Listmonk

Self-hosted newsletter and mailing list manager. Listmonk handles subscriber management, list segmentation, campaign creation, email template rendering, and delivery tracking. It requires PostgreSQL and an external SMTP provider to send emails.

Key Features

• Subscriber and list management — import, segment, and manage subscriber lists
• Campaign management — HTML and plain-text email campaigns with template support
• Transactional emails — API-driven transactional message delivery
• PostgreSQL backend — bundled subchart or external database with pgcrypto auto-provisioned
• Persistent uploads storage — media and attachment files on a dedicated PVC
• Idempotent bootstrap — init container applies schema migrations on every pod start
• Superadmin from a Secret — created on a fresh database, so the first-run admin page is never exposed
• Hardened pod — non-root, read-only root filesystem, no privilege escalation, all capabilities dropped
• Configurable listener — listmonk.port changes the real HTTP listener
• Ingress or Gateway API — Ingress or HTTPRoutes
• S3 backup — scheduled PostgreSQL pg_dump to S3-compatible storage

Operational Patterns

The chart supports four primary operating modes: bundled PostgreSQL for simple installs, managed external PostgreSQL for platform databases, TLS ingress for public administration, and an optional database backup CronJob for S3-compatible object storage. Uploaded media is stored on a separate PVC, so database backups and uploads backups must be planned together for disaster recovery.

Security Scan

Security Scan: Kubescape on rendered default manifests.

Remaining findings map to controls that depend on the platform: resource limits and namespace network policy.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install listmonk helmforge/listmonk

OCI registry:

helm install listmonk oci://ghcr.io/helmforgedev/helm/listmonk

Getting Started

The db-init init container creates the superadmin (admin by default) on a fresh database. Read the password, port-forward, and log in:

kubectl rollout status deploy/listmonk --timeout=300s
kubectl get secret listmonk-admin -o jsonpath='{.data.admin-password}' | base64 -d; echo
kubectl port-forward svc/listmonk 9000:80
# Open http://localhost:9000/admin

A release whose name contains listmonk uses it as the resource prefix; other releases use <release>-listmonk. Configure SMTP under Settings → SMTP before sending campaigns.

Deployment Examples

# values.yaml — Listmonk with bundled PostgreSQL
# After deploying, configure SMTP in the admin UI: Settings → SMTP
postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

storage:
  enabled: true
  size: 5Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: listmonk.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Production Listmonk with TLS and daily PostgreSQL backup
# Backup covers the PostgreSQL database only. Uploads PVC is not included.
postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

storage:
  enabled: true
  size: 10Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-listmonk-backups
    prefix: listmonk
    existingSecret: listmonk-s3-credentials

resources:
  requests:
    memory: 128Mi
    cpu: 100m
  limits:
    memory: 512Mi
    cpu: 500m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: listmonk.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: listmonk-tls
      hosts:
        - listmonk.example.com

# values.yaml — Listmonk with external managed PostgreSQL
# The external PostgreSQL database must have the pgcrypto extension available.
database:
  mode: external
  external:
    host: postgresql.database.svc.cluster.local
    port: 5432
    name: listmonk
    username: listmonk
    existingSecret: listmonk-db-credentials
    existingSecretPasswordKey: database-password
    sslMode: require

postgresql:
  enabled: false

storage:
  enabled: true
  size: 10Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: listmonk.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Configure SMTP via environment variables (bypasses UI)
# Listmonk reads SMTP config from environment when set.
# Refer to Listmonk environment variable documentation for all available keys.
listmonk:
  extraEnv:
    - name: LISTMONK_smtp__host
      value: 'smtp.postmarkapp.com'
    - name: LISTMONK_smtp__port
      value: '587'
    - name: LISTMONK_smtp__auth_protocol
      value: 'login'
    - name: LISTMONK_smtp__username
      valueFrom:
        secretKeyRef:
          name: listmonk-smtp
          key: username
    - name: LISTMONK_smtp__password
      valueFrom:
        secretKeyRef:
          name: listmonk-smtp
          key: password

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

storage:
  enabled: true
  size: 5Gi

Configuration Reference

Core

Image

Listmonk Configuration

Database

Database — Embedded Subchart

The bundled PostgreSQL subchart automatically provisions the pgcrypto extension and the required grants via init SQL scripts. This extension is mandatory for Listmonk — deployments against external databases must ensure pgcrypto is available.

Uploads Storage

Backup

Service

Ingress

Gateway API

Probes

Resources and Security

Service Account

Scheduling

Extra

Email Deliverability

More Information

• Listmonk Official Website
• Listmonk Documentation
• Listmonk GitHub Repository
• HelmForge Listmonk Chart Source