From 42855403af15957ac055edf603f1d03e0ca025b3 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Thu, 12 Feb 2026 22:58:39 +0000
Subject: [PATCH] Restrict direct access to the web frontends

---
 cookbooks/web/recipes/frontend.rb             | 11 ++++++
 .../web/templates/default/apache.frontend.erb | 35 +++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/cookbooks/web/recipes/frontend.rb b/cookbooks/web/recipes/frontend.rb
index b67965594..0132c99c1 100644
--- a/cookbooks/web/recipes/frontend.rb
+++ b/cookbooks/web/recipes/frontend.rb
@@ -25,6 +25,7 @@ include_recipe "fail2ban"
 include_recipe "web::rails"
 include_recipe "web::cgimap"
 
+admins = data_bag_item("apache", "admins")
 web_passwords = data_bag_item("web", "passwords")
 
 apache_module "alias"
@@ -68,9 +69,19 @@ end
 
 fastlyips = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/fastly-ip-list.json"))
 
+remote_file "#{Chef::Config[:file_cache_path]}/statuscake-locations.json" do
+  source "https://app.statuscake.com/Workfloor/Locations.php?format=json"
+  compile_time true
+  ignore_failure true
+end
+
+statuscakelocations = JSON.parse(IO.read("#{Chef::Config[:file_cache_path]}/statuscake-locations.json"))
+
 apache_site "www.openstreetmap.org" do
   template "apache.frontend.erb"
   variables :fastly => fastlyips["addresses"] + fastlyips["ipv6_addresses"],
+            :statuscake => statuscakelocations.flat_map { |_, v| [v["ip"], v["ipv6"]] },
+            :admins => admins["hosts"],
             :status => node[:web][:status],
             :secret_key_base => web_passwords["secret_key_base"]
 end
diff --git a/cookbooks/web/templates/default/apache.frontend.erb b/cookbooks/web/templates/default/apache.frontend.erb
index 0e180045e..7fcf281c4 100644
--- a/cookbooks/web/templates/default/apache.frontend.erb
+++ b/cookbooks/web/templates/default/apache.frontend.erb
@@ -242,6 +242,41 @@ ErrorLog /var/log/apache2/error.log
   RewriteCond %{HTTP_HOST} =api.openstreetmap.org
   RewriteCond %{REQUEST_URI} !^/api/
   RewriteRule ^(.*)$ https://www.openstreetmap.org$1 [L,NE,R=permanent]
+
+  # Restrict access to CDN nodes and admins
+  <Location />
+    Require expr "%{CONN_REMOTE_ADDR} != %{REMOTE_ADDR}"
+    # Fastly POPs
+<% @fastly.sort.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+    # StatusCake monitoring
+<% @statuscake.sort.reject { |address| address.empty? }.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+    # Administrators
+<% @admins.sort.each do |address| -%>
+    Require ip <%= address %>
+<% end -%>
+    # OSM Amsterdam IPv4 (he.net)
+    Require ip 184.104.179.128/27
+    # OSM Amsterdam IPv4 (equinix)
+    Require ip 82.199.86.96/27
+    # OSM Amsterdam IPv6 (he.net)
+    Require ip 2001:470:1:fa1::/64
+    # OSM Amsterdam IPv6 (equinix)
+    Require ip 2001:4d78:500:5e3::/64
+    # OSM Dublin IPv4 (he.net)
+    Require ip 184.104.226.96/27
+    # OSM Dublin IPv4 (equinix)
+    Require ip 87.252.214.96/27
+    # OSM Dublin IPv6 (he.net)
+    Require ip 2001:470:1:b3b::/64
+    # OSM Dublin IPv6 (equinix)
+    Require ip 2001:4d78:fe03:1c::/64
+    # OSM UCL IPv4
+    Require ip 193.60.236.0/24
+  </Location>
 </VirtualHost>
 
 <VirtualHost *:80>
-- 
2.39.5