Aliaser

A single-page web app for managing email aliases across multiple providers, without touching their admin interfaces.

Supported providers

Provider	List	Create	Delete	Disable	Notes	Contacts
OVH (Zimbra)	✅	✅	✅	✅	✅	—
Infomaniak	✅	✅	✅	✅	✅	—
SimpleLogin	✅	✅	✅	✅	✅	✅
Addy.io	✅	✅	✅	✅	✅	✅
Cloudflare	✅	✅	✅	—	✅	—
Haltman	✅	✅	✅	✅	✅	—

Features

• Manage aliases from multiple providers and accounts in one place
• Create aliases with custom or auto-generated names
• Add notes to aliases (synced to provider API where supported)
• Copy alias address in one click
• Disable/re-enable aliases without deleting them
• Search across all aliases (address, target, note)
• SimpleLogin & Addy.io contacts / reverse aliases management
• Dark theme, responsive (mobile + desktop)
• Installable PWA, with instant load from a cached alias list (stale-while-revalidate)
• All data stored server-side, encrypted credentials

Screenshots

Architecture

No framework, no build step — vanilla JS + PHP.

app/
  index.html        — UI (single page)
  css/style.css     — Styles (dark theme, responsive)
  js/app.js         — All frontend logic
  proxy.php         — PHP backend: proxies provider API calls, persists data
  json/             — Server-side data (auto-created, not committed)
extensions/
  chrome/           — Chrome extension (MV3)
  firefox/          — Firefox extension
docker/             — Dockerfile, entrypoint, Apache config
docker-compose.yml

Server-side data lives under app/json/ (mounted as a volume, not committed). Sensitive values are encrypted at rest.

Deployment

Docker with Portainer (recommended)

1. In Portainer → Stacks → Add stack → Web editor:

   services:
     aliaser:
       image: kitround/aliaser
       restart: unless-stopped
       ports:
         - "8090:80"
       volumes:
         - ~/aliaser/app/json:/var/www/html/json
       environment:
         ALIASER_SECRET_KEY: "your_key_here"

2. Generate ALIASER_SECRET_KEY with openssl rand -hex 32 (64 hex chars) and keep it stable across restarts.

3. Open http://YOUR_HOST:8090. On first run you'll create the admin account, enrol TOTP two-factor (scan/enter the secret in an authenticator app), and save the one-time backup codes. Then add your provider accounts from Settings.

Manual (nginx / Apache + PHP 8.2+)

Requirements: PHP 8.2+, openssl extension, curl extension.

1. Copy the app/ folder contents to your web root.

2. Make json/ writable by the web server:

   mkdir -p json && chown www-data:www-data json

3. Set ALIASER_SECRET_KEY (64 hex chars) as an environment variable in your PHP-FPM or Apache config, and ensure json/ is not reachable over HTTP.

4. Open the app — complete the first-run admin + TOTP setup, then add your accounts from Settings.

Browser extensions

The Chrome/Firefox popups talk to the same server.

1. Load the extension (extensions/chrome or extensions/firefox).
2. Open the extension Options and set the Server URL (e.g. https://YOUR_HOST).
3. In the app: Settings → Security → Extension tokens → Generate, copy the token (shown once).
4. Paste it into the extension's Device token field in Options and save.

Tokens are revocable from the same screen. One token per device/browser is recommended.

Sign-in & two-factor

On first run you create the admin account and enrol TOTP (authenticator app) with one-time backup codes.

In Settings → Security → Two-factor you can then:

• Add passkeys (WebAuthn / FIDO2 — Touch ID, Windows Hello, Android, security keys). A passkey is a passwordless login: on the sign-in screen, tap "Sign in with a passkey" and confirm with biometrics/PIN — no username or password needed.
• Enable/disable TOTP. You can't remove your last factor, so you always keep a way in.

Password + TOTP stays available as the alternative to passkeys.

Passkeys require HTTPS and a real domain name (not a bare IP) — they also work in the installed mobile PWA. Behind a reverse proxy, forward the original Host header and X-Forwarded-Proto.

Security

• Login required, with two-factor: TOTP and/or passwordless passkeys.
• Provider API tokens are encrypted at rest and never returned to the browser.
• CSRF protection, brute-force lockout, and standard security headers.
• Extensions authenticate with a revocable device token (Settings → Security → Extension tokens).

⚠️ Intended to run behind HTTPS (reverse proxy / Cloudflare), ideally on a private network / VPN. Set a stable ALIASER_SECRET_KEY and keep json/ off the public web.

Adding accounts

OVH

1. Create an app at eu.api.ovh.com/createApp to get an App Key and App Secret
2. Add the account in Settings → authenticate to get a Consumer Key

Infomaniak

1. Go to manager.infomaniak.com/v3/profile/api
2. Create a token with Mail Hosting read + write permissions

SimpleLogin

1. Go to app.simplelogin.io/dashboard/api_key
2. Copy your API key

Addy.io

1. Go to app.addy.io/settings → API Keys section
2. Create an API key

Cloudflare

1. Go to dash.cloudflare.com/profile/api-tokens
2. Create a token with Email Routing read + edit permissions