{ "slug": "listmonk", "name": "Listmonk", "tagline": "Newsletter and mailing list manager with campaigns and subscriber segmentation", "category": "business-apps", "use_cases": [ "newsletters", "email-campaigns", "mailing-lists" ], "aliases": [], "status": "live", "upstream": { "vendor": "Kailash Nadh", "url": "https://listmonk.app", "license": "AGPL-3.0", "license_url": "https://github.com/knadh/listmonk/blob/master/LICENSE" }, "image": { "os": "Ubuntu 24.04 LTS", "cis_level": 1, "ports": [ 80, 443 ], "artifacts": [ "/etc/lynxroute/sbom.json", "/etc/lynxroute/cis-report.html", "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md" ] }, "clouds": { "aws": { "status": "live", "version": "6.2.0", "last_build": "2026-08-24", "entity_id": "prod-dbvvxyxfbux5e", "ami_alias": "/aws/service/marketplace/prod-dbvvxyxfbux5e/latest", "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-ivkfaen64wbf6", "recommended_instance_type": "t3.small", "price_usd_per_hour": 0.03, "free_trial_days": 5, "unit": "instance-hour" }, "azure": { "status": "live", "version": "6.2.0", "last_build": "2026-08-26", "offer_id": "listmonk", "plan_id": "payg-gen2", "image_urn": "lynxroute:listmonk:payg-gen2:latest", "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.listmonk?tab=Overview", "recommended_vm_size": "Standard_D2s_v3", "price_usd_per_vcpu_hour": 0.028, "unit": "vcpu-hour" }, "alicloud": { "status": "not_offered" } }, "urls": { "page": "https://lynxroute.com/products/listmonk/", "json": "https://lynxroute.com/products/listmonk/product.json" }, "release_notes": [ { "version": "6.2.0", "title": "Listmonk v6.2.0", "notes": "* Log rotation no longer silently stops application logging. The unit uses `StandardOutput=append:`, so systemd owns the log file descriptor; the previous logrotate config used `create`, which left the running service writing into the old unlinked inode while the fresh file stayed empty forever. Rotation now uses `copytruncate`, which truncates the same inode and keeps the descriptor valid. Listmonk 6.2.0 itself is unchanged.\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base.\n", "source": "backfill-aws-listing", "live": { "aws": "2026-08-24", "azure": "2026-08-26" } }, { "version": "6.2.0", "title": "Listmonk 6.2.0", "notes": "* Listmonk 6.2.0 - self-hosted newsletter & mailing list manager (minor update from 6.1.0; security fixes for multi-user campaign/list permission validation, inline CID images, trusted redirect URLs)\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n", "source": "backfill-aws-listing", "live": { "aws": "2026-08-24", "azure": "2026-08-26" } }, { "version": "6.1.0", "title": "Listmonk 6.1.0", "notes": "* Listmonk 6.1.0 single-binary on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Super-admin user with unique password (EC2 Instance ID) generated at first boot\n* Admin UI bound to 127.0.0.1:9000 and reachable only through Nginx with TLS\n* PostgreSQL 16 local, bound to 127.0.0.1 with per-instance generated password\n* UFW firewall pre-configured (TCP 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n", "source": "backfill-aws-api", "live": { "aws": "2026-05-08", "azure": "2026-06-03" } } ], "release_history": [ { "version": "6.2.0", "aws": "2026-08-24", "azure": "2026-08-26" }, { "version": "6.1.0", "aws": "2026-05-08", "azure": "2026-06-03" } ], "deploy": { "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n --image-id resolve:ssm:/aws/service/marketplace/prod-dbvvxyxfbux5e/latest \\\n --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx", "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer listmonk --plan payg-gen2\naz vm create -g my-rg -n listmonk --size Standard_D2s_v3 \\\n --image lynxroute:listmonk:payg-gen2:latest --admin-username azureuser --generate-ssh-keys" }, "description": { "what_is": "Listmonk is an open-source, self-hosted newsletter and mailing list manager built as a single statically linked Go binary. It supports double or single opt-in subscriber lists, public and private lists, segmented campaigns, transactional email via REST API, HTML and plain-text templates, scheduled and continuous campaigns, bounce processing, click and view tracking, public archive pages, multi-language i18n, custom subscriber attributes, and a built-in admin UI. Connects to any standard SMTP relay (Amazon SES, SendGrid, Postmark, Mailgun, or self-hosted Postfix). Persists subscribers, campaigns, templates, and tracking data in PostgreSQL. AGPL-3.0 license, no vendor lock-in.", "image_adds": "Security hardening:\n* Super-admin account with unique password (EC2 Instance ID) generated at first boot - never baked into the image\n* Listmonk admin UI bound to 127.0.0.1:9000 - reachable only through the Nginx reverse proxy with TLS\n* PostgreSQL 16 local, listening on 127.0.0.1 only - database password generated per instance\n* Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, security headers\n* UFW firewall pre-configured - only TCP 22, 80, 443 are exposed\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md" }, "generated_at": "2026-10-31T09:36:34Z" }