@abtnode/router-provider 1.16.45-beta-20250624-134945-a23c15fc → 1.16.45-beta-20250625-064956-91b0fb8f

package/lib/nginx/index.js

@@ -224,6 +224,9 @@ class NginxProvider extends BaseProvider {
         } else {
           this.updateBlacklist([]);
         }
+
+        this.updateWhitelist();
+
         this.updateProxyPolicy(proxyPolicy);
 
         const allRules = sites.reduce((acc, site) => {
@@ -897,7 +900,12 @@ class NginxProvider extends BaseProvider {
       server._add('listen', `${decideHttpsPort()} ssl`);
     }
 
-    server._add('return', '444');
+    if (process.env.ABT_NODE_IP_WHITELIST) {
+      server._addVerbatimBlock('if ($access_trusted = 0)', 'return 444;');
+      server._add('return', '200');
+    } else {
+      server._add('return', '444');
+    }
   }
 
   _addStubStatusLocation(conf) {
@@ -1190,6 +1198,18 @@ class NginxProvider extends BaseProvider {
     fs.writeFileSync(blacklistFile, blacklist.map((x) => `${x} 1;`).join(os.EOL));
   }
 
+  updateWhitelist() {
+    try {
+      const whitelistFile = path.join(this.includesDir, 'whitelist');
+      let whitelist = process.env.ABT_NODE_IP_WHITELIST?.split(',') || []; // IP 地址列表，支持 CIDR 格式
+      whitelist = whitelist.map((x) => x.trim()).filter(Boolean);
+
+      fs.writeFileSync(whitelistFile, whitelist.map((x) => `${x} 1;`).join(os.EOL));
+    } catch (error) {
+      logger.error('Failed to update whitelist', { error, env: process.env.ABT_NODE_IP_WHITELIST });
+    }
+  }
+
   updateProxyPolicy(proxyPolicy) {
     const proxyRaw = fs.readFileSync(path.join(this.includesDir, 'proxy.raw'), 'utf8');
     const proxyPolicyFile = path.join(this.includesDir, 'proxy');
@@ -1447,6 +1467,10 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     await provider.start();
     await provider.stop();
 
+    if (fs.existsSync(testDir)) {
+      fs.rmSync(testDir, { recursive: true, force: true });
+    }
+
     return result;
   } catch (error) {
     if (process.env.DEBUG) {
@@ -1456,10 +1480,6 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     result.error = error.message;
     logger.error('check nginx failed', { error });
     return result;
-  } finally {
-    if (fs.existsSync(testDir)) {
-      fs.rmSync(testDir, { recursive: true, force: true });
-    }
   }
 };
 

package/lib/nginx/util.js

@@ -209,6 +209,10 @@ real_ip_recursive ${proxyPolicy?.trustRecursive ? 'on' : 'off'};`
       default 0;
       include includes/blacklist;
     }
+    geo $access_trusted {
+      default 0;
+      include includes/whitelist;
+    }
     map $http_upgrade $connection_upgrade {
       default upgrade;
       '' "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.45-beta-20250624-134945-a23c15fc",
+  "version": "1.16.45-beta-20250625-064956-91b0fb8f",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,11 +32,11 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/db-cache": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/logger": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/router-templates": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/util": "1.16.45-beta-20250624-134945-a23c15fc",
+    "@abtnode/constant": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/db-cache": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/logger": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/router-templates": "1.16.45-beta-20250625-064956-91b0fb8f",
+    "@abtnode/util": "1.16.45-beta-20250625-064956-91b0fb8f",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "@ocap/util": "^1.20.14",
@@ -62,5 +62,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "3b56a1dbe3fea9df0d6b644a1821afae9b376ee8"
+  "gitHead": "90b9c4c9352f9ae33139f4e376b97b3be43698fa"
 }