apicast-policy.json

{
  "$schema": "http://apicast.io/policy-v1.1/schema",
  "name": "IP Check",
  "summary": "Accepts or denies a request based on the IP.",
  "description": [
    "Accepts or denies requests according to a whitelist or a blacklist of ",
    "IPs. \n",
    "In the configuration, both single IPs (like 172.18.0.1) and CIDR ",
    "ranges (like 172.18.0.0/16) can be used."
  ],
  "version": "builtin",
  "configuration": {
    "type": "object",
    "properties": {
      "check_type": {
        "description": "The type of check to apply",
        "type": "string",
        "oneOf": [
          {
            "enum": ["blacklist"],
            "title": "Block the IPs included in the list"
          },
          {
            "enum": ["whitelist"],
            "title": "Allow only the IPs included in the list"
          }
        ]
      },
      "ips": {
        "description": "List of IPs",
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "error_msg": {
        "description": "",
        "type": "string",
        "default": "IP address not allowed"
      },
      "client_ip_sources": {
        "description": "Specifies how to get the client IP and in which order the options are tried",
        "type": "array",
        "default": ["last_caller"],
        "minItems": 1,
        "maxItems": 3,
        "items": {
          "type": "string",
          "anyOf": [
            {
              "enum": ["X-Forwarded-For"],
              "title": "Get the IP from the X-Forwarded-For header (first IP of the list)"
            },
            {
              "enum": ["X-Real-IP"],
              "title": "Get the IP from the X-Real-IP header"
            },
            {
              "enum": ["proxy_protocol_addr"],
              "title": "Get the IP from the proxy_protocol_addr variable"
            },
            {
              "enum": ["last_caller"],
              "title": "Use the IP of the last caller"
            }
          ]
        }
      }
    },
    "required": ["ips", "check_type"]
  }
}