devsam/image
1
0
Fork 3
Code Issues 1 Pull Requests Releases 1 Wiki Activity

Generalize reverse proxy source allowlist

Browse Source
This commit is contained in:
Hide_D
2026-08-06 11:32:40 +00:00
parent 87cc2977d5
commit 5078f6f3b1
6 changed files with 55 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -7
View File
@@ -39,11 +39,14 @@ remote branch tip, rejects dirty or non-fast-forward updates, and serializes all
Git changes. The initial and only allowed branch is `master` unless
`IMAGE_ALLOWED_BRANCHES` is explicitly expanded.
The current Caddy host reaches this server from `172.30.1.75`. Keep the observed
source in the untracked `.env`; re-check it whenever Caddy networking changes.
The published port binds all server interfaces, so production also needs a
host `DOCKER-USER` (or equivalent) firewall rule allowing that source CIDR to
TCP 8191 and rejecting other sources. Nginx applies the same source allowlist.
The service is reverse-proxy agnostic. Its current reverse proxy happens to
reach this server from `172.30.1.75`, but Caddy, Nginx, HAProxy, or another
proxy can be used. Keep every observed proxy source CIDR in the untracked
`TRUSTED_PROXY_CIDRS` value, separated by commas or spaces, and re-check the
value whenever proxy networking changes. The published port binds all server
interfaces, so production also needs a host `DOCKER-USER` (or equivalent)
firewall rule allowing those source CIDRs to TCP 8191 and rejecting other
sources. The static Nginx edge applies the same source allowlist.
### Prepare
@@ -57,7 +60,7 @@ docker compose build
Apply and inspect the dedicated Docker ingress chain with root privileges:
```sh
sudo env CADDY_SOURCE_CIDR=172.30.1.75/32 IMAGE_PORT=8191 \
sudo env TRUSTED_PROXY_CIDRS=172.30.1.75/32 IMAGE_PORT=8191 \
./deploy/scripts/firewall-8191.sh apply
sudo ./deploy/scripts/firewall-8191.sh check
```
@@ -109,7 +112,7 @@ signed administration command:
./deploy/scripts/admin-deploy.sh <branch> [expected-commit]
```
The administration route is not proxied through Nginx or Caddy.
The administration route is not exposed through the public reverse proxy.
### Tests and rollback