Paul LütznerandClaude Opus 5
ff29d7ba7d
Reported from a live instance: message bodies stopped resizing, with "Executing inline script violates the following Content Security Policy directive 'script-src 'self' 'nonce-…'" on every open. A srcdoc frame inherits the EMBEDDING page's Content-Security-Policy on top of the <meta> one it carries itself, so the height reporter inside it — the only reason `allow-scripts` is on that sandbox at all — has to satisfy both. MessageRenderer minted a nonce of its own, which the frame's policy named and the page's policy had never heard of. The moment the application itself grew a CSP, the script was blocked by the inherited one and every message sat at its 80px floor with a scrollbar inside a scrollbar. The error names the policy that did it: 'self' appears in the page's script-src and never in the frame's. It uses the request's nonce now. Nothing is given away by sharing it — the nonce is already in that document, beside the email's own markup, and the whole point of a nonce is that markup which did not come from us cannot name it. Asking CspNonce for the value is also what tells the response listener the header must carry one. WHY THE SUITE DID NOT CATCH IT, which matters more than the fix. Under APP_DEBUG the full policy is sent Report-Only — deliberately: the profiler injects inline scripts nothing can nonce. Report-Only does not block. The browser stack runs debug, so message-frame-height.spec.ts measured a frame that worked perfectly there while being blocked in production, where the same policy is ENFORCED. Verified: that spec passes with this fix reverted. So the guard is a unit test. It asserts the invariant the enforced policy depends on — the frame's nonce IS the request's — which is true or false whichever header the environment happens to send. It fails without the fix. Also the two deprecation warnings from the same console: Turbo.config.forms.confirm replaces the removed-in-future Turbo.setConfirmMethod, and mobile-web-app-capable joins the Apple- prefixed meta rather than replacing it — older iOS is the platform that tag was written for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
plMail
Self-hosted mail with a calendar beside it. Connect the mailboxes you already have — IMAP, Gmail, Outlook — and read them side by side in one inbox, on a server you own.
📖 Read the handbook →
Installing on Docker, Linux, WSL2, macOS or a NAS · every feature in detail · connecting Gmail and
Outlook, with the exact permissions to tick · how the internals work.
Also on the wiki and in docs/ — all three
are built from the same files.
What it is
A mail client you host yourself. It connects to the mailboxes you already have — IMAP, Gmail, Outlook — syncs them into your own PostgreSQL database, and gives them one inbox, one search box and one set of labels in the browser.
It is not a mail server: it doesn't receive mail from the internet or host your domain. Because everything is synced locally, search runs against your database, and your mail stays readable when a provider doesn't.
Highlights
- Every account in one place — IMAP, Gmail and Outlook side by side, sending aliases included. Credentials are encrypted before they touch the database.
- New mail arrives on its own — IMAP IDLE, Gmail and Outlook push, browser notifications.
- Search that means it — full text plus
from:,subject:,label:,has:,before:and friends, completed as you type. - Filters as a tree — any/all/none, nested, restated in plain English and counted against real mail before you save. Apply one to mail that arrived before it existed.
- A calendar beside the mail — two-way sync with Google, Microsoft and CalDAV, drag-to-move week grid, invitations answered in place, share and booking links.
- Files where you keep them — attach from and save to Drive, Photos, OneDrive, Dropbox, Nextcloud and Immich.
- Yours — two-factor auth, per-app JMAP passwords, 41 themes, English, German and Pirate.
A look around
 |
 |
| Threads — replies collapse into one conversation. | Compose — rich text, autocomplete, undo send. |
 |
 |
| Themes — 41 of them, light and dark. | Calendar — docked beside the mail, or its own page. |
 |
 |
| Filters — counted before you save. | Admin — workers, push health, logs, queue. |
Screenshots use demo data — none of the accounts, senders or messages shown are real.
Install
Images are published for linux/amd64 and linux/arm64. Nothing to fill in first: the secrets are
generated on first start, and the public address is asked for on the setup screen.
Docker
git clone https://github.com/karatektus/pl_mail.git
cd pl_mail
docker compose up -d
Open https://localhost and create your account.
TrueNAS SCALE
- Create a dataset for plMail — say
yourPool/yourDataSet/plmail. - Open
truenas.compose.yamland change one line to that path:path_data: &path_data /mnt/yourPool/yourDataSet/plmail - Apps → Discover → ⋮ → Install via YAML, paste the file, install.
Reach it on port 30080 and put a reverse proxy in front of it. Everything else in that file works
as it is; each setting explains itself in place.
Then
Add an IMAP mailbox in Settings → Mail accounts and you're done. Gmail and Outlook need OAuth credentials from Google or Microsoft first — the handbook walks through both, including the optional Pub/Sub topic for instant Gmail delivery.
Back up two things, separately: the PostgreSQL data and
var/secrets/generated.env. The database holds your mail; the key inside that file unlocks the credentials in it. Keeping them apart is the point — and losing the key means the stored mailbox passwords are gone.
Contributing
Bug reports and pull requests welcome — see CONTRIBUTING.md for the dev setup, the test suites and the console commands.
License
AGPL-3.0.