1
mkdir -p /opt/stalwart && cd /opt/stalwart
2
cat > docker-compose.yml << 'EOF'
3
services:
4
  stalwart:
5
    image: stalwartlabs/stalwart:v0.16.19
6
    container_name: stalwart
7
    hostname: mail.example.com
8
    restart: unless-stopped
9
    ports:
10
      - "25:25"      # SMTP — 接收外部邮件
11
      - "143:143"    # IMAP — STARTTLS
12
      - "465:465"    # SMTPS — 隐式 TLS，客户端发信
13
      - "587:587"    # SMTP submission — STARTTLS
14
      - "993:993"    # IMAPS — 隐式 TLS，客户端收信
15
      - "8088:8080"  # Web 管理后台 + JMAP（8088 避开 qBittorrent 的 8080）
16
      - "443:443"    # HTTPS + ACME TLS-ALPN-01
17
    volumes:
18
      - ./data:/opt/stalwart-mail
19
    environment:
20
      - STALWART_HOSTNAME=mail.example.com
21
EOF

1
dig MX example.com @8.8.8.8 +short
2
# 应返回: 10 mail.example.com.
3

4
dig A mail.example.com @8.8.8.8 +short
5
# 应返回: <PUBLIC_IP>
6

7
dig TXT example.com @8.8.8.8 +short
8
# 应返回: "v=spf1 a mx ip4:<PUBLIC_IP> ~all"
9

10
dig TXT _dmarc.example.com @8.8.8.8 +short
11
# 应返回: "v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com"
12

13
dig TXT v1-ed25519-20260824._domainkey.example.com @8.8.8.8 +short
14
# 应返回 DKIM 公钥
15

16
dig TXT v1-rsa-20260824._domainkey.example.com @8.8.8.8 +short
17
# 应返回 RSA 公钥

1
# 读取证书和私钥 PEM
2
CERT_PEM=$(cat ~/.acme.sh/mail.example.com_ecc/fullchain.cer)
3
KEY_PEM=$(cat ~/.acme.sh/mail.example.com_ecc/mail.example.com_pkcs8.key)
4

5
# 通过 JMAP 上传证书
6
# 认证: HTTP Basic, 用户 admin@example.com
7
# 端点: http://127.0.0.1:8088/jmap
8

9
# 方法一: 直接 curl（需要用文件传 PEM，命令行太长不便内联）
10
# 写入 JSON 到文件再 POST
11
python3 -c "
12
import json, sys
13
cert = open('~/.acme.sh/mail.example.com_ecc/fullchain.cer').read()
14
key = open('~/.acme.sh/mail.example.com_ecc/mail.example.com_pkcs8.key').read()
15
payload = {
16
    'using': ['urn:ietf:params:jmap:core', 'urn:stalwart:jmap'],
17
    'methodCalls': [['x:Certificate/set', {
18
        'create': {
19
            'cert1': {
20
                'certificate': {'@type': 'Text', 'value': cert},
21
                'privateKey': {'@type': 'Text', 'secret': key}
22
            }
23
        }
24
    }, 'a1']]
25
}
26
with open('/tmp/cert_upload.json', 'w') as f:
27
    json.dump(payload, f)
28
print('JSON written')
29
"
30

31
curl -s -u 'admin@example.com:<PASSWORD>' \
32
  -X POST http://127.0.0.1:8088/jmap \
33
  -H 'Content-Type: application/json' \
34
  -d @/tmp/cert_upload.json
35

36
# 成功返回: {"methodResponses":[["x:Certificate/set",{"created":{"cert1":{"id":"jbmXXXXXXX"}},"accountId":"..."},"a1"]],...}
37
# 记录返回的 cert id

1
# 重启 Stalwart 加载新证书（用 docker restart，不要用 compose up）
2
docker restart stalwart
3
sleep 15
4

5
# 验证 443 端口证书
6
echo | openssl s_client -connect 127.0.0.1:443 -servername mail.example.com 2>/dev/null \
7
  | openssl x509 -noout -issuer -subject -dates
8

9
# 期望输出:
10
# issuer=C=US, O=Let's Encrypt, CN=YE1
11
# subject=CN=mail.example.com
12
# notBefore=Aug 25 00:00:00 2026 GMT
13
# notAfter=Nov 23 00:00:00 2026 GMT
14

15
# 验证 465 (SMTPS)
16
echo | openssl s_client -connect 127.0.0.1:465 -servername mail.example.com 2>/dev/null \
17
  | openssl x509 -noout -issuer -subject
18

19
# 验证 993 (IMAPS)
20
echo | openssl s_client -connect 127.0.0.1:993 -servername mail.example.com 2>/dev/null \
21
  | openssl x509 -noout -issuer -subject
22

23
# 外部可达性验证
24
echo | timeout 10 openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null \
25
  | openssl x509 -noout -issuer -subject

1
# 查看当前 spam 设置
2
curl -s -u 'admin@example.com:<PASSWORD>' -X POST http://127.0.0.1:8088/jmap \
3
  -H 'Content-Type: application/json' \
4
  -d '{
5
    "using": ["urn:ietf:params:jmap:core", "urn:stalwart:jmap"],
6
    "methodCalls": [["x:SpamSettings/get", {"ids": ["singleton"]}, "c1"]]
7
  }'
8

9
# 修改阈值（scoreSpam 5.0 → 15.0）
10
curl -s -u 'admin@example.com:<PASSWORD>' -X POST http://127.0.0.1:8088/jmap \
11
  -H 'Content-Type: application/json' \
12
  -d '{
13
    "using": ["urn:ietf:params:jmap:core", "urn:stalwart:jmap"],
14
    "methodCalls": [["x:SpamSettings/set", {
15
      "update": {
16
        "singleton": {
17
          "scoreSpam": 15.0,
18
          "scoreDiscard": 0,
19
          "scoreReject": 0,
20
          "trustContacts": true,
21
          "trustReplies": true,
22
          "enable": true
23
        }
24
      }
25
    }, "c1"]]
26
  }'
27

28
# 重启生效
29
docker restart stalwart

1
# 获取 JMAP session（拿到 accountId）
2
SESSION=$(curl -s -u 'admin@example.com:<PASSWORD>' \
3
  http://127.0.0.1:8088/jmap/session)
4
ACCOUNT_ID=$(echo $SESSION | python3 -c "import sys,json; print(json.load(sys.stdin)['primaryAccounts']['urn:ietf:params:jmap:mail'])")
5

6
# 查询 Junk 文件夹中的邮件
7
curl -s -u 'admin@example.com:<PASSWORD>' -X POST http://127.0.0.1:8088/jmap \
8
  -H 'Content-Type: application/json' \
9
  -d "{
10
    \"using\": [\"urn:ietf:params:jmap:core\", \"urn:ietf:params:jmap:mail\"],
11
    \"methodCalls\": [[\"Email/query\", {
12
      \"accountId\": \"$ACCOUNT_ID\",
13
      \"filter\": {\"inMailbox\": \"c\"},
14
      \"limit\": 50,
15
      \"calculateTotal\": true
16
    }, \"q1\"]]
17
  }"
18

19
# 将 Junk 邮件移到 Inbox（清除 $junk 关键字）
20
# 需要替换 eid1, eid2... 为实际邮件 ID
21
curl -s -u 'admin@example.com:<PASSWORD>' -X POST http://127.0.0.1:8088/jmap \
22
  -H 'Content-Type: application/json' \
23
  -d '{
24
    "using": ["urn:ietf:params:jmap:core", "urn:ietf:params:jmap:mail"],
25
    "methodCalls": [["Email/set", {
26
      "accountId": "<ACCOUNT_ID>",
27
      "update": {
28
        "<eid1>": {"mailboxIds": {"a": true, "c": false}, "keywords": {"$junk": null}},
29
        "<eid2>": {"mailboxIds": {"a": true, "c": false}, "keywords": {"$junk": null}}
30
      }
31
    }, "m1"]]
32
  }'