restrict ldap UI to local network only

README.md

@@ -10,6 +10,7 @@ services. Also, the design will be extendable to allow users to add services not
 
 - [ ] SSO with Authelia.
 - [X] LDAP server through lldap, it provides a nice Web UI.
+  - [X] Administrative UI only accessible from local network.
 - [X] Backup with Restic or BorgBackup
 - [X] Monitoring through Prometheus and Grafana.
   - [X] Export systemd services status.

modules/ldap.nix

@@ -32,6 +32,12 @@ in
       description = "Sops file location";
       example = "secrets/ldap.yaml";
     };
+
+    localNetworkIPRange = lib.mkOption {
+      type = lib.types.str;
+      description = "Local network range, to restrict access to the UI to only those IPs.";
+      example = "192.168.1.1/24";
+    };
   };
 
   
@@ -61,6 +67,8 @@ in
         locations."/" = {
           extraConfig = ''
             proxy_set_header Host $host;
+            allow ${cfg.localNetworkIPRange};
+            deny all;
           '';
           proxyPass = "http://${toString config.services.lldap.settings.http_host}:${toString config.services.lldap.settings.http_port}/";
         };