Homebox

A set of Ansible scripts to setup a secure email and personal files server. This project is for you if:

• You are interested to host your emails yourself, for privacy, security or any other reason.
• You want your server to be secure against both physical and remote intrusion.
• You want a low maintenance box that keep itself updated automatically.
• You trust the Debian community to publish security updates.

Official documentation and user's guide

• Stable branch
• Development branch

Mailing lists

Thanks to Framasoft, two mailing lists have been created, one for general questions, suggestions and support, and another one dedicated for development.

• General questions: https://framalistes.org/sympa/info/homebox-general
• Development: https://framalistes.org/sympa/info/homebox-dev

Current project status

System installation and features

• Custom Debian installer generation with full disk encryption and fully automatic installation.
• Unlock the system upon boot by entering the passphrase through SSH or with a Yubikey.
• Install packages only from Debian stable (Bullseye).
• Automatic letsencrypt certificates generation using DNS challenge.
• Automatic security updates (optional).
• Centralised authentication with an LDAP users database, SSL certificate, password policies, PAM integration.
• AppArmor activated by default, with a profile for all daemons.
• Random passwords generated and saved into pass by default.
• Can be used at home, on a dedicated or virtual server hosted online.
• Flexible IP address support: IPv4 only, IPv6 only, and IPv4+IPv4 or IPv4+IPv6.
• Embedded DNS server, with CAA, DNSSEC and SSHFP (SSH fingerprint) support.
• Grade A https sites, HSTS implemented by default.
• Automatic configuration of OpenPGP Web Key Directory.
• Automatic firewall rules for inbound, outbound and forwarding traffic, using nftables.
• Restricted outbound traffic to the minimum.
• Automatic update of DNS servers and glue records on Gandi.

Emails

• Postfix configuration and installation, with LDAP lookups, internationalised email aliases, fully SSL compliant.
• Generate DKIM keys, SPF and DMARC DNS records. The DKIM keys are generated every year.
• Automatic copy of sent emails into the sent folder.
• Automatic creation of the postmaster account and special email addresses using RFC 2142 specifications.
• Dovecot configuration, IMAPS, POP3S, Quotas, ManageSieve, simple spam and ham learning by moving emails in and out the Junk folder, sieve and vacation scripts.
• Virtual folders for server search: unread messages, conversations view, all messages, flagged and messages labelled as "important".
• Email addresses with recipient delimiter included, e.g. [email protected].
• Optional master user creation, e.g. for families with children or moderated communities.
• Server side full text search inside emails, attached documents and files and compressed archives, with better results than GMail.
• SOGo webmail with sieve filters management, password change form, Calendar and Address book management, GUI to import other account emails.
• Powerful and light antispam system with rspamd and optional access to the web interface.
• Antivirus for inbound and outbound emails with clamav.
• Automatic configuration for Thunderbird and Outlook using published XML and other clients with special DNS records (RFC 6186).

Calendar and Address book

• Install and configure a CalDAV / CardDAV server, with automatic discovery (RFC 6186).
• Groupware functionality in a web interface, with SOGo.
• Recurring events, email alerts, shared address books and calendars.
• Mobile devices compatibility: Android, Apple iOS, BlackBerry 10 and Windows mobile through Microsoft ActiveSync.

Other optional features

• Incremental backups, encrypted, on multiple destination (SFTP, S3, Samba share or USB drive), with email and Jabber reporting.
• Jabber server, using ejabberd, with LDAP authentication, direct or offline file transfer and optional server to server communication.
• Static web site skeleton configuration, with https certificates and A+ security grade by default.

Development

• YAML files validation on each commit, using travis-ci.
• End to end integration tests for the majority of components.
• Playbooks to facilitate the installation or removal of development packages.
• Global debug flag to activate the debug mode of all components.
• Fully open source Ansible scripts licensed under GPLv3.