jcoffey-dev
f95f10809a
The fork had CI and nothing after it. v2026.9.20 was tagged and released by hand, and there has never been an image: running INBUXA meant building the tree yourself, or using install.sh to do it for you. This adds the three workflows ihasmail already runs -- weekly release, publish, prune. Monday 10:07 UTC, and nothing on a quiet week. Last of the three, so INBUXA Admin and the webmail release ahead of the server they talk to, and staggered so a bad Monday names one repository rather than three. The version is the difference from ihasmail. ihasmail derives its version from the commit it builds, so its release only reads. INBUXA's lives in the brand_version! macro, deliberately apart from Cargo.toml so upstream's bumps merge without conflicts -- so the release writes it: the bump is committed to main and the tag names that commit. The tree a tag points at therefore reports the version the tag claims, which a tag placed beside an unbumped macro cannot promise. Both the bump and the read are scoped to the macro body and fail if they do not match exactly once. branding.rs holds other string literals, and a bump that silently edited one of those, or an image tagged from one, would be worse than a run that stops. The existing Dockerfile needs nothing: it cross-compiles from BUILDPLATFORM and takes no arguments beyond TARGETPLATFORM, so each architecture builds on its own native runner as ihasmail's does, without docker-bake.hcl. `docker build --check` is clean. Two things to expect from the first run. GHCR creates a package private the first time even in a public repository, and no workflow can change that, so the first image will refuse an anonymous pull until its visibility is set by hand. And a full Rust build of this tree is long; the per-platform GitHub Actions cache is what keeps the second one from being just as long, and it is worth watching that it stays inside the cache limit.
A complete mail and collaboration server, every feature included, under the AGPL
INBUXA is a mail and collaboration server: JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV, in one Rust binary, with ihasmail as its web front end. It is a fork of Stalwart. Project site: inbuxa.org. Documentation: docs.inbuxa.org.
Stalwart ships some features only in a paid Enterprise Edition: multi-tenancy, masked email, undelete and others. INBUXA ships everything to everybody under the AGPL-3.0, rebuilding those features independently and without using any of Stalwart's Enterprise code.
What's different from Stalwart
- Every feature, one edition. No license key, no edition checks, no
upsell. See
docs/spec/SPEC.md§4 for the features being rebuilt, anddocs/spec/features/for each one's specification. - Webmail and administration by ihasmail, as a separate service that can run beside the server or elsewhere. Stalwart's own web interface is removed, so there's no web front end on the mail host.
- Clean-room rebuilds. Enterprise-only code is stripped from every
upstream release before it's imported. The rebuilt features are written
from specifications that use only public sources (
docs/spec/SPEC.md§3).
How the fork is kept
Upstream releases arrive as stripped snapshots, never with upstream's git
history, which contains Enterprise code. tools/fork/strip.py builds each
snapshot on top of upstream's own ossify.py, then verifies it independently.
The report for every import is in docs/fork/strip-reports/. See
docs/spec/SPEC.md §2.
Building
cargo build --release -p inbuxa # the binary is target/release/inbuxa
docker build -t inbuxa . # or the container image
Settings are read from INBUXA_* environment variables. An existing Stalwart
install's STALWART_* variables still work, with a warning to rename them.
New installs keep their data in /var/lib/inbuxa and logs in
/var/log/inbuxa. Existing installs keep the paths their configuration
already names, so none of their data moves.
License and credits
INBUXA is free software under the GNU Affero General Public License, version 3.
It is a fork of Stalwart, copyright © Stalwart Labs LLC, modified by Coffey Labs in 2026. Upstream's copyright notices are kept on every file they cover, and every upstream file this fork changed says so in its header, under the notice it came with. Stalwart's files are dual-licensed AGPL-3.0-only or Stalwart's Enterprise License, and INBUXA takes them under the AGPL-3.0 only. A few of those files also carry code from other projects under MIT or BSD licenses, which stays under those licenses; THIRD-PARTY.md lists it with its notices. "Stalwart" is Stalwart Labs' name. INBUXA isn't affiliated with or endorsed by Stalwart Labs.
The INBUXA mark reuses ihasmail's cat-and-envelope artwork.