diff --git a/webmails/roundcube/config.inc.php b/webmails/roundcube/config.inc.php
new file mode 100644
index 00000000..797f229c
--- /dev/null
+++ b/webmails/roundcube/config.inc.php
@@ -0,0 +1,66 @@
+<?php
+
+$config = array();
+
+// Generals
+$config['db_dsnw'] = getenv('DB_DSNW');;
+$config['temp_dir'] = '/tmp/';
+$config['des_key'] = getenv('SECRET_KEY') ? getenv('SECRET_KEY') : trim(file_get_contents(getenv('SECRET_KEY_FILE')));
+$config['cipher_method'] = 'AES-256-CBC';
+$config['identities_level'] = 0;
+$config['reply_all_mode'] = 1;
+
+// List of active plugins (in plugins/ directory)
+$config['plugins'] = array(
+    'archive',
+    'zipdownload',
+    'markasjunk',
+    'managesieve',
+    'enigma',
+    'carddav'
+);
+
+$front = getenv('FRONT_ADDRESS') ? getenv('FRONT_ADDRESS') : 'front';
+$imap  = getenv('IMAP_ADDRESS')  ? getenv('IMAP_ADDRESS')  : 'imap';
+
+// Mail servers
+$config['default_host'] = $front;
+$config['default_port'] = 10143;
+$config['smtp_server'] = $front;
+$config['smtp_port'] = 10025;
+$config['smtp_user'] = '%u';
+$config['smtp_pass'] = '%p';
+
+// Sieve script management
+$config['managesieve_host'] = $imap;
+$config['managesieve_usetls'] = false;
+
+// Customization settings
+if (filter_var(getenv('ADMIN'), FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE)) {
+	array_push($config['plugins'], 'mailu');
+	$config['support_url'] = getenv('WEB_ADMIN') ? '../..' . getenv('WEB_ADMIN') : '';
+	$config['sso_logout_url'] = getenv('WEB_ADMIN').'/ui/logout';
+}
+$config['product_name'] = 'Mailu Webmail';
+
+// We access the IMAP and SMTP servers locally with internal names, SSL
+// will obviously fail but this sounds better than allowing insecure login
+// from the outter world
+$ssl_no_check = array(
+ 'ssl' => array(
+     'verify_peer' => false,
+     'verify_peer_name' => false,
+  ),
+);
+$config['imap_conn_options'] = $ssl_no_check;
+$config['smtp_conn_options'] = $ssl_no_check;
+$config['managesieve_conn_options'] = $ssl_no_check;
+
+// skin name: folder from skins/
+$config['skin'] = 'elastic';
+
+// Enigma gpg plugin
+$config['enigma_pgp_homedir'] = '/data/gpg';
+
+// Set From header for DKIM signed message delivery reports
+$config['mdn_use_from'] = true;
diff --git a/webmails/roundcube/mailu.php b/webmails/roundcube/mailu.php
new file mode 100644
index 00000000..bb4d65e9
--- /dev/null
+++ b/webmails/roundcube/mailu.php
@@ -0,0 +1,59 @@
+<?php
+
+class mailu extends rcube_plugin
+{
+
+  function init()
+  {
+    $this->add_hook('startup', array($this, 'startup'));
+    $this->add_hook('authenticate', array($this, 'authenticate'));
+    $this->add_hook('login_after', array($this, 'login'));
+    $this->add_hook('login_failed', array($this, 'login_failed'));
+    $this->add_hook('logout_after', array($this, 'logout'));
+  }
+
+  function startup($args)
+  {
+    if (empty($_SESSION['user_id'])) {
+        $args['action'] = 'login';
+    }
+
+    return $args;
+  }
+
+  function authenticate($args)
+  {
+    if (!in_array('HTTP_X_REMOTE_USER', $_SERVER) || !in_array('HTTP_X_REMOTE_USER_TOKEN', $_SERVER)) {
+        header('HTTP/1.0 403 Forbidden');
+        die();
+    }
+    $args['user'] = $_SERVER['HTTP_X_REMOTE_USER'];
+    $args['pass'] = $_SERVER['HTTP_X_REMOTE_USER_TOKEN'];
+
+    $args['cookiecheck'] = false;
+    $args['valid'] = true;
+
+    return $args;
+  }
+
+  function logout($args) {
+    // Redirect to global SSO logout path.
+    $this->load_config();
+
+    $sso_logout_url = rcmail::get_instance()->config->get('sso_logout_url');
+    header("Location: " . $sso_logout_url, true);
+    exit;
+  }
+
+  function login($args)
+  {
+      header('Location: index.php');
+      exit();
+  }
+  function login_failed($args)
+  {
+      header('Location: sso.php');
+      exit();
+  }
+
+}