While a reverse proxy has indeed other advantages and I’d recommend it (WAF/…), in a situation where this isn’t possible but still desirable, you can put sth like this:
location /admin {
allow 1.2.3.4;
allow 2.3.4.5;
allow 3.4.5.6;
deny all;
}
location /domainadmin {
allow 1.2.3.4;
allow 2.3.4.5;
allow 3.4.5.6;
deny all;
}
into data/conf/nginx/site.ip-restrictions.custom and it will be merged into the Nginx container config as shown via docker compose exec nginx-mailcow nginx -T after container restart.
The changes survive updates as data/conf/nginx/*.custom is in .gitignore. It’s also documented here.
Note that this isn’t trivial for other paths (e.g. /SOGo/so) afaik. Regex-matcher e.g. won’t work for already defined nginx instructions, top-level overrides will conflict with mailcow defaults etc. Not saying it can’t be done, but ymmv.
I’d also recommend 2FA and so on, but this is an additional security measure that’s worthwhile and easy to implement. Sth. to be monitored on updates nevertheless… Updated this thread as it was the last such issue and turns up high in search results.