INSTALL GUIDE · AWS
Blue Folder Mail on AWS
Run it on an EC2 instance or a Lightsail VPS. Both are a Linux box with Docker — and AWS S3 is a natural home for the sealed blob store.
Option 1 — EC2
- Launch an instance A t3.small (or t4g.small for arm64) on Amazon Linux 2023 or Ubuntu is ample. Attach an EBS volume if you'll keep data locally.
- Security group
Allow inbound 80, 443 and 22. Leave 8080 closed to the internet — the proxy fronts it.
- Install Docker, then the app
curl -fsSL https://get.docker.com | sh curl -fsSL https://raw.githubusercontent.com/gordonvividtone/bluefolder-mail/main/install.sh | bash
Set INBOUND_SECRET and RESEND_API_KEY. Create your mailbox at the instance's address once HTTPS is up.
Option 2 — Lightsail
Simpler and flat-rate. Create a Linux/Unix instance (the "OS Only → Ubuntu" or Docker blueprint), then install exactly as on EC2:
curl -fsSL https://raw.githubusercontent.com/gordonvividtone/bluefolder-mail/main/install.sh | bash
Open 80/443 in the Lightsail networking tab. Data persists in the bfm-data volume; snapshot the instance to back it up, or use S3 below.
Storage — local disk or S3
Default is local disk on the instance (EBS). To keep sealed blobs in S3 — durable and lets the container stay replaceable — set:
STORAGE_BACKEND=s3 S3_ENDPOINT=https://s3.us-east-1.amazonaws.com S3_BUCKET=your-bucket S3_ACCESS_KEY_ID=... S3_SECRET_ACCESS_KEY=...
Give the bucket a tightly-scoped IAM user. With S3 for blobs, keep the SQLite index on the EBS volume. The bucket only ever holds ciphertext sealed to your key.
Sending: verify your domains at resend.com and set RESEND_API_KEY. (This is unrelated to Amazon SES.)
Receiving mail — the honest part
Recommended — webhook
Point a provider (Mailgun, SendGrid, Postal, Resend inbound) at https://your-host/_inbound with the secret as the x-inbound-secret header or ?secret=…, forwarding full raw MIME.
Built-in SMTP — not on AWS
HTTPS & the front door
Terminate TLS with Caddy on the instance (automatic Let's Encrypt), or put an Application Load Balancer with an ACM certificate in front. Caddy is simplest:
mail.example.com {
reverse_proxy localhost:8080
}
Point a Route 53 (or any DNS) A record at the instance's Elastic IP first. Add a login with BASIC_AUTH_USER / BASIC_AUTH_PASS, or front it with a private network / VPN.