mirror of
https://github.com/MengMengCode/CLICD.git
synced 2026-08-07 06:14:42 +08:00
Add custom image handling and access policy management
- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected. - Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies. - Add NAT network configuration with validation for RFC1918 compliance and subnet parsing. - Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers. - Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests. - Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives. - Include comprehensive tests for all new functionalities to ensure reliability and correctness.
This commit is contained in:
MengMengCode
@@ -191,6 +191,26 @@ Update example:
|
||||
| `disabled` | Whether this key is disabled. |
|
||||
| `container_uuids` | Optional container allowlist that limits the key to specific containers. |
|
||||
|
||||
## Panel Access Source Policy
|
||||
|
||||
Use `GET /api/v1/access-policy` to read the panel source allowlist and `PUT /api/v1/access-policy` to update it. Both endpoints require `admin:access`. The policy covers panel pages, login endpoints, and every API.
|
||||
|
||||
```json
|
||||
{
|
||||
"enabled": true,
|
||||
"allowed_sources": [
|
||||
"203.0.113.10",
|
||||
"192.168.1.0/24",
|
||||
"2001:db8::/32"
|
||||
],
|
||||
"trusted_proxies": [
|
||||
"127.0.0.1"
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
Both lists accept IPv4, IPv6, and CIDR values. The backend only uses `X-Forwarded-For`, `X-Real-IP`, or `CF-Connecting-IP` when the direct peer matches `trusted_proxies`, so untrusted clients cannot bypass the policy by spoofing those headers. An enabled policy requires at least one allowed source, and the API rejects changes that exclude the current administrator source. Direct loopback access remains available as a CLI/SSH recovery path.
|
||||
|
||||
## Python Example
|
||||
|
||||
Fetch containers:
|
||||
@@ -302,6 +322,8 @@ print(resp.json())
|
||||
| GET | `/api/v1/templates` | Template list |
|
||||
| GET | `/api/v1/images` | Image management list |
|
||||
| GET | `/api/v1/images/enabled` | Enabled and downloaded images; supports `type=lxc\|kvm` |
|
||||
| POST | `/api/v1/images/custom` | Add a third-party LXC/KVM image source |
|
||||
| DELETE | `/api/v1/images/custom` | Remove a third-party LXC/KVM image source and cache |
|
||||
| POST | `/api/v1/images/download` | Download image |
|
||||
| POST | `/api/v1/images/cancel` | Cancel image download |
|
||||
| DELETE | `/api/v1/images/delete` | Delete image cache |
|
||||
|
||||
@@ -21,6 +21,23 @@ systemctl restart clicd
|
||||
journalctl -u clicd -n 100 --no-pager
|
||||
```
|
||||
|
||||
## Panel Access Allowlist CLI
|
||||
|
||||
```bash
|
||||
# Show the current policy
|
||||
clicd access-policy show
|
||||
|
||||
# Allow selected addresses and networks; add reverse proxies when needed
|
||||
clicd access-policy set \
|
||||
--allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
|
||||
--trusted-proxy "127.0.0.1"
|
||||
|
||||
# Disable source restrictions
|
||||
clicd access-policy disable
|
||||
```
|
||||
|
||||
The same controls are available from the "Panel access allowlist" item in `clicd cli`. Both paths persist the setting and restart the running panel service automatically.
|
||||
|
||||
## Security Recommendations
|
||||
|
||||
- Do not expose the web panel directly to untrusted networks.
|
||||
|
||||
@@ -17,6 +17,8 @@ CLICD provides a one-line installer. By default, it installs the latest version
|
||||
curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
|
||||
```
|
||||
|
||||
The installer asks for separate LXC and KVM NAT private subnets. Press Enter to scan host routes, interfaces, bridges, and libvirt networks and select non-overlapping RFC1918 `/24` networks, or enter a CIDR such as `172.28.40.0/24`. For unattended installation, set `CLICD_LXC_SUBNET` and `CLICD_KVM_SUBNET`.
|
||||
|
||||
The script defaults to `CLICD_VERSION=latest` and downloads `clicd-linux-amd64.tar.gz` or `clicd-linux-arm64.tar.gz` from `releases/latest` according to the host architecture.
|
||||
|
||||
## Install a Specific Version
|
||||
|
||||
@@ -191,6 +191,26 @@ curl -H "Authorization: Bearer YOUR_API_KEY" https://panel.example.com/api/v1/da
|
||||
| `disabled` | 是否禁用该 Key。 |
|
||||
| `container_uuids` | 可选；限制该 Key 只能访问指定容器。 |
|
||||
|
||||
## 面板访问来源策略
|
||||
|
||||
`GET /api/v1/access-policy` 读取面板访问白名单，`PUT /api/v1/access-policy` 更新策略。两者均需要 `admin:access` 权限。策略覆盖面板页面、登录入口和全部 API。
|
||||
|
||||
```json
|
||||
{
|
||||
"enabled": true,
|
||||
"allowed_sources": [
|
||||
"203.0.113.10",
|
||||
"192.168.1.0/24",
|
||||
"2001:db8::/32"
|
||||
],
|
||||
"trusted_proxies": [
|
||||
"127.0.0.1"
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
`allowed_sources` 和 `trusted_proxies` 均支持 IPv4、IPv6 及 CIDR。只有直接连接来源命中 `trusted_proxies` 时，后端才会使用 `X-Forwarded-For`、`X-Real-IP` 或 `CF-Connecting-IP`；其他客户端伪造这些请求头不会绕过白名单。启用策略时至少要配置一个允许来源，且接口会拒绝排除当前管理来源的配置。本机回环直连保留为 CLI/SSH 故障恢复通道。
|
||||
|
||||
## Python 示例
|
||||
|
||||
获取容器列表：
|
||||
@@ -302,6 +322,8 @@ print(resp.json())
|
||||
| GET | `/api/v1/templates` | 模板列表 |
|
||||
| GET | `/api/v1/images` | 镜像管理列表 |
|
||||
| GET | `/api/v1/images/enabled` | 已启用且已下载的镜像；支持 `type=lxc\|kvm` |
|
||||
| POST | `/api/v1/images/custom` | 添加第三方 LXC/KVM 镜像源 |
|
||||
| DELETE | `/api/v1/images/custom` | 移除第三方 LXC/KVM 镜像源及缓存 |
|
||||
| POST | `/api/v1/images/download` | 下载镜像 |
|
||||
| POST | `/api/v1/images/cancel` | 取消镜像下载 |
|
||||
| DELETE | `/api/v1/images/delete` | 删除镜像缓存 |
|
||||
|
||||
@@ -21,6 +21,23 @@ systemctl restart clicd
|
||||
journalctl -u clicd -n 100 --no-pager
|
||||
```
|
||||
|
||||
## 面板访问白名单 CLI
|
||||
|
||||
```bash
|
||||
# 查看当前策略
|
||||
clicd access-policy show
|
||||
|
||||
# 仅允许指定 IP/网段；反向代理地址按需填写
|
||||
clicd access-policy set \
|
||||
--allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
|
||||
--trusted-proxy "127.0.0.1"
|
||||
|
||||
# 关闭白名单限制
|
||||
clicd access-policy disable
|
||||
```
|
||||
|
||||
也可以运行 `clicd cli`，在交互菜单中选择“面板访问白名单”。直接命令和交互菜单都会保存配置，并在服务运行时自动重启面板。
|
||||
|
||||
## 安全建议
|
||||
|
||||
- 不要把 Web 面板直接暴露给不可信来源。
|
||||
|
||||
@@ -17,6 +17,8 @@ CLICD 提供一键安装脚本。脚本默认安装 GitHub Releases 的最新版
|
||||
curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
|
||||
```
|
||||
|
||||
安装器会分别询问 LXC 与 KVM 的 NAT 私网网段。直接回车时，脚本会扫描宿主机路由、网卡、网桥和 libvirt 网络，自动选择未冲突的 RFC1918 `/24` 网段；也可以输入 `172.28.40.0/24` 这类 CIDR。非交互安装可设置 `CLICD_LXC_SUBNET` 和 `CLICD_KVM_SUBNET`。
|
||||
|
||||
脚本当前默认使用 `CLICD_VERSION=latest`，会按宿主架构下载 `releases/latest` 对应的 `clicd-linux-amd64.tar.gz` 或 `clicd-linux-arm64.tar.gz`。
|
||||
|
||||
## 安装指定版本
|
||||
|
||||
Reference in New Issue
Block a user