Deploy and Host Stalwart Webmail on Railway

The webmail Stalwart is missing. Stalwart is a superb modern mail server, but it ships without a webmail UI. This template fills that gap: a fast, offline-capable JMAP mail client you point at your own Stalwart server — one container, two variables, done.

About Hosting Stalwart Webmail

A single SvelteKit (Node) service with a volume at /app/.data for sessions, rate limits and push subscriptions. Set PUBLIC_JMAP_SERVER_URL to your Stalwart server's base URL (e.g. https://mail.example.com) — everything else has working defaults, and SESSION_SECRET is auto-generated. Your users sign in with their mailbox email + password (app passwords and password$totp TOTP suffixes work); credentials are AES-256-GCM-sealed in a server-side SQLite store, the browser cookie only ever holds an opaque session id, and all JMAP traffic is proxied same-origin. Mail is cached client-side in IndexedDB, so the app works offline and installs as a PWA. Set PUBLIC_APP_NAME and the UI, page titles and install manifest follow your branding. There's a Stalwart template on Railway too — deploy both for a complete self-hosted mail stack.

Common Use Cases

• Give a self-hosted Stalwart server the webmail UI it doesn't ship with
• Small teams and families running their own mail who want a fast, modern client with contacts, calendars and vacation responses
• White-labeled webmail for agencies or hosting providers — set PUBLIC_APP_NAME and it's your product

Dependencies for Stalwart Webmail Hosting

• A running Stalwart mail server (or any JMAP server that accepts HTTP Basic auth) — this is a client, it does not run a mail server
• Everything else is bundled: one service, one volume, no database to manage

Deployment Dependencies

• Self-hosting guide
• Source on GitHub (apps/webmail)
• Stalwart mail server — pair with the Stalwart template

Implementation Details

Recommended: Stalwart OAuth. With OAuth the server stores revocable tokens instead of the password:

1. In Stalwart, register an OAuth client — redirect URI https:///api/auth/oauth/callback, PKCE S256.
2. Set STALWART_OAUTH_ENABLED=true, STALWART_OAUTH_ISSUER_URL (usually your JMAP URL) and STALWART_OAUTH_CLIENT_ID.
3. Password sign-in disables itself automatically.

Notes:

• Calendars, quotas and vacation responses are feature-probed, so the client degrades gracefully with your server configuration.
• Token-only JMAP servers (Fastmail) are not yet supported for sign-in.
• Signup and password-reset flows stay hidden unless you wire the optional register service — manage accounts in Stalwart directly.
• PORT=3000, HOST=:: (dual-stack for Railway networking) and RAILWAY_RUN_UID=0 (volume write access) are pre-configured — leave them as they are.

Why Deploy Stalwart Webmail on Railway?

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Stalwart Webmail on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.