ops: Implement ACL for internal APIs

2024-02-27 11:45:35 +09:00
parent 43fde86e9d
commit e918e1fdab
3 changed files with 16 additions and 2 deletions
--- a/production/nginx/location-api.conf
+++ b/production/nginx/location-api.conf
@@ -4,10 +4,17 @@

 # Block the internal APIs of esplora
 location /api/internal/ {
-	return 403;
+	if ($mempool_external) {
+		return 403;
+	}
+	rewrite ^/api/(.*) /$1 break;
+	try_files /dev/null @esplora-api-cache-disabled;
 }
 location /api/v1/internal/ {
-	return 403;
+	if ($mempool_external) {
+		return 403;
+	}
+	try_files /dev/null @mempool-api-v1-cache-normal;
 }

 # websocket has special HTTP headers