BackendSide WebMail

1. Signing in

Open the WebMail address in any modern browser. You'll see a login page with two sides — a welcome panel and a sign-in form.

If the server rejects your password, the form tells you so. If WebMail can't reach the server at all, you'll see a different error — check the server name and your internet connection.

2. The main screen

After signing in, the screen splits into three columns:

┌──────────┬─────────────────┬────────────────────────┐
│ Folders  │  Message list   │  Open message          │
│          │                 │                        │
│  Inbox 3 │  ★ Alice        │  From: Alice           │
│  Sent    │    Re: Lunch    │  Subject: Re: Lunch    │
│  Drafts  │    Bob          │                        │
│  Trash   │    Project plan │  Hey, sounds great…    │
│  Spam    │                 │                        │
│          │                 │                        │
│  Quota:  │                 │                        │
│  ▓▓░░ 42%│                 │                        │
└──────────┴─────────────────┴────────────────────────┘
   sidebar      list pane          reading pane

• Sidebar — your folders, with an unread count next to each one. The bottom of the sidebar shows how full your mailbox is (when the server reports it).
• List pane — messages in the selected folder, newest at the top. The unread ones are bold, starred ones show a coloured star.
• Reading pane — the message you have open. Empty until you click one.

New mail appears in the list automatically. You don't need to refresh; the inbox and unread badges update on their own as messages arrive, are moved, or are deleted.

The browser tab title also shows your unread count, e.g. (3) WebMail, so you can spot new mail from another tab.

3. Reading mail

• Click a message in the list pane to open it.
• The header shows From, To, Cc, Date, and Subject.
• The body appears below. If the message contains both plain text and formatted (HTML) text, you'll see the formatted version.

Remote images

To protect your privacy, images hosted on the sender's server are blocked by default. A small notice appears at the top of the message with a Load Images button. Click it to show the images for that message.

4. Writing mail

Sent messages are also saved to your Sent folder on the server, so they're visible from any other mail client you use on the same account.

Drafts are saved to your Drafts folder. Open a draft from there to keep editing it.

5. Replying and forwarding

With a message open:

• Reply (or press r) — reply to the sender only.
• Reply All (or press a) — reply to the sender plus everyone in the To and Cc lines.
• Forward (or press f) — send the message on to someone new.

In all three cases the original message is quoted in the body automatically. Edit before, after, or in the middle of the quoted text as you wish.

6. Attachments

Receiving

When a message has attachments, they're listed at the bottom of the reading pane with filenames and sizes. Click a filename to download it to your computer.

Sending

In the compose window, click the paperclip icon in the bottom row to pick one or more files. Each file appears as a chip with its name and size, plus a small × to remove it. The total size is shown at the end of the list.

You can attach files to new messages, replies, forwards, and drafts. Attached files travel with the draft when you save it.

7. Folders

Most accounts come with a standard set of folders — Inbox, Sent, Drafts, Trash, Spam — which WebMail detects and gives icons to automatically, regardless of how the server names them.

Creating, renaming, deleting

• Click the + button at the top of the sidebar to create a new folder.
• Click the ⋮ menu next to any folder you created to rename or delete it.
• Built-in folders (Inbox, Sent, Drafts, Trash, Spam) can't be renamed or deleted.

8. Search

• Click the search bar above the message list (or press /).
• Type a word, phrase, or address.
• Results appear after a brief pause as you type.
• The search runs on the server, so it covers every message in the current folder, not just the ones you've already scrolled to.
• Click the × in the search bar to clear it and go back to the normal folder view.

You can also narrow by sender, by date range, or to unread-only — the search bar exposes these as extra fields.

9. Starring, marking, and deleting

With a message selected or open:

• Star (★, or press s) — flags the message. Useful for follow-up.
• Mark unread (or press u) — moves the message back to bold so you remember to come back to it.
• Delete (or press d) — moves the message to Trash. From the Trash folder itself, Delete removes the message permanently.

These actions are reflected on the server immediately, so the same state is visible from your phone or any other mail client on the same account.

10. Keyboard shortcuts

Press ? at any time to see this list in the app.

11. On a phone or tablet

On a narrow screen the three columns stack instead of sitting side-by-side:

• The sidebar becomes a drawer. Tap the ☰ (hamburger) icon at the top-left to slide it in, tap outside to dismiss.
• Tapping a message slides the reading pane in from the right. The top-left arrow takes you back to the list.
• All buttons and menus work the same as on the desktop.

12. Signing out

Click your address (or the Sign out button) at the top of the sidebar. Your session is destroyed on the server, your password is discarded from memory, and you're returned to the login page.

If you simply close the browser tab without signing out, your session expires automatically 24 hours after you signed in.

13. Troubleshooting

I get an error when I try to sign in.

Double-check your email address, password, and the server selection. Gmail, Outlook, and Yahoo usually require an app password rather than your normal login password — your provider's help pages explain how to generate one.

My password is correct but it says it can't connect.

The server name or port may be wrong (if you're using Custom server), or the network between you and the mail server may be blocked.

New mail doesn't show up.

WebMail normally updates on its own. If it has stopped, refreshing the page reconnects. If the problem persists, sign out and back in.

Images in an email aren't showing.

That's by design — click the Load Images notice at the top of the message to allow them for that message.

The compose window is missing a Cc field.

It's hidden by default. Click the "Cc" link near the To field to reveal it.

A folder I created isn't there anymore.

It may have been deleted from another mail client on the same account. The folder list always reflects what's on the server.

Something else is wrong.

Ask whoever set up WebMail for you — they can check the server logs.

14. Configuration (for administrators)

This section is for the person who installs and runs WebMail on a server. Day-to-day users don't need any of it.

WebMail reads a single YAML file at startup. The package installs a default at /etc/backendside-webmail/config.yaml; when running from source, a config.yaml in the working directory is used instead.

After editing the file, restart the service:

sudo systemctl restart backendside-webmail

Complete example

# WebMail Configuration

server:
  listen_addr: ":8083"
  session_secret: "change-me-to-a-random-32-char-string"
  cookie_secure: false

allow_custom_server: true
allow_insecure_plaintext: false

mail_servers:
  - name: "Gmail"
    imap_host: "imap.gmail.com"
    imap_port: 993
    imap_tls: true
    smtp_host: "smtp.gmail.com"
    smtp_port: 587
    smtp_starttls: true

  - name: "Outlook / Office 365"
    imap_host: "outlook.office365.com"
    imap_port: 993
    imap_tls: true
    smtp_host: "smtp.office365.com"
    smtp_port: 587
    smtp_starttls: true

  - name: "Yahoo Mail"
    imap_host: "imap.mail.yahoo.com"
    imap_port: 993
    imap_tls: true
    smtp_host: "smtp.mail.yahoo.com"
    smtp_port: 465
    smtp_starttls: false

  - name: "Local / Self-hosted"
    imap_host: "localhost"
    imap_port: 993
    imap_tls: true
    tls_skip_verify: true
    smtp_host: "localhost"
    smtp_port: 587
    smtp_starttls: true

server — HTTP server settings

allow_custom_server

Default true. When true, the Custom server… option appears in the login dropdown, letting users enter any IMAP / SMTP host, port, and TLS options. Set this to false if WebMail should only serve a specific company's mail server.

allow_insecure_plaintext

Default false. By default, WebMail refuses to send your password to an IMAP or SMTP server in cleartext. It will:

• Reject a plain IMAP connection (port 143) if the server does not advertise the STARTTLS upgrade.
• Reject an outgoing SMTP message if the server does not advertise STARTTLS on a non-TLS port.

mail_servers — predefined providers shown in the login dropdown

A list. Each entry produces one option in the Mail server dropdown on the login page. Fields per entry:

Adding a new predefined provider

  - name: "Fastmail"
    imap_host: "imap.fastmail.com"
    imap_port: 993
    imap_tls: true
    smtp_host: "smtp.fastmail.com"
    smtp_port: 465
    smtp_starttls: false

Then restart the service. The new option appears in the dropdown.

Operations

# Status & logs
sudo systemctl status backendside-webmail
sudo journalctl -u backendside-webmail -f          # follow
sudo journalctl -u backendside-webmail -n 50       # last 50 lines

# Lifecycle
sudo systemctl start backendside-webmail
sudo systemctl stop backendside-webmail
sudo systemctl restart backendside-webmail
sudo systemctl is-enabled backendside-webmail      # on boot?

Security notes

• Passwords are never written to disk. They live only in the in-memory session for the duration of a sign-in, up to a 24-hour TTL.
• Sessions use a 256-bit cryptographically random cookie token — not a signed/derived token. The session_secret setting is reserved for a future stateless-token mode and currently does nothing.
• CSRF protection is enforced on every mutating API call via a double-submit cookie + X-CSRF-Token header.
• Login rate-limit: ten failed attempts per minute per source IP before further attempts are dropped. Per-IP buckets reset after fifteen minutes of inactivity.
• HTTPS: WebMail itself serves plain HTTP. Run it behind a TLS-terminating reverse proxy (nginx, Caddy, Traefik) for production deployments, and set server.cookie_secure: true.