Email archives contain some of your most sensitive data — business correspondence, financial records, personal conversations. Here's how to keep your Bichon instance secure.

1. Always Use HTTPSCopy Anchor Link

Never expose Bichon over plain HTTP in production. Use a reverse proxy with TLS termination:

server {
    listen 443 ssl;
    server_name archive.example.com;

    ssl_certificate     /etc/letsencrypt/live/archive.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/archive.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:15630;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

Or enable Bichon's built-in HTTPS:

BICHON_ENABLE_REST_HTTPS=true

2. Change Default Credentials ImmediatelyCopy Anchor Link

On first launch, Bichon creates a default admin account:

• Username: admin
• Password: admin@bichon

Change this password before exposing Bichon to any network. Go to Settings → Profile in the WebUI.

3. Use Strong Encryption PasswordsCopy Anchor Link

BICHON_ENCRYPT_PASSWORD protects all stored credentials (IMAP passwords, OAuth tokens). Use a strong, unique password:

# Generate a strong password
openssl rand -base64 32
# Store it securely, e.g., in a password manager or .env file
BICHON_ENCRYPT_PASSWORD=$(cat /secure/bichon-encrypt-password)

Important: If you lose this password, all stored credentials become unrecoverable. Keep a secure backup.

4. Principle of Least PrivilegeCopy Anchor Link

Don't give everyone admin access. Bichon's RBAC system has 5 built-in roles:

Create custom roles for fine-grained control:

1. Go to /users/roles
2. Create a role with only the permissions needed
3. Assign users to that role

5. Restrict Network AccessCopy Anchor Link

Firewall RulesCopy Anchor Link

Only expose the ports you need:

# Allow HTTPS from your network
ufw allow from 192.168.1.0/24 to any port 443

# Block direct access to Bichon's port
ufw deny 15630

CORS ConfigurationCopy Anchor Link

Restrict CORS to known origins:

BICHON_CORS_ORIGINS=https://archive.example.com

Don't leave CORS origins unset in production — it allows all origins.

SOCKS5 Proxy for IMAPCopy Anchor Link

Route IMAP traffic through a proxy to avoid exposing your server's IP to email providers:

# Add a SOCKS5 proxy in WebUI → Settings → Proxies
# Then assign it per-account in Account Settings

6. Regular BackupsCopy Anchor Link

Use the built-in backup engine (WebUI → Backup): it writes incremental, content-addressed backups to any S3-compatible store (AWS S3, MinIO, R2) or to a local directory on a separate volume, keeps a manifest per restore point, and prunes old restore points on a retention policy you set. Once configured, backups run on a schedule — no scripts to maintain.

Whichever target you pick, put it somewhere the data disk failing does not take with it: a local target on the same disk is not a backup. See Storage & Backup for what the local target guarantees.

7. Keep Bichon UpdatedCopy Anchor Link

Watch the GitHub releases page for security updates. Docker users can update with:

docker pull rustmailer/bichon:latest
docker stop bichon
docker rm bichon
# Re-run with the same volume mounts and env vars

Security ChecklistCopy Anchor Link

• HTTPS enabled (reverse proxy or built-in)
• Default admin password changed
• Strong BICHON_ENCRYPT_PASSWORD set
• Users have appropriate roles (not all admins)
• CORS origins restricted
• Firewall rules applied
• Automated daily backups configured
• Monitoring / alerting for failed logins

Have questions or suggestions? Join the discussion on Discord or open an issue.