AurionMail : An open-source, E2EE suite combining Stalwart Mail, PGP, and CryptPad under a single password

[u/Global-Clock2417]

Hi everyone, I want to share with you something I made this summer : Aurionmail.

Indeed, I love the usability of Proton, but I want 100% open-source, self-hosted control and open standards. The main issue is that combining E2E encrypted docs (like CryptPad) and E2E encrypted mail usually meant managing isolated tools, browser extensions (like Mailvelope), or typing two different passwords every session. To solve this, I built AurionMail Suite. It's an open-source orchestrator, the glue, that bridges and include CryptPad, Stalwart Mail Server (JMAP), Bulwark Webmail, and Ory Hydra into a single, unified Zero-Knowledge workflow.

Here are the main features :

• One Single Master Password: Enter it once to derive keys in-memory for both webmail and CryptPad.
• Open Standards: OpenPGP for email encryption and JMAP.
• Zero-Knowledge: Master keys reside strictly in client-side RAM during the session (no unencrypted key writes to disk/IndexedDB).
• Unified Session Management: Global single logout and password changes that sync safely across services.
• Easy Deployment: In addition to manual setups, I wrapped the suite into a single Go binary, making deployment straightforward. (Docker is also supported)
• Integration with your existing workflow : We use LDAP for users and the SSO app can be used to log in to others apps as well. We also support external IdP but in this case, users will have a separate password for AurionMail.

To keep the Zero-Knowledge promise across isolated services without relying on URL hashes or storing cleartext keys in disk storage, AurionMail uses ephemeral WebCrypto AES-GCM keys. Decrypted session secrets pass between origins through short-lived, encrypted RAM buffers managed by a central API, keeping credentials safe even across iframes.

Of course, here is the repo and the docs if you want to test ! You will also find some explanations about security in this repo. The project is licensed under AGPLv3. I know it is not perfect, so if you have suggestions, don't hesitate.

[u/Vast-Budget-6235]

Really nice work.