From d96a26899958d79f488080c795af0fef572e4120 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ji=C5=99=C3=AD=20Uhl=C3=AD=C5=99?= Date: Wed, 17 Jun 2026 06:48:10 +0000 Subject: [PATCH] Update scripts/generate-caddyfile.sh --- scripts/generate-caddyfile.sh | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/scripts/generate-caddyfile.sh b/scripts/generate-caddyfile.sh index 50ac29b..574aaaa 100755 --- a/scripts/generate-caddyfile.sh +++ b/scripts/generate-caddyfile.sh @@ -225,7 +225,18 @@ with open(caddy_file, "a", encoding="utf-8") as f: rules = rules_by_app.get(app_id, []) safe_name = safe_matcher_name(app_id) + + f.write(f" route /apps/{app_id}/* {{\n") + + # Public endpoints are always open and are handled before IP rules. open_paths = [f"/apps/{app_id}{suffix}" for suffix in OPEN_PATH_SUFFIXES] + f.write(f" @open_{safe_name} {{\n") + f.write(" path " + " ".join(open_paths) + "\n") + f.write(" }\n") + f.write(f" handle @open_{safe_name} {{\n") + f.write(f" uri strip_prefix /apps/{app_id}\n") + f.write(f" reverse_proxy {app_id}:{port}\n") + f.write(" }\n\n") if rules: allowed_by_method = {method: [] for method in ALL_METHODS} @@ -245,15 +256,13 @@ with open(caddy_file, "a", encoding="utf-8") as f: matcher = f"blocked_{safe_name}_{method.lower()}" - f.write(f" @{matcher} {{\n") - f.write(f" path /apps/{app_id}/*\n") - f.write(f" method {method}\n") - f.write(" not path " + " ".join(open_paths) + "\n") - f.write(" not remote_ip " + " ".join(allowed_ips) + "\n") - f.write(" }\n") - f.write(f" respond @{matcher} \"Forbidden\" 403\n\n") + f.write(f" @{matcher} {{\n") + f.write(f" method {method}\n") + f.write(" not remote_ip " + " ".join(allowed_ips) + "\n") + f.write(" }\n") + f.write(f" respond @{matcher} \"Forbidden\" 403\n\n") - f.write(f" handle_path /apps/{app_id}/* {{\n") + f.write(f" uri strip_prefix /apps/{app_id}\n") f.write(f" reverse_proxy {app_id}:{port}\n") f.write(" }\n\n") PY