ActivePush
Exchange ActiveSync server written in Rust - a from-scratch successor of Z-Push (PHP) for classic mail stacks: IMAP + SMTP (e.g. Dovecot + Postfix), CalDAV and CardDAV (Radicale, SOGo, Baikal, Nextcloud, DAViCal). One binary, no PHP-FPM, with a built-in administration panel in the RustProxy style: configuration, devices, remote wipe, policies, statistics, charts and live traffic.
phone / Outlook --HTTPS--> nginx | RustProxy --> ActivePush :8081 --> IMAP / SMTP / CalDAV / CardDAV
administrator --(SSH tunnel / VPN)-------------> panel :9091
Features
| Area | What you get |
|---|---|
| Protocol | ActiveSync 2.5, 12.0, 12.1, 14.0, 14.1; WBXML; plain and base64 query strings; multipart responses |
| Commands | Sync (incl. empty/partial and hanging Sync), FolderSync, FolderCreate/Update/Delete, GetHierarchy, Ping (push), Provision, SendMail, SmartReply, SmartForward, GetAttachment, ItemOperations (Fetch, byte ranges, EmptyFolderContents), GetItemEstimate, MoveItems, MeetingResponse, Search (GAL and mailbox), ResolveRecipients, Settings, ValidateCert |
| IMAP folder hierarchy and SPECIAL-USE, read/flag/answered/forwarded, move, trash, attachments, text/HTML/MIME bodies with truncation and preview, S/MIME passthrough, iMIP invitations as MeetingRequest | |
| Calendar | VEVENT <-> EAS: time zones (TIME_ZONE_INFORMATION <-> IANA), all-day events, RRULE recurrences, exceptions (EXDATE + RECURRENCE-ID), attendees and responses, reminders, busy status, categories |
| Tasks | VTODO <-> EAS Tasks (due, start, completion, priority, reminder, recurrence) |
| Contacts | vCard 2.1/3.0/4.0 <-> EAS Contacts with lossless merging of fields ActiveSync cannot represent |
| Push | Ping with cheap change detection (IMAP STATUS / DAV CTag every N seconds, full diff only when a signature changes) |
| Security | per-account and per-IP lockout, fail2ban friendly log line, user/domain/network/device-type allow and block lists, device approval, provisioning policies, remote wipe, sender enforcement, DAV SSRF guard, XML without DTD, size limits, panel with argon2id + CSRF + strict CSP |
| Panel | overview charts, live traffic (SSE), devices grouped per phone, mailboxes, backends with connection tests, ActiveSync settings, policies, security, logs and audit; English/Polish, dark/light theme |
| Operations | hardened systemd unit, portable .deb, Prometheus /metrics, /healthz, Z-Push config importer, CLI equivalent of z-push-admin, automatic database retention and compaction |
Quick start (development)
cp .env.example .env
./dev.sh backends # terminal 1: Dovecot + Radicale + SMTP sink (needs dovecot-imapd, radicale, aiosmtpd)
./dev.sh seed # settings matching those backends
./dev.sh # terminal 2: server (ActiveSync :8081, panel :9091)
./dev.sh admin setup-token # one-time token for creating the administrator at http://127.0.0.1:9091
./dev.sh probe jan@test.local # ActiveSync smoke test (password: Test-Password-123)
./dev.sh e2e # end-to-end test of every command
./dev.sh help lists all commands (lint, test, release, deb, dist, import-zpush ...).
Production (Debian/Ubuntu)
./dev.sh deb # -> dist/active-push_<version>-1_amd64.deb (glibc >= 2.30)
sudo apt install ./dist/active-push_*.deb # creates the user and directories, enables the service
sudo -u active-push active-push admin setup-token
ssh -L 9091:127.0.0.1:9091 server # panel: http://127.0.0.1:9091
Then replace the Z-Push fastcgi locations in nginx with proxy_pass - ready snippet:
deploy/nginx-active-push.conf. Details: docs/INSTALL.md.
Migrating from Z-Push
python3 /usr/share/active-push/zpush-import.py /usr/share/z-push > zpush.json # or /etc/z-push
sudo -u active-push active-push config apply zpush.json
Devices resynchronise on their own (unknown sync key -> status 9/3, unknown policy key -> provisioning, unknown Z-Push collection ids are removed from the device). See docs/MIGRATION.md.
Documentation
- docs/PANEL.md - tour of the administration panel with screenshots
- docs/INSTALL.md - installation, nginx/RustProxy, systemd, upgrades, backups
- docs/CONFIGURATION.md - every setting and its Z-Push equivalent
- docs/LOGS.md - logging, retention, rotation and database maintenance
- docs/SECURITY.md - security model and recommendations
- docs/MIGRATION.md - moving from Z-Push
- docs/TROUBLESHOOTING.md - common problems
- docs/DEVELOPMENT.md - architecture, tests, development environment
- docs/API.md - panel API and Prometheus metrics
License
AGPL-3.0-only (like Z-Push, from which the WBXML code pages and protocol behaviour originate).