commit d53e7eef3759544f31c894750e669d73c5e77d20
Author: Oscar Grey <oscarg@coolbea.nz>
Date:   Mon Aug 10 14:37:39 2026 +1200

    init

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..2b26e4c
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,16 @@
+# Domain Information
+DOMAIN_NAME=example.com
+
+# Subdomain Information (DO NOT EDIT AFTER RUNNING ONCE)
+WEBMAIL_SUBDOMAIN=mail
+MAIL_SUBDOMAIN=mx
+AUTH_SUBDOMAIN=auth
+
+# Secret Keys
+# This should be generated automatically.
+BULWARK_SECRET=
+OAUTH_SECRET=
+
+# Testing Stuff
+# Leave CADDY_TLS blank to automatically obtain a certificate.
+CADDY_TLS=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..d075a8c
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,69 @@
+services:
+    reverse_proxy:
+        image: caddy:latest
+        container_name: reverse_proxy
+        ports:
+            - "80:80"
+            - "443:443"
+        volumes:
+            - ./service_data/reverse_proxy:/etc/caddy
+            - caddy-data:/data
+        environment:
+            - CADDY_TLS=${CADDY_TLS}
+            - DOMAIN_NAME=${DOMAIN_NAME}
+            - MAIL_SUBDOMAIN=${MAIL_SUBDOMAIN}
+            - WEBMAIL_SUBDOMAIN=${WEBMAIL_SUBDOMAIN}
+        networks:
+            - proxy-net
+
+    email_backend:
+        image: stalwartlabs/stalwart:latest
+        container_name: email_backend
+        restart: unless-stopped
+        volumes:
+            - stalwart-etc:/etc/stalwart
+            - stalwart-data:/var/lib/stalwart
+        environment:
+            - STALWART_PUBLIC_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
+        ports:
+            - "25:25"
+            - "587:587"
+            - "465:465"
+            - "143:143"
+            - "993:993"
+            - "110:110"
+            - "995:995"
+            - "4190:4190"
+        networks:
+            - proxy-net
+
+    email_frontend:
+        image: ghcr.io/bulwarkmail/webmail:latest
+        container_name: email_frontend
+        restart: unless-stopped
+        environment:
+            - JMAP_SERVER_URL=https://${MAIL_SUBDOMAIN}.${DOMAIN_NAME}
+            - NODE_TLS_REJECT_UNAUTHORIZED=0 # DEFINITELY REMOVE AFTER TESTING
+            - OAUTH_ALLOW_PRIVATE_ENDPOINTS=true # ALSO DEFINITELY REMOVE THIS
+            - SESSION_SECRET=${BULWARK_SECRET}
+            - OAUTH_ENABLED=true
+            - OAUTH_ONLY=true
+            - OAUTH_CLIENT_ID=bulwark-webmail
+            - OAUTH_CLIENT_SECRET=${OAUTH_SECRET}
+            - AUTO_SSO_ENABLED=true
+        volumes:
+            - bulwark-config:/app/data/admin
+            - bulwark-state:/app/data/admin-state
+        networks:
+            - proxy-net
+
+volumes:
+    stalwart-etc:
+    stalwart-data:
+    caddy-data:
+    bulwark-config:
+    bulwark-state:
+
+networks:
+    proxy-net:
+        external: true
diff --git a/service_data/reverse_proxy/Caddyfile b/service_data/reverse_proxy/Caddyfile
new file mode 100644
index 0000000..c41dba1
--- /dev/null
+++ b/service_data/reverse_proxy/Caddyfile
@@ -0,0 +1,19 @@
+{$WEBMAIL_SUBDOMAIN}.{$DOMAIN_NAME} {
+    {$CADDY_TLS}
+    reverse_proxy email_frontend:3000
+}
+
+{$MAIL_SUBDOMAIN}.{$DOMAIN_NAME} {
+    {$CADDY_TLS}
+	reverse_proxy email_backend:8080
+
+	header {
+		Access-Control-Allow-Origin "https://{$WEBMAIL_SUBDOMAIN}.{$DOMAIN_NAME}"
+		Access-Control-Allow-Credentials "true"
+		Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
+		Access-Control-Allow-Headers "Authorization, Content-Type, X-JMAP-Prefix, X-JMAP-Framework"
+	}
+
+	@options method OPTIONS
+	respond @options 204
+}