Vib Mail — Open-Source Self-Hosted Team Email & Shared Mailbox Platform

Secure receive-only business inboxes, team mailbox access and Maildir ingestion for Ubuntu servers

Receive-only mail server · shared team inbox · role-based mailbox access · Maildir ingestion · one-command installer

Quick start · Documentation · Security · Contributing · Roadmap

Overview

Vib Mail is a self-hosted, open-source team email and shared mailbox platform for organizations that need controlled, receive-only business inboxes on their own VPS. It combines Django, Postfix, Dovecot LMTP, MariaDB, Maildir, Gunicorn and Nginx in a hardened single-node reference deployment.

The project provides a private web inbox, administrator-managed users and mailbox assignments, safe message rendering, protected attachments, live inbox updates, operational backup/restore tooling, a public website, and an isolated contact-form service.

Release status: v1.3.0-rc.1 is a public release candidate. Automated source, test, security, template and archive gates pass. A clean Ubuntu 24.04 VPS installation and real external SMTP/LMTP acceptance campaign remain required before stable promotion.

Key features

• Administrator and ordinary-user accounts with object-level mailbox isolation
• Shared mailbox assignments for teams
• Mailbox create, enable, disable and soft-delete lifecycle
• Receive-only Postfix virtual-mail delivery through Dovecot LMTP
• Durable Maildir ingestion with duplicate protection and restart safety
• Search, pagination, mailbox counters and read/unread state
• Sanitized HTML email display and protected attachment downloads
• Live inbox polling and browser notification support
• Structured audit logging and health/readiness endpoints
• Public website and CSRF-protected, rate-limited contact service
• Configurable domain and hostnames with legacy vibmail.my compatibility
• Ubuntu 24.04 one-command installer, backup, restore, verification and release tooling

The complete preservation record is in docs/FEATURE_MATRIX.md.

Architecture

Internet mail
    │
    ▼
Postfix (receive-only SMTP)
    │ private LMTP socket
    ▼
Dovecot LMTP ──► /var/vmail/<domain>/<mailbox>/Maildir
                                  │
                                  ▼
                    Maildir ingestion worker
                                  │
                                  ▼
                         MariaDB + attachments
                                  │
                                  ▼
Browser ──HTTPS──► Nginx ──Unix socket──► Gunicorn/Django
                  └──────────────► static public site/contact service

See docs/ARCHITECTURE.md for trust boundaries and component responsibilities.

Quick start

Requirements

• Clean Ubuntu Server 24.04 LTS VPS
• Root or sudo access
• Public IPv4 or IPv6 address
• DNS records for the public, application and mail hostnames
• Reachable inbound ports 25, 80 and 443
• A VPS provider that permits inbound SMTP on port 25

Validate the plan without changing the server

./install.sh \
  --domain example.com \
  --admin-email admin@example.com \
  --server-ip 203.0.113.10 \
  --non-interactive \
  --plan

Install

chmod +x install.sh
sudo ./install.sh \
  --domain example.com \
  --admin-email admin@example.com \
  --server-ip 203.0.113.10 \
  --non-interactive

The installer provisions MariaDB, Postfix, Dovecot LMTP, Nginx, Let's Encrypt TLS, Django/Gunicorn, the ingestion worker, the public website and the contact service. It generates strong credentials and creates postmaster@DOMAIN and abuse@DOMAIN.

Read docs/INSTALLATION.md, docs/QUICKSTART.md and docs/DNS_AND_DELIVERABILITY.md before production use.

Supported deployment model

Vib Mail is intentionally receive-only for hosted team mailboxes. The reference deployment does not expose IMAP, POP3, SMTP submission, outbound campaigns or public account registration. The contact service can submit a fixed notification through local Postfix; remote SMTP clients are not granted relay access.

Screenshots

The repository does not include screenshots containing live mailbox data. The recommended screenshot set and sanitization rules are documented in docs/SCREENSHOTS.md. Add only synthetic/demo data before publication.

Development and verification

cd mailbox-app
python3.12 -m venv .venv
. .venv/bin/activate
pip install -r requirements/development.txt
pytest --cov=apps --cov-fail-under=85
ruff check .
bandit -c .bandit -q -r apps config

Run the complete repository gate from the project root:

python scripts/forensic_audit.py --root . --full

See docs/DEVELOPMENT.md, docs/BUILD.md and docs/CODING_STANDARDS.md.

Documentation

Area	Document
Installation	docs/INSTALLATION.md
Configuration	docs/CONFIGURATION.md
Architecture	docs/ARCHITECTURE.md
Operations	docs/OPERATIONS.md
Backup and restore	docs/BACKUP_RESTORE.md
Security model	docs/SECURITY_REVIEW.md
API/routes	docs/API_REFERENCE.md
Troubleshooting	docs/TROUBLESHOOTING.md
FAQ	docs/FAQ.md
Release process	docs/RELEASE_PROCESS.md
GitHub metadata	docs/GITHUB_REPOSITORY_METADATA.md
Licensing rationale	docs/LICENSING.md
Forensic file inventory	docs/FORENSIC_FILE_INVENTORY.json

Security

Do not publish .env files, generated credentials, MariaDB dumps, Maildir data, attachments, logs, TLS keys or backups. Report vulnerabilities privately as described in SECURITY.md. Review docs/THREAT_MODEL.md before exposing a deployment to the internet.

Roadmap

The roadmap prioritizes clean-VPS acceptance, stable release qualification, automated deliverability checks, operator observability and future multi-node research without changing the receive-only security model. See ROADMAP.md.

Vib Tools ecosystem

• Company: Vib Tools
• More free open-source projects: dev.vib.tools
• Free subdomain registration: ygit.net

These links identify the project publisher and related ecosystem resources; they are not required dependencies for self-hosting Vib Mail.

Contributing and support

Contributions must preserve existing features, migrations and backward compatibility unless a breaking change is explicitly approved. Read CONTRIBUTING.md, CODE_OF_CONDUCT.md and SUPPORT.md.

License

Vib Mail is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0-or-later). The complete license text is in LICENSE. Third-party components remain under their respective licenses; see NOTICE.md and mailbox-app/LICENSES.md.

Copyright © 2026 Vib Tools and Vib Mail contributors.