webmailMaquita: Cliente webmail open-source (AGPLv3) con eDiscovery y DLP para Postfix/Dovecot
Hi everyone! I’d like to share with the community an open-source project we recently released under the AGPL-3.0 license: webmailMaquita. It is a webmail and collaboration suite designed to address a very specific need: providing advanced compliance capabilities such as eDiscovery, legal hold, and DLP on self-hosted mail servers based on Postfix + Dovecot, without relying on per-user commercial…
Introducing webmailMaquita, an open-source webmail and collaboration suite released under the AGPL-3.0 license. This innovative platform is specifically designed to provide advanced compliance features like eDiscovery, legal hold, and DLP on self-hosted mail servers running Postfix + Dovecot, without requiring per-user commercial licenses or cloud suites.
The team behind webmailMaquita identified the limitations of Roundcube for auditing and interface needs in production environments using Postfix + Dovecot. They decided to create an open-source layer that offers these essential capabilities while maintaining control over the infrastructure.
Key features of webmailMaquita include a modern webmail interface built with React + FastAPI, supporting conversation threads, labels, Sieve rules, and full-text search. Users can also manage calendars and contacts through CalDAV/CardDAV, create Kanban tasks, and engage in chat functionality.
Security is a top priority, with two-factor authentication (2FA TOTP) and email encryption at rest utilizing Dovecot mail_crypt. The platform also includes email security authentication measures such as SPF, DKIM, DMARC, and Rspamd. An anti-spoofing system detects lookalike domains, homoglyphs, and impersonation of internal roles.
For outbound DLP, it effectively detects sensitive data like national ID numbers, tax IDs, IBANs, and payment card information, and integrates seamlessly with Outlook and mobile clients via a milter.
The platform offers forensic search capabilities for compliance, including digital signatures for email exports that are GPG-signed and timestamped using RFC 3161. Additionally, a traceability system logs 39 event types with end-to-end correlation, ensuring transparency throughout the email process.
Included in the project repository are additional tools such as shared drives, integration with OnlyOffice, and an optional local AI module powered by Ollama/Whisper. This module enables dictation and suggestions without sending data to external APIs.
The project is currently under development, with pending features including automatic retention policies and automated purge/archive processes. While it has been successfully tested with around 300 mailboxes in a real production environment, further validation remains necessary for deployments with thousands of concurrent users.
The complete source code is available on GitHub (https://github.com/wilsongabriel30/webmailMaquita). The developers welcome testing on clean Debian installations, security reviews, bug reports, feedback on the architecture, insights into the roadmap, and contributions from developers and sysadmins alike. They envision webmailMaquita as a valuable, privacy-focused alternative for those seeking a self-hosted email infrastructure and compliance solution.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
