@abtnode/router-provider 1.16.45-beta-20250624-134945-a23c15fc → 1.16.45-beta-20250625-103530-e1f5b0b8

package/lib/nginx/index.js

@@ -224,6 +224,9 @@ class NginxProvider extends BaseProvider {
         } else {
           this.updateBlacklist([]);
         }
+
+        this.updateWhitelist();
+
         this.updateProxyPolicy(proxyPolicy);
 
         const allRules = sites.reduce((acc, site) => {
@@ -293,8 +296,13 @@ class NginxProvider extends BaseProvider {
         }
 
         if (enableDefaultServer) {
-          this._addDefaultServer(conf, nodeInfo.port);
-          logger.info('enable default server success');
+          const existDefaultServer = !!sites.find((x) => x.domain === '_');
+          if (existDefaultServer) {
+            logger.info('default server is declared by blocklet server');
+          } else {
+            this._addDefaultServer(conf, nodeInfo.port);
+            logger.info('add default server success');
+          }
         } else {
           this._addDefaultBlackHoleServer(conf);
           logger.info('add default blackhole server success');
@@ -897,7 +905,12 @@ class NginxProvider extends BaseProvider {
       server._add('listen', `${decideHttpsPort()} ssl`);
     }
 
-    server._add('return', '444');
+    if (process.env.ABT_NODE_IP_WHITELIST) {
+      server._addVerbatimBlock('if ($access_trusted = 0)', 'return 444;');
+      server._add('return', '200');
+    } else {
+      server._add('return', '444');
+    }
   }
 
   _addStubStatusLocation(conf) {
@@ -985,7 +998,10 @@ class NginxProvider extends BaseProvider {
   }
 
   _addHttpServerUnit({ conf, serverName, port = '' }) {
-    const listen = port || this.httpPort;
+    let listen = port || this.httpPort;
+    if (serverName === '_') {
+      listen = `${listen} default_server`;
+    }
 
     conf.nginx.http._add('server');
     const httpServerUnit = this._getLastServer(conf);
@@ -1190,6 +1206,18 @@ class NginxProvider extends BaseProvider {
     fs.writeFileSync(blacklistFile, blacklist.map((x) => `${x} 1;`).join(os.EOL));
   }
 
+  updateWhitelist() {
+    try {
+      const whitelistFile = path.join(this.includesDir, 'whitelist');
+      let whitelist = process.env.ABT_NODE_IP_WHITELIST?.split(',') || []; // IP 地址列表，支持 CIDR 格式
+      whitelist = whitelist.map((x) => x.trim()).filter(Boolean);
+
+      fs.writeFileSync(whitelistFile, whitelist.map((x) => `${x} 1;`).join(os.EOL));
+    } catch (error) {
+      logger.error('Failed to update whitelist', { error, env: process.env.ABT_NODE_IP_WHITELIST });
+    }
+  }
+
   updateProxyPolicy(proxyPolicy) {
     const proxyRaw = fs.readFileSync(path.join(this.includesDir, 'proxy.raw'), 'utf8');
     const proxyPolicyFile = path.join(this.includesDir, 'proxy');
@@ -1447,6 +1475,10 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     await provider.start();
     await provider.stop();
 
+    if (fs.existsSync(testDir)) {
+      fs.rmSync(testDir, { recursive: true, force: true });
+    }
+
     return result;
   } catch (error) {
     if (process.env.DEBUG) {
@@ -1456,10 +1488,6 @@ NginxProvider.check = async ({ configDir = '' } = {}) => {
     result.error = error.message;
     logger.error('check nginx failed', { error });
     return result;
-  } finally {
-    if (fs.existsSync(testDir)) {
-      fs.rmSync(testDir, { recursive: true, force: true });
-    }
   }
 };
 

package/lib/nginx/util.js

@@ -209,6 +209,10 @@ real_ip_recursive ${proxyPolicy?.trustRecursive ? 'on' : 'off'};`
       default 0;
       include includes/blacklist;
     }
+    geo $access_trusted {
+      default 0;
+      include includes/whitelist;
+    }
     map $http_upgrade $connection_upgrade {
       default upgrade;
       '' "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.45-beta-20250624-134945-a23c15fc",
+  "version": "1.16.45-beta-20250625-103530-e1f5b0b8",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,11 +32,11 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/db-cache": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/logger": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/router-templates": "1.16.45-beta-20250624-134945-a23c15fc",
-    "@abtnode/util": "1.16.45-beta-20250624-134945-a23c15fc",
+    "@abtnode/constant": "1.16.45-beta-20250625-103530-e1f5b0b8",
+    "@abtnode/db-cache": "1.16.45-beta-20250625-103530-e1f5b0b8",
+    "@abtnode/logger": "1.16.45-beta-20250625-103530-e1f5b0b8",
+    "@abtnode/router-templates": "1.16.45-beta-20250625-103530-e1f5b0b8",
+    "@abtnode/util": "1.16.45-beta-20250625-103530-e1f5b0b8",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
     "@ocap/util": "^1.20.14",
@@ -62,5 +62,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "3b56a1dbe3fea9df0d6b644a1821afae9b376ee8"
+  "gitHead": "68ba563213161265ceb38eaec06d43454a341f48"
 }