From 0f1155b064d0a8201a66fdbd6bc7278a91bbf3f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 14 Apr 2025 00:52:23 +0200
Subject: [PATCH] rspamd: add allowedIPs option

---
 docs/rspamd-tuning.rst |  1 +
 mail-server/rspamd.nix | 19 ++++++++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/docs/rspamd-tuning.rst b/docs/rspamd-tuning.rst
index 545d2a5..4feb99d 100644
--- a/docs/rspamd-tuning.rst
+++ b/docs/rspamd-tuning.rst
@@ -100,6 +100,7 @@ example with `basic auth <https://docs.nginx.com/nginx/admin-guide/security-cont
   mailserver.rspamdWebUI = {
     enable = true;
     domain = "rspamd.example.com";
+    allowedIPs = [ "0.0.0.0" "::/0" ];
   };
 
   services.nginx.virtualHosts."${config.mailserver.rspamdWebUI.domain}".basicAuthFile = "/basic/auth/hashes/file";
diff --git a/mail-server/rspamd.nix b/mail-server/rspamd.nix
index 6a8cb15..eca2952 100644
--- a/mail-server/rspamd.nix
+++ b/mail-server/rspamd.nix
@@ -31,10 +31,18 @@ in
       example = true;
       description = ''
         Whether to enable the rspamd web ui on the configured domain.
+      '';
+    };
 
-        :::warning
-        Make sure to configure authentication for it!
-        :::
+    allowedIPs = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [ ];
+      example = [ "0.0.0.0" "::/0" ];
+      description = ''
+        List of IPs from which the web ui will be reachable *without* authentication.
+
+        When using a reverse proxy like nginx and another authentication method like basic auth or oatuh2-proxy is implemented,
+        than this can be set to ``[ "0.0.0.0" "::/0" ]`` to solely rely on the other authentication method.
       '';
     };
 
@@ -69,10 +77,7 @@ in
       inherit debug;
 
       overrides = lib.mkIf cfg.rspamdWebUI.enable {
-        "worker-controller.inc".text = ''
-          secure_ip = "0.0.0.0/0";
-          secure_ip = "::/0";
-        '';
+        "worker-controller.inc".text = lib.concatMapStringsSep "\n" (ip: ''secure_ip = "${ip}";'') cfg.rspamdWebUI.allowedIPs;
       };
 
       locals = {