Roundcube on FreeBSD: Webmail Client Review

Roundcube on FreeBSD: Webmail Client Review

Roundcube is an open-source, browser-based IMAP email client. It provides a desktop-like email interface that runs entirely in the browser -- no desktop application needed. Users connect to their IMAP server through Roundcube's web interface to read, compose, search, and organize email. On FreeBSD, Roundcube integrates with the standard mail stack: Dovecot for IMAP, Postfix or OpenSMTPD for SMTP, NGINX or Apache for the web frontend, and PHP-FPM for application execution. This review covers installation, configuration, NGINX integration, the plugin ecosystem, Dovecot connectivity, and how Roundcube compares with Rainloop and SOGo.

What Roundcube Does

Roundcube is a webmail client, not a mail server. It does not store email, route messages, or handle SMTP delivery. It is a PHP application that acts as an intermediary between a user's web browser and their IMAP/SMTP servers. Think of it as a web-based Thunderbird that requires no client installation.

Core features:

• IMAP client -- connects to any IMAP server (Dovecot, Cyrus, Courier, Exchange via IMAP). Supports IMAP IDLE for real-time push notifications.
• SMTP sending -- sends email through a configured SMTP server with STARTTLS or SSL encryption.
• Address book -- local address book with contact groups, vCard import/export, and LDAP directory integration.
• Search -- full-text search across mailboxes using the IMAP server's search capabilities.
• Drag-and-drop -- move messages between folders with drag-and-drop in a responsive AJAX interface.
• HTML and plain text -- compose and read HTML emails with a rich text editor, or work in plain text.
• Sieve filtering -- manage server-side email filters through the managesieve plugin (requires Dovecot with ManageSieve enabled).
• Spell check -- built-in spell checking with multiple language support.
• Themes and skins -- multiple visual themes, including the modern "Elastic" responsive skin that works on mobile devices.

Installation on FreeBSD

Prerequisites

Roundcube requires a web server, PHP, and a database. The recommended stack on FreeBSD:

sh
pkg install nginx php83 php83-gd php83-mbstring php83-intl php83-ldap \
    php83-pdo_pgsql php83-imap php83-zip php83-xml php83-dom php83-curl \
    php83-fileinfo php83-session php83-json php83-ctype php83-pdo \
    php83-tokenizer

For the database backend (PostgreSQL recommended):

sh
pkg install postgresql16-server
sysrc postgresql_enable="YES"
service postgresql initdb
service postgresql start

Install Roundcube

sh
pkg install roundcube

This installs Roundcube at /usr/local/www/roundcube/. The package includes the web application, default configuration, and the Elastic skin.

Alternatively, install from ports for more control:

sh
cd /usr/ports/mail/roundcube
make config
make install clean

Database Setup

Create a PostgreSQL database for Roundcube:

sh
su - postgres
createuser roundcube
createdb -O roundcube roundcubemail
psql -c "ALTER USER roundcube WITH PASSWORD 'secure-password';"
exit

Initialize the database schema:

sh
psql -U roundcube -d roundcubemail < /usr/local/www/roundcube/SQL/postgres.initial.sql

Roundcube Configuration

Copy the sample configuration and edit it:

sh
cp /usr/local/www/roundcube/config/config.inc.php.sample \
   /usr/local/www/roundcube/config/config.inc.php

Edit /usr/local/www/roundcube/config/config.inc.php:

sh
$config['db_dsnw'] = 'pgsql://roundcube:secure-password@localhost/roundcubemail';

$config['imap_host'] = 'ssl://mail.example.com:993';
$config['smtp_host'] = 'tls://mail.example.com:587';

$config['support_url'] = '';
$config['product_name'] = 'Webmail';

$config['des_key'] = 'your-24-char-random-key!!';

$config['plugins'] = array(
    'archive',
    'zipdownload',
    'managesieve',
    'markasjunk'
);

$config['skin'] = 'elastic';
$config['language'] = 'en_US';
$config['default_charset'] = 'UTF-8';

$config['smtp_user'] = '%u';
$config['smtp_pass'] = '%p';

$config['imap_conn_options'] = array(
    'ssl' => array(
        'verify_peer' => true,
        'verify_peer_name' => true,
        'cafile' => '/etc/ssl/cert.pem'
    )
);

Generate a random des_key:

sh
openssl rand -base64 18

Set permissions:

sh
chown -R www:www /usr/local/www/roundcube/temp/
chown -R www:www /usr/local/www/roundcube/logs/
chmod 640 /usr/local/www/roundcube/config/config.inc.php

NGINX Integration

PHP-FPM Configuration

Enable and configure PHP-FPM:

sh
sysrc php_fpm_enable="YES"

Edit /usr/local/etc/php-fpm.d/www.conf:

sh
[www]
user = www
group = www
listen = /var/run/php-fpm.sock
listen.owner = www
listen.group = www
listen.mode = 0660
pm = dynamic
pm.max_children = 20
pm.start_servers = 5
pm.min_spare_servers = 3
pm.max_spare_servers = 10

Start PHP-FPM:

sh
service php-fpm start

NGINX Server Block

Create /usr/local/etc/nginx/conf.d/roundcube.conf:

sh
server {
    listen 443 ssl http2;
    server_name mail.example.com;

    ssl_certificate /usr/local/etc/letsencrypt/live/mail.example.com/fullchain.pem;
    ssl_certificate_key /usr/local/etc/letsencrypt/live/mail.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /usr/local/www/roundcube/;
    index index.php;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\. {
        deny all;
    }

    location ~ ^/(config|temp|logs|SQL|bin|CHANGELOG|INSTALL|LICENSE|README|UPGRADING) {
        deny all;
    }
}

server {
    listen 80;
    server_name mail.example.com;
    return 301 https://$server_name$request_uri;
}

The security locations at the bottom are critical -- they prevent access to configuration files, temporary data, logs, and other sensitive directories that Roundcube ships in its web root.

Enable NGINX:

sh
sysrc nginx_enable="YES"
nginx -t
service nginx start

Dovecot IMAP Integration

Roundcube connects to Dovecot as a standard IMAP client. No special Dovecot configuration is needed for basic operation, but several features benefit from specific settings.

IMAP Configuration

Ensure Dovecot listens for IMAP connections:

sh
# In /usr/local/etc/dovecot/conf.d/10-master.conf
service imap-login {
    inet_listener imap {
        port = 143
    }
    inet_listener imaps {
        port = 993
        ssl = yes
    }
}

ManageSieve for Server-Side Filters

Roundcube's managesieve plugin allows users to create server-side email filters through the web interface. Enable ManageSieve in Dovecot:

sh
# In /usr/local/etc/dovecot/conf.d/20-managesieve.conf
protocols = $protocols sieve

service managesieve-login {
    inet_listener sieve {
        port = 4190
    }
}

plugin {
    sieve = file:~/sieve;active=~/.dovecot.sieve
    sieve_max_script_size = 1M
    sieve_max_actions = 32
}

Configure Roundcube's managesieve plugin:

sh
# In /usr/local/www/roundcube/plugins/managesieve/config.inc.php
$config['managesieve_port'] = 4190;
$config['managesieve_host'] = 'localhost';
$config['managesieve_usetls'] = true;

IMAP Namespace and Special Folders

Configure Roundcube to recognize Dovecot's special folders:

sh
$config['drafts_mbox'] = 'Drafts';
$config['junk_mbox'] = 'Junk';
$config['sent_mbox'] = 'Sent';
$config['trash_mbox'] = 'Trash';
$config['create_default_folders'] = true;

Ensure Dovecot's namespace configuration matches:

sh
# In /usr/local/etc/dovecot/conf.d/15-mailboxes.conf
namespace inbox {
    mailbox Drafts {
        auto = subscribe
        special_use = \Drafts
    }
    mailbox Junk {
        auto = subscribe
        special_use = \Junk
    }
    mailbox Sent {
        auto = subscribe
        special_use = \Sent
    }
    mailbox Trash {
        auto = subscribe
        special_use = \Trash
    }
}

Plugin Ecosystem

Roundcube's plugin system is one of its strongest features. Plugins extend functionality without modifying core code, making upgrades straightforward.

Essential Plugins (Included)

• archive -- moves messages to an Archive folder with one click.
• zipdownload -- downloads multiple attachments or entire folders as a ZIP file.
• managesieve -- server-side email filter management through the web interface.
• markasjunk -- moves messages to Junk and optionally trains spam filters.
• password -- allows users to change their email password through Roundcube.
• enigma -- PGP encryption and signing within the webmail interface.
• newmail_notifier -- browser desktop notifications for new email.

Notable Third-Party Plugins

• CardDAV -- synchronizes contacts with CardDAV servers (Nextcloud, Radicale, SOGo).
• CalDAV -- calendar integration for viewing and managing events.
• Two-factor authentication -- adds TOTP-based 2FA to the Roundcube login.
• Contextmenu -- adds right-click context menus for messages and folders.

Install a plugin by downloading it to the plugins directory:

sh
cd /usr/local/www/roundcube/plugins/
git clone https://github.com/blind-coder/rcmcarddav.git carddav
chown -R www:www carddav/

Enable it in the configuration:

sh
$config['plugins'] = array(
    'archive',
    'zipdownload',
    'managesieve',
    'markasjunk',
    'carddav'
);

Performance and Caching

Roundcube can be slow with large mailboxes (10,000+ messages) without proper caching.

Enable IMAP Caching

sh
$config['imap_cache'] = 'db';
$config['imap_cache_ttl'] = '10d';
$config['messages_cache'] = 'db';
$config['messages_cache_ttl'] = '10d';
$config['messages_cache_threshold'] = 50;

This caches IMAP folder listings and message headers in the PostgreSQL database, dramatically reducing IMAP round trips for folder views.

PHP OPcache

Ensure PHP OPcache is enabled for faster page loads:

sh
# In /usr/local/etc/php/ext-20-opcache.ini
opcache.enable=1
opcache.memory_consumption=128
opcache.max_accelerated_files=10000
opcache.validate_timestamps=0

Set validate_timestamps=0 in production and clear the cache after updates. This eliminates filesystem stat calls for every PHP file on every request.

Session Handling

For multi-server deployments, store sessions in the database:

sh
$config['session_storage'] = 'db';
$config['session_lifetime'] = 1440;

Security Hardening

Rate Limiting Login Attempts

Configure rate limiting for the login endpoint in NGINX:

sh
# In the http block
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

# In the server block
location ~ ^/\?_task=login {
    limit_req zone=login burst=3;
    fastcgi_pass unix:/var/run/php-fpm.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root/index.php;
}

Content Security Policy

Add security headers:

sh
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header X-XSS-Protection "1; mode=block";
add_header Referrer-Policy strict-origin-when-cross-origin;

Disable the Installer

After initial setup, remove or disable the installer:

sh
rm -rf /usr/local/www/roundcube/installer/

Or in the configuration:

sh
$config['enable_installer'] = false;

Roundcube vs Rainloop vs SOGo

Rainloop / SnappyMail

SnappyMail (the active fork of Rainloop) is a lightweight webmail client with a modern JavaScript interface. It requires no database -- configuration and caching use flat files. SnappyMail is faster to deploy and lighter on resources than Roundcube, but its plugin ecosystem is smaller and it lacks features like ManageSieve integration and the rich address book.

Choose SnappyMail when: you need a quick, lightweight webmail deployment with minimal dependencies and do not need server-side filter management or extensive customization.

SOGo

SOGo is a full groupware server, not just a webmail client. It provides email, calendaring, contact management, and Microsoft ActiveSync support. SOGo is significantly more complex to install and maintain than Roundcube -- it requires its own daemon processes, LDAP or database-backed user management, and more memory.

Choose SOGo when: you need full groupware functionality (shared calendars, shared address books, ActiveSync for mobile devices) in a self-hosted solution. If you only need webmail, SOGo is overkill.

Summary

| Feature | Roundcube | SnappyMail | SOGo |

|---------|-----------|------------|------|

| Webmail | Yes | Yes | Yes |

| Calendar | Plugin | No | Yes |

| Contacts/CardDAV | Plugin | Limited | Yes |

| ManageSieve | Yes | No | Yes |

| ActiveSync | No | No | Yes |

| Database required | Yes | No | Yes |

| Memory footprint | Medium | Low | High |

| Plugin ecosystem | Large | Small | Medium |

| Mobile responsive | Yes (Elastic) | Yes | Yes |

Maintenance

Upgrading Roundcube

sh
pkg upgrade roundcube

After upgrading, run the database migration:

sh
cd /usr/local/www/roundcube
php bin/update.sh

Cleaning Expired Data

Roundcube stores cached data and expired sessions in the database. Clean them periodically:

sh
# Add to /etc/crontab
0 3 * * * www /usr/local/bin/php /usr/local/www/roundcube/bin/cleandb.sh

Log Monitoring

Check Roundcube logs for errors:

sh
tail -f /usr/local/www/roundcube/logs/errors.log

Verdict

Roundcube is the most capable open-source webmail client for FreeBSD. It balances features, usability, and maintainability in a way that neither SnappyMail (too simple) nor SOGo (too complex) match for the pure webmail use case. The Elastic skin provides a modern, responsive interface that works on desktop and mobile. The plugin system covers common needs -- ManageSieve for filters, PGP for encryption, CardDAV for contacts -- without bloating the core application.

On FreeBSD, the standard NGINX + PHP-FPM + PostgreSQL + Dovecot stack runs Roundcube reliably with modest resource requirements. A Roundcube instance serving 50-100 users needs 512 MB to 1 GB of RAM for the entire stack. For self-hosted email on FreeBSD, Roundcube is the webmail frontend to deploy.

Frequently Asked Questions

Can Roundcube connect to Gmail or other external IMAP servers?

Yes. Roundcube connects to any standard IMAP server. Configure the IMAP host in config.inc.php to point at Gmail's IMAP server (ssl://imap.gmail.com:993). Users log in with their Gmail credentials. Note that Gmail requires app-specific passwords or OAuth2 when 2FA is enabled.

Does Roundcube support mobile devices?

Yes. The Elastic skin is fully responsive and works well on smartphones and tablets in a mobile browser. Roundcube does not support ActiveSync or push notifications to native mail apps -- for that, you need SOGo or a similar groupware server.

How do I enable PGP encryption in Roundcube?

Enable the enigma plugin in the plugins array. Users generate or import PGP keys through the Roundcube interface. The enigma plugin uses GnuPG on the server for cryptographic operations, so install GnuPG: pkg install gnupg.

Can I use MySQL instead of PostgreSQL?

Yes. Roundcube supports MySQL/MariaDB and SQLite in addition to PostgreSQL. Change the db_dsnw connection string and use the appropriate SQL schema file (mysql.initial.sql instead of postgres.initial.sql). PostgreSQL is recommended for its reliability and FreeBSD integration.

How many users can a single Roundcube instance handle?

A single Roundcube instance on FreeBSD with NGINX and PHP-FPM can comfortably serve 100-500 concurrent users, depending on server resources and IMAP caching configuration. Roundcube itself is stateless per request -- the bottleneck is usually the IMAP server, not Roundcube.