SOGo 6 Evaluation: A Technical Deep Dive
🇩🇪 Auf Deutsch lesen~5 min read
DevOpsEmail Infrastructuresogogroupwarestalwartopenldapdocker-composewebmailcalendarcontactsssooidcsamlmfaemail-infrastructureself-hosted
Back openDesk Edu for a sovereign, open-source education — every vote counts.
Vote nowSave products you love by clicking the heart icon.
Eine praktische Anleitung zum Deployment von SOGo 6 (dem kompletten Neubau der SOGo-Groupware-Suite) mit Stalwart Mail Server und OpenLDAP-Authentifizierung — vollständig containerisiert mit Docker Compose.
TL;DR: SOGo 6 is a complete rebuild of the classic SOGo groupware suite, replacing the GNUstep/Objective-C stack with a modern Next.js 16 + Flask/Python 3.14 architecture. This fork packages it with Stalwart mail server and OpenLDAP, implements every major roadmap feature, and adds SSO, MFA, app passwords, calendar/contact sharing, and a CardDAV sync engine — all backed by >1,800 passing tests.
SOGo has been a staple of the self-hosted groupware landscape for years, but SOGo 5's GNUstep/Objective-C foundation made it difficult to extend, containerize, and maintain. SOGo 6 is a ground-up rewrite that addresses these pain points directly:
The result is a stack that feels modern, containerizes cleanly, and is straightforward to extend.
The stack runs seven Docker services orchestrated via Docker Compose:
| Service | Role |
|---|---|
| SOGo6 UI | Next.js 16 standalone frontend |
| SOGo6 Server | Flask/Python 3.14 REST API |
| PostgreSQL | Primary database |
| Redis | Session cache, rate limiting, sync locking |
| OpenLDAP | User directory with seed data |
| Stalwart | IMAP/SMTP/Sieve mail server |
| NGINX | Reverse proxy with TLS termination |
All original SOGo 6 roadmap features are complete:
Beyond the original roadmap, this fork adds significant enterprise-grade functionality:
SSO (OIDC + SAML2) — Full OpenID Connect Relying Party and SAML2 Service Provider implementation. OIDC supports discovery, token exchange, RS256/384/512 and ES256/384/512 signature validation, and RP-initiated logout. SAML2 supports AuthnRequest XML generation, HTTP-Redirect and HTTP-POST bindings, SP metadata publishing, and auto-provisioning on first login.
MFA/TOTP — Time-based one-time passwords generated via pyotp, with QR code provisioning URIs integrated directly into the login flow. Code verification happens within the existing POST /login endpoint rather than a separate challenge flow, keeping the UX simple.
App Passwords — sogo-ap-<64-hex> tokens with bcrypt hashing, exposed via a full CRUD + verify API endpoint. Designed for Thunderbird, Outlook, and other desktop/mobile clients that can't perform interactive MFA.
Password Recovery — Full lifecycle with SHA-256 hashed tokens, rate-limited endpoints, and SMTP relay via Stalwart. The recovery flow is three steps: check → re-authenticate → LDAP update.
Auth Hardening — Redis-backed brute-force protection (per-user-account tracking), per-IP rate limiting (20 requests/minute), security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), and CORS hardening.
Calendar Sharing — Database-backed share tables with an ACL engine supporting VIEW, MODIFY, and DELETE permissions. A frontend share dialog lets users manage access without admin intervention.
Contact Sharing — Similar DB-backed shares with VIEW and MODIFY ACLs. Shares are enforced at both the API and UI layers.
CardDAV Sync Engine — An SSRF-protected HTTPS fetcher that connects to external CardDAV servers, performs vCard diff-by-UID, and executes insert/update/delete pipelines. Redis locking prevents concurrent sync conflicts, and sync status is exposed via the API.
Theme Settings — HSL color scheme, logo URL, and custom CSS are stored in PostgreSQL and served via a live public CSS endpoint. No redeployment needed for visual changes.
Rules CRUD — Sieve mail filter rules are stored in PostgreSQL with a full admin CRUD API, replacing the need for direct Sieve file manipulation.
Observability — Prometheus /metrics endpoint (request count, duration, errors), structured JSON logging, and an enhanced health endpoint that checks PostgreSQL, LDAP, Redis, and Stalwart connectivity.
CI/CD — GitHub Actions pipeline with build, backend test suite, Playwright E2E tests (23 scenarios), k6 load tests (3 suites), and a CardDAV sync benchmark.
| Suite | Count | Details |
|---|---|---|
| Backend Python | 1,723 | Module, interface, API, E2E, SMTP protocol |
| Frontend Jest | 69 | Admin pages, user settings, a11y |
| Admin API (bash) | 29 | All admin CRUD endpoints |
| Playwright E2E | 23 | Auth flows, admin, navigation, settings |
| k6 Load Tests | 100% pass | 3 suites, 0% errors, ~25ms p95 |
| Shell Tests | 129+ | SMTP/IMAP, LDAP, Postgres, Redis, Nginx, security, integration |
| Total | >1,800 |
The stack is fully Docker Compose-based. A single setup command gets you running:
git clone https://github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized
cd sogo6-stalwart-openldap-dockerized
bash sogo6/scripts/setup.sh
docker compose up -d
bash sogo6/scripts/init-sogo6.sh
Two environments are supported:
docker compose up -d) — multi-stage builds, hardened containers, TLS terminationdocker compose -f docker-compose.dev.yaml up -d) — hot-reloading, MailHog for email testing, pgAdmin, Redis Insight, Prometheus/GrafanaThe original source repository is at github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized. The SOGo mailing list (users@sogo.nu) is the best place for community discussion.
Areas where feedback would be especially valuable:
This evaluation and the accompanying fork were developed with assistance from Mistral AI (model Mistral Medium 3.5 128B, accessed via hessian.ai and hosted at TU Darmstadt) for code generation, debugging, and architectural guidance. Many thanks to both Mistral AI and hessian.ai.