Generalize reverse proxy source allowlist

deploy/scripts/firewall-8191.sh

@@ -2,7 +2,7 @@
 set -eu
 
 action=${1:-check}
-source_cidr=${CADDY_SOURCE_CIDR:-}
+trusted_proxy_cidrs=${TRUSTED_PROXY_CIDRS:-${CADDY_SOURCE_CIDR:-}}
 image_port=${IMAGE_PORT:-8191}
 chain=SAM_IMAGE_INGRESS
 
@@ -24,15 +24,31 @@ case "$action" in
         ;;
     apply)
         require_root
-        if [ -z "$source_cidr" ]; then
-            echo "CADDY_SOURCE_CIDR is required" >&2
+        if [ -z "$trusted_proxy_cidrs" ]; then
+            echo "TRUSTED_PROXY_CIDRS is required" >&2
+            exit 2
+        fi
+        rule_count=0
+        for trusted_proxy_cidr in $(printf '%s' "$trusted_proxy_cidrs" | tr ',' ' '); do
+            case "$trusted_proxy_cidr" in
+                *[!0-9A-Fa-f:./]*)
+                    echo "Invalid trusted proxy CIDR: $trusted_proxy_cidr" >&2
+                    exit 2
+                    ;;
+            esac
+            rule_count=$((rule_count + 1))
+        done
+        if [ "$rule_count" -eq 0 ]; then
+            echo "TRUSTED_PROXY_CIDRS must contain at least one CIDR" >&2
             exit 2
         fi
         iptables -n -L DOCKER-USER >/dev/null
         iptables -n -L "$chain" >/dev/null 2>&1 || iptables -N "$chain"
         iptables -F "$chain"
-        iptables -A "$chain" -s "$source_cidr" -j ACCEPT
         iptables -A "$chain" -j DROP
+        for trusted_proxy_cidr in $(printf '%s' "$trusted_proxy_cidrs" | tr ',' ' '); do
+            iptables -I "$chain" 1 -s "$trusted_proxy_cidr" -j ACCEPT
+        done
         iptables -C DOCKER-USER -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain" 2>/dev/null \
             || iptables -I DOCKER-USER 1 -p tcp -m conntrack --ctorigdstport "$image_port" -j "$chain"
         ;;