pmb
eb6d7cad46
docker-build-push / build-push (push) Successful in 5s
Publishes the IP ranges and email domains the bot has auto-blocked as JSON: GET /api/blocks, /api/blocks/ip-ranges, /api/blocks/email-domains, each taking an optional ?limit=N. The endpoints are unauthenticated, so BLOCKS_API_ENABLED gates them and defaults to false — with it unset the paths 404 as if they didn't exist. Publishing which ranges are already blocked also tells a spam signup which ones to avoid, so opting in is a per-deployment call; yttrx.com sets it true in the box's .env. Responses assert only that a block exists: the blocked range/domain, a signups count, and first/last seen. No account identifiers, and none of the ipapi.is or check-mail.org classification that drove the decision — republishing a paid reputation feed's verdicts on an open endpoint would be redistributing their data rather than ours. Supporting changes: - signup_ip gains a block_cidr column (migrated in place on open) so the API reports the network actually blocked rather than the signup IP. Rows predating it fall back to that IP's /32 or /128, which is exactly what was registered before range-blocking started 2026-07-15. - register_ip_block / register_email_domain_block now return whether the block landed, and the caller only marks it registered on success, so a failed POST is no longer published as a block that exists.
50 lines
1.7 KiB
Plaintext
50 lines
1.7 KiB
Plaintext
# /etc/nginx/sites-available/hooks on admin.yttrx.com
|
|
# Enable with: ln -s ../sites-available/hooks /etc/nginx/sites-enabled/hooks
|
|
|
|
server {
|
|
listen 80;
|
|
listen [::]:80;
|
|
server_name hooks.yttrx.com;
|
|
# certbot --nginx will manage the redirect / cert; left here for the
|
|
# initial standalone issuance flow described in the README.
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen 443 ssl;
|
|
listen [::]:443 ssl;
|
|
server_name hooks.yttrx.com;
|
|
|
|
ssl_certificate /etc/letsencrypt/live/hooks.yttrx.com/fullchain.pem;
|
|
ssl_certificate_key /etc/letsencrypt/live/hooks.yttrx.com/privkey.pem;
|
|
|
|
# Only the webhook endpoint and health check are exposed.
|
|
location = /webhook {
|
|
proxy_pass http://127.0.0.1:8087;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location = /healthz {
|
|
proxy_pass http://127.0.0.1:8087;
|
|
}
|
|
|
|
# Read-only blocklist API (GET /api/blocks, /api/blocks/ip-ranges,
|
|
# /api/blocks/email-domains). Unauthenticated by design, and gated in the
|
|
# app by BLOCKS_API_ENABLED — with that unset the app 404s these paths,
|
|
# so proxying them here exposes nothing on its own.
|
|
location ^~ /api/blocks {
|
|
proxy_pass http://127.0.0.1:8087;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
|
|
location / {
|
|
return 404;
|
|
}
|
|
}
|