vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(zed-fim-proxy): source-IP allowlist stays OFF by design (Zed roams WG 10.0.0.0/8)

Browse Source
This commit is contained in:
vh
2026-07-27 22:58:22 -07:00
parent a300cdcd26
commit 792aa2852c
3 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stacks/zed-fim-proxy/.env.example
+6 -4
View File
@@ -10,10 +10,12 @@ ZED_UPSTREAM=http://localhost:4000
# The ONLY model this route will forward (proxy rejects any other "model").
ZED_ALLOWED_MODEL=coder-fast
# Best-effort source-IP allowlist (comma-separated). Empty = allow all — fine on the
# internal network, but TIGHTEN to the Mac's observed source IP once it connects
# (watch `docker logs zed-fim-proxy` for the real source). Only meaningful if the
# proxy sees the real client IP (network_mode: host); a site-to-site NAT may mask it.
# Source-IP allowlist (comma-separated, EXACT IPs). Empty = allow all.
# LEFT EMPTY BY DESIGN (operator direction 2026-07-27): Zed roams the operator's
# WireGuard 10.0.0.0/8, so a single-IP pin would break it — do NOT tighten. The
# route is bounded instead by the coder-fast-scoped key + the model/path allowlist
# (keyless but coder-fast-only, internal-net-only). NOTE: this proxy matches exact
# IPs only — scoping to a CIDR like 10.0.0.0/8 would need CIDR support (not added).
ZED_ALLOWED_IPS=
# A LiteLLM virtual key SCOPED TO ZED_ALLOWED_MODEL ONLY (the real blast-radius
stacks/zed-fim-proxy/README.md
+6 -5
View File
@@ -26,11 +26,12 @@ safe if it can't be pivoted:
(`POST /key/generate {"models":["coder-fast"]}`). Even if guards 1–2 were
bypassed, the key reaches nothing else (verified: 403 on `gen`). **This is the
real blast-radius bound.**
4. **Best-effort source-IP allowlist** (`ZED_ALLOWED_IPS`) — only enforceable if
the proxy sees the real client IP (hence `network_mode: host`; docker
port-publish would NAT it away). A site-to-site NAT may still mask the Mac's
`10.0.10.83` — verify against `docker logs zed-fim-proxy` and tighten. Internal
network only; no public exposure.
4. **Source-IP allowlist** (`ZED_ALLOWED_IPS`) — **intentionally left OFF**
(operator direction 2026-07-27): Zed roams the operator's WireGuard
`10.0.0.0/8`, so a single-IP pin would break it. **Do NOT tighten.** The
keyless route is bounded by guards 1–3 (coder-fast-only, `/v1/completions`-only,
scoped key) and is internal-network only. (The proxy matches exact IPs; a
`10.0.0.0/8` CIDR would need CIDR support — deliberately not added.)
## Deploy