ForkMaster/nixos-mailserver
1
0
Fork 0
mirror of https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git synced 2025-05-04 17:50:51 +05:00
Code Issues Packages Projects Releases Wiki Activity

rspamd: add allowedIPs option

Browse Source
This commit is contained in:
Sandro Jäckel 2025-04-14 00:52:23 +02:00
parent 196b9b61e5
commit 0f1155b064
No known key found for this signature in database
GPG Key ID: 3AF5A43A3EECC2E5
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/rspamd-tuning.rst
View File

@ -100,6 +100,7 @@ example with `basic auth <https://docs.nginx.com/nginx/admin-guide/security-cont
mailserver.rspamdWebUI = { mailserver.rspamdWebUI = {
enable = true; enable = true;
domain = "rspamd.example.com"; domain = "rspamd.example.com";
allowedIPs = [ "0.0.0.0" "::/0" ];
}; };
services.nginx.virtualHosts."${config.mailserver.rspamdWebUI.domain}".basicAuthFile = "/basic/auth/hashes/file"; services.nginx.virtualHosts."${config.mailserver.rspamdWebUI.domain}".basicAuthFile = "/basic/auth/hashes/file";

19
mail-server/rspamd.nix
View File

@ -31,10 +31,18 @@ in
example = true; example = true;
description = '' description = ''
Whether to enable the rspamd web ui on the configured domain. Whether to enable the rspamd web ui on the configured domain.
'';
};
:::warning allowedIPs = lib.mkOption {
Make sure to configure authentication for it! type = with lib.types; listOf str;
::: default = [ ];
example = [ "0.0.0.0" "::/0" ];
description = ''
List of IPs from which the web ui will be reachable *without* authentication.
When using a reverse proxy like nginx and another authentication method like basic auth or oatuh2-proxy is implemented,
than this can be set to ``[ "0.0.0.0" "::/0" ]`` to solely rely on the other authentication method.
''; '';
}; };
@ -69,10 +77,7 @@ in
inherit debug; inherit debug;
overrides = lib.mkIf cfg.rspamdWebUI.enable { overrides = lib.mkIf cfg.rspamdWebUI.enable {
"worker-controller.inc".text = '' "worker-controller.inc".text = lib.concatMapStringsSep "\n" (ip: ''secure_ip = "${ip}";'') cfg.rspamdWebUI.allowedIPs;
secure_ip = "0.0.0.0/0";
secure_ip = "::/0";
'';
}; };
locals = { locals = {