gregdotca/csp-to-email repository overview

⁠CSP to Email

A small web service that receives your site's Content Security Policy (CSP) violation reports and emails you a digest of them every few minutes, grouped by page and violation. There's no UI or dashboard.

• Accepts both report formats browsers send: report-uri and the Reporting API (report-to)
• Queues reports in SQLite, so a slow or unreachable mail server never delays the browser
• Marks violations it hasn't reported before as [NEW], and retries when the mail server is down
• Limits abuse with a host allowlist, a per-IP rate limit, and a cap on stored reports
• Strips query strings and fragments from stored URLs, and never writes client IPs to disk

Full instructions: https://github.com/gregdotca/csp-to-email⁠

⁠Quick start

The image runs as two services that share a data volume: web receives reports, and worker emails the digests.

x-csp2e-env: &csp2e-env
  CSP2E_SERVER: mail.example.com
  CSP2E_PROTOCOL: starttls
  CSP2E_PORT: "587"
  CSP2E_USERNAME: user
  CSP2E_PASSWORD: pass
  CSP2E_SENDER: [email protected]
  CSP2E_RECEIVER: [email protected]
  CSP2E_ALLOWED_HOSTS: "example.com,www.example.com"
  CSP2E_PROXY_HOPS: "1"

services:
  web:
    image: gregdotca/csp-to-email:latest
    ports:
      - "127.0.0.1:5000:5000"
    environment: *csp2e-env
    volumes:
      - csp-to-email-data:/data
    restart: unless-stopped

  worker:
    image: gregdotca/csp-to-email:latest
    command: ["python", "worker.py"]
    environment: *csp2e-env
    volumes:
      - csp-to-email-data:/data
    restart: unless-stopped
    stop_grace_period: 120s

volumes:
  csp-to-email-data:

Put a reverse proxy with HTTPS in front of the web service, then point your CSP's report-uri and report-to at it. The README covers the reverse proxy setup, the headers to add to your site, a test report to check it works, healthchecks, and every setting.

⁠Tags

• latest, 0, 0.1, 0.1.0

Images are built for linux/amd64, linux/arm64, and linux/arm/v7. The containers run as a non-root user (UID and GID 10001).

⁠License

MIT