From bea2659041c85e53a53d03b547d62e7fae10398d Mon Sep 17 00:00:00 2001 From: jiri Date: Mon, 15 Jun 2026 09:32:06 +0000 Subject: [PATCH] Update scripts/generate-caddyfile.sh --- scripts/generate-caddyfile.sh | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/scripts/generate-caddyfile.sh b/scripts/generate-caddyfile.sh index b062488..50ac29b 100755 --- a/scripts/generate-caddyfile.sh +++ b/scripts/generate-caddyfile.sh @@ -234,27 +234,22 @@ with open(caddy_file, "a", encoding="utf-8") as f: for method in rule["methods"]: allowed_by_method.setdefault(method, []).append(rule["ip_cidr"]) - for method in WRITE_METHODS: - matcher = f"blocked_{safe_name}_{method.lower()}" + for method in ALL_METHODS: allowed_ips = sorted(set(allowed_by_method.get(method, []))) + # Core rule: + # If a method has no rules, it stays open. + # If a method has at least one rule, it becomes IP-whitelisted. + if not allowed_ips: + continue + + matcher = f"blocked_{safe_name}_{method.lower()}" + f.write(f" @{matcher} {{\n") f.write(f" path /apps/{app_id}/*\n") f.write(f" method {method}\n") f.write(" not path " + " ".join(open_paths) + "\n") - if allowed_ips: - f.write(" not remote_ip " + " ".join(allowed_ips) + "\n") - f.write(" }\n") - f.write(f" respond @{matcher} \"Forbidden\" 403\n\n") - - get_allowed_ips = sorted(set(allowed_by_method.get("GET", []))) - if get_allowed_ips: - matcher = f"blocked_{safe_name}_get" - f.write(f" @{matcher} {{\n") - f.write(f" path /apps/{app_id}/*\n") - f.write(" method GET\n") - f.write(" not path " + " ".join(open_paths) + "\n") - f.write(" not remote_ip " + " ".join(get_allowed_ips) + "\n") + f.write(" not remote_ip " + " ".join(allowed_ips) + "\n") f.write(" }\n") f.write(f" respond @{matcher} \"Forbidden\" 403\n\n")