jjmapd — Zero-knowledge JMAP email-fetch server

A JMAP (RFC 8620) email-fetch server that stores age-encrypted email blobs. Plaintext is never stored on disk. Decryption happens only on the client.

Quick Start

jjmapd serve --config examples/jjmap.json

Architecture

┌──────────┐  plaintext   ┌──────────┐  encrypted   ┌─────────┐
│  SMTP    │ ──────────→  │  jjmapd  │ ────────────→ │ SQLite  │
│  server  │  (maildir)   │  ingest  │  (age blobs)  │  + FS   │
└──────────┘              └──────────┘               └─────────┘
                                    │
                          JMAP/TLS  │  encrypted
                          ←─────────┘  (age blobs)
                                    │
                            ┌───────┴───────┐
                            │  Android APK  │
                            │  (decrypts    │
                            │   on device)  │
                            └───────────────┘

Build

make build        # Jerboa library build
make binary       # produce jjmapd binary
make native-build # Rust age library
make test         # run tests
make verify       # CI/pre-commit gate
make dist         # distribution build
make release-evidence

Security

See SECURITY.md. Cryptographic operations are pure Rust, no OpenSSL.

Operator Docs

• docs/threat-model.md
• docs/runbook.md
• docs/protocol-coverage.md
• docs/deployment-freebsd.md

License

Apache 2.0