From adcdf6e8c80317dae403f1d27cb0eeaeeda98f15 Mon Sep 17 00:00:00 2001
From: lingkai5wu <lingkai5wu@outlook.com>
Date: Mon, 21 Sep 2026 23:58:08 +0800
Subject: [PATCH] feat: add EdgeOne X-Origin-Token validation

---
 conf.d/00-maps.conf.template                  | 23 +++++++++++++++++++
 ...conf.template => 10-default.conf.template} |  5 ----
 conf.d/adguardhome.conf.template              |  1 -
 conf.d/backrest.conf.template                 |  1 -
 conf.d/qbittorrent.conf.template              |  1 -
 snippets/internal-only.conf.template          |  2 --
 snippets/proxy.conf.template                  |  4 ++++
 7 files changed, 27 insertions(+), 10 deletions(-)
 create mode 100644 conf.d/00-maps.conf.template
 rename conf.d/{default.conf.template => 10-default.conf.template} (76%)
 delete mode 100644 snippets/internal-only.conf.template

diff --git a/conf.d/00-maps.conf.template b/conf.d/00-maps.conf.template
new file mode 100644
index 0000000..6cf1899
--- /dev/null
+++ b/conf.d/00-maps.conf.template
@@ -0,0 +1,23 @@
+map_hash_bucket_size 128;
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+geo $is_internal {
+    default         0;
+    172.30.0.1      1;
+    192.168.10.0/24 1;
+}
+
+map $http_x_origin_token $valid_origin_token {
+    default            0;
+    ${EO_ORIGIN_TOKEN} 1;
+}
+
+map $is_internal$valid_origin_token $allow_access {
+    default 0;
+    10      1;
+    01      1;
+}
diff --git a/conf.d/default.conf.template b/conf.d/10-default.conf.template
similarity index 76%
rename from conf.d/default.conf.template
rename to conf.d/10-default.conf.template
index a080ff9..72f7d7f 100644
--- a/conf.d/default.conf.template
+++ b/conf.d/10-default.conf.template
@@ -15,8 +15,3 @@ server {
 
     return 404;
 }
-
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
diff --git a/conf.d/adguardhome.conf.template b/conf.d/adguardhome.conf.template
index c46ecd9..ce99cad 100644
--- a/conf.d/adguardhome.conf.template
+++ b/conf.d/adguardhome.conf.template
@@ -5,7 +5,6 @@ server {
     server_name adguard.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://adguardhome;
diff --git a/conf.d/backrest.conf.template b/conf.d/backrest.conf.template
index e557460..3b1bd7c 100644
--- a/conf.d/backrest.conf.template
+++ b/conf.d/backrest.conf.template
@@ -5,7 +5,6 @@ server {
     server_name backrest.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://backrest:9898;
diff --git a/conf.d/qbittorrent.conf.template b/conf.d/qbittorrent.conf.template
index bddc427..5b52f6d 100644
--- a/conf.d/qbittorrent.conf.template
+++ b/conf.d/qbittorrent.conf.template
@@ -5,7 +5,6 @@ server {
     server_name qbt.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://qbittorrent:8080;
diff --git a/snippets/internal-only.conf.template b/snippets/internal-only.conf.template
deleted file mode 100644
index 232b40d..0000000
--- a/snippets/internal-only.conf.template
+++ /dev/null
@@ -1,2 +0,0 @@
-allow 192.168.10.0/24;
-deny all;
diff --git a/snippets/proxy.conf.template b/snippets/proxy.conf.template
index bcabf1a..fd5bae5 100644
--- a/snippets/proxy.conf.template
+++ b/snippets/proxy.conf.template
@@ -1,3 +1,7 @@
+if ($allow_access = 0) {
+    return 403;
+}
+
 # set headers
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $remote_addr;