Catalog / Business applications

Listmonk

Newsletter and mailing list manager with campaigns and subscriber segmentation

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace6.2.0↗ Azure Marketplace6.2.0↗

Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	6.2.0	$0.03/hr Recommended instance: t3.small · 5-day free trial	2026-08-24	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	6.2.0	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-08-26	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	AGPL-3.0
Upstream	Kailash Nadh
Machine-readable	product.json · catalog.json

What is Listmonk

Listmonk is an open-source, self-hosted newsletter and mailing list manager built as a single statically linked Go binary. It supports double or single opt-in subscriber lists, public and private lists, segmented campaigns, transactional email via REST API, HTML and plain-text templates, scheduled and continuous campaigns, bounce processing, click and view tracking, public archive pages, multi-language i18n, custom subscriber attributes, and a built-in admin UI. Connects to any standard SMTP relay (Amazon SES, SendGrid, Postmark, Mailgun, or self-hosted Postfix). Persists subscribers, campaigns, templates, and tracking data in PostgreSQL. AGPL-3.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Super-admin account with unique password (EC2 Instance ID) generated at first boot - never baked into the image
Listmonk admin UI bound to 127.0.0.1:9000 - reachable only through the Nginx reverse proxy with TLS
PostgreSQL 16 local, listening on 127.0.0.1 only - database password generated per instance
Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, security headers
UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/listmonk-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-dbvvxyxfbux5e/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer listmonk --plan payg-gen2
az vm create -g my-rg -n listmonk --size Standard_D2s_v3 \
  --image lynxroute:listmonk:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Listmonk v6.2.0

AWS · 2026-08-24Azure · 2026-08-26

Log rotation no longer silently stops application logging. The unit uses `StandardOutput=append:`, so systemd owns the log file descriptor; the previous logrotate config used `create`, which left the running service writing into the old unlinked inode while the fresh file stayed empty forever. Rotation now uses `copytruncate`, which truncates the same inode and keeps the descriptor valid. Listmonk 6.2.0 itself is unchanged.
Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.