jcoffey-dev
7c4add8425
INBUXA Admin, hosted off the mail server as SPEC.md §5.3 requires, signs in and then cannot load: "Failed to load the admin panel configuration. Failed to fetch." Every other endpoint works from the same origin with the same token; only /api/schema fails, and it is the one thing a schema-driven interface cannot do without. It is Chrome's cache, not CORS. Measured from the page itself: a normal fetch fails, while cache: "reload", cache: "no-store" and a cache-busted URL all return 200. The server never sees the failing request, which is why the logs had nothing to show and why it looked like a CORS fault for so long. Two things made that possible, and both are fixed here. The schema response was `public, max-age=31536000, immutable`. It is served behind authenticate_headers and its CORS headers vary by Origin, so it is neither public nor safe to freeze for a year on a hash-named URL that never changes. It is now `private`, matching what DownloadResponse already does for the same reason. The other caller of with_immutable_cache serves the applications' static bundles, which really are public, and keeps it. And `Vary: Origin` was only emitted when an origin list existed. Before the front ends are configured that list is empty, so a response cached in that window carries neither CORS headers nor Vary, and a cache will later replay it to an origin that should have been allowed. Vary now goes on every response, so entries key on the origin whatever the configuration was when they were stored. Verified against a bootstrapped server in restrictive CORS mode, from a browser on a separate origin: /api/account, /api/schema and the hashed target all return 200, with `private, max-age=31536000, immutable` and `Vary: Origin`. Nobody hit this before because the admin has always been served from the mail host at /admin, where it is same-origin and no CORS applies. The first deployment that follows §5.3 meets it immediately.
A complete mail and collaboration server, every feature included, under the AGPL
INBUXA is a mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV, in one Rust binary, with ihasmail as its web front end. It is a fork of Stalwart. Project site: inbuxa.org (not up yet).
Stalwart ships some features only in a paid Enterprise Edition: multi-tenancy, masked email, undelete and others. INBUXA ships everything to everybody under the AGPL-3.0, rebuilding those features independently and without using any of Stalwart's Enterprise code.
What's different from Stalwart
- Every feature, one edition. No license key, no edition checks, no
upsell. See
docs/spec/SPEC.md§4 for the features being rebuilt, anddocs/spec/features/for each one's specification. - Webmail and administration by ihasmail, as a separate service that can run beside the server or elsewhere. Stalwart's own web interface is removed, so there's no web front end on the mail host.
- Clean-room rebuilds. Enterprise-only code is stripped from every
upstream release before it's imported. The rebuilt features are written
from specifications that use only public sources (
docs/spec/SPEC.md§3).
How the fork is kept
Upstream releases arrive as stripped snapshots, never with upstream's git
history, which contains Enterprise code. tools/fork/strip.py builds each
snapshot on top of upstream's own ossify.py, then verifies it independently.
The report for every import is in docs/fork/strip-reports/. See
docs/spec/SPEC.md §2.
Building
cargo build --release -p inbuxa # the binary is target/release/inbuxa
docker build -t inbuxa . # or the container image
Settings are read from INBUXA_* environment variables. An existing Stalwart
install's STALWART_* variables still work, with a warning to rename them.
New installs keep their data in /var/lib/inbuxa and logs in
/var/log/inbuxa. Existing installs keep the paths their configuration
already names, so none of their data moves.
License and credits
INBUXA is free software under the GNU Affero General Public License, version 3.
It is a fork of Stalwart, copyright © Stalwart Labs LLC, modified by Coffey Labs in 2026. Upstream's copyright notices are kept on every file they cover, and every upstream file this fork changed says so in its header, under the notice it came with. Stalwart's files are dual-licensed AGPL-3.0-only or Stalwart's Enterprise License, and INBUXA takes them under the AGPL-3.0 only. A few of those files also carry code from other projects under MIT or BSD licenses, which stays under those licenses; THIRD-PARTY.md lists it with its notices. "Stalwart" is Stalwart Labs' name. INBUXA isn't affiliated with or endorsed by Stalwart Labs.
The INBUXA mark reuses ihasmail's cat-and-envelope artwork.