Restrict NGINX to Cloudflare IPs only
Nobody has claimed this yet.
- Dominant language
- Jinja
- Stars
- 541
- Forks
- 185
- Avg merge
- 22h 15m
- Merged PRs (30d)
- 4
Description
Currently, anyone can access direct.nodejs.org, bypassing the Cloudflare CDN, caching and protection. It is relatively well documented that folks are using this to get around some of the blocking that was put in place for misconfigured Artifactory instances etc.
The NGINX config should be updated such that it only accepts connections from Cloudflare, removing the ability to make HTTP requests to direct.nodejs.org. As I understand it, the hostname itself needs to remain (unproxied) for SSH access etc., but I don't believe there is any need for direct HTTP access, so I believe this should be fine to do?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the NGINX configuration serving direct.nodejs.org and review how Cloudflare source ranges and SSH access are handled. Confirm that HTTP accepts only Cloudflare IPs while the hostname remains available for SSH, then validate the configuration and test direct HTTP access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx
- Domain
- infrastructure, networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100