Add ACL support to the server

luca0N commented

2025-11-25 18:45:45 +00:00

Owner

Add basic access-control list (ACL) support to the server, so that users are able to restrict WebSocket access from specific IP addresses.

luca0N added the

labels

2025-11-25 18:45:45 +00:00

luca0N self-assigned this

2025-11-25 18:45:45 +00:00

luca0N added this to the v1.0.0 project

2025-11-25 18:45:46 +00:00

luca0N commented

2026-01-05 23:41:00 +00:00

Author

Owner

This issue is slightly related to #26, which was created specifically for addressing authentication (whereas this issue covers TCP/IP-level ACL only).

luca0N commented

2026-02-01 18:41:02 +00:00

Author

Owner

I have been thinking about how to approach this. I think that a simple configuration file could have some options that would allow server administrators to specify CIDR ranges for allowlisting and denylisting. For instance:

[acl]
; ...where the denylist takes precedence over allowlist
denylist_ranges=192.168.15.0/24,192.168.20.0/24
allowlist_ranges=192.168.0.0/16

Even though this is easy to implement, there seems to be several Go packages that already handle CIDR notations, so they could be used in the project.

Another way to implement this would be to have a database with a preferences table, in which we could save the exact same information. I believe a configuration file would be a better approach, even if databases will be used regardless due to #26, because, otherwise, administrators would have to either use the web app to set up ACLs, or a command-line utility would have to be created, which would then add/modify the relevant records in the server database. Having administrators directly modify the database is bad UX.

I have been thinking about how to approach this. I think that a simple configuration file could have some options that would allow server administrators to specify CIDR ranges for allowlisting and denylisting. For instance: ```cfg [acl] ; ...where the denylist takes precedence over allowlist denylist_ranges=192.168.15.0/24,192.168.20.0/24 allowlist_ranges=192.168.0.0/16 ``` Even though this is easy to implement, there seems to be several Go packages that already handle CIDR notations, so they could be used in the project. Another way to implement this would be to have a database with a preferences table, in which we could save the exact same information. I believe a configuration file would be a better approach, even if databases will be used regardless due to #26, because, otherwise, administrators would have to either use the web app to set up ACLs, or a command-line utility would have to be created, which would then add/modify the relevant records in the server database. Having administrators directly modify the database is bad UX.

luca0N referenced this issue from a pull request that will close it,

2026-02-02 23:49:40 +00:00

WIP: Add ACL support to the server (closes #25) #42

luca0N added a new dependency

2026-02-02 23:55:09 +00:00

#42 WIP: Add ACL support to the server (closes #25)

Rows
Columns

Add ACL support to the server #25