webui_rspamd

    # Rspamd WebUI
    rewrite ^(/save.+)$ /rspamd$1 last;
    location /rspamd/ {
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-XSS-Protection "1; mode=block";

        proxy_pass         http://rspamd.controller.ip:11334/;
        proxy_redirect     http://rspamd.controller.ip:11334/ default;
        proxy_read_timeout 60s;

        proxy_set_header Host            $host;
        proxy_set_header X-Real-IP       $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # If you want to allow access from restricted IPs:
        #allow xxx.xxx.xxx.xxx;
        allow yyy.yyy.yyy.yyy/yy;
        deny  all;
    }

Thanks, used it for mailcow-dockerized. :-)