Generalize reverse proxy source allowlist

deploy/nginx/entrypoint.sh

@@ -1,13 +1,29 @@
 #!/bin/sh
 set -eu
 
-if [ -z "${CADDY_SOURCE_CIDR:-}" ]; then
-    echo "CADDY_SOURCE_CIDR is required" >&2
+trusted_proxy_cidrs=${TRUSTED_PROXY_CIDRS:-${CADDY_SOURCE_CIDR:-}}
+
+if [ -z "$trusted_proxy_cidrs" ]; then
+    echo "TRUSTED_PROXY_CIDRS is required" >&2
     exit 1
 fi
 
-envsubst '${CADDY_SOURCE_CIDR}' \
-    < /etc/image/default.conf.template \
-    > /tmp/nginx.conf
+: > /tmp/trusted-proxy-allow.conf
+for trusted_proxy_cidr in $(printf '%s' "$trusted_proxy_cidrs" | tr ',' ' '); do
+    case "$trusted_proxy_cidr" in
+        *[!0-9A-Fa-f:./]*)
+            echo "Invalid trusted proxy CIDR: $trusted_proxy_cidr" >&2
+            exit 2
+            ;;
+    esac
+    printf 'allow %s;\n' "$trusted_proxy_cidr" >> /tmp/trusted-proxy-allow.conf
+done
+
+if [ ! -s /tmp/trusted-proxy-allow.conf ]; then
+    echo "TRUSTED_PROXY_CIDRS must contain at least one CIDR" >&2
+    exit 2
+fi
+
+cp /etc/image/default.conf.template /tmp/nginx.conf
 
 exec nginx -c /tmp/nginx.conf -g 'daemon off;'

deploy/nginx/templates/default.conf.template

@@ -24,7 +24,7 @@ http {
 
     allow 127.0.0.1;
     allow ::1;
-    allow ${CADDY_SOURCE_CIDR};
+    include /tmp/trusted-proxy-allow.conf;
     deny all;
 
     location = /healthz {