Expose IP allow list configuration in cluster web interface

[gsanchietti]

Issue #7312 addresses the need for limiting access to certain NS8 services to trusted networks/IPs by configuring the Traefik router. This feature is important for enhancing security by restricting access based on IP addresses.

Proposed solution
Expose the IP Allow List configuration feature in the cluster web interface. This enhancement would allow administrators to manage IP restrictions directly through the web interface, making it more user-friendly and accessible.

References:

• Original Issue #7312
• Traefik IP Allow List Documentation

[gsanchietti]

Testing image: core-3.6.1-dev.1

Test case 1

• Update an existing installation
• Access "Settings" -> "HTTP routes"
• Verify that automatic routes are tagged as such inside the route list
• Verify that manual routes do not have the automatic tag

Test case 2

• Try to add a new manual route
• Verify there is a new "Restrict access from" field at the end of the drawer
• Try to add an invalid IP address, verify an error is raised
• Add one or more valid IP addresses
• Verify the root is accessible only from configured addresses
• Verify the route has new tag inside the route list

Test case 3

• Open the details of the routes
• Verify the "Restrict access from" is listed in the details modal

Test case 4

• Edit an automatic routes (previously, such routes were not editable)
• Add one ore more IP address inside the "Restrict access from" field
• Save the changes and verify the route is still marked as automatic
• Verify the routes accessible only from configured addresses

Test case 5

• Verify the "Edit" action is the first element on the kebab menu of each route

[DavidePrincipi]

@gsanchietti great feature! Could you explain the new UI feature also in the Proxy manual page? https://docs.nethserver.org/projects/ns8/en/latest/proxy.html

[DavidePrincipi]

VERIFIED

It is important to state in the manual that the default "cluster-admin" route if restricted to some IPs may prevent a new worker from joining the cluster https://docs.nethserver.org/projects/ns8/en/latest/system_requirements.html#worker-node-requirements.

This may be worth an UI notice too.