Squid
a79cb61104
Build the Go API and React UI for managing domain denylist/allowlist/recipient deny and spam settings, plus shared lists that import/apply across domains with wildcard compaction, entry verification, and Migadu-friendly list encoding (including per-domain recipient filtering and rejection bisect on apply).
96 lines
3.0 KiB
Markdown
96 lines
3.0 KiB
Markdown
# MigaduAdmin
|
|
|
|
Administrate domain-level Migadu settings for multiple domains in one place:
|
|
sender denylist (blacklist), sender allowlist (whitelist), recipient denylist,
|
|
and spam controls.
|
|
|
|
The Go backend holds your Migadu credentials and talks to the
|
|
[Migadu JSON API](https://www.migadu.com/api/). The React UI only talks to this
|
|
application.
|
|
|
|
## Features
|
|
|
|
- Multi-domain list and detail views
|
|
- Shared denylist / allowlist / recipient deny lists with manual apply to all or selected domains
|
|
- Edit per-domain denylist / allowlist / recipient deny lists
|
|
- Edit domain spam aggressiveness and related toggles
|
|
- First registered local account becomes admin
|
|
- Optional [Pangolin](https://docs.pangolin.net/manage/access-control/forwarded-headers)
|
|
SSO via `Remote-Email` (and related) headers from trusted proxies
|
|
|
|
## Requirements
|
|
|
|
- Go 1.25+ (or Go toolchain that can download it)
|
|
- Node.js 20+ (for building the UI)
|
|
|
|
## Quick start
|
|
|
|
```bash
|
|
make dev
|
|
```
|
|
|
|
On first run this will:
|
|
1. Create `.env` from `.env.example` with a generated `SESSION_SECRET`
|
|
2. Install frontend dependencies
|
|
3. Start the Go API and Vite UI together
|
|
|
|
Then open **http://127.0.0.1:5173**, create the first admin account, and edit
|
|
`.env` with your real `MIGADU_USER` / `MIGADU_API_KEY` before managing domains.
|
|
|
|
Production-style single binary:
|
|
|
|
```bash
|
|
# edit .env first
|
|
make build
|
|
make run
|
|
```
|
|
|
|
Open http://127.0.0.1:8080.
|
|
|
|
## Configuration
|
|
|
|
| Variable | Description |
|
|
| --- | --- |
|
|
| `MIGADU_USER` | Migadu account email (Basic Auth username) |
|
|
| `MIGADU_API_KEY` | Migadu API key |
|
|
| `MIGADU_BASE_URL` | Default `https://api.migadu.com/v1` |
|
|
| `LISTEN_ADDR` | Default `:8080` |
|
|
| `SESSION_SECRET` | Cookie signing secret (min 32 characters) |
|
|
| `DATABASE_PATH` | SQLite path for users/sessions |
|
|
| `AUTH_MODE` | `local`, `pangolin`, or `both` |
|
|
| `TRUSTED_PROXIES` | CIDRs allowed to set SSO headers |
|
|
| `REGISTRATION_OPEN` | Allow new local signups after bootstrap |
|
|
| `SSO_AUTO_PROVISION` | Auto-create users from trusted Pangolin emails |
|
|
| `COOKIE_SECURE` | Set `true` behind HTTPS |
|
|
|
|
Create a Migadu API key under **My Account → API Keys** in the Migadu admin UI.
|
|
|
|
## Pangolin SSO
|
|
|
|
When `AUTH_MODE` is `pangolin` or `both`, and the request comes from an IP in
|
|
`TRUSTED_PROXIES`, the backend trusts:
|
|
|
|
- `Remote-Email` (required)
|
|
- `Remote-User`, `Remote-Name`, `Remote-Role` (optional)
|
|
|
|
Identity headers from untrusted peers are stripped. Put Pangolin / Badger in
|
|
front of this app and add the proxy address to `TRUSTED_PROXIES`.
|
|
|
|
## API overview
|
|
|
|
| Method | Path | Notes |
|
|
| --- | --- | --- |
|
|
| GET | `/api/auth/status` | Registration open + auth mode |
|
|
| POST | `/api/auth/register` | Bootstrap / open registration |
|
|
| POST | `/api/auth/login` | Local login |
|
|
| POST | `/api/auth/logout` | Clear session |
|
|
| GET | `/api/auth/me` | Current user |
|
|
| GET | `/api/domains` | List domains (admin) |
|
|
| GET | `/api/domains/{domain}` | Domain settings (admin) |
|
|
| PATCH | `/api/domains/{domain}` | Update lists/spam fields (admin) |
|
|
| GET/POST | `/api/users` | List / create users (admin) |
|
|
|
|
## License
|
|
|
|
See [LICENSE](LICENSE).
|