#?.info

So I'm probably going to be really boring on Mastodon for a week or two as I start another self hosting project. This post is primarily about why and also compares two webmail systems, #Roundcube and #SOGo.

Right now I have a fairly old version of Zimbra handling my email. It's old because Zimbra turned to the dark side a few years ago, going from offering an open source email-in-a-box thingie to making it only available with a high priced support contract. No “Community Edition” any more, probably a bunch of execs had a Matt Mullenweg moment of realizing they were maintaining open source but not a lot of people were paying for it, and made Mullenweg look almost reasonable by just closing up everything.

Which is a shame. Zimbra had its flaws, but it did a lot in one relatively easy to install and maintain package.

And honestly, if you look out there at the other “Mail in a box” packages, they're OK, but they're not quite as advanced. I was able to get Zimbra to sit behind my firewall, with a proxy routing email to my home network via a non-blocked port, authenticate against my Samba AD system (which I admit, is unusual), and manage numerous email aliases so I could block off spammers, etc.

The problem

The community edition of Zimbra isn't really being updated any more. And that's a major problem because there are security holes in it. I found that out the hard way when someone hacked my mailserver and turned it into a proxy. My Internet connection started acting weird, various websites started blocking me, and I found out after doing some snooping on my network that there was weird traffic coming out of my mail server. Logged into it and found processes running from /tmp/ and /dev/shm/.randomstring/ (/dev/shm? Really?) that were clearly not meant to be running.

I've since locked it down. Firewalls now prevent the mail server from making pretty much any outgoing connections with the exception of my smarthost. I also have to block access to webmail from outside. But this is a wake up call. The final versions of open Zimbra aren't just “old” in the sense of “doesn't have the latest features and looks like it came out 20 years ago” way that everyone puts too much emphasis on IMO, but they also have major security holes. I can't keep using them.

Alternatives

The obvious alternative is just to use a mail-in-a-box solution like Mailcow and Kolab. Mailcow looks decent but it's not clear to me how easy it is to integrate with an existing infrastructure, or run behind a firewall with hacks to get around ISP port blocks. Kolab seems to be available in two versions, a version 3 which is elderly and run from regular tools and LDAP, and the shiny new version 4 which isn't but is designed to be very scalable. I have not yet found an answer to whether it can be integrated into my hardware or not.

Most of the tools out there seem to be a combination of an off the shelf webmail service, like Roundcube or SOGo, with a standard email backend like Postfix and Dovecot (those are VERY popular, and with good reason!), an LDAP server, and some kind of interface to manage the LDAP server.

So I started there. What about I just get the common components, and then the only thing I'm going to have to worry about is some sort of front end for LDAP. Maybe I could even write one.

Why not write my own everything?

I don't have the time.

Why not vibe code it?

Go away.

OK, so Roundcube vs SOGo. What's the deal?

So Roundcube and SOGo are both very decent webmail front ends that can be bolted on to any IMAP, SMTP Submission, and LDAP server backends. To explain that a little:

• IMAP servers like Dovecot store email. They're the destination point of any email sent across the Internet.
• SMTP Submission servers receive outgoing emails and send them across the Internet. Back when I wasn't considered “old” and the Internet didn't suck, there was no need, you could just send email directly to the servers of the users who wanted it, but then the spammers happened, and then email administrators went overboard, and, well, now we can't send email directly to anyone. But we can send it to SMTP Submission servers who forward it for us. And definitely don't abuse that power.
• LDAP is a directory system. It essentially contains all the user information. There's usually an LDAP server that maintains usernames and passwords, and sometimes that server, and sometimes a different one, also maintains lists of people in an organization etc. An SMTP server that receives email can look up the username in an LDAP server, or more typically in files generated from the LDAP server's data, and use this information to know whether it's a valid user, whether it needs to be forwarded to multiple users, etc.

So: IMAP – holds the email. SMTP Submission servers send the email. LDAP says who is in the email locally so the other two can work properly.

Right, so Roundcube and SOGo are the user facing parts of this (unless you have an email client in which case that's the user facing part.) These are probably the two most popular and thus well supported open source email front ends at this time.

Roundcube

Roundcube is a fairly bare bones system written in PHP (boo! Well, not boo, because it makes it very easy to modify and maintain. But PHP does also make it easy to add certain types of security hole because the language itself has bugs in it. Like “” is equal to zero, “0”, null, and false, for some reason. Still, it has a lot of eyes on it, and probably is fairly secure.) PHP programs are, trust me, pretty straightforward to stand up and manage so ultimately it's an easy install and relatively easy to customize.

The user interface is fairly straightforward with no unexpected weird behavior. A minor niggle is that the list of emails has a dot that's beside the subject rather than the sender and date above it, which draws your eye to that line and makes it appear the sender and date are below (because they're after the dot.) There's a thin line that separates emails, but somehow I keep misreading it. Anyway. Not a major issue and probably fixable with some CSS. I did have problems with the user interface constantly logging me out, which may be a configuration issue. The mobile interface works but feels a little crude too, again probably fixable with some CSS.

Roundcube is webmail only. It has a contacts manager, but otherwise that's all Roundcube has. If you're used to online email systems supporting an integrated calendar, you're out of luck. Well, supposedly there are extensions out there that support a CalDAV back-end but I'm drawing a blank finding one that's not part of an existing suite, or requiring payment.

Should webmail support online calendars?

SOGo

SOGo does. SOGo also has a straightforward user interface, with maybe a little unexpected behavior, and has an integrated calendar function. The UI style is extremely slick, with sweeping wipes between screens that would excite George Lucas. Font choices seem better, there's good use of white space, there's been a lot of thought into the general look of the UI. I said a little unexpected behavior: CTRL-ENTER doesn't send emails. Initially I couldn't send an email at all (the button was disabled) because I hadn't set a from address, and there were no visual clues I was supposed to do that and never used an email client before where you were supposed to select the only email address you have before sending anything. By default composing a new email brings up a selector asking you what type of window you want to compose the message in, which is weird, but you can set a preference to disable this and just create the window. Entering email addresses in the To: line is a “mode” that that requires specific keys to exit.

SOGo is a more sophisticated system whose server side is written in Objective C, a programming language from the 1980s that, at one time, was considered a rival to C++. The NeXT computers had their user interfaces written in it. And modern Apple is basically NeXT – Apple bought NeXT in the mid-1990s and its management became Apple's management, rather than vice versa. And macOS, nee Mac OS X, is a direct descendant of NEXTSTEP, which is the aforementioned operating system.

Despite Apple's adoption of Objective C, it's never really taken off, and Apple themselves have replaced it with Swift. Despite that it has a following, especially among veteran NeXTStep users, and Apple's WebObjects framework, a 1990s web development environment originally written in Objective C, has an open source equivalent in SOPE.

So... SOGo runs over SOPE, the back end is written in Objective C, and, compared to Roundcube, has a more modern UI that uses the AngularJS framework for the front end.

Is this good? Well, the devs themselves don't seem to think so. They are currently engaged in a rewrite to convert the Objective C code into Python. Objective C isn't a bad language, but it's not memory safe, and compiling C-family applications in 2026 is a royal pain, with very little in the way of intelligent dependency management. There are relatively few developers familiar with the language and the environment, which doesn't help either.

My thoughts on the front end.

I started very pro-SOGo and as time (24 hours!) has worn on have rethought my views. Here are the basic issues I have with SOGo:

1. It's a beast to compile and release updates. OK, I can automate that, or, maybe hopefully perhaps, find that I can configure one of the Big Suites that includes it to handle that side of things.
2. I am concerned about Objective C from a security standpoint. I'd be suspicious of a web application written in C++, and Objective C is arguably a little worse. There's a reason Apple switched WebObjects to Java, and replaced Objective C with Swift.
3. The user interface looks gorgeous... but it's also glitchy. Why can't I hit return after entering an email address in a To line? Why are the defaults so messy? Why doesn't CTRL-ENTER “send” like Outlook, Zimbra, and even Mastodon?
4. The devs have essentially deprecated the current version in favor of the rewrite. I think they're right to do so, but it also means switching to it now is going to leave me with another unsupported platform.
5. While SOGo has calendaring, it prefers to manage the entire system itself. I found nothing to suggest it will work with external CalDAV systems. That might or might not work for you, but if you intend, long term, to not be tied to any specific platform, this might be an issue.

The alternative, Roundcube, has many of these issues too, and is not as fully featured. I do need to find a calendar app for it. It's visually less clean too. So at this point it's not so much that I'm anti-SOGo, just unsure about it. Roundcube's main advantage is that it's better supported, and the use of PHP means it's much easier to customize.