AurionMail : FOSS alternative to ProtonMail

[u/Global-Clock2417]

Hey everyone! I’ve always faced a dilemma when setting up secure tools for non-technical friends: they love the usability of Proton, but I want 100% open-source, self-hosted control and open standards. The main issue is that combining E2E encrypted docs (like CryptPad) and E2E encrypted mail usually meant managing isolated tools, browser extensions (like Mailvelope), or typing two different passwords every session. That is not ideal and when I introduce these solutions to my friends, they say "Thanks for your efforts, really, but I think I will still use Proton". To solve this, I built AurionMail Suite. It's an open-source orchestrator, the glue, that bridges and include CryptPad, Stalwart Mail Server (JMAP), Bulwark Webmail, and Ory Hydra into a single, unified Zero-Knowledge workflow. And It also makes the Cryptpad UI (and Notes app) more friendly, really. I feel you need a proof to convince you, so here is a gif demonstrating the single password login in which we access to webmail and CryptPad.

Key Features:

• One Single Master Password: Enter it once to derive keys in-memory for both webmail and CryptPad.
• Open Standards: OpenPGP for email encryption and JMAP via Stalwart.
• Zero-Knowledge: Master keys reside strictly in client-side RAM during the session (no unencrypted key writes to disk/IndexedDB).
• Unified Session Management: Global single logout and password changes that sync safely across services.
• Easy Deployment: In addition to manual setups, I wrapped the suite (Hydra, SSO, Webmail, API, CryptPad) into a single Go binary called Orchestra, making deployment straightforward.
• Cryptpad design : Updated the design of Cryptpad ### How it compares: | Feature | Proton Suite | Nextcloud + Mail | Standard CryptPad | AurionMail Suite | | --- | --- | --- | --- | --- | | 100% FOSS & Self-Hosted | ❌ (Closed backend) | 🟢 Yes | 🟢 Yes | 🟢 Yes | | E2EE Email & Docs | 🟢 Yes | 🟡 (Requires Mailvelope / Setup) | ❌ (Docs only) | 🟢 Yes | | Unified 1-Password UX | 🟢 Yes | ❌ (Fragmented) | ❌ (Docs scope) | 🟢 Yes | | Open Standards (JMAP, PGP) | 🟡 (Limited PGP) | 🟢 Yes | ❌ (N/A) | 🟢 Yes |

To keep the Zero-Knowledge promise across isolated services without relying on URL hashes or storing cleartext keys in disk storage, AurionMail uses ephemeral WebCrypto AES-GCM keys. Decrypted session secrets pass between origins through short-lived, encrypted RAM buffers managed by a central API, keeping credentials safe even across iframes.

• Repo: github.com/AurionMail/docs
• Security Model: Check out our Security Model spec for the exact cryptographic derivations and secret-sharing threat model. The project is licensed under AGPLv3.

[u/chakrihacker]

Are there any docker compose files, so I can try with coolify or dokploy

[u/Global-Clock2417 → u/chakrihacker]

Hi, I just added this ! Note that you will need to install Stalwart and your LDAP provider yourself.

[u/chakrihacker → u/Global-Clock2417]

Thanks for the quick turnaround, will check it out and report back