jcoffey-dev
a0ffdb8071
Personal-data catalog spec, defaults D2, D3, D4, D6 and D7 (settled 2026-09-28, new installs only): - D2: automatic IP bans expire after 30 days instead of never; D3: spam training samples, whole messages, are kept 90 days instead of 180; D4: Pyzor, which sends a digest of each message's text to a public server, is off; D6: delivery history is kept 14 days instead of 30. Written on the first boot of a new install only -- one with no roles yet, the same test the built-in roles use -- by reading each singleton, setting these fields and writing it back whole. A server with roles keeps its settings, saved or default. - D7: a webhook created from now on starts with the include policy and no events, so it sends nothing until events are chosen (Rust default and schema default, marked). The registry stores every field, so existing webhooks keep their policy. - Expired bans are also removed by the daily data clean-up. They already stopped blocking and were deleted when settings next loaded; a server that seldom reloads kept them. D1 (log retention) and D5 (the hashed-address blocklist off) are held, and the spec says why: x:TracerLog is stored inside x:Bootstrap with a field after it, so adding one changes that object's stored format; and the spam-rules loader D5 touches is being reworked by the v0.16.24 import. The spec also corrects finding 3: expired bans were deleted on settings load; bans were permanent only because no period is set. Tested: unit tests for the new-install values and that everything else in each singleton stays; the system suite, whose security test now purges an expired ban and checks its record is gone; the telemetry test; common's unit tests; fork checks.
A complete mail and collaboration server, every feature included, under the AGPL
inbuxa is a mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV, in one Rust binary, with ihasmail as its web front end. It is a fork of Stalwart. Project site: inbuxa.org. Documentation: docs.inbuxa.org.
Stalwart ships some features only in a paid Enterprise Edition: multi-tenancy, masked email, undelete and others. inbuxa ships everything to everybody under the AGPL-3.0, rebuilding those features independently and without using any of Stalwart's Enterprise code.
What's different from Stalwart
- Every feature, one edition. No license key, no edition checks, no
upsell. See
docs/spec/SPEC.md§4 for the features being rebuilt, anddocs/spec/features/for each one's specification. - Webmail and administration by ihasmail, as a separate service that can run beside the server or elsewhere. Stalwart's own web interface is removed, so there's no web front end on the mail host.
- Clean-room rebuilds. Enterprise-only code is stripped from every
upstream release before it's imported. The rebuilt features are written
from specifications that use only public sources (
docs/spec/SPEC.md§3).
How the fork is kept
Upstream releases arrive as stripped snapshots, never with upstream's git
history, which contains Enterprise code. tools/fork/strip.py builds each
snapshot on top of upstream's own ossify.py, then verifies it independently.
The report for every import is in docs/fork/strip-reports/. See
docs/spec/SPEC.md §2.
Building
cargo build --release -p inbuxa # the binary is target/release/inbuxa
docker build -t inbuxa . # or the container image
Settings are read from INBUXA_* environment variables. An existing Stalwart
install's STALWART_* variables aren't read: the server stops at startup and
names each one to rename.
New installs keep their data in /var/lib/inbuxa and logs in
/var/log/inbuxa. Existing installs keep the paths their configuration
already names, so none of their data moves.
License and credits
inbuxa is free software under the GNU Affero General Public License, version 3.
It is a fork of Stalwart, copyright © Stalwart Labs LLC, modified by Coffey Labs in 2026. Upstream's copyright notices are kept on every file they cover, and every upstream file this fork changed says so in its header, under the notice it came with. Stalwart's files are dual-licensed AGPL-3.0-only or Stalwart's Enterprise License, and inbuxa takes them under the AGPL-3.0 only. A few of those files also carry code from other projects under MIT or BSD licenses, which stays under those licenses; THIRD-PARTY.md lists it with its notices. "Stalwart" is Stalwart Labs' name. inbuxa isn't affiliated with or endorsed by Stalwart Labs.
The inbuxa mark reuses ihasmail's cat-and-envelope artwork.