MigaduAdmin

Administrate domain-level Migadu settings for multiple domains in one place: sender denylist (blacklist), sender allowlist (whitelist), recipient denylist, and spam controls.

The Go backend holds your Migadu credentials and talks to the Migadu JSON API. The React UI only talks to this application.

Features

• Multi-domain list and detail views
• Shared denylist / allowlist / recipient deny lists with manual apply to all or selected domains
• Edit per-domain denylist / allowlist / recipient deny lists
• Edit domain spam aggressiveness and related toggles
• First registered local account becomes admin
• Optional Pangolin SSO via Remote-Email (and related) headers from trusted proxies

Requirements

• Go 1.25+ (or Go toolchain that can download it)
• Node.js 20+ (for building the UI)

Quick start

make dev

On first run this will:

1. Create .env from .env.example with a generated SESSION_SECRET
2. Install frontend dependencies
3. Start the Go API and Vite UI together

Then open http://127.0.0.1:5173, create the first admin account, and edit .env with your real MIGADU_USER / MIGADU_API_KEY before managing domains.

Production-style single binary:

# edit .env first
make build
make run

Open http://127.0.0.1:8080.

Configuration

Variable	Description
MIGADU_USER	Migadu account email (Basic Auth username)
MIGADU_API_KEY	Migadu API key
MIGADU_BASE_URL	Default https://api.migadu.com/v1
LISTEN_ADDR	Default :8080
SESSION_SECRET	Cookie signing secret (min 32 characters)
DATABASE_PATH	SQLite path for users/sessions
AUTH_MODE	local, pangolin, or both
TRUSTED_PROXIES	CIDRs allowed to set SSO headers
REGISTRATION_OPEN	Allow new local signups after bootstrap
SSO_AUTO_PROVISION	Auto-create users from trusted Pangolin emails
COOKIE_SECURE	Set true behind HTTPS

Create a Migadu API key under My Account → API Keys in the Migadu admin UI.

Pangolin SSO

When AUTH_MODE is pangolin or both, and the request comes from an IP in TRUSTED_PROXIES, the backend trusts:

• Remote-Email (required)
• Remote-User, Remote-Name, Remote-Role (optional)

Identity headers from untrusted peers are stripped. Put Pangolin / Badger in front of this app and add the proxy address to TRUSTED_PROXIES.

API overview

Method	Path	Notes
GET	/api/auth/status	Registration open + auth mode
POST	/api/auth/register	Bootstrap / open registration
POST	/api/auth/login	Local login
POST	/api/auth/logout	Clear session
GET	/api/auth/me	Current user
GET	/api/domains	List domains (admin)
GET	/api/domains/{domain}	Domain settings (admin)
PATCH	/api/domains/{domain}	Update lists/spam fields (admin)
GET/POST	/api/users	List / create users (admin)

License

See LICENSE.