Gandalf

"You shall not pass!"

This is a simple Go app that exposes two routes:

• /check: returns a success or failure based on whether the client IP is permitted to access
• /let-me-in: stores the current client IP in a map of permitted addresses

Intended use case: protect my Jellyfin server from the world, but still make it available to people. A friend can access https://my.site.com/let-me-in and then be able to visit https://jellyfin.site.com.

Configuration

All configuration is performed through environment variables starting with GANDALF_.

• GANDALF_ALLOWLIST: a comma-separated list of IPs that will always be permitted access. No default.
• GANDALF_EXPIRATION: the number of hours for which a permitted IP will be granted access. Defaults to 24.
• GANDALF_PATH: the URL that will be used to let someone in.
• GANDALF_PORT: the port on which Gandalf will listen. Defaults to 8080.
• GANDALF_TRUSTED_PROXIES: a comma-separated list of IPs to configure the Gin.TrustedProxies setting. This is required to get the client IP from an X-FORWARDED_FOR header. No default.

localhost and 192.168. addresses are always permitted.

Caddy Configuration

The relevant Caddy config looks something like this:

jellyfin.site.com {
	forward_auth localhost:8080 {
		uri /check
	}
}

my.site.com {
	handle /let-me-in {
		reverse_proxy localhost:8080
	}
	...
}

Build Instructions

Build: go build -buildvcs=false -ldflags "-s -w" -o gandalf

Cross-compile: GOOS=linux GOARCH=arm64 go build -buildvcs=false -ldflags "-s -w" -o gandalf.arm64