reindexing, maintenance scans) can run for hours, so the query limit bounds each wait for the database (preparing, the query starting, the next row) rather than the whole scan. The limits are fixed, like the pool timeouts; the DataStore schema has no field for them. Tests set them with Store::with_query_timeouts (test_mode only). Readiness. /healthz/ready answered 200 whenever a data store was configured. It now reads one key from the data store with a 2 s limit and reuses the answer for 2 s, so probes can't load the database; while one probe runs, others get the last answer. The first failed probe of an outage is logged. /healthz/live stays 200: restarting a node doesn't bring its database back, and an orchestrator restarting on failed liveness would restart every node at once. The container HEALTHCHECK already uses /healthz/live. Tests, store::pool_timeout (a proxy that stops forwarding while keeping connections open plays the paused database): - postgres_query_timeout, mysql_query_timeout (new): with four pooled connections open, a read, a scan and a write each fail with "Query timed out" 2.0 s after the pause (2 s test limit); once the proxy forwards again the store answers. With the limits set to an hour (upstream's behavior), the read was still waiting at the test's 20 s limit. - postgres_readiness (new, STORE=PostgreSql): a node's data store goes through the proxy; /healthz/ready is 200, 503 about 4 s after the pause while /healthz/live stays 200, and 200 again about 2 s after it ends. - postgres_pool_timeout, mysql_pool_timeout: pass as before. store::store_tests (PostgreSql, MySql, including the MariaDB statement timeout step) and store::task_locks (PostgreSql) pass; store::search_tests (PostgreSql) fails at the same ordering assertion (query.rs:684) as on main.
A complete mail and collaboration server, every feature included, under the AGPL
inbuxa is a mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV, in one Rust binary, with ihasmail as its web front end. It is a fork of Stalwart. Project site: inbuxa.org. Documentation: docs.inbuxa.org.
Stalwart ships some features only in a paid Enterprise Edition: multi-tenancy, masked email, undelete and others. inbuxa ships everything to everybody under the AGPL-3.0, rebuilding those features independently and without using any of Stalwart's Enterprise code.
What's different from Stalwart
- Every feature, one edition. No license key, no edition checks, no
upsell. See
docs/spec/SPEC.md§4 for the features being rebuilt, anddocs/spec/features/for each one's specification. - Webmail and administration by ihasmail, as a separate service that can run beside the server or elsewhere. Stalwart's own web interface is removed, so there's no web front end on the mail host.
- Clean-room rebuilds. Enterprise-only code is stripped from every
upstream release before it's imported. The rebuilt features are written
from specifications that use only public sources (
docs/spec/SPEC.md§3).
How the fork is kept
Upstream releases arrive as stripped snapshots, never with upstream's git
history, which contains Enterprise code. tools/fork/strip.py builds each
snapshot on top of upstream's own ossify.py, then verifies it independently.
The report for every import is in docs/fork/strip-reports/. See
docs/spec/SPEC.md §2.
Building
cargo build --release -p inbuxa # the binary is target/release/inbuxa
docker build -t inbuxa . # or the container image
Settings are read from INBUXA_* environment variables. An existing Stalwart
install's STALWART_* variables aren't read: the server stops at startup and
names each one to rename.
New installs keep their data in /var/lib/inbuxa and logs in
/var/log/inbuxa. Existing installs keep the paths their configuration
already names, so none of their data moves.
License and credits
inbuxa is free software under the GNU Affero General Public License, version 3.
It is a fork of Stalwart, copyright © Stalwart Labs LLC, modified by Coffey Labs in 2026. Upstream's copyright notices are kept on every file they cover, and every upstream file this fork changed says so in its header, under the notice it came with. Stalwart's files are dual-licensed AGPL-3.0-only or Stalwart's Enterprise License, and inbuxa takes them under the AGPL-3.0 only. A few of those files also carry code from other projects under MIT or BSD licenses, which stays under those licenses; THIRD-PARTY.md lists it with its notices. "Stalwart" is Stalwart Labs' name. inbuxa isn't affiliated with or endorsed by Stalwart Labs.
The inbuxa mark reuses ihasmail's cat-and-envelope artwork.