wind-explorer/mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ip whitelist

Browse Source
This commit is contained in:
wind-explorer
2026-08-11 02:02:39 +08:00
parent 6e0b0c92d1
commit b62c74b883
10 changed files with 270 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -1
View File
@@ -11,6 +11,21 @@ A read-only Axum + Svelte sidecar for `itzg/docker-minecraft-server`. It streams
The container runs as UID/GID `10001`, uses a read-only root filesystem, drops every capability, does not mount the Docker socket, and mounts the shared Minecraft volume at `/data:ro`.
The Compose example bind-mounts the host directory `log-viewer-config` and reads
`log-viewer-config/ip-whitelist.txt`. Put one IP address or CIDR on each line
(`#` comments are supported) to grant an explicit owner override. Mount the
directory rather than the individual file: editors commonly save by replacing a
file, and an individual Docker file bind mount remains attached to the replaced
inode. The file is read after normal player authorization fails on every access
attempt, so edits take effect without restarting the viewer. An unreadable or
malformed file grants no override.
With `RUST_LOG=minecraft_log_viewer=debug,tower_http=info`, each API access logs
the effective client IP and authorization source. Override checks also log the
configured path, complete parsed IP/CIDR list, match/miss result, and read or
parse errors. The complete set of IPs authorized through successful joins and
the current Minecraft whitelist is logged as `allowed_player_ips`.
Example Caddy integration:
```caddyfile
@@ -27,7 +42,7 @@ Only successful joins in the current `latest.log` count. Failed, banned, rejecte
## Configuration
Required: `PUBLIC_ORIGIN`. Paths default to `/data`, `/data/logs`, `/data/logs/latest.log`, and `/data/whitelist.json`. The Compose example documents proxy and redaction settings. Resource limits are configurable with `INITIAL_LOG_LINES`, `MAX_HISTORY_LINES_PER_REQUEST`, `ARCHIVE_CACHE_MAX_BYTES`, `ARCHIVE_CACHE_MAX_FILES`, `MAX_ARCHIVE_DECOMPRESSED_BYTES`, `WS_CLIENT_QUEUE_CAPACITY`, and `MAX_WS_CONNECTIONS`.
Required: `PUBLIC_ORIGIN`. Paths default to `/data`, `/data/logs`, `/data/logs/latest.log`, and `/data/whitelist.json`. Set optional `IP_WHITELIST_FILE` to a mounted owner-managed IP/CIDR file. The Compose example documents proxy and redaction settings. Resource limits are configurable with `INITIAL_LOG_LINES`, `MAX_HISTORY_LINES_PER_REQUEST`, `ARCHIVE_CACHE_MAX_BYTES`, `ARCHIVE_CACHE_MAX_FILES`, `MAX_ARCHIVE_DECOMPRESSED_BYTES`, `WS_CLIENT_QUEUE_CAPACITY`, and `MAX_WS_CONNECTIONS`.
Malformed startup configuration or an unreadable initial whitelist fails closed. Later malformed whitelist updates retain the last valid snapshot.