In between commit, updated matrix and optimized mailu

roles/web-app-mailu/tasks/01_core.yml

@@ -8,6 +8,21 @@
     success_msg: "MAILU_HOSTNAMES is valid."
   when: MODE_ASSERT | bool
 
+- name: "load variables from {{ DOCKER_VARS_FILE }}"
+  include_vars: "{{ DOCKER_VARS_FILE }}"
+
+- name: Ensure Rspamd overrides directory exists (host)
+  file:
+    path: "{{ MAILU_RSPAMD_HOST_DIR }}"
+    state: directory
+    mode: "0755"
+
+- name: Render ratelimit.conf
+  template:
+    src: ratelimit.conf.j2
+    dest: "{{ MAILU_RSPAMD_HOST_FILE }}"
+    mode: "0644"
+
 - name: "Mailu Docker and Webserver Setup"
   block:
   - name: "load docker, db and proxy for {{ application_id }}"

roles/web-app-mailu/templates/docker-compose.yml.j2

@@ -97,7 +97,7 @@
     volumes:
       - "filter:/var/lib/rspamd"
       - "dkim:/dkim"
-      - "{{ docker_compose.directories.volumes }}overrides/rspamd:/overrides:ro"
+      - "{{ MAILU_RSPAMD_HOST_DIR }}:/overrides:ro"
     depends_on:
       - front
       - redis

roles/web-app-mailu/templates/ratelimit.conf.j2

@@ -0,0 +1,24 @@
+# AUTOGENERATED by Ansible – Rspamd ratelimits
+# Mount path in container: /overrides/ratelimit.conf  (read-only)
+
+rates {
+  {# Optional global defaults for authenticated SMTP senders #}
+  authenticated = {
+    bucket = [{
+      burst = {{ MAILU_RSPAMD_LIMITS_DEFAULTS.BURST | int }};
+      rate  = "{{ MAILU_RSPAMD_LIMITS_DEFAULTS.RATE }}";
+    }];
+  }
+
+  {# Per-user limits: require both .limits.rate and .limits.burst #}
+  {% for uname, u in users.items() %}
+    {% if (u.limits.rate | default(false) and u.limits.burst | default(false)) %}
+  "user={{ u.email }}" = {
+    bucket = [{
+      burst = {{ u.limits.burst | int }};
+      rate  = "{{ u.limits.rate }}";
+    }];
+  };
+    {% endif %}
+  {% endfor %}
+}

roles/web-app-mailu/vars/main.yml

@@ -58,3 +58,10 @@ MAILU_DMARC_RUF:                      "{{ applications | get_app_conf(applicatio
 
 MAILU_DKIM_KEY_FILE:                  "{{ MAILU_DOMAIN }}.dkim.key"
 MAILU_DKIM_KEY_PATH:                  "/dkim/{{ MAILU_DKIM_KEY_FILE }}"
+
+## Rspamd
+MAILU_RSPAMD_HOST_DIR:                "{{ [ docker_compose.directories.volumes, 'overrides/rspamd' ] | path_join }}"
+MAILU_RSPAMD_HOST_FILE:               "{{ [ MAILU_RSPAMD_HOST_DIR,'ratelimit.conf' ] | path_join }}"
+MAILU_RSPAMD_LIMITS_DEFAULTS:
+  RATE:   "30 / 1min"
+  BURST:  50