INSTALL GUIDE · DIGITALOCEAN
Blue Folder Mail on DigitalOcean
Two ways: a Droplet you run Docker on (most control), or App Platform from the repo's app.json (no server to manage). Both keep your data in a volume.
Option 1 — Droplet (Docker)
- Create the Droplet A $6 basic Droplet (1 GB) is plenty. Pick Ubuntu 22.04+; the "Docker" Marketplace image has Docker preinstalled.
- Open the firewall
In the Droplet's firewall, allow inbound 80, 443 and 22. Keep 8080 internal.
- Install the app
curl -fsSL https://raw.githubusercontent.com/gordonvividtone/bluefolder-mail/main/install.sh | bash
Set INBOUND_SECRET and RESEND_API_KEY when prompted. Data persists in the bfm-data volume.
This is the Docker guide on a Droplet — see it for S3 storage and HTTPS with Caddy.
Option 2 — App Platform
The repo ships app.json, which declares the container and its env vars (with INBOUND_SECRET marked as a generated secret).
- Create the App from your repo In App Platform, create an App pointing at your fork; it builds the included Dockerfile.
- Attach a volume for /data
App Platform gives you one container — mount a volume at /data so the SQLite index and sealed blobs survive restarts.
- Set the env vars
Add RESEND_API_KEY, let INBOUND_SECRET generate, and set BASIC_AUTH_USER / BASIC_AUTH_PASS. Deploy — TLS on the App's URL is automatic.
Storage & sending
- Storage — local disk (volume) by default; or STORAGE_BACKEND=s3 with DigitalOcean Spaces or any S3-compatible bucket. The bucket only ever holds sealed ciphertext.
- Sending — verify domains at resend.com, set RESEND_API_KEY.
Receiving mail — the honest part
Recommended — webhook
Point a provider (Mailgun, SendGrid, Postal, Resend inbound) at https://your-host/_inbound with the secret as the x-inbound-secret header or ?secret=…, forwarding full raw MIME.
Built-in SMTP — not here
HTTPS & the front door
On App Platform, TLS is automatic. On a Droplet, terminate TLS with Caddy and keep the app on localhost:
mail.example.com {
reverse_proxy localhost:8080
}
Either way, add a login with BASIC_AUTH_USER / BASIC_AUTH_PASS before putting real mail in it.