Building a Self-Hosted Groupware Stack: SOGo 6, Stalwart, and OpenLDAP in Docker

SOGo 6 Evaluation: Ein technischer Deep Dive

Eine gründliche Evaluierung von SOGo 6, der Next.js/Flask-Groupware-Suite, bereitgestellt mit dem Stalwart-Mailserver und OpenLDAP via Docker Compose. Behandelt Architektur, Feature-Implementierung, SSO, MFA und über 1.800 bestandene Tests.

SOGo 6 is a ground-up rewrite of the SOGo groupware suite. After 20 years of AngularJS and Objective-C in SOGo 5, the new version ships a Python/Flask REST API backend, a Next.js 16 frontend, PostgreSQL for persistence, Redis for caching and task queues, and a proper admin API replacing the old sogo-tool CLI. The first public beta is planned for summer 2026.

This article walks through a production-representative Docker Compose stack that wires SOGo 6 together with Stalwart (an all-in-one IMAP/SMTP/Sieve mail server) and OpenLDAP (for user authentication). The full source is at github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized.

Architecture

The stack runs eight services on a single Docker network:

An Nginx reverse proxy terminates TLS on ports 80/443, routing /api/ to the Flask backend and everything else to the Next.js frontend. A MailDev container catches outgoing mail for inspection during testing.

Each service has resource limits, health checks, and dependency ordering defined in docker-compose.yaml. The total memory footprint sits around 2 GB.

Component Breakdown

SOGo 6 Server (Flask)

The backend is a Gunicorn/Flask application serving a RESTful API. It connects to PostgreSQL for data persistence (calendars, address books, user preferences), Redis for session caching and the Celery task queue, and OpenLDAP for authentication.

Core environment variables:

SOGO_DB_URI: postgresql://sogo:sogo@sogo6-postgres:5432/sogo
SOGO_REDIS_URI: redis://sogo6-redis:6379/0
SOGO_LDAP_URI: ldap://sogo6-ldap:389
SOGO_LDAP_BASE_DN: dc=example,dc=org
SOGO_LDAP_BIND_DN: cn=admin,dc=example,dc=org
SOGO_SMTP_SERVER: sogo6-stalwart
SOGO_SMTP_PORT: 20025

SOGo 6 splits its configuration into two layers:

• Process settings — mandatory boot parameters (DB URI, Redis URI, secrets) provided via environment variables or a process.conf file. The container mounts this read-only at /etc/sogo/process.conf.
• Dynamic settings — everything else (IMAP/SMTP servers, user sources, domain overrides, mail filtering) stored in PostgreSQL and manageable through the Admin API or web UI. These are applied without restart.

The server exposes two API surface areas:

SOGo 6 UI (Next.js)

The frontend is a Next.js 16 application (React 19, TypeScript, Tailwind CSS). Its only configuration is the API base URL — it proxies all data requests to the Flask backend. The UI container is stateless and can be scaled independently.

Stalwart Mail Server

Stalwart is an all-in-one mail server written in Rust. It replaces the traditional stack of Postfix + Dovecot + Rspamd with a single binary supporting every standard mail protocol:

• JMAP — modern JSON-over-HTTP mail protocol with push notifications and WebSocket support
• IMAP4rev2 with IMAP4rev1 fallback
• SMTP with Sieve scripting (every IANA-registered extension)
• POP3 with STLS for legacy clients
• ManageSieve for user-managed server-side filters

In this stack, Stalwart uses PostgreSQL as its storage backend (separate database from SOGo). The configuration is a single JSON file:

{
  "@type": "PostgreSql",
  "host": "sogo6-postgres",
  "port": 5432,
  "database": "stalwart",
  "authUsername": "stalwart",
  "authSecret": {
    "@type": "Value",
    "secret": "stalwart_sogo6_2026"
  }
}

Stalwart v0.16 (used here) introduced a unified JMAP-based management API and a stalwart-cli apply command for declarative configuration — fitting naturally into infrastructure-as-code workflows.

Port mappings expose all mail protocols to the host for client testing:

OpenLDAP

OpenLDAP provides the user directory. The Docker image is custom-built with seed data baked in — three test users (two standard, one admin) loaded from an LDIF file on first start.

dn: uid=testuser@example.org,ou=users,dc=example,dc=org
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: testuser@example.org
cn: Test User
sn: User
mail: testuser@example.org
userPassword: password123

The health check runs an LDAP search against the base DN to verify slapd is responsive.

One caveat: OpenLDAP's ch_calloc assertion fails when Docker sets a high ulimit -n. The custom entrypoint script works around this by clamping to ulimit -n 1024 before starting slapd.

Nginx Reverse Proxy

Nginx terminates TLS (self-signed certificates generated by the included gen-certs.sh script) and routes traffic:

• /api/* → sogo6-server:5000 (Flask backend)
• /* → sogo6-ui:3000 (Next.js frontend)
• HTTP on port 80 redirects to HTTPS

The configuration supports WebSocket upgrade headers for Server-Sent Events and future real-time features.

How the Components Interact

Authentication Flow

1. User enters credentials in the Next.js UI
2. Frontend POSTs to /api/user/v1/auth/login
3. Flask backend binds to OpenLDAP with the configured SOGO_LDAP_BIND_DN and verifies the user's password against the inetOrgPerson entry
4. On success, the backend returns a JWT token
5. Subsequent API calls include the JWT in the Authorization: Bearer header

Mail Flow

1. User composes an email in the SOGo UI
2. Flask backend submits via SMTP to Stalwart (sogo6-stalwart:25)
3. In production, Stalwart delivers to external recipients. In this test stack, MailDev catches all outbound mail on port 25 and exposes a web UI at http://localhost:1080 for inspection
4. Incoming mail (in production) is stored by Stalwart and served via IMAP to the SOGo backend

Calendar and Contacts

SOGo 6 implements CalDAV and CardDAV servers. Calendar events and address book entries are stored in PostgreSQL. LDAP contacts are read from OpenLDAP in real-time.

Deployment

Prerequisites

• Docker and Docker Compose v2.20+
• Git
• ~2 GB free RAM (tested on a 1 GB DigitalOcean droplet)

Step 1: Clone and Build

git clone https://github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized.git
cd sogo6-stalwart-openldap-dockerized
bash sogo6/scripts/setup.sh

The setup script:

• Clones the SOGo6-UI and SOGo6-server repositories
• Builds Docker images for both the frontend and backend
• Generates a secrets vault (secrets/sogo6.vault.env, gitignored)
• Generates self-signed TLS certificates (sogo6/nginx/certs/)
• Builds the custom OpenLDAP image with seed data

Step 2: Start the Stack

docker compose up -d

Docker Compose starts services in dependency order — PostgreSQL, Redis, LDAP, and Stalwart become healthy before the Flask backend starts, and the backend must be healthy before the Next.js frontend launches.

Step 3: Initialise System Configuration

bash sogo6/scripts/init-sogo6.sh

This script calls the Admin API to configure:

• LDAP as the user authentication source
• Stalwart as the IMAP/SMTP server
• Default domain settings for example.org
• System parameters required before the user API accepts requests

Step 4: Verify

docker compose ps                          # All 8 services healthy
curl http://localhost:3000/env              # Next.js frontend responds
curl http://localhost:5001/api/user/v1/system  # Flask API responds
curl http://localhost:1080                  # MailDev web UI

Access Points

Test Credentials

Test Coverage

The repository ships 129 shell-based integration tests that require nothing beyond bash, curl, and openssl. They cover:

Run everything with bash tests/run-all-tests.sh. Python integration tests (pytest + psycopg2) and Playwright E2E tests are available as optional extras.

Operations

Secrets Management

bash sogo6/scripts/manage-secrets.sh          # Generate vault
bash sogo6/scripts/manage-secrets.sh --list     # List masked secrets
bash sogo6/scripts/manage-secrets.sh --env-file  # Export for docker-compose

Backup

bash sogo6/scripts/backup.sh

Creates a timestamped archive of all Docker volumes (PostgreSQL, Redis, Stalwart, LDAP data and config) to ./backups/.

Database Reset

docker compose down -v
docker compose up -d
bash sogo6/scripts/init-sogo6.sh

TLS Certificates

For production testing, replace the self-signed certs in sogo6/nginx/certs/ with real certificates and regenerate:

bash sogo6/scripts/gen-certs.sh

SOGo 5 vs SOGo 6: What Changed

The SOGo team announced at FOSDEM 2026 that the public beta is planned for summer 2026. The initial release covers the complete web application (mail, calendar, contacts) but will not include the desktop sync server initially.

Source Code

All code is open source under the MIT licence:

• Dockerised stack: github.com/tobias-weiss-ai-xr/sogo6-stalwart-openldap-dockerized
• SOGo 6 UI: github.com/tobias-weiss-ai-xr/SOGo6-UI
• SOGo 6 Server: github.com/tobias-weiss-ai-xr/SOGo6-server
• SOGo 5 production image: github.com/tobias-weiss-ai-xr/docker-sogo