celguard: Improvements

With celguard I introduced a Traefik plugin that filters incoming HTTP requests based on freely definable rules. A lot has changed since then: version 0.4.1 ships several improvements that make day-to-day use noticeably easier.

Real client IPs behind proxies When running celguard behind a proxy or load balancer, the request shows the proxy’s address instead of the real client IP. The new source_ip option resolves the client IP from a header using a CEL expression:

matcher:
  source_ip: request.headers['x-real-ip']

Rules can now use request.source_ip; if the header is missing, the socket address is used as a fallback.

Simpler configuration The configuration is now clearly separated: the plugin section holds global settings such as default_status, while matcher contains the source_ip and the rules. Actions are defined right on the rule and can be shared between rules with YAML anchors – a separate list of actions is no longer needed.

Easier header checks Header values now arrive as a string or a list depending on the number of values, and there are small helper functions such as contains, lower, and trim. A rule like “block requests without a User-Agent” fits in a single line:

request.headers.contains('user-agent') == false

Faster and smaller Internally, the plugin moved to version 0.14 of the CEL crate, request evaluation was optimized, and the dependency tree was trimmed. The Wasm binary is smaller and requests are evaluated faster.

The current documentation with examples is available in the repository.