# MigaduAdmin

Administrate domain-level Migadu settings for multiple domains in one place:
sender denylist (blacklist), sender allowlist (whitelist), recipient denylist,
and spam controls.

The Go backend holds your Migadu credentials and talks to the
[Migadu JSON API](https://www.migadu.com/api/). The React UI only talks to this
application.

## Features

- Multi-domain list and detail views
- Shared denylist / allowlist / recipient deny lists with manual apply to all or selected domains
- Edit per-domain denylist / allowlist / recipient deny lists
- Edit domain spam aggressiveness and related toggles
- First registered local account becomes admin
- Optional [Pangolin](https://docs.pangolin.net/manage/access-control/forwarded-headers)
  SSO via `Remote-Email` (and related) headers from trusted proxies

## Requirements

- Go 1.25+ (or Go toolchain that can download it)
- Node.js 20+ (for building the UI)

## Quick start

```bash
make dev
```

On first run this will:
1. Create `.env` from `.env.example` with a generated `SESSION_SECRET`
2. Install frontend dependencies
3. Start the Go API and Vite UI together

Then open **http://127.0.0.1:5173**, create the first admin account, and edit
`.env` with your real `MIGADU_USER` / `MIGADU_API_KEY` before managing domains.

Production-style single binary:

```bash
# edit .env first
make build
make run
```

Open http://127.0.0.1:8080.

## Configuration

| Variable | Description |
| --- | --- |
| `MIGADU_USER` | Migadu account email (Basic Auth username) |
| `MIGADU_API_KEY` | Migadu API key |
| `MIGADU_BASE_URL` | Default `https://api.migadu.com/v1` |
| `LISTEN_ADDR` | Default `:8080` |
| `SESSION_SECRET` | Cookie signing secret (min 32 characters) |
| `DATABASE_PATH` | SQLite path for users/sessions |
| `AUTH_MODE` | `local`, `pangolin`, or `both` |
| `TRUSTED_PROXIES` | CIDRs allowed to set SSO headers |
| `REGISTRATION_OPEN` | Allow new local signups after bootstrap |
| `SSO_AUTO_PROVISION` | Auto-create users from trusted Pangolin emails |
| `COOKIE_SECURE` | Set `true` behind HTTPS |

Create a Migadu API key under **My Account → API Keys** in the Migadu admin UI.

## Pangolin SSO

When `AUTH_MODE` is `pangolin` or `both`, and the request comes from an IP in
`TRUSTED_PROXIES`, the backend trusts:

- `Remote-Email` (required)
- `Remote-User`, `Remote-Name`, `Remote-Role` (optional)

Identity headers from untrusted peers are stripped. Put Pangolin / Badger in
front of this app and add the proxy address to `TRUSTED_PROXIES`.

## API overview

| Method | Path | Notes |
| --- | --- | --- |
| GET | `/api/auth/status` | Registration open + auth mode |
| POST | `/api/auth/register` | Bootstrap / open registration |
| POST | `/api/auth/login` | Local login |
| POST | `/api/auth/logout` | Clear session |
| GET | `/api/auth/me` | Current user |
| GET | `/api/domains` | List domains (admin) |
| GET | `/api/domains/{domain}` | Domain settings (admin) |
| PATCH | `/api/domains/{domain}` | Update lists/spam fields (admin) |
| GET/POST | `/api/users` | List / create users (admin) |

## License

See [LICENSE](LICENSE).