Nuvomailo
Multi-Tenant Email Hosting SaaS Platform
🎯 Project Overview & Objective
A multi-tenant email hosting platform in development, built with TypeScript, Express, React, PostgreSQL, and Docker Mailserver, structured around organization-scoped tenant isolation and domain administration.
⚡ The Engineering Challenge
Agencies and growing businesses managing multiple client domains face exorbitant per-mailbox subscription fees from major email providers. Self-hosting email infrastructure is notoriously difficult due to complex Postfix/Dovecot configurations, DNS authentication requirements, and lack of multi-tenant administrative interfaces for provisioning client domains and storage quotas.
🏗️ Architecture & System Design
Frontend Architecture
React single-page application built with TypeScript, featuring modular administration views for organization switching, domain management, mailbox quota graphs, and user provisioning.
Backend & Service Layer
TypeScript Express modular service-layer architecture providing RESTful endpoints, request validation, and decoupled service classes separating tenant logic from email daemons.
Database & Persistence
Relational PostgreSQL database enforcing tenant isolation through strict organization_id scoping, foreign keys, and indexed domain/mailbox relationships.
Auth, Permissions & Security
JWT session authentication, bcrypt password hashing, and role-based permissions separating System Administrators from Organization Managers.
Infrastructure & Packaging
Docker and Docker Compose multi-container orchestration packaging the web application, PostgreSQL database, and Docker Mailserver (running Postfix, Dovecot, and SpamAssassin).
System Architecture Data Flow
+-----------------------------------------------------------------------------+
| ADMINISTRATION FRONTEND |
| React 18 SPA (TypeScript) |
| - Multi-Tenant Org Switcher - Domain & Namespace Dashboard |
| - Mailbox Provisioning & Quotas - DNS Configuration Guidance (SPF/DKIM)|
+--------------------------------------|--------------------------------------+
| REST API (JSON / Bearer JWT)
v
+-----------------------------------------------------------------------------+
| EXPRESS SERVICE MONOLITH |
| Node.js / Express Service Layer |
| - Organization-Scoping Middleware - Mailbox Provisioning Services |
| - Domain Management Controller - Role-Based Access Control (RBAC) |
+------------------|---------------------------------------|------------------+
| Relational Queries | Container Orchestration
v v
+------------------------------------+ +------------------------------------+
| DATABASE PERSISTENCE | | CONTAINERIZED MAIL ENGINE |
| PostgreSQL Database | | Docker Mailserver Suite |
| - Strict organization_id Scoping | | - Postfix (SMTP Routing) |
| - Domains, Accounts, Quotas | | - Dovecot (IMAP Retrieval) |
+------------------------------------+ +------------------------------------+ 🚀 Implemented Capabilities
Multi-Tenant Organization Hierarchy
Multi-tier tenant architecture allowing system administrators to manage multiple client organizations, each with isolated domain namespaces and mailboxes.
Domain & Namespace Administration
CRUD workflows for adding custom domains, setting default mailbox limits, and reviewing expected DNS configuration parameters.
Mailbox Provisioning & Quota Allocation
Creation of individual user mailboxes with customizable storage limits, forwarders, aliases, and automated password generation.
Containerized Email Engine
Docker Mailserver integration orchestrating Postfix for SMTP transmission and Dovecot for IMAP message retrieval within container networks.
🛠️ Engineering Challenges & Solutions
Strict Tenant Isolation in Shared Relational Schemas
In multi-tenant platforms, any leak of domain or mailbox data across client organizations presents critical security and privacy violations.
Implemented mandatory organization-scoping middleware on all Express routes and verified foreign key cascading rules in PostgreSQL to guarantee that requests can only access data belonging to the authenticated tenant.
Decoupling Web Management from Low-Level Mail Daemons
Directly modifying Linux system configuration files (/etc/postfix, /etc/dovecot) from web controllers creates race conditions and security vulnerabilities.
Architected a decoupled service layer where web management communicates with mailbox databases through controlled database abstractions and structured state synchronization.
⚖️ Technical Decisions & Architectural Trade-offs
Containerized Docker Mailserver vs Bare-Metal Postfix/Dovecot
Chose Docker Mailserver to encapsulate SMTP/IMAP/SpamAssassin daemons in isolated containers, enabling reproducible developer environments and eliminating brittle host OS configuration drift.
Inter-container network routing and persistent volume permission management requires careful Docker Compose orchestration.
Service-Layer Monolith vs Microservices
Maintained a modular Express service-layer architecture to keep tenant management and mailbox provisioning within a single predictable, easily auditable codebase.
Background mail synchronization jobs share memory with the HTTP API server in early development.
Organization-Scoped Multi-Tenancy vs Database-Per-Tenant
Implemented a shared PostgreSQL schema with strict organization_id foreign key isolation to minimize operational connection overhead while scaling across client domains.
Mandatory scoping middleware is required on every single query to eliminate cross-tenant data leaks.
🧪 Testing Strategy & Verification
Quality Strategy: Multi-tenant boundary verification and containerized SMTP/IMAP protocol connectivity tests.
Verified Test Scenarios
- Tenant isolation tests confirming Organization A cannot query, update, or delete domains belonging to Organization B.
- Mailbox quota validation preventing mailbox provisioning when tenant quota limit is exceeded.
- Docker Mailserver container health checks and SMTP handshake tests via local Postman and nodemailer scripts.
- Password hash generation using bcrypt with verified authentication session tokens.
📈 Results & Technical Learnings
Verified Implemented Outcomes
- Developed core multi-tenant backend service layer and React administration dashboard with verified PostgreSQL persistence.
- Configured containerized Docker Mailserver environment for local SMTP and IMAP service validation.
- Public GitHub repository available at bouhouchhamza/Nuvomailo_V1.
Planned Next Milestones
- Automated DNS TXT record verification checking SPF, DKIM, and DMARC before mailbox activation.
- Daemon synchronization service automating Postfix virtual mailbox table updates on live Linux hosts.
- Production pilot testing with select beta client domains.
Architectural Takeaways
- Multi-tenant data isolation must be enforced systematically through middleware and database constraints, never left to ad-hoc controller queries.
- Containerizing complex mail suites with Docker Compose accelerates local integration testing and eliminates environment discrepancies.
🧰 Complete Technology Stack
Need a Similar System or Application?
I collaborate with businesses and agencies to engineer scalable web backends, interactive client applications, and custom automation workflows.