Webmail is where my de-Googling project meets its toughest jury. Last week’s post put my family on the platform; their daily experience of it is not Stalwart’s elegant architecture, it’s a browser tab. And stock Roundcube, bless its reliable heart, looks like the year 2012 shipped a security update. For people leaving Gmail, unfamiliarity is friction, and friction is how migrations die.

So the webmail got treated as a product surface, not an afterthought. Some of that work was configuration, and some of it was, uncharacteristically for this project, spending money.

Buying polish

Roundcube Plus sells commercial plugins, and I bought the skin framework with the Gmail-style theme. Self-hosters can be allergic to paying for software; I think that instinct is exactly backwards for a project like this. The entire stack costs me server bills and my evenings, and a modest payment that makes the interface feel familiar to my family is the cheapest adoption insurance in the whole budget. The skin got its SCSS recompiled after I adjusted it, the theme-switcher and color menus got disabled (family members want email, not a settings safari), and a persistent-login plugin added the “stay signed in” behavior every commercial provider has and stock webmail oddly lacks.

The rest of the additions, in rough order of family impact: a calendar plugin speaking CalDAV to Stalwart, with a cron timer for event reminders and a timezone fix that mattered more than it sounds; a CardDAV plugin preconfigured to auto-discover the Stalwart address book, so contacts exist in webmail without anyone configuring a sync URL; full-text search switched on by default, backed by the OpenSearch index Stalwart already maintains; and a ManageSieve UI, so the spam-filter-to-Junk rule from the deliverability post is something each person can enable themselves with checkboxes instead of asking me to edit scripts.

The plumbing behind the paint

Two infrastructure notes hide under the cosmetics. Roundcube keeps sessions and caches in Valkey, and the managed Valkey requires TLS, which Roundcube’s Redis client doesn’t speak. The fix is a small stunnel sidecar terminating TLS next to the app, so Roundcube talks plaintext across localhost and stunnel carries it encrypted to the DBaaS. It works, it’s invisible, and it earns a grim callback in a later post when a rotated database IP taught me what stunnel caches at startup.

And because webmail rode the same two-node round-robin as mail itself in this era, the whole arrangement ran per-host with its own mesh hostname on each mail node, deployed by the same role. One Ansible run, identical webmails, zero snowflakes.

Updates, the unglamorous part

Commercial plugins bring a commercial-plugin lifecycle. Updates arrive as tarballs from a customer portal, not a package manager, and I’ve learned their internal layout varies enough between downloads that my update procedure now probes each archive before extracting instead of assuming. The other lesson cost me a config regression: the plugin config that matters is the one templated by Ansible, and any setting adjusted directly in the deployed file is one converge away from being clobbered. Nothing here is difficult, but “unglamorous and slightly manual” is the honest cost of the polish, paid roughly twice a year when updates ship. This summer’s round also bumped Roundcube itself to the 1.6.16 LTS release and enabled the calendar plugin’s SSRF protection, because polish should never come at security’s expense.

The webmail verdict from the household jury: it looks familiar, search finds things, calendars remind, and nobody asks where the old thing went. In this project’s scoring system, silence is the five-star review.

Next week the series leaves the mail era: keeping the old addresses alive while the world catches up to the new ones.