- Go 77.9%
- Shell 20%
- Python 1.1%
- Roff 0.6%
- Dockerfile 0.4%
66f5b58511
A public mail relay for a private mail server that runs without LibrePortal: the librepost command, the bundled mail engine, the systemd unit, the .deb build, docs, and unit, end-to-end and systemd tests that run on throwaway Docker containers only. Assisted-by: Claude |
||
|---|---|---|
| cmd/librepost | ||
| docs | ||
| internal | ||
| packaging | ||
| release | ||
| scripts | ||
| test | ||
| .gitignore | ||
| CHANGELOG.md | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| README.md | ||
| VERSION | ||
LibrePost
A post office for your private mail server. LibrePost sits on a small public machine and handles the internet's side of email, so the mail server that holds your messages can stay hidden at home. Nothing on the internet needs to know where that server is.
It is for people who run their own mail server and do not want to expose it: a home server, a machine behind a VPN, or a server that must not have port 25 open to the world. If you already have a private link between a public machine and your mail server (WireGuard, a VPN or a plain LAN), LibrePost uses it. It installs like any other Linux service and leaves the rest of the machine alone.
What you get
- Your mail server stays private. Other mail servers only ever talk to the public machine. Yours is never named in DNS, headers or logs.
- Unknown addresses are refused at the door. LibrePost asks your server whether a mailbox exists before it says yes, so you do not send bounce messages to strangers who forged someone's address.
- Junk is stopped while the sender is still connected. Blocklists, sender checks, rate limits and optional greylisting run before a message is accepted.
- Nothing is lost when your server is off. Mail waits in a short queue (five days by default) and is delivered as soon as your server is back.
- It is never an open relay. Outgoing mail is accepted only from your server, only over an encrypted and signed-in connection, and only for your own domains. A built-in test proves it.
- Plays nicely with what is already there. It does not touch your firewall, web server or intrusion-prevention software. It tells you which ports it needs and leaves opening them to you.
- Easy to script. Every command can print JSON, so an installer or a monitoring tool can set it up, read its status and get the exact DNS records to publish, without a single question.
Get started
LibrePost is a Debian package for Debian and Ubuntu. Follow the install guide (also on the wiki). In short: install the package, describe your domains and your server in one small file, and publish the DNS records LibrePost lists for you.
The package is checked with LibrePortal's release key. The guide shows how to verify it before installing.
Already using LibrePortal?
LibrePortal has a LibrePost app that does the same job with a tunnel it sets up for you. How the app and the standalone package relate, and how to move between them.
Learn more
For developers
The mail engine is Stalwart, bundled unchanged. LibrePost is a small Go program that configures it from one declarative file, answers its recipient checks, and reports on it. Build, test and release notes are in the developer guide on the wiki. The end-to-end test needs only Docker.
Contributing and reporting problems
Found a bug or have an idea? Open an issue. Please never post passwords, keys or other secrets in an issue; describe the problem and we will say what to share. Security problems: use the report a bug page rather than a public issue. Pull requests are welcome.
Licence
GNU AGPL-3.0-or-later. The bundled Stalwart mail engine is AGPL-3.0 too.