feat: add header key auth as alternative to IP allowlist

docker-entrypoint.sh

@@ -6,9 +6,11 @@ set -e
 CONF_DIR="/etc/caddy"
 MATCHERS="${CONF_DIR}/matchers.caddy"
 GUARD="${CONF_DIR}/guard.caddy"
+SCRUB_EXTRA="${CONF_DIR}/scrub_extra.caddy"
 
 : > "${MATCHERS}"
 : > "${GUARD}"
+: > "${SCRUB_EXTRA}"
 
 # --- 0. Required settings ---
 if [ -z "${DOMAIN}" ]; then
@@ -20,13 +22,42 @@ if [ -z "${ACME_EMAIL}" ]; then
     exit 1
 fi
 
-# --- 1. IP allowlist ---
+# --- 1. API key header (optional bypass of the IP allowlist) ---
+KEY_MATCH=""
+if [ -n "${AUTH_HEADER_NAME}" ] || [ -n "${AUTH_HEADER_VALUE}" ]; then
+    if [ -z "${AUTH_HEADER_NAME}" ] || [ -z "${AUTH_HEADER_VALUE}" ]; then
+        echo "[entrypoint] FATAL: AUTH_HEADER_NAME and AUTH_HEADER_VALUE must be set together" >&2
+        exit 1
+    fi
+    case "${AUTH_HEADER_NAME}" in
+        *[!A-Za-z0-9-]*)
+            echo "[entrypoint] FATAL: AUTH_HEADER_NAME may contain only [A-Za-z0-9-]" >&2
+            exit 1 ;;
+    esac
+    case "${AUTH_HEADER_VALUE}" in
+        *[!A-Za-z0-9._~+/=-]*)
+            echo "[entrypoint] FATAL: AUTH_HEADER_VALUE may contain only [A-Za-z0-9._~+/=-]" >&2
+            exit 1 ;;
+    esac
+    KEY_MATCH="not header ${AUTH_HEADER_NAME} \"${AUTH_HEADER_VALUE}\""
+    echo "# strip the key header before it reaches upstreams" > "${SCRUB_EXTRA}"
+    echo "header_up -${AUTH_HEADER_NAME}" >> "${SCRUB_EXTRA}"
+    echo "[entrypoint] Header key auth configured (header: ${AUTH_HEADER_NAME})"
+fi
+
+# --- 2. IP allowlist (a valid key header also grants access) ---
 if [ -z "${ALLOWED_CIDR}" ]; then
     echo "[entrypoint] ALLOWED_CIDR is empty — allowing all IPs (dev mode)"
+    if [ -n "${KEY_MATCH}" ]; then
+        echo "[entrypoint] WARNING: header key has no effect while ALLOWED_CIDR is empty" >&2
+    fi
 else
     CIDR_LIST=$(echo "${ALLOWED_CIDR}" | tr ',' ' ' | tr -s ' ')
     cat >> "${MATCHERS}" <<MATCH
-@denied_ip not remote_ip ${CIDR_LIST}
+@denied_ip {
+	not remote_ip ${CIDR_LIST}
+	${KEY_MATCH}
+}
 MATCH
     cat >> "${GUARD}" <<GUARDRULE
 respond @denied_ip \`{"error":"ip_not_allowed"}\` 403 {
@@ -36,7 +67,7 @@ GUARDRULE
     echo "[entrypoint] IP allowlist configured: ${CIDR_LIST}"
 fi
 
-# --- 2. Token auth ---
+# --- 3. Token auth (legacy, applied in addition to the checks above) ---
 if [ -z "${PROXY_SECRET}" ]; then
     echo "[entrypoint] PROXY_SECRET is not set — token auth disabled (open mode)"
 else
@@ -51,7 +82,7 @@ GUARDRULE
     echo "[entrypoint] Token auth configured"
 fi
 
-# --- 3. Validate and start ---
+# --- 4. Validate and start ---
 caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
 echo "[entrypoint] Starting caddy (domain: ${DOMAIN})..."
 exec caddy run --config /etc/caddy/Caddyfile --adapter caddyfile