CamelMailer
DocsAPISDKsTemplatesHow-to

Self-hosting

One Rust binary, one PostgreSQL. If you can run Docker Compose, you can run your own mail platform with unlimited everything, MIT licensed.

What you need

  • A Linux host with Docker (1 vCPU / 1 GB is enough to start).
  • A domain, plus DNS control for it.
  • Outbound port 25. Many clouds block it by default, so request unblocking (AWS, Hetzner and OVH all have a form for it) or relay through smtp_relays.
  • Reverse DNS (PTR) on your sending IP, matching your SMTP hostname.

Boot the stack

You do not need to clone the repository. The published multi-arch images run from a single compose file you download:

terminal
mkdir camelmailer && cd camelmailer
curl -fsSLO https://raw.githubusercontent.com/camelmailer/camelmailer/main/install/docker-compose.yml
echo "POSTGRES_PASSWORD=$(openssl rand -hex 16)" > .env
docker compose up -d
curl http://localhost:5000/health

This pulls ghcr.io/camelmailer/camelmailer, starts PostgreSQL, runs migrations, and launches the HTTP API (:5000), the SMTP server (:25) and the delivery worker. Pin a release with CAMELMAILER_VERSION=vX.Y.Z in .env.

On bare metal, install the Debian or Ubuntu package instead (amd64 and arm64, with systemd units) from the releases page, point /etc/camelmailer/camelmailer.yml at your own PostgreSQL, and start the units. Cloning the repository and running docker compose up -d --build is only for building from source, which you need only if you are changing CamelMailer itself.

First account & first mail

terminal
# an admin login for the dashboard
docker compose exec web camelmailer make-user you@yourdomain.com Ada Ops --admin

# or script everything with a machine key
docker compose exec web camelmailer make-admin-api-key ops

Sign in, create an organization → mail server → sending domain → API credential, then send. The quickstart covers the calls; the dashboard does the same via clicks.

DNS you must set

RecordPurpose
A mail.yourdomain.comThe instance (API + dashboard, TLS via your reverse proxy)
MXOn inbound domains: receiving replies/bounces → your instance
TXT SPFv=spf1 a:mail.yourdomain.com -all on sending domains
TXT DKIMPublish the DKIM public key shown during setup
TXT DMARCv=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com
PTR (reverse DNS)Sending IP → SMTP hostname; set at your hosting provider

Details and copy-paste values per domain live in the dashboard. See verify a domain.

Production checklist

  • Terminate TLS for the API/dashboard at a reverse proxy (Caddy, nginx, Traefik) in front of port 5000.
  • Enable SMTP STARTTLS: smtp_server.tls_enabled with your certificate.
  • Set auth.frontend_url and web_server.cors_origins if you host the dashboard on its own origin.
  • Back up PostgreSQL. That is all the state. pg_dump on a timer is fine to start.
  • Warm up fresh sending IPs gradually; keep transactional volume steady rather than bursty while reputation builds.
  • Upgrades: docker compose pull then docker compose up -d (or bump CAMELMAILER_VERSION). Migrations run automatically via the one-shot migrate service.

Configuration

Everything lives in one YAML file ( config/camelmailer.example.yml documents every group) or environment variables for the essentials (DATABASE_URL). Accounts, RBAC, SSO and CORS are covered in the repository's docs/authentication.md.

The application database role must not be a PostgreSQL superuser. Superusers bypass row-level security, which would disable tenant isolation. The bundled compose file creates the role correctly.

Sizing

The binary is a few dozen MB of RSS per role; PostgreSQL dominates. A 2 vCPU / 4 GB box comfortably handles hundreds of thousands of transactional messages a day. Scale by giving PostgreSQL room first, then add worker replicas.