mixandClaude Opus 5.5
31c2b50457
test / test (push) Canceled after 0s
rspamd 3.11.1's milter_headers skips its verdict routines - removes none of the sender's X-Spamd-Result / X-Rspamd-Action, adds none - for a client it counts as local (loopback, a unix socket, local_addrs: the private ranges) or one that authenticated (skip_local, skip_authenticated, both on by default; milter_headers.lua skip_wanted(), lua_ip.c lua_ip_is_local()). The custom routine that signs X-SelfPost-Filter is never put through skip_wanted(), so it signed the sender's own verdict, and Inbound > Log showed it as rspamd's. Every sender is private when Docker's proxy relays port 25 from the bridge gateway. Both options set to false. Tried 2026-10-14 in a throwaway rspamd/rspamd:3.11.1-3 on the test server (rspamc --ucl, a message carrying its own verdict headers): old config, from 10.0.0.5 and as an authenticated user, the milter reply removed and added neither and added the signature; new config, both removed and rspamd's own added, as from 203.0.113.9. Also: the sender rules take the envelope only (extract_from = "smtp"; by default a bounce's From: header is used - tried: a bounce whose From: domain is denied was refused before, is not now; a denied sender is refused either way); the image pinned to 3.11.1-3, the build read (3.11 and 3.11.1 move with each rebuild); the prefilter lines no longer read go. architecture.md and security.md say so. Assumptions C-R7, B-R1, C-R4, C-R12, C-R5. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
43 lines
2.0 KiB
YAML
43 lines
2.0 KiB
YAML
# Optional anti-spam sidecar for inbound relay (docs/plans/inbound-relay.md).
|
|
#
|
|
# SelfPost does not ship or start an anti-spam engine. This fragment brings up
|
|
# rspamd next to SelfPost and points the inbound smtpd milter at it. Merge it
|
|
# only when you want filtering on port 25:
|
|
#
|
|
# docker compose -f docker-compose.yml -f antispam/docker-compose.antispam.yml up -d
|
|
#
|
|
# Requires INBOUND_RELAY_ENABLE=true in .env. The milter sees the real client
|
|
# IP, HELO and PTR — unlike the upstream, which only sees SelfPost's address.
|
|
#
|
|
# The rspamd image is pinned to one build, 3.11.1-3 - "3.11" and "3.11.1"
|
|
# move with each rebuild (Docker Hub rspamd/rspamd tags 3.11.1-0 ... -3) -
|
|
# and it is the build the comments in antispam/rspamd/ were read against;
|
|
# bump it deliberately, and read them again. Default milter action is fail-open (accept) so a down sidecar
|
|
# does not block backup-MX. Set INBOUND_ANTISPAM_MILTER_ACTION=tempfail to
|
|
# defer instead.
|
|
|
|
services:
|
|
selfpost:
|
|
environment:
|
|
INBOUND_RELAY_ENABLE: "${INBOUND_RELAY_ENABLE:-true}"
|
|
INBOUND_ANTISPAM_MILTER: "${INBOUND_ANTISPAM_MILTER:-inet:antispam:11332}"
|
|
INBOUND_ANTISPAM_MILTER_ACTION: "${INBOUND_ANTISPAM_MILTER_ACTION:-accept}"
|
|
depends_on:
|
|
- antispam
|
|
|
|
antispam:
|
|
# The milter: rspamd 3.11.1, conf/worker-proxy.inc, "milter = yes" for the
|
|
# rspamd_proxy worker, which the image binds to *:11332 (rspamd-docker
|
|
# v3.11.1+3, patches/rspamd-docker-config.diff), and runs as uid 11333
|
|
# (its Dockerfile, USER 11333:11333).
|
|
image: rspamd/rspamd:3.11.1-3
|
|
restart: unless-stopped
|
|
# No host ports: only SelfPost talks to the milter on the compose network.
|
|
volumes:
|
|
# The verdict headers SelfPost's inbound journal reads.
|
|
- ./antispam/rspamd/milter_headers.conf:/etc/rspamd/local.d/milter_headers.conf:ro
|
|
# The allow and deny lists kept in the panel: the rules, and the files
|
|
# SelfPost writes them to.
|
|
- ./antispam/rspamd/multimap.conf:/etc/rspamd/local.d/multimap.conf:ro
|
|
- ./data/antispam:/etc/rspamd/selfpost:ro
|