diff --git a/README.md b/README.md
index 57ac61d..9abfe4a 100644
--- a/README.md
+++ b/README.md
@@ -42,26 +42,26 @@ Setting up `lohr` should be quite simple:
     configuration](https://rocket.rs/v0.4/guide/configuration/).
 
 2.  Export a secret variable:
-    
+
         $ export LOHR_SECRET=42 # please don't use this secret
 
 3.  Run `lohr`:
-    
+
         $ cargo run # or `cargo run --release` for production usage
 
 4.  Configure your favorite git server to send a webhook to `lohr`'s address on
     every push event.
-    
+
     I used [Gitea's webhooks format](https://docs.gitea.io/en-us/webhooks/), but
     I **think** they're similar to GitHub and GitLab's webhooks, so these should
     work too! (If they don't, **please** file an issue!)
-    
+
     Don't forget to set the webhook secret to the one you chose above.
 
 5.  Add a `.lohr` file containing the remotes you want to mirror this repo to:
-    
+
         git@github.com:you/your_repo
-    
+
     and push it. That's it! `lohr` is mirroring your repo now.
 
 
@@ -96,8 +96,8 @@ default_remotes:
 additional_remotes:
     - "git@git.sr.ht:~user"
 
-blacklist:
-    - "private-.*"
+filters:
+    - FIXME:
 ```
 
 - `default_remotes` is a list of remotes to use if no `.lohr` file is found in a
diff --git a/src/main.rs b/src/main.rs
index 46ee9f0..6bf0d1d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -34,12 +34,15 @@ fn gitea_webhook(
     config: State<GlobalSettings>,
 ) -> Status {
     if config
-        .blacklist
+        .filters
         .iter()
-        .any(|re| re.is_match(&payload.repository.full_name))
+        // Find first filter that matches the given destination
+        .find(|filter| filter.destination.as_ref().map_or(false, |re| re.is_match(&payload.repository.full_name)))
+        // Default to mirroring, unless told not to
+        .map_or(true, |filter| filter.mirror)
     {
         info!(
-            "Ignoring webhook for repo {} which is blacklisted",
+            "Ignoring webhook for repo {} which is marked as not mirrored",
             payload.repository.full_name
         );
         return Status::Ok;
diff --git a/src/settings.rs b/src/settings.rs
index ef55940..8b91376 100644
--- a/src/settings.rs
+++ b/src/settings.rs
@@ -10,8 +10,29 @@ pub(crate) struct GlobalSettings {
     /// List of remote stems to use for every repository
     #[serde(default)]
     pub additional_remotes: Vec<RepoUrl>,
-    /// List of regexes, if a repository's name matches any of the, it is not mirrored by `lohr`
-    /// even if it contains a `.lorh` file.
-    #[serde(with = "serde_regex", default)]
-    pub blacklist: Vec<regex::Regex>,
+    /// List of filters to blacklist repositories, or modify push options on specific remotes.
+    /// Only the first matching filter is applied, so order is important.
+    #[serde(default)]
+    pub filters: Vec<FilterSettings>,
+}
+
+#[derive(Clone, Default, Deserialize)]
+pub(crate) struct FilterSettings {
+    /// Match on the source remote
+    #[serde(with = "serde_regex", default)]
+    pub source: Option<regex::Regex>,
+    /// Match on the destination remote
+    #[serde(with = "serde_regex", default)]
+    pub destination: Option<regex::Regex>,
+    /// Whether to mirror the repository or not
+    #[serde(default = "default_true")]
+    pub mirror: bool,
+    /// Push options to be used for the matched remote
+    #[serde(default)]
+    pub push_options: Vec<String>,
+}
+
+// Workaround for https://github.com/serde-rs/serde/issues/368
+fn default_true() -> bool {
+    true
 }