Deploy Stalwart Webmail

Deploy and Host Stalwart Webmail on Railway

The webmail Stalwart is missing. Stalwart is a superb modern mail server, but it ships without a webmail UI. This template fills that gap: a fast, offline-capable JMAP mail client you point at your own Stalwart server — one container, two variables, done.

About Hosting Stalwart Webmail

A single SvelteKit (Node) service with a volume at /app/.data for its SQLite store: sessions, rate limits, settings and push subscriptions. Set PUBLIC_JMAP_SERVER_URL to your Stalwart server's base URL (e.g. https://mail.example.com) — everything else has working defaults, and SESSION_SECRET is auto-generated. Your users sign in with their mailbox email + password (app passwords and password$totp TOTP suffixes work); credentials are AES-256-GCM-sealed in a server-side SQLite store, the browser cookie only ever holds an opaque session id, and all JMAP traffic is proxied same-origin. The client is Zaur Mail 2: mail, contacts, calendar and server-side filter rules in one app, with drafts and an outbox that keep working offline, live updates over JMAP push, and phone and tablet layouts. It installs as a PWA. There's a Stalwart template on Railway too — deploy both for a complete self-hosted mail stack.

Common Use Cases

• Give a self-hosted Stalwart server the webmail UI it doesn't ship with
• Small teams and families running their own mail who want a fast, modern client with contacts, calendars and vacation responses
• A browser and phone client for any Stalwart account, with new-mail push notifications once you add VAPID keys

Dependencies for Stalwart Webmail Hosting

• A running Stalwart mail server (or any JMAP server that accepts HTTP Basic auth) — this is a client, it does not run a mail server
• Everything else is bundled: one service, one volume, no database to manage

Deployment Dependencies

• Zaur Mail 2 README
• Source on GitHub (apps/mail2)
• Stalwart mail server — pair with the Stalwart template

Implementation Details

Recommended: Stalwart OAuth. With OAuth the server stores revocable tokens instead of the password:

1. In Stalwart, register an OAuth client — redirect URI https:///api/auth/oauth/callback, PKCE S256.
2. Set STALWART_OAUTH_ENABLED=true, STALWART_OAUTH_ISSUER_URL (usually your JMAP URL) and STALWART_OAUTH_CLIENT_ID.
3. Password sign-in disables itself automatically.

Notes:

• Push notifications: generate keys with npx web-push generate-vapid-keys and set VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY and VAPID_SUBJECT. Without them the app still updates live while open; it just can't notify when closed.
• The interface is branded Zaur Mail.
• Calendars, quotas and vacation responses are feature-probed, so the client degrades gracefully with your server configuration.
• Token-only JMAP servers (Fastmail) are not yet supported for sign-in.
• Signup and password-reset flows stay hidden unless you wire the optional register service — manage accounts in Stalwart directly.
• PORT=3000, HOST=:: (dual-stack for Railway networking) and RAILWAY_RUN_UID=0 (volume write access) are pre-configured — leave them as they are.

Why Deploy Stalwart Webmail on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Stalwart Webmail on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.