Feature request: IP address white list

[alexander-potemkin]

Feedly uses 8.29.198.0/24 IP address and I would like to limit access to those IP addresses only, to make sure Telegram won't ban my account, in case if someone will (for some) reason sign / DoS me.

I would be lovely to have an option to limit access - directly or via HTTP reverse proxy headers, if possible?

[nDmitry]

Sure, that can be implemented.

via HTTP reverse proxy headers

I guess you mean reading proxy headers to get the IP from? I could extract IP from a request like so (in pseudocode): r.Header.Get("X-Real-IP") || r.Header.Get("X-Forwarded-For") || r.RemoteAddr.

But the problem is a client can set this headers to whatever it pleases and DoS you all it want 😄, so if you're exposing tgfeed to the internet, it must be behind a reverse proxy. Therefore I would also add a bool option (env var) REVERSE_PROXY and read this headers only if it is intentionally set to true.

Note to self (or LLM): X-Forwarded-For is (potentially) a list of IP addresses (proxy-chaining). Need to split by comma first (the first IP should be the client's). And also run net.ParseIP.

[alexander-potemkin]

Thank you! And yeah - I'm running tgfeed via Caddy :)

[alexander-potemkin]

Apologies for the delay in getting back to you and thanks a lot!

It seems to work, but I'm a bit confused with the log entries - I can see in the logs it says:

"remote_addr":"172.20.0.4:49044" - which is a Docker's network and not the IP address that Caddy passes over to make the filtering happens...

Could you possibly fix that? Or shall I open another issue? Or just take it as is? ;)

[nDmitry]

Apologies for the delay in getting back to you and thanks a lot!

It seems to work, but I'm a bit confused with the log entries - I can see in the logs it says:

"remote_addr":"172.20.0.4:49044" - which is a Docker's network and not the IP address that Caddy passes over to make the filtering happens...

Could you possibly fix that? Or shall I open another issue? Or just take it as is? ;)

Yeah, forgot to update the logging, should be fixed in #13.

[alexander-potemkin]

Thanks a lot, @nDmitry ! Really appreciate that!!