Roundcube is the most popular open-source webmail client: a responsive, Gmail-like interface for any IMAP server, with folders, search, an address book, filters and a plugin system. If you run your own mail server (Postfix and Dovecot, for example), Roundcube lets users read mail from any browser.

Already using mailcow (SOGo) or Mail-in-a-Box (which includes Roundcube)? You don’t need a separate install.

Requirements

  • An IMAP server (Dovecot) and an SMTP submission server (Postfix on 587/465).
  • PHP 8.1+ with intl, mbstring, xml, zip, gd and pdo extensions, plus a database (SQLite, MySQL/MariaDB or PostgreSQL).
  • Nginx (or Apache) with HTTPS.

Option 1: Docker

# /opt/roundcube/compose.yaml
services:
  roundcube:
    image: roundcube/roundcubemail:latest-apache
    restart: unless-stopped
    ports:
      - "127.0.0.1:8000:80"
    environment:
      ROUNDCUBEMAIL_DEFAULT_HOST: ssl://mail.example.com
      ROUNDCUBEMAIL_DEFAULT_PORT: 993
      ROUNDCUBEMAIL_SMTP_SERVER: tls://mail.example.com
      ROUNDCUBEMAIL_SMTP_PORT: 587
      ROUNDCUBEMAIL_DB_TYPE: sqlite
      ROUNDCUBEMAIL_PLUGINS: archive,zipdownload,managesieve
      ROUNDCUBEMAIL_UPLOAD_MAX_FILESIZE: 25M
    volumes:
      - ./db:/var/roundcube/db
      - ./config:/var/roundcube/config
cd /opt/roundcube && docker compose up -d

Put Nginx with HTTPS in front (proxy to 127.0.0.1:8000). See Nginx reverse proxy.

Option 2: manual install on LEMP

sudo apt install nginx php-fpm php-intl php-mbstring php-xml php-zip php-gd php-sqlite3 php-curl
cd /var/www
sudo wget https://github.com/roundcube/roundcubemail/releases/download/1.6.9/roundcubemail-1.6.9-complete.tar.gz
sudo tar xzf roundcubemail-*-complete.tar.gz && sudo mv roundcubemail-1.6.9 roundcube
sudo chown -R www-data:www-data /var/www/roundcube/{temp,logs}

(Use the current release.) Nginx: point the root at /var/www/roundcube/public_html (the public directory in recent versions), pass PHP to PHP-FPM, and deny access to config, temp, logs and similar internals. See Nginx with PHP-FPM.

Run the installer at https://webmail.example.com/installer/, or write config/config.inc.php yourself:

<?php
$config['db_dsnw'] = 'sqlite:////var/www/roundcube/db/roundcube.db?mode=0640';
$config['imap_host'] = 'ssl://mail.example.com:993';
$config['smtp_host'] = 'tls://mail.example.com:587';
$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';
$config['support_url'] = '';
$config['des_key'] = 'a-24-character-random-key';
$config['plugins'] = ['archive', 'zipdownload', 'managesieve'];
$config['product_name'] = 'Example Webmail';
$config['ip_check'] = true;

Delete the installer/ directory afterwards, or set $config['enable_installer'] = false;.

Useful plugins

  • managesieve: server-side filters and vacation replies (requires Dovecot’s Pigeonhole/ManageSieve on port 4190).
  • archive and zipdownload: archive folders and download attachments as ZIP.
  • markasjunk: spam training integration.
  • 2FA: community plugins such as twofactor_gauthenticator.
  • password: let users change their mail password (driver depends on your user backend).

HTTPS and security hardening

server {
    server_name webmail.example.com;
    client_max_body_size 25M;
    # … root/proxy config …
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "same-origin" always;
    # listen 443 ssl; certbot --nginx -d webmail.example.com
}
  • HTTPS only. Credentials are entered here.
  • Keep Roundcube updated. It’s a frequent target, and security releases happen regularly. See updating self-hosted apps.
  • Brute-force protection: Roundcube logs failed logins to logs/errors.log, which a Fail2Ban jail can watch. See Fail2Ban.
  • Restrict upload_max_filesize to match your mail size limits.

Backups

Back up config/ and the database (contacts, settings and identities). Mail itself lives on the IMAP server. See backup strategy.

Quick reference

Setting Example
IMAP ssl://mail.example.com:993
SMTP tls://mail.example.com:587
SMTP auth %u / %p (the user’s own login)
Filters managesieve plugin + Dovecot Sieve
Installer Remove after setup

Related: SMTP ports and email deliverability.

  • Email
  • Self-Hosting
  • PHP