Add custom image handling and access policy management

- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected.
- Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies.
- Add NAT network configuration with validation for RFC1918 compliance and subnet parsing.
- Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers.
- Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests.
- Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives.
- Include comprehensive tests for all new functionalities to ensure reliability and correctness.

backend/internal/cli/access_policy.go

@@ -0,0 +1,86 @@
+package cli
+
+import (
+	"flag"
+	"fmt"
+	"strings"
+
+	"clicd/internal/config"
+)
+
+// RunAccessPolicyCommand manages the panel source policy without requiring the
+// interactive menu. It is intended to remain usable over SSH as a recovery path.
+func RunAccessPolicyCommand(args []string) error {
+	action := "show"
+	if len(args) > 0 {
+		action = strings.ToLower(strings.TrimSpace(args[0]))
+		args = args[1:]
+	}
+
+	switch action {
+	case "show":
+		printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
+		return nil
+	case "disable", "off":
+		next := config.AppConfig.PanelAccessPolicy
+		next.Enabled = false
+		if err := savePanelAccessPolicy(next); err != nil {
+			return err
+		}
+		fmt.Println("Panel access allowlist disabled.")
+		return reloadPanelAfterAccessPolicyCommand()
+	case "set", "enable":
+		flags := flag.NewFlagSet("clicd access-policy set", flag.ContinueOnError)
+		flags.SetOutput(new(strings.Builder))
+		var allowed string
+		var trusted string
+		flags.StringVar(&allowed, "allow", "", "comma-separated allowed IP/CIDR values")
+		flags.StringVar(&trusted, "trusted-proxy", "", "comma-separated trusted proxy IP/CIDR values")
+		if err := flags.Parse(args); err != nil {
+			return fmt.Errorf("invalid access-policy arguments: %w", err)
+		}
+		next := config.PanelAccessPolicy{
+			Enabled:        true,
+			AllowedSources: splitPanelAccessEntries(allowed),
+			TrustedProxies: splitPanelAccessEntries(trusted),
+		}
+		if err := savePanelAccessPolicy(next); err != nil {
+			return err
+		}
+		fmt.Println("Panel access allowlist saved.")
+		printPanelAccessPolicy(config.AppConfig.PanelAccessPolicy)
+		return reloadPanelAfterAccessPolicyCommand()
+	default:
+		return fmt.Errorf("unknown access-policy action %q; use show, set, or disable", action)
+	}
+}
+
+func savePanelAccessPolicy(policy config.PanelAccessPolicy) error {
+	normalized, err := config.NormalizePanelAccessPolicy(policy)
+	if err != nil {
+		return err
+	}
+	previous := config.AppConfig.PanelAccessPolicy
+	config.AppConfig.PanelAccessPolicy = normalized
+	if err := config.SaveConfig(); err != nil {
+		config.AppConfig.PanelAccessPolicy = previous
+		return fmt.Errorf("save panel access policy: %w", err)
+	}
+	return nil
+}
+
+func reloadPanelAfterAccessPolicyCommand() error {
+	if !isWebPanelRunning() {
+		return nil
+	}
+	if err := restartService("clicd"); err != nil {
+		return fmt.Errorf("policy was saved but clicd service restart failed: %w", err)
+	}
+	return nil
+}
+
+func printPanelAccessPolicy(policy config.PanelAccessPolicy) {
+	fmt.Printf("Enabled: %t\n", policy.Enabled)
+	fmt.Printf("Allowed sources: %s\n", strings.Join(policy.AllowedSources, ", "))
+	fmt.Printf("Trusted proxies: %s\n", strings.Join(policy.TrustedProxies, ", "))
+}