Skip to content

IP Access List #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
shopsD wants to merge 22 commits into
base: develop
Choose a base branch
from
Draft

IP Access List #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
6aadc15
Update caddy:2.11.4 Docker digest to 844f60b
renovate[bot] Jul 16, 2026
013ccaf
dep updates
renovate[bot] Jul 21, 2026
fe4df2c
breaking: protect oidc with totp (with env to revert), remove loginAs…
Zoey2936 Jul 21, 2026
43cc0f7
fix certificate migration
Zoey2936 Jul 21, 2026
0c7d7d7
warn if INITIAL_ envs are set since they are only needed once
Zoey2936 Jul 21, 2026
cee652b
block deletion of used certs in the backend/reload after cert uploads
Zoey2936 Jul 21, 2026
a43021d
use forks of some nginx module sinstead of patching them
Zoey2936 Jul 23, 2026
85bad18
support upload of custom profile pictures
Zoey2936 Jul 23, 2026
acda2ba
lint-and-format (#3624)
Zoey2936 Jul 23, 2026
1cce807
also set satisfy any if there are no IP rules
Zoey2936 Jul 24, 2026
b448f43
add migrations to fix npmplus_proxy_host_access_list table
Zoey2936 Jul 24, 2026
6386eae
hide version string and docs behind login
Zoey2936 Jul 24, 2026
baedd04
partly replace lodash
Zoey2936 Jul 25, 2026
b90213d
add notNull where possible
Zoey2936 Jul 25, 2026
5ea560a
Update dependency-updates.yml
Zoey2936 Jul 25, 2026
7a7a5d2
adjust typescrip, vite and biome configs
Zoey2936 Jul 25, 2026
76fba6b
ratelimit certificate downloads
Zoey2936 Jul 27, 2026
3b25289
use cron and use dinit to manager nginx, backend, etc
Zoey2936 Jul 28, 2026
3cd7322
save 2fa challenge token in a cookie
Zoey2936 Jul 28, 2026
1436de6
fix: correct inverted pass_auth logic in proxy_host template
ChillSkyGlow Jul 29, 2026
486247b
dep updates
renovate[bot] Jul 30, 2026
336071a
initial code for frontend ip
shopsD Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/caddy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,21 +17,21 @@ jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
with:
platforms: arm64
- uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
- name: docker.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
if: ${{ github.repository_owner == 'ZoeyVid' && github.event_name != 'pull_request' }}
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: ghcr.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
if: ${{ github.repository_owner == 'ZoeyVid' && github.event_name != 'pull_request' }}
with:
registry: ghcr.io
Expand Down
93 changes: 55 additions & 38 deletions .github/workflows/dependency-updates.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,9 @@ jobs:
AWSLC_VER="$(
git ls-remote --tags --refs https://github.com/aws/aws-lc \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
AWSLC_SHA="$(git ls-remote https://github.com/aws/aws-lc "$AWSLC_VER" | cut -f1)"
Expand All @@ -43,8 +44,9 @@ jobs:
NGINX_VER="$(
git ls-remote --tags --refs https://github.com/nginx/nginx \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
NGINX_SHA="$(git ls-remote https://github.com/nginx/nginx "$NGINX_VER" | cut -f1)"
Expand Down Expand Up @@ -134,58 +136,60 @@ jobs:
title: update zlib-ng-patch version to ${{ steps.update.outputs.version }}
body: update zlib-ng-patch version to ${{ steps.update.outputs.version }}

ngx_brotli-update:
ngx_http_brotli_module-update:
runs-on: ubuntu-slim
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: update ngx_brotli version
- name: update ngx_http_brotli_module version
id: update
run: |
NB_VER="$(
git ls-remote --tags --refs https://github.com/google/ngx_brotli \
git ls-remote --tags --refs https://github.com/HanadaLee/ngx_http_brotli_module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ -z "$NB_VER" ]; then NB_VER=master; fi
NB_SHA="$(git ls-remote https://github.com/google/ngx_brotli "$NB_VER" | cut -f1)"
if [ "$NB_VER" = "v1.0.0rc" ]; then NB_VER=master; fi
NB_SHA="$(git ls-remote https://github.com/HanadaLee/ngx_http_brotli_module "$NB_VER" | cut -f1)"
sed -i "s|ARG NB_VER=.*|ARG NB_VER=$NB_SHA # $NB_VER|" Dockerfile
echo "version=$NB_VER" >> $GITHUB_OUTPUT
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
signoff: true
delete-branch: true
commit-message: update ngx_brotli version to ${{ steps.update.outputs.version }}
branch: update-ngx_brotli-version
title: update ngx_brotli version to ${{ steps.update.outputs.version }}
body: update ngx_brotli version to ${{ steps.update.outputs.version }}
ngx_unbrotli-update:
commit-message: update ngx_http_brotli_module version to ${{ steps.update.outputs.version }}
branch: update-ngx_http_brotli_module-version
title: update ngx_http_brotli_module version to ${{ steps.update.outputs.version }}
body: update ngx_http_brotli_module version to ${{ steps.update.outputs.version }}
ngx_http_unbrotli_filter_module-update:
runs-on: ubuntu-slim
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: update ngx_unbrotli version
- name: update ngx_http_unbrotli_filter_module version
id: update
run: |
NUB_VER="$(
git ls-remote --tags --refs https://github.com/clyfish/ngx_unbrotli \
git ls-remote --tags --refs https://github.com/HanadaLee/ngx_http_unbrotli_filter_module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ -z "$NUB_VER" ]; then NUB_VER=main; fi
NUB_SHA="$(git ls-remote https://github.com/clyfish/ngx_unbrotli "$NUB_VER" | cut -f1)"
NUB_SHA="$(git ls-remote https://github.com/HanadaLee/ngx_http_unbrotli_filter_module "$NUB_VER" | cut -f1)"
sed -i "s|ARG NUB_VER=.*|ARG NUB_VER=$NUB_SHA # $NUB_VER|" Dockerfile
echo "version=$NUB_VER" >> $GITHUB_OUTPUT
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
signoff: true
delete-branch: true
commit-message: update ngx_unbrotli version to ${{ steps.update.outputs.version }}
branch: update-ngx_unbrotli-version
title: update ngx_unbrotli version to ${{ steps.update.outputs.version }}
body: update ngx_unbrotli version to ${{ steps.update.outputs.version }}
commit-message: update ngx_http_unbrotli_filter_module version to ${{ steps.update.outputs.version }}
branch: update-ngx_http_unbrotli_filter_module-version
title: update ngx_http_unbrotli_filter_module version to ${{ steps.update.outputs.version }}
body: update ngx_http_unbrotli_filter_module version to ${{ steps.update.outputs.version }}
zstd-nginx-module-update:
runs-on: ubuntu-slim
steps:
Expand All @@ -194,14 +198,14 @@ jobs:
id: update
run: |
ZNM_VER="$(
git ls-remote --tags --refs https://github.com/tokers/zstd-nginx-module \
git ls-remote --tags --refs https://github.com/hsw/zstd-nginx-module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ "$ZNM_VER" = "0.1.1" ]; then ZNM_VER=master; fi
ZNM_SHA="$(git ls-remote https://github.com/tokers/zstd-nginx-module "$ZNM_VER" | cut -f1)"
ZNM_SHA="$(git ls-remote https://github.com/hsw/zstd-nginx-module "$ZNM_VER" | cut -f1)"
sed -i "s|ARG ZNM_VER=.*|ARG ZNM_VER=$ZNM_SHA # $ZNM_VER|" Dockerfile
echo "version=$ZNM_VER" >> $GITHUB_OUTPUT
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
Expand All @@ -222,8 +226,9 @@ jobs:
NHUZFM_VER="$(
git ls-remote --tags --refs https://github.com/HanadaLee/ngx_http_unzstd_filter_module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ -z "$NHUZFM_VER" ]; then NHUZFM_VER=main; fi
Expand All @@ -248,8 +253,9 @@ jobs:
NF_VER="$(
git ls-remote --tags --refs https://github.com/aperezdc/ngx-fancyindex \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
NF_SHA="$(git ls-remote https://github.com/aperezdc/ngx-fancyindex "$NF_VER" | cut -f1)"
Expand All @@ -273,8 +279,9 @@ jobs:
HMNM_VER="$(
git ls-remote --tags --refs https://github.com/openresty/headers-more-nginx-module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
HMNM_SHA="$(git ls-remote https://github.com/openresty/headers-more-nginx-module "$HMNM_VER" | cut -f1)"
Expand All @@ -298,8 +305,9 @@ jobs:
NDK_VER="$(
git ls-remote --tags --refs https://github.com/vision5/ngx_devel_kit \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
NDK_SHA="$(git ls-remote https://github.com/vision5/ngx_devel_kit "$NDK_VER" | cut -f1)"
Expand All @@ -323,8 +331,9 @@ jobs:
LNM_VER="$(
git ls-remote --tags --refs https://github.com/openresty/lua-nginx-module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
LNM_SHA="$(git ls-remote https://github.com/openresty/lua-nginx-module "$LNM_VER" | cut -f1)"
Expand All @@ -350,8 +359,9 @@ jobs:
NJS_VER="$(
git ls-remote --tags --refs https://github.com/nginx/njs \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
NJS_SHA="$(git ls-remote https://github.com/nginx/njs "$NJS_VER" | cut -f1)"
Expand All @@ -375,8 +385,9 @@ jobs:
NAL_VER="$(
git ls-remote --tags --refs https://github.com/kvspb/nginx-auth-ldap \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ "$NAL_VER" = "v0.1" ]; then NAL_VER=master; fi
Expand All @@ -401,8 +412,9 @@ jobs:
VTS_VER="$(
git ls-remote --tags --refs https://github.com/vozlt/nginx-module-vts \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
VTS_SHA="$(git ls-remote https://github.com/vozlt/nginx-module-vts "$VTS_VER" | cut -f1)"
Expand All @@ -426,8 +438,9 @@ jobs:
NNTLM_VER="$(
git ls-remote --tags --refs https://github.com/gabihodoroaga/nginx-ntlm-module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
if [ "$NNTLM_VER" = "v1.19.3-beta.1" ]; then NNTLM_VER=master; fi
Expand All @@ -452,8 +465,9 @@ jobs:
NHG2M_VER="$(
git ls-remote --tags --refs https://github.com/leev/ngx_http_geoip2_module \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
NHG2M_SHA="$(git ls-remote https://github.com/leev/ngx_http_geoip2_module "$NHG2M_VER" | cut -f1)"
Expand All @@ -478,8 +492,9 @@ jobs:
LRC_VER="$(
git ls-remote --tags --refs https://github.com/openresty/lua-resty-core \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
LRC_SHA="$(git ls-remote https://github.com/openresty/lua-resty-core "$LRC_VER" | cut -f1)"
Expand All @@ -503,8 +518,9 @@ jobs:
LRL_VER="$(
git ls-remote --tags --refs https://github.com/openresty/lua-resty-lrucache \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
LRL_SHA="$(git ls-remote https://github.com/openresty/lua-resty-lrucache "$LRL_VER" | cut -f1)"
Expand All @@ -529,8 +545,9 @@ jobs:
LCSB_VER="$(
git ls-remote --tags --refs https://github.com/crowdsecurity/lua-cs-bouncer \
| cut -d/ -f3 \
| sed 's|rc|~&|I' \
| sort -V \
| grep -vi rc \
| sed 's|~||' \
| tail -1
)"
LCSB_SHA="$(git ls-remote https://github.com/crowdsecurity/lua-cs-bouncer "$LCSB_VER" | cut -f1)"
Expand Down
19 changes: 8 additions & 11 deletions .github/workflows/docker-beta.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,15 @@ jobs:
with:
driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
- name: ghcr.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: zoeyvid
password: ${{ github.token }}
- name: version
run: |
sudo apt-get update
sudo apt-get install -y moreutils
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' frontend/package.json | sponge frontend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' backend/package.json | sponge backend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' frontend/package.json > frontend/package.json.tmp && mv frontend/package.json.tmp frontend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' backend/package.json > backend/package.json.tmp && mv backend/package.json.tmp backend/package.json
- uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
Expand All @@ -44,16 +42,15 @@ jobs:
with:
driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=-1
- name: ghcr.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: zoeyvid
password: ${{ github.token }}
- name: version
run: |
sudo apt-get install -y moreutils
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' frontend/package.json | sponge frontend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' backend/package.json | sponge backend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' frontend/package.json > frontend/package.json.tmp && mv frontend/package.json.tmp frontend/package.json
jq --arg v "${{ inputs.tag }}-$(git rev-parse --short HEAD)-$(cat .version)" '.version = $v' backend/package.json > backend/package.json.tmp && mv backend/package.json.tmp backend/package.json
- uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
context: .
Expand All @@ -68,12 +65,12 @@ jobs:
if: ${{ github.repository_owner == 'ZoeyVid' }}
steps:
- name: docker.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}
- name: ghcr.io-login
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with:
registry: ghcr.io
username: zoeyvid
Expand Down
Loading
Loading