From 0af1ad923cd2aa61a201d65ce4f19acb13858790 Mon Sep 17 00:00:00 2001
From: Offending Commit <offendingcommit@gmail.com>
Date: Tue, 2 Jun 2026 13:12:29 -0500
Subject: [PATCH] feat(docker): render SSRF allowlist map from env

---
 docker/40-openconcho-config.sh | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/docker/40-openconcho-config.sh b/docker/40-openconcho-config.sh
index 864de84..cba4a9e 100644
--- a/docker/40-openconcho-config.sh
+++ b/docker/40-openconcho-config.sh
@@ -9,3 +9,25 @@ set -eu
 cat > /usr/share/nginx/html/config.js <<EOF
 window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}";
 EOF
+
+# Render the SSRF allowlist into an nginx map for $allow_upstream.
+# Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the
+# localhost-bound default. Set it (comma-separated host globs) before exposing
+# the proxy (e.g. behind a tunnel) to reject non-matching upstreams.
+ALLOWLIST_CONF=/etc/nginx/conf.d/allowlist_map.conf
+if [ -z "${OPENCONCHO_UPSTREAM_ALLOWLIST:-}" ]; then
+	printf 'map $http_x_honcho_upstream $allow_upstream { default 1; }\n' > "$ALLOWLIST_CONF"
+else
+	{
+		printf 'map $http_x_honcho_upstream $allow_upstream {\n'
+		printf '    default 0;\n'
+		IFS=','
+		for host in $OPENCONCHO_UPSTREAM_ALLOWLIST; do
+			host=$(printf '%s' "$host" | tr -d ' ')
+			[ -z "$host" ] && continue
+			esc=$(printf '%s' "$host" | sed -e 's/[.]/\\./g' -e 's#[*]#[^/]*#g')
+			printf '    "~^https?://%s(:[0-9]+)?(/.*)?$" 1;\n' "$esc"
+		done
+		printf '}\n'
+	} > "$ALLOWLIST_CONF"
+fi