feat: add EdgeOne X-Origin-Token validation

conf.d/00-maps.conf.template

@@ -0,0 +1,23 @@
+map_hash_bucket_size 128;
+
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+geo $is_internal {
+    default         0;
+    172.30.0.1      1;
+    192.168.10.0/24 1;
+}
+
+map $http_x_origin_token $valid_origin_token {
+    default            0;
+    ${EO_ORIGIN_TOKEN} 1;
+}
+
+map $is_internal$valid_origin_token $allow_access {
+    default 0;
+    10      1;
+    01      1;
+}

conf.d/10-default.conf.template

@@ -15,8 +15,3 @@ server {
 
     return 404;
 }
-
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}

conf.d/adguardhome.conf.template

@@ -5,7 +5,6 @@ server {
     server_name adguard.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://adguardhome;

conf.d/backrest.conf.template

@@ -5,7 +5,6 @@ server {
     server_name backrest.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://backrest:9898;

conf.d/qbittorrent.conf.template

@@ -5,7 +5,6 @@ server {
     server_name qbt.${BASE_DOMAIN};
 
     include snippets/proxy.conf;
-    include snippets/internal-only.conf;
 
     location / {
         proxy_pass http://qbittorrent:8080;

snippets/internal-only.conf.template

@@ -1,2 +0,0 @@
-allow 192.168.10.0/24;
-deny all;

snippets/proxy.conf.template

@@ -1,3 +1,7 @@
+if ($allow_access = 0) {
+    return 403;
+}
+
 # set headers
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $remote_addr;