mikrotik-spamlist

Go application that fetches IP threat intelligence feeds, converts them to MikroTik RouterOS .rsc address-list scripts, and publishes them as release assets on Forgejo.

Designed to run as a Kubernetes CronJob. A RouterOS scheduler script on the router periodically fetches and imports the generated lists.

Feeds

Feed	Source	List Name	~Entries
Tor exit nodes	check.torproject.org	tor_exit	1,850
Spamhaus DROP	spamhaus.org	spamhaus_drop	2,600
Spamhaus EDROP	spamhaus.org	spamhaus_drop	(merged)
IPsum Level 5	github.com/stamparm/ipsum	ipsum_threat	4,250
blocklist.de strongips	lists.blocklist.de	bl_strongips	290
blocklist.de SSH	lists.blocklist.de	bl_ssh	5,300
CINS Army	cinsscore.com	cins_army	6,500

Total: ~20k entries across 6 address lists.

Usage

# Preview generated .rsc files (no upload)
mikrotik-spamlist --dry-run

# Write .rsc files to a directory
mikrotik-spamlist --output-dir=/tmp/rsc

# Upload to Forgejo release (requires FORGEJO_TOKEN)
FORGEJO_TOKEN=your-token mikrotik-spamlist

Flags

Flag	Default	Description
--dry-run	false	Print .rsc output to stdout
--output-dir		Write .rsc files to directory
--forgejo-url	https://git.teixos.net	Forgejo instance base URL
--owner	yannick	Repository owner
--repo	mikrotik-spamlist	Repository name
--timeout	30s	HTTP timeout for feed fetching

Environment Variables

Variable	Required	Description
FORGEJO_TOKEN	Yes (for upload)	Forgejo personal access token with write:release scope

Building

# Build binary
make build

# Run tests
make test

# Build container image
make container

# See all targets
make help

Container Image

Multi-arch image (amd64/arm64) built via Forgejo Actions and pushed to the registry.

podman run --rm -e FORGEJO_TOKEN=xxx mikrotik-spamlist:latest

Kubernetes Deployment

Reference manifests are in deploy/. The CronJob runs daily at 02:00 UTC.

# Apply with kustomize
kubectl apply -k deploy/

# Create the token secret
kubectl create secret generic mikrotik-spamlist-token \
  --from-literal=token=<YOUR_FORGEJO_PAT> \
  -n mikrotik-spamlist

RouterOS Integration

See examples/routeros-setup.rsc for a complete example including:

• Fetch script to download .rsc files from the Forgejo release
• Scheduler to run daily
• RAW firewall rules referencing the address lists

The generated .rsc files are self-cleaning: each run removes all existing entries for a list before re-adding them.

How It Works

1. Fetches all configured threat feeds concurrently
2. Parses IPs/CIDRs from each feed (handles plain-text and Spamhaus formats)
3. Deduplicates entries per list (CIDR-aware: /32s covered by a broader prefix are removed)
4. Generates .rsc scripts with remove [find list=X] + add commands
5. Uploads .rsc files as assets to a rolling latest release on Forgejo

If a feed is unavailable, the run continues with the feeds that succeeded.

Example Output

# tor_exit - Generated by mikrotik-spamlist at 2024-01-15T02:00:00Z
# Sources: https://check.torproject.org/torbulkexitlist
# Entries: 1847

/ip/firewall/address-list
remove [find list=tor_exit]

add list=tor_exit address=1.2.3.4
add list=tor_exit address=5.6.7.0/24
...