Rspamd - How to provide changes for settings.conf?

[loeffelpan]

I would like to provide some additional settings.conf for rspamd.
With my configuration DMS relays mails for simplelogin aliases to another container and gets them back for delivery to my real account.

Something like this would achieve that rspamd wouldn't apply any filter when mails coming back from that other container.

whitelist {
	priority = high;
	ip = 172.30.3.10/32;
	want_spam = yes;
}

Any way to merge this into rspamd's config without using override.d which replaces default config of DMS?
The only way seems to be user-patches.sh which is a bit hacky. Hopefully I missed something.

Thanks for any help in advance.

[polarathene]

It's been some time since I was familiar with our rspamd integration support (DMS Rspamd override docs) and how rspamd's own config system applies.

It seems you're probably asking a question similar to this existing one? (unanswered)

I am pretty sure I have run into this concern and resolved it before, but I am not sure if I have notes about it online. I may have been writing up detailed information to improve the docs on this concern at one point but lost it due to a system crash 😓

There's a chance that I have the information somewhere else, but I don't have the time to spare assisting atm. Please do share if you resolve your issue (and info on how, so anyone else stumbling here can benefit).

UPDATE: I found this writeup of mine which was probably what I had in mind to polish into proper docs.

---

Here is some scattered comments/posts I've authored with plenty of info provided to reproduce/reference that may be a helpful resource to you:

• Using official rspamd image for troubleshooting config adjustments prior to worrying about involving DMS (keep it simple):
  • How do the symbols `FROM_NEQ_ENVFROM` and `FORGED_SENDER` differ? rspamd/rspamd#5749 (technical insights / commands)
  • `554 5.7.1 Matched map` - Can a rule provide a custom rejection message instead? rspamd/rspamd#5350 (additionally demonstrates troubleshooting applying an override via override.d/)
• Other references using DMS:
  • bug report: Rspamd crashing in loop from setup config dkim #4579 (useful reference for DMS Rspamd basic compose.yaml example)
  • https://github.com/orgs/docker-mailserver/discussions/4348#discussioncomment-12106141 (useful troubleshooting insights/advice with getmail + rspamd integration)

---

The only way seems to be user-patches.sh which is a bit hacky.

It's a fallback solution for anything that doesn't warrant upstream support, with the caveat that it may not always integrate smoothly (future upgrade may break it, or something like check-for-changes.sh service might overwrite config at runtime).

After testing a user-patches.sh workaround for a while, or confirming through the DMS script source code that there's nothing that'd conflict, just pay attention to our changelog when upgrading the image to avoid mishaps. Most changes are described there, including internal ones.

Any way to merge this into rspamd's config without using override.d which replaces default config of DMS?

Are you sure that's the case? As our docs should explain, override.d/ is an Rspamd convention, DMS is AFAIK making it available for you by copying from your DMS config volume to the internal Rspamd override.d/

• DMS internal custom config changes to rspamd should be handled by us using local.d/ IIRC. While your custom overrides should do as you'd expect (override), but AFAIK the scope of the override depends on that you're targeting.
• This behaviour should be covered in upstream rspamd docs, and possibly in my override.d/ upstream discussion link of my own, I don't think it wiped everything from the override itself, some overrides should merge/overlay.

My suggestion would be to take an approach like I did in my linked resources, where you can verify config changes are applied correctly with the official rspamd image (NOTE: Uses a different config location than DMS). Then compare to DMS to find out what differs/conflicts?

[loeffelpan]

Thank you for your detailed answer.

Are you sure that's the case? As our docs should explain, override.d/ is an Rspamd convention, DMS is AFAIK making it available for you by copying from your DMS config volume to the internal Rspamd override.d/

Never tried. The Rspamd docs are pretty clear.
https://docs.rspamd.com/faq/#what-is-the-difference-between-locald-and-overrided
Says Replaces defaults. Entire sections are overwritten. and additionally the examples show what I would expect.

But I tried and however - configs are merged.
That's not intended according the docs (see above). So I will keep an eye on it.

*** Section settings ***
authenticated {
    priority = "high";
    authenticated = true;
    apply {
        groups_enabled [
            "dkim",
        ]
    }
}
whitelist {
    priority = "high";
    ip = "172.30.3.10/32";
    want_spam = true;
}
*** End of section settings ***

[polarathene]

The Rspamd docs are pretty clear.
https://docs.rspamd.com/faq/#what-is-the-difference-between-locald-and-overrided
Says Replaces defaults. Entire sections are overwritten. and additionally the examples show what I would expect.

It's been a while but I recall the rspamd docs discuss overriding in several pages and aren't exactly consistent.

Regardless AFAIK in this case whitelist is a section itself? So you've replaced that entire section value ({ ... }) via an override. Perhaps your interpretation was the entire module config would be replaced, such as authenticated, even though you only supplied whitelist.