ifdef::manvolnum[]
pmgquarantineproxy(8)
=====================
:pmg-toplevel:

NAME
----

pmgquarantineproxy - Proxmox Mail Gateway User Quarantine Daemon


SYNOPSIS
--------

include::generated/pmgquarantineproxy.8-synopsis.adoc[]

DESCRIPTION
-----------
endif::manvolnum[]

ifndef::manvolnum[]
pmgquarantineproxy - Proxmox Mail Gateway User Quarantine Daemon
===============================================================
endif::manvolnum[]

This daemon serves only the user quarantine, on a port of its own. It exists so
that the quarantine can be reached by users without also exposing the
management API, which `pmgproxy` serves on the same socket as the quarantine.

Like `pmgproxy` it runs as user `www-data` with very limited permissions, and
forwards operations that need more to the local `pmgdaemon`.

Every request for a path outside the quarantine is refused before
authentication happens. A stolen or forged quarantine ticket therefore cannot
reach node, configuration or access management endpoints through this daemon.
The management interface itself is not served here at all; the bare host
redirects to `/quarantine`.

The daemon is not enabled after installation. Enable it deliberately, once the
port, the certificate and the access control below are configured:

----
systemctl enable --now pmgquarantineproxy
----

Port and certificate
--------------------

Both are read from the `spamquar` section of `/etc/pmg/pmg.conf`, not from
`/etc/default/pmgquarantineproxy`:

`listenport`::
The port this daemon binds to. Defaults to 8007.

`listencert`::
The certificate it serves, containing both certificate and key. Defaults to
`/etc/pmg/pmg-api.pem`. Use a separate certificate when the public quarantine
hostname differs from the management hostname.

Note that `spamquar` also has a `port` option. That one is unrelated to this
daemon: it only shapes the links in the daily spam report. Set it as well when
users reach the quarantine on a different port than `listenport`, for example
behind a reverse proxy. With protocol `https` and port 443, no port is added to
those links.

Restricting the management interface
------------------------------------

Splitting the quarantine off is only useful if the management interface is then
actually restricted. Set `LISTEN_IP` in `/etc/default/pmgproxy` to an internal
address, and restart `pmgproxy`:

----
systemctl restart pmgproxy.service
----

Host based Access Control
-------------------------

The same ``apache2''-like access control lists as for `pmgproxy` are read from
`/etc/default/pmgquarantineproxy`, using `ALLOW_FROM`, `DENY_FROM` and
`POLICY`. `LISTEN_IP`, `CIPHERS`, `CIPHERSUITES`, `HONOR_CIPHER_ORDER`,
`DHPARAMS`, `DISABLE_TLS_1_2`, `DISABLE_TLS_1_3` and `COMPRESSION` behave as
they do for `pmgproxy`; see the `pmgproxy` manual page for details.

WARNING: This daemon is meant to be reachable from untrusted networks. Keep the
access control here as tight as the deployment allows.

ifdef::manvolnum[]
include::pmg-copyright.adoc[]
endif::manvolnum[]
