Add TCP file list

Author: CAJIO

.traefik.yml

@@ -4,7 +4,7 @@ iconPath: .assets/icon.png
 
 import: github.com/CAJIO/allowiprequest
 
-summary: '[CAJIO] Allow IP Request on request path /knock-knock'
+summary: 'Its plugin that allows you to whitelist your ip address by visiting a secret URL. It protects your services by blocking all requests by default while allowing users to self-whitelist their IP address by visiting a secret URL.'
 
 testData:
   KnockURL: "/knock-knock"
@@ -13,3 +13,5 @@ testData:
     - "192.168.0.0/16"
     - "10.0.0.0/8"
     - "127.0.0.0/8"
+  SyncAllowlist: true
+  AllowlistFile: "/etc/traefik/conf.d/allowlist.yml"

allowiprequest.go

@@ -3,18 +3,22 @@ package allowiprequest
 import (
 	"context"
 	"fmt"
+	"log"
 	"net"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"sync"
-	"text/template"
 	"time"
 )
 
 type Config struct {
 	KnockURL          string   `json:"knockUrl,omitempty"`
 	WhitelistDuration string   `json:"whitelistDuration,omitempty"`
 	AllowedSubnets    []string `json:"allowedSubnets,omitempty"`
+	SyncAllowlist     bool     `json:"syncAllowlist,omitempty"`
+	AllowlistFile     string   `json:"allowlistFile,omitempty"`
 }
 
 func CreateConfig() *Config {
@@ -25,12 +29,15 @@ func CreateConfig() *Config {
 	}
 }
 
-type Demo struct {
+type AllowIpR struct {
 	next              http.Handler
 	name              string
 	knockURL          string
 	whitelistDuration time.Duration
 	allowedIPNets     []*net.IPNet
+	allowedSubnets    []string
+	syncAllowlist     bool
+	allowlistFile     string
 	whitelist         map[string]time.Time
 	mu                sync.RWMutex
 }
@@ -54,17 +61,30 @@ func New(ctx context.Context, next http.Handler, config *Config, name string) (h
 		allowedIPNets = append(allowedIPNets, ipNet)
 	}
 
-	return &Demo{
+	d := &AllowIpR{
 		next:              next,
 		name:              name,
 		knockURL:          config.KnockURL,
 		whitelistDuration: duration,
 		allowedIPNets:     allowedIPNets,
+		allowedSubnets:    config.AllowedSubnets,
+		syncAllowlist:     config.SyncAllowlist,
+		allowlistFile:     config.AllowlistFile,
 		whitelist:         make(map[string]time.Time),
-	}, nil
+	}
+
+	if d.syncAllowlist {
+		if d.allowlistFile == "" {
+			return nil, fmt.Errorf("allowlistFile must be set when syncAllowlist is enabled")
+		}
+		log.Printf("[allowiprequest] allowlist sync enabled, file: %s", d.allowlistFile)
+		d.writeAllowlist()
+	}
+
+	return d, nil
 }
 
-func (a *Demo) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+func (a *AllowIpR) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 	// Extract IP (without port)
 	host, _, err := net.SplitHostPort(req.RemoteAddr)
 	if err != nil {
@@ -98,6 +118,9 @@ func (a *Demo) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 		a.mu.Lock()
 		a.whitelist[host] = time.Now().Add(a.whitelistDuration)
 		a.mu.Unlock()
+		if a.syncAllowlist {
+			a.writeAllowlist()
+		}
 		a.serveSuccessPage(rw, host)
 		return
 	}
@@ -122,14 +145,17 @@ func (a *Demo) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
 			a.mu.Lock()
 			delete(a.whitelist, host)
 			a.mu.Unlock()
+			if a.allowlistFile != "" {
+				a.writeAllowlist()
+			}
 		}
 	}
 
 	// Block by default
 	http.Error(rw, "Forbidden", http.StatusForbidden)
 }
 
-func (a *Demo) serveSuccessPage(rw http.ResponseWriter, ip string) {
+func (a *AllowIpR) serveSuccessPage(rw http.ResponseWriter, ip string) {
 	rw.Header().Set("Content-Type", "text/html; charset=utf-8")
 	rw.WriteHeader(http.StatusOK)
 	html := fmt.Sprintf(`
@@ -157,7 +183,7 @@ func (a *Demo) serveSuccessPage(rw http.ResponseWriter, ip string) {
 	rw.Write([]byte(html))
 }
 
-func (a *Demo) serveAdminPage(rw http.ResponseWriter) {
+func (a *AllowIpR) serveAdminPage(rw http.ResponseWriter) {
 	a.mu.RLock()
 	// Copy whitelist to avoid holding lock while rendering
 	ips := make(map[string]time.Time, len(a.whitelist))
@@ -217,3 +243,66 @@ func (a *Demo) serveAdminPage(rw http.ResponseWriter) {
 
 	rw.Write([]byte(html))
 }
+
+func (a *AllowIpR) writeAllowlist() {
+	var sb strings.Builder
+	sb.WriteString("tcp:\n")
+	sb.WriteString("  middlewares:\n")
+	sb.WriteString("    local-whitelist:\n")
+	sb.WriteString("      IPAllowList:\n")
+	sb.WriteString("        sourceRange:\n")
+
+	for _, subnet := range a.allowedSubnets {
+		sb.WriteString(fmt.Sprintf("          - \"%s\"\n", subnet))
+	}
+
+	now := time.Now()
+	a.mu.RLock()
+	for ip, expiry := range a.whitelist {
+		if now.Before(expiry) {
+			parsed := net.ParseIP(ip)
+			if parsed == nil {
+				continue
+			}
+			if parsed.To4() != nil {
+				sb.WriteString(fmt.Sprintf("          - \"%s/32\"\n", ip))
+			} else {
+				sb.WriteString(fmt.Sprintf("          - \"%s/128\"\n", ip))
+			}
+		}
+	}
+	a.mu.RUnlock()
+
+	dir := filepath.Dir(a.allowlistFile)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		log.Printf("[allowiprequest] failed to create directory %s: %v", dir, err)
+		return
+	}
+
+	tmp, err := os.CreateTemp(dir, ".allowlist-*.yml.tmp")
+	if err != nil {
+		log.Printf("[allowiprequest] failed to create temp file in %s: %v", dir, err)
+		return
+	}
+	tmpName := tmp.Name()
+
+	if _, err := tmp.WriteString(sb.String()); err != nil {
+		tmp.Close()
+		os.Remove(tmpName)
+		log.Printf("[allowiprequest] failed to write temp file: %v", err)
+		return
+	}
+	if err := tmp.Close(); err != nil {
+		os.Remove(tmpName)
+		log.Printf("[allowiprequest] failed to close temp file: %v", err)
+		return
+	}
+
+	if err := os.Rename(tmpName, a.allowlistFile); err != nil {
+		os.Remove(tmpName)
+		log.Printf("[allowiprequest] failed to rename %s -> %s: %v", tmpName, a.allowlistFile, err)
+		return
+	}
+
+	log.Printf("[allowiprequest] allowlist written to %s", a.allowlistFile)
+}

allowiprequest_test.go

@@ -4,14 +4,16 @@ import (
 	"context"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/CAJIO/allowiprequest"
 )
 
-func TestDemo(t *testing.T) {
+func TestAllowIpR(t *testing.T) {
 	cfg := allowiprequest.CreateConfig()
 	cfg.KnockURL = "/knock-knock"
 	cfg.WhitelistDuration = "1s" // Short duration for testing
@@ -23,7 +25,7 @@ func TestDemo(t *testing.T) {
 		rw.Write([]byte("OK"))
 	})
 
-	handler, err := allowiprequest.New(ctx, next, cfg, "demo-plugin")
+	handler, err := allowiprequest.New(ctx, next, cfg, "allowiprequest-plugin")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -109,3 +111,72 @@ func TestDemo(t *testing.T) {
 		t.Errorf("expected 403 Forbidden for admin view from external IP, got %d", recorder.Code)
 	}
 }
+
+func TestAllowlistFileWrite(t *testing.T) {
+	tmpDir := t.TempDir()
+	allowlistPath := filepath.Join(tmpDir, "conf.d", "allowlist.yml")
+
+	cfg := allowiprequest.CreateConfig()
+	cfg.KnockURL = "/knock-knock"
+	cfg.WhitelistDuration = "1s"
+	cfg.AllowedSubnets = []string{"192.168.0.0/16"}
+	cfg.SyncAllowlist = true
+	cfg.AllowlistFile = allowlistPath
+
+	ctx := context.Background()
+	next := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
+		rw.WriteHeader(http.StatusOK)
+	})
+
+	handler, err := allowiprequest.New(ctx, next, cfg, "allowiprequest-plugin")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// File should be created on init with static subnets
+	data, err := os.ReadFile(allowlistPath)
+	if err != nil {
+		t.Fatalf("allowlist file not created on init: %v", err)
+	}
+	content := string(data)
+	if !strings.Contains(content, "192.168.0.0/16") {
+		t.Errorf("allowlist file missing static subnet, got:\n%s", content)
+	}
+	if !strings.Contains(content, "IPAllowList") {
+		t.Errorf("allowlist file missing IPAllowList key, got:\n%s", content)
+	}
+
+	// Knock to add dynamic IP
+	req := httptest.NewRequest(http.MethodGet, "http://localhost/knock-knock", nil)
+	req.RemoteAddr = "10.0.0.2:4321"
+	recorder := httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+
+	data, err = os.ReadFile(allowlistPath)
+	if err != nil {
+		t.Fatalf("failed to read allowlist after knock: %v", err)
+	}
+	content = string(data)
+	if !strings.Contains(content, "10.0.0.2/32") {
+		t.Errorf("allowlist file missing knocked IP, got:\n%s", content)
+	}
+	if !strings.Contains(content, "192.168.0.0/16") {
+		t.Errorf("allowlist file lost static subnet after knock, got:\n%s", content)
+	}
+
+	// Wait for expiry, then trigger cleanup
+	time.Sleep(1100 * time.Millisecond)
+	req = httptest.NewRequest(http.MethodGet, "http://localhost/", nil)
+	req.RemoteAddr = "10.0.0.2:4321"
+	recorder = httptest.NewRecorder()
+	handler.ServeHTTP(recorder, req)
+
+	data, err = os.ReadFile(allowlistPath)
+	if err != nil {
+		t.Fatalf("failed to read allowlist after expiry: %v", err)
+	}
+	content = string(data)
+	if strings.Contains(content, "10.0.0.2/32") {
+		t.Errorf("allowlist file still contains expired IP, got:\n%s", content)
+	}
+}

readme.md

@@ -25,6 +25,8 @@ To use this plugin, you must configure it in your Traefik dynamic configuration.
 | `knockUrl` | `string` | `"/knock-knock"` | The specific URL path users must visit to whitelist their IP. |
 | `whitelistDuration` | `string` | `"24h"` | How long the IP remains whitelisted (e.g., "1h", "30m"). |
 | `allowedSubnets` | `[]string` | `["192.168.0.0/16", ...]` | List of CIDR ranges that bypass the knock check and can view the admin page. |
+| `syncAllowlist` | `bool` | `false` | Enable writing the current allowlist to a YAML file for use as a Traefik TCP middleware. |
+| `allowlistFile` | `string` | `""` | Path to the YAML file (required when `syncAllowlist` is `true`). |
 
 ### Add the plugin to Traefik
 ```yaml
@@ -49,6 +51,61 @@ http:
             - "192.168.1.0/24"
 ```
 
+### TCP Allowlist Sync
+
+The plugin can write a YAML file that Traefik's [file provider](https://doc.traefik.io/traefik/providers/file/) picks up as a TCP `IPAllowList` middleware. This lets you reuse the same dynamic allowlist for TCP routers (e.g. databases, mail servers) that don't support HTTP middleware plugins.
+
+Enable it by setting `syncAllowlist: true` and providing the output path:
+
+```yaml
+http:
+  middlewares:
+    my-ip-allowlist:
+      plugin:
+        allowiprequest:
+          knockUrl: "/knock-knock"
+          whitelistDuration: "24h"
+          allowedSubnets:
+            - "127.0.0.1/32"
+            - "192.168.1.0/24"
+          syncAllowlist: true
+          allowlistFile: "/etc/traefik/conf.d/allowlist.yml"
+```
+
+The generated file has the following structure and is updated atomically on every change (knock / expiry):
+
+```yaml
+tcp:
+  middlewares:
+    local-whitelist:
+      IPAllowList:
+        sourceRange:
+          - "127.0.0.1/32"
+          - "192.168.1.0/24"
+          - "1.2.3.4/32"   # dynamically added via knock
+```
+
+To use it, configure Traefik's file provider to watch the output directory and reference the middleware in a TCP router:
+
+```yaml
+# traefik.yml (static config)
+providers:
+  file:
+    directory: /etc/traefik/conf.d
+    watch: true
+```
+
+```yaml
+# TCP router example
+tcp:
+  routers:
+    my-tcp-service:
+      rule: "HostSNI(`*`)"
+      middlewares:
+        - local-whitelist
+      service: my-tcp-backend
+```
+
 ### Router Configuration
 ```yaml
 http: