Add Migadu domain admin with shared lists, compaction, and safer apply.

Build the Go API and React UI for managing domain denylist/allowlist/recipient deny and spam settings, plus shared lists that import/apply across domains with wildcard compaction, entry verification, and Migadu-friendly list encoding (including per-domain recipient filtering and rejection bisect on apply).
2026-07-26 21:50:26 +02:00
parent 930f1f7b69
commit a79cb61104
55 changed files with 7600 additions and 1 deletions
@@ -1,3 +1,95 @@
 # MigaduAdmin

-Administrate settings for several domains in one place.
+Administrate domain-level Migadu settings for multiple domains in one place:
+sender denylist (blacklist), sender allowlist (whitelist), recipient denylist,
+and spam controls.
+
+The Go backend holds your Migadu credentials and talks to the
+[Migadu JSON API](https://www.migadu.com/api/). The React UI only talks to this
+application.
+
+## Features
+
+- Multi-domain list and detail views
+- Shared denylist / allowlist / recipient deny lists with manual apply to all or selected domains
+- Edit per-domain denylist / allowlist / recipient deny lists
+- Edit domain spam aggressiveness and related toggles
+- First registered local account becomes admin
+- Optional [Pangolin](https://docs.pangolin.net/manage/access-control/forwarded-headers)
+  SSO via `Remote-Email` (and related) headers from trusted proxies
+
+## Requirements
+
+- Go 1.25+ (or Go toolchain that can download it)
+- Node.js 20+ (for building the UI)
+
+## Quick start
+
+```bash
+make dev
+```
+
+On first run this will:
+1. Create `.env` from `.env.example` with a generated `SESSION_SECRET`
+2. Install frontend dependencies
+3. Start the Go API and Vite UI together
+
+Then open **http://127.0.0.1:5173**, create the first admin account, and edit
+`.env` with your real `MIGADU_USER` / `MIGADU_API_KEY` before managing domains.
+
+Production-style single binary:
+
+```bash
+# edit .env first
+make build
+make run
+```
+
+Open http://127.0.0.1:8080.
+
+## Configuration
+
+| Variable | Description |
+| --- | --- |
+| `MIGADU_USER` | Migadu account email (Basic Auth username) |
+| `MIGADU_API_KEY` | Migadu API key |
+| `MIGADU_BASE_URL` | Default `https://api.migadu.com/v1` |
+| `LISTEN_ADDR` | Default `:8080` |
+| `SESSION_SECRET` | Cookie signing secret (min 32 characters) |
+| `DATABASE_PATH` | SQLite path for users/sessions |
+| `AUTH_MODE` | `local`, `pangolin`, or `both` |
+| `TRUSTED_PROXIES` | CIDRs allowed to set SSO headers |
+| `REGISTRATION_OPEN` | Allow new local signups after bootstrap |
+| `SSO_AUTO_PROVISION` | Auto-create users from trusted Pangolin emails |
+| `COOKIE_SECURE` | Set `true` behind HTTPS |
+
+Create a Migadu API key under **My Account → API Keys** in the Migadu admin UI.
+
+## Pangolin SSO
+
+When `AUTH_MODE` is `pangolin` or `both`, and the request comes from an IP in
+`TRUSTED_PROXIES`, the backend trusts:
+
+- `Remote-Email` (required)
+- `Remote-User`, `Remote-Name`, `Remote-Role` (optional)
+
+Identity headers from untrusted peers are stripped. Put Pangolin / Badger in
+front of this app and add the proxy address to `TRUSTED_PROXIES`.
+
+## API overview
+
+| Method | Path | Notes |
+| --- | --- | --- |
+| GET | `/api/auth/status` | Registration open + auth mode |
+| POST | `/api/auth/register` | Bootstrap / open registration |
+| POST | `/api/auth/login` | Local login |
+| POST | `/api/auth/logout` | Clear session |
+| GET | `/api/auth/me` | Current user |
+| GET | `/api/domains` | List domains (admin) |
+| GET | `/api/domains/{domain}` | Domain settings (admin) |
+| PATCH | `/api/domains/{domain}` | Update lists/spam fields (admin) |
+| GET/POST | `/api/users` | List / create users (admin) |
+
+## License
+
+See [LICENSE](LICENSE).