Change path to nix-support/private

flake.nix

@@ -84,8 +84,8 @@
         packages = {
           inherit nix-serve-ng lix-serve-ng;
           private = pkgs.runCommand "private" { } ''
-            mkdir -p $out/nix-support
+            mkdir $out
-            touch $out/nix-support/private
+            touch $out/.private
           '';
           default = nix-serve-ng;
         };

src/Main.hs

@@ -12,6 +12,7 @@ import Control.Monad.IO.Class (liftIO)
 import Data.ByteString (ByteString)
 import Data.CharSet.ByteSet (ByteSet(..))
 import Data.Function ((&))
+import Data.Word (Word8)
 import Network.Socket (SockAddr(..))
 import Network.Wai (Application)
 import Nix (NoSuchPath(..), PathInfo(..))
@@ -57,6 +58,20 @@ validHashPartBytes =
         <>  [ 0x76 .. 0x7A ]  -- vwxyz
         )
 
+type HostAddressTuple = (Word8, Word8, Word8, Word8)
+
+isAllowed :: Socket.HostAddress -> Bool
+isAllowed host = any (uncurry (ipMatches $ Socket.hostAddressToTuple host)) allowedIPs
+    where
+        allowedIPs :: [(HostAddressTuple, HostAddressTuple)]
+        allowedIPs = [
+                ((127,0,0,1),    (127,0,0,1)),
+                ((10,0,0,1),     (10,255,255,254)),
+                ((192,168,72,1), (192,168,79,254))
+            ]
+
+        ipMatches ip a b = ip >= a && ip <= b
+
 validHashPart :: ByteString -> Bool
 validHashPart hash = ByteString.all (`ByteSet.member` validHashPartBytes) hash
 
@@ -256,8 +271,27 @@ makeApplication ApplicationOptions{..} request respond = do
                 let privateFilePath = ByteString.Char8.unpack storePath ++ "/nix-support/private"
                 isPrivate <- liftIO $ Directory.doesPathExist privateFilePath
 
+                let isLocalNet = case Wai.remoteHost request of
+                                    SockAddrInet _ host -> isAllowed host
+                                    _ -> False
+
+                traceM $ show (Wai.remoteHost request, isLocalNet)
                 traceM $ show (privateFilePath, isPrivate)
 
+                Monad.when (isPrivate && not isLocalNet) do
+                    let headers = [ ("Content-Type", "text/plain") ]
+
+                    let builder = "Forbidden.\n"
+
+                    let response =
+                            Wai.responseBuilder
+                                    Types.status403
+                                    headers
+                                    builder
+
+                    done response
+
+
                 let streamingBody write flush = do
                        result <- Nix.dumpPath hashPart callback
 
@@ -269,7 +303,7 @@ makeApplication ApplicationOptions{..} request respond = do
                             () <- write builder
                             flush
 
-                let headers = [ ("Content-Type", "text/plain") ] <> [("X-Private", "true") | isPrivate]
+                let headers = [ ("Content-Type", "text/plain") ]
 
                 let response =
                         Wai.responseStream Types.status200 headers streamingBody