Cloud Mail

A simple, responsive email service designed to run on Cloudflare Workers 🎉

English | 简体中文

Important

This project is a fork of maillab/cloud-mail with the following key modifications:

• Enhanced Cloud Mail Backend: Mail APIs, CC/BCC support, notification systems, and security improvements.
• New Feature: Added compatibility/support for the iOS client CF Mail.

Description

With only one domain, you can create multiple different email addresses, similar to major email platforms. This project can be deployed on Cloudflare Workers to reduce server costs and build your own email service.

Project Showcase

• Live Demo
  
• Deployment Guide
  

Features

• 💰 Low-Cost Usage: No server required — deploy to Cloudflare Workers to reduce costs.

• 💻 Responsive Design: Automatically adapts to both desktop and most mobile browsers.

• 📧 Email Sending: Integrated with Resend, supporting bulk email sending and attachments.

• 🛡️ Admin Features: Admin controls for user and email management with RBAC-based access control.

• 📦 Attachment Support: Send and receive attachments, stored and downloaded via R2 object storage.

• 🔔 Email Push: Forward received emails to Telegram bots or other email providers.

• 📡 Open API: Supports batch user creation via API and multi-condition email queries

• 🔢 Verification Code Recognition: Auto-detect codes via Workers AI

• 📈 Data Visualization: Use ECharts to visualize system data, including user email growth.

• 🎨 Personalization: Customize website title, login background, and transparency.

• 🤖 CAPTCHA: Integrated with Turnstile CAPTCHA to prevent automated registration.

• 📜 More Features: Under development...

Tech Stack

• Platform: Cloudflare Workers

• Web Framework: Hono

• ORM: Drizzle

• Frontend Framework: Vue3

• UI Framework: Element Plus

• Email Service: Resend

• Cache: Cloudflare KV

• Database: Cloudflare D1

• File Storage: Cloudflare R2

Project Structure

cloud-mail
├── mail-worker				    # Backend worker project
│   ├── src                  
│   │   ├── api	 			    # API layer
│   │   ├── const  			    # Project constants
│   │   ├── dao                 # Data access layer
│   │   ├── email			    # Email processing and handling
│   │   ├── entity			    # Database entities
│   │   ├── error			    # Custom exceptions
│   │   ├── hono			    # Web framework, middleware, error handling
│   │   ├── i18n			    # Internationalization
│   │   ├── init			    # Database and cache initialization
│   │   ├── model			    # Response data models
│   │   ├── security			# Authentication and authorization
│   │   ├── service			    # Business logic layer
│   │   ├── template			# Message templates
│   │   ├── utils			    # Utility functions
│   │   └── index.js			# Entry point
│   ├── package.json			# Project dependencies
│   └── wrangler.toml			# Project configuration
│
├─ mail-vue				        # Frontend Vue project
│   ├── src
│   │   ├── axios 			    # Axios configuration
│   │   ├── components			# Custom components
│   │   ├── echarts			    # ECharts integration
│   │   ├── i18n			    # Internationalization
│   │   ├── init			    # Startup initialization
│   │   ├── layout			    # Main layout components
│   │   ├── perm			    # Permissions and access control
│   │   ├── request			    # API request layer
│   │   ├── router			    # Router configuration
│   │   ├── store			    # Global state management
│   │   ├── utils			    # Utility functions
│   │   ├── views			    # Page components
│   │   ├── app.vue			    # Root component
│   │   ├── main.js			    # Entry JS file
│   │   └── style.css			# Global styles
│   ├── package.json			# Project dependencies
└── └── env.release				# Environment configuration

IMPORTANT

Please ensure you read BACKEND_SECURITY_AUDIT.md prior to deployment. When upgrading, please follow these steps:

1. Rotate and configure secrets (such as jwt_secret, init_secret, and resend_webhook_secret) using wrangler secret put.
2. Run the latest database migrations via POST /api/init with the X-Init-Secret header.
3. Rebuild and deploy mail-vue to enable OAuth state and one-time binding credentials.
4. Verify email delivery/reception, Webhooks, object storage, and APNs in the staging environment before routing production traffic.

The legacy GET /api/init/:secret endpoint and unsigned Resend Webhooks are disabled by default and are not recommended to be re-enabled.

License

This project is licensed under the GPLv3 License.

Upstream

This project is modified from maillab/cloud-mail.