migrate

2026-07-20 09:23:17 -04:00
parent c1315882da
commit 72272e4006
3179 changed files with 562960 additions and 14 deletions
@@ -0,0 +1,24 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: << resource_name >>
+  namespace: << namespace >>
+spec:
+  ipAllowList:
+    sourceRange:
+<%- for source_range in source_ranges.split(',') %>
+      - << source_range.strip() >>
+<%- endfor %>
+<%- if ip_strategy_depth_enabled or excluded_ips_enabled %>
+    ipStrategy:
+<%- if ip_strategy_depth_enabled %>
+      depth: << ip_strategy_depth >>
+<%- endif %>
+<%- if excluded_ips_enabled %>
+      excludedIPs:
+<%- for ip in excluded_ips.split(',') %>
+        - << ip.strip() >>
+<%- endfor %>
+<%- endif %>
+<%- endif %>
@@ -0,0 +1,101 @@
+{
+  "slug": "traefik-ipallowlist",
+  "kind": "kubernetes",
+  "metadata": {
+    "name": "Traefik IPAllowList Middleware",
+    "description": "Traefik Middleware CRD for restricting access to trusted source CIDR ranges, with optional client IP strategy controls for proxied deployments.",
+    "tags": [],
+    "icon": {
+      "provider": "selfhst",
+      "id": "traefik"
+    },
+    "draft": true,
+    "version": {
+      "name": "3.5.3",
+      "source_dep_name": "manual/traefik-ipallowlist"
+    }
+  },
+  "variables": [
+    {
+      "title": "General",
+      "name": "general",
+      "items": [
+        {
+          "name": "resource_name",
+          "type": "str",
+          "title": "Middleware name",
+          "required": false,
+          "default": "allow-private-networks",
+          "config": {
+            "placeholder": "allow-private-networks"
+          }
+        },
+        {
+          "name": "namespace",
+          "type": "str",
+          "title": "Namespace",
+          "required": false,
+          "default": "default",
+          "config": {
+            "placeholder": "default"
+          }
+        }
+      ]
+    },
+    {
+      "title": "IP Allow List",
+      "name": "ipallowlist",
+      "items": [
+        {
+          "name": "source_ranges",
+          "type": "str",
+          "title": "Source ranges",
+          "required": false,
+          "default": "192.168.0.0/16,10.0.0.0/8,172.16.0.0/12",
+          "description": "Comma-separated list of CIDR ranges allowed to access the route.",
+          "config": {
+            "placeholder": "192.168.0.0/16,10.0.0.0/8,172.16.0.0/12"
+          }
+        },
+        {
+          "name": "ip_strategy_depth_enabled",
+          "type": "bool",
+          "title": "Depth strategy",
+          "required": false,
+          "default": false,
+          "description": "Evaluate the client IP based on a specific position in the X-Forwarded-For chain."
+        },
+        {
+          "name": "ip_strategy_depth",
+          "type": "int",
+          "title": "Depth",
+          "required": false,
+          "default": 1,
+          "description": "Position from the right in the X-Forwarded-For chain.",
+          "config": {
+            "placeholder": "1"
+          }
+        },
+        {
+          "name": "excluded_ips_enabled",
+          "type": "bool",
+          "title": "Excluded IPs",
+          "required": false,
+          "default": false,
+          "description": "Exclude trusted proxy IPs from client IP evaluation."
+        },
+        {
+          "name": "excluded_ips",
+          "type": "str",
+          "title": "Excluded IPs list",
+          "required": false,
+          "default": "10.42.0.0/16,10.43.0.0/16",
+          "description": "Comma-separated list of trusted proxy ranges to ignore during client IP evaluation.",
+          "config": {
+            "placeholder": "10.42.0.0/16,10.43.0.0/16"
+          }
+        }
+      ]
+    }
+  ]
+}