Monviech / os-caddy-plugin

Caddy Plugin with GUI for OPNsense
Other
38 stars 0 forks source link

Add abort as final directive after all handles #70

Closed Monviech closed 8 months ago

Monviech commented 8 months ago

Abort all connections that didn't match any handle by default. Otherwise they stay connected to the Frontend Domain even though the connection is not valid.

This is no security risk.

https://caddyserver.com/docs/caddyfile/directives/abort

Example:

example.com {
        @e030f6bb-9ed3-4389-ae68-0289ddad53da {
                client_ip 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8
        }
        handle @e030f6bb-9ed3-4389-ae68-0289ddad53da {
                handle {
                        reverse_proxy 192.168.1.1:7860 {
                        }
                }
        }
        abort
}

Needs a small template adjustement.

I can't place the abort first because it would break current functionality with the access lists. It would invert the logic of it, leaving all configurations that already use the access lists inverted.

An option in General Settings "Reject Unmatched Connections" will be added that that makes this behavior selectable.