Self-Hosted Newsletter Sender

Marketing & Sales

A self-hosted newsletter system: manage subscriber lists, build templates, send campaigns and read send reports, with the lists and send records kept in your own database. You bring it up on your own machine with Docker Compose, the first start creates the administrator and a workspace on its own, and the admin password is generated at random by a script. Derived from a frozen snapshot of open-source newsletter software under the MIT licence; the delivery adds a Dockerfile that builds the image from source, an orchestration file for four services (including PostgreSQL), a script that generates the keys and password, a package lock file that was added, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Small teams who send newsletters regularly and want the subscriber list and send records to stay in their own database.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview200 paths

▸app73

Console/
Exceptions/
Http/
Livewire/
Models/
Providers/
Repositories/
Rules/
Services/
Setup/
…

▸bootstrap2

app.php
cache/

▸config17

app.php
auth.php
broadcasting.php
cache.php
cors.php
database.php
filesystems.php
hashing.php
horizon.php
logging.php
…

▸database16

.gitignore
factories/
migrations/
seeders/

▸docker4

quickstart/

▸public4

.htaccess
favicon.ico
index.php
robots.txt

▸resources26

views/

▸routes4

api.php
channels.php
console.php
web.php

▸scripts1

quickstart/

▸storage9

app/
framework/
logs/

▸tests18

CreatesApplication.php
Feature/
TestCase.php
TestSupportTrait.php
Unit/

▫ATTRIBUTION.md

▫CHANGELOG.md

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫artisan

▫composer.json

▫composer.lock

▫delivery-manifest.txt

▫docker-compose.yml

▫phpunit.xml.dist

▫server.php

▫Config and hidden files 11

Latest passing run

Clone → Checkout → Toolchain → Build images → Newsletter login and subscriber

Pre-purchase Disclosure

What you are buying

A self-hosted newsletter sender: subscriber lists, templates and campaigns. After running the password generation script you bring it up with Docker Compose, and the first start creates the administrator on its own.

Derived from open-source newsletter software under the MIT licence, and not the original project itself. Our work: a Dockerfile that builds the image from source, an orchestration file for four services, a script that generates the keys and password, a package lock file that was added, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 6cda6e1.

Known limitations

The service serves plain HTTP on port 8080 of the local machine; TLS and a reverse proxy are yours to bring
The interface is in English
The system brings no mail service of its own, and before sending a campaign you connect your own mail service in the interface
System mail (password reset, member invitations) is only written to the log and is not sent
Self-registration is closed, and the only login is the administrator created at the first start
The administrator account is created at the first start only, and changing .env afterwards does not affect the existing account
The database password takes effect only when the database is first created
APP_KEY cannot be changed once it is in use
docker compose down -v deletes all subscribers, templates, campaigns and send records
The first start builds the image from source, fetching from registries, apt and Composer during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit f759dc8. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when the application key, database password or admin login is missing; debug mode is off; self-registration is off; the database is not published; system mail is only written to the log), docker/quickstart/entrypoint.sh (it runs the database migration, then creates the first administrator and workspace, and only then starts the web server), the Dockerfile, and scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, existing values are not overwritten). The upstream PHP sources and the package that holds the main functions were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and the entry script are ours (read line by line); the build goes through docker/quickstart/Dockerfile (read line by line: packages from apt, Composer taken from a digest-pinned image and installing from the lock file, with no download piped straight into a shell). At start-up the web, scheduler and queue worker services share one image and the entry script.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Mettle. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the PHP dependencies are declared in composer.json and locked by the composer.lock we added, and the packages themselves are fetched from the Composer repository when the buyer builds; the base images and system packages come from a registry and apt. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).