stalwart

All-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV).

• Category: Apps
• Status: 0
• Image: stalwartlabs/stalwart, 4
• Healthcheck: Yes
• Backups: Yes
• Email: Yes
• Tests: No
• SSO: Yes

Quick start

abra app new stalwart --secrets
abra app config <app-name>   # set DOMAIN, BASE_DOMAIN
abra app deploy <app-name>

On first deploy, Stalwart generates a random admin password and prints it to logs:

abra app logs <app-name> app

Then open https://mail.example.com/admin to complete the setup wizard.

Post-deploy configuration (required)

After the setup wizard, apply these settings in the Stalwart admin UI under Network → Servuces → HTTP → General:

• Enable Obtain remote IP from Forwarded header — required so Stalwart sees real client IPs from Traefik

Ports

Port	Mode	Protocol	Purpose
25	Host	SMTP	Inbound mail from other servers
465	Host	SMTPS	Client mail submission (implicit TLS)
587	Host	Submission	Client mail submission (STARTTLS)
993	Host	IMAPS	Client mail retrieval (implicit TLS)
443	Traefik	HTTPS	Admin UI, JMAP, autodiscover, webmail

Bulwark webmail (optional)

To enable the Bulwark webmail client at webmail.example.com:

1. Add a DNS record: webmail.example.com CNAME → mail.example.com
2. Uncomment the three Bulwark lines in .env:

   COMPOSE_FILE="compose.yml:compose.bulwark.yml"
   WEBMAIL_DOMAIN=webmail.example.com
   SECRET_BULWARK_SESSION_SECRET_VERSION=v1
   

3. Generate the session secret: abra app secret generate <app-name>
4. Redeploy: abra app deploy <app-name>

When Bulwark is active, https://mail.example.com/ redirects to https://webmail.example.com/. The admin interface remains at https://mail.example.com/admin.

Backup

Backupbot backs up both volumes:

• /etc/stalwart - server configuration
• /var/lib/stalwart - RocksDB mail data (hot copy; RocksDB's WAL ensures the backup is recoverable on restore)