Blue Folder

INSTALL GUIDE · GOOGLE CLOUD

Blue Folder Mail on Google Cloud

Run it on a Compute Engine VM with a persistent disk. (Cloud Run looks tempting but its stateless, scale-to-zero model fights the local SQLite index — see the caveat below.)

← All guidesCompute EngineCloud Run caveatInbound email
Good fit (on a VM)
A small Compute Engine instance with a persistent disk is a clean home. Use GCS for blobs if you like. As on all clouds, port 25 is blocked — use the webhook for inbound.

Compute Engine

  1. Create the VM An e2-small on Debian or Ubuntu is plenty. Add a persistent disk (or use the boot disk) for data.
  2. Firewall

    Allow tcp:80,443 (and 22) via a firewall rule or the "Allow HTTP/HTTPS traffic" checkboxes. Keep 8080 internal.

  3. Install Docker, then the app 
    curl -fsSL https://get.docker.com | sh
curl -fsSL https://raw.githubusercontent.com/gordonvividtone/bluefolder-mail/main/install.sh | bash

    Set INBOUND_SECRET and RESEND_API_KEY. Data persists in the bfm-data volume on the disk.

This is the Docker guide on a GCE VM — see it for S3/GCS storage and Caddy TLS.

Why not Cloud Run?

Cloud Run containers are stateless and scale to zero — local disk is ephemeral and there's no mounted volume that survives. The SQLite metadata index needs somewhere durable, so Cloud Run is a poor fit unless you re-architect storage.

If you must use Cloud Run: set STORAGE_BACKEND=s3 (point at GCS via its S3-compatible endpoint, or any S3 store) for the sealed blobs, and keep the SQLite index on durable storage — a persistent disk or managed database — not on the container's filesystem. For most people a small always-on VM is simpler and cheaper than making Cloud Run stateful.

Storage & sending

Receiving mail — the honest part

Recommended — webhook

Point a provider (Mailgun, SendGrid, Postal, Resend inbound) at https://your-host/_inbound with the secret as the x-inbound-secret header or ?secret=…, forwarding full raw MIME.

Built-in SMTP — not on GCP

Google Cloud blocks outbound port 25 from Compute Engine. Running the built-in SMTP MTA is not practical here — use the webhook.

HTTPS & the front door

Terminate TLS with Caddy on the VM (automatic Let's Encrypt), or front it with a Google HTTPS load balancer:

mail.example.com {
    reverse_proxy localhost:8080
}

Add a login with BASIC_AUTH_USER / BASIC_AUTH_PASS, or keep the port on a private VPC / IAP.

Blue Folder Mail on Google Cloud — a VM that keeps your data beats a serverless box that forgets it. Full reference: DEPLOY.md. Other platforms →