feat(security): Add whitelisting and better security filtering

[nfebe]

…tion

• Whitelist table with default internal IPs/paths prevents self-blocking
• CRUD API for whitelist management (/api/security/whitelist)
• RejectUnknownDomains config drops connections to unconfigured hosts
• Real client IP extracted from CF-Connecting-IP/X-Forwarded-For headers
• Docker gateway auto-whitelisted on startup
• /stats endpoint includes networks and ports counts

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.

[sourceant]

Review complete. No specific code suggestions were generated. See the overview comment for a summary.

[sourceant]

Code Review Summary

✨ This pull request significantly enhances the agent's security capabilities by introducing an IP/CIDR/path whitelisting mechanism, both managed by the agent and integrated into Nginx via Lua scripts. It also adds functionality for tracking unknown domain traffic statistics and improves Nginx configuration flexibility. The changes introduce several valuable security and monitoring features.

🚀 Key Improvements

• Introduction of a robust whitelisting feature for IPs, CIDRs, and request paths, with caching in Nginx Lua for performance.
• Enhanced Nginx configuration management to dynamically apply settings like RejectUnknownDomains based on agent config.
• Improved client IP detection in Nginx Lua scripts, correctly handling X-Forwarded-For and CF-Connecting-IP headers.
• New internal Nginx API endpoints to dynamically manage blocked IPs and whitelist entries, allowing the agent to update Nginx rules in real-time.
• Added unknown domain traffic statistics to help identify suspicious probing or misconfigurations.

💡 Minor Suggestions

• Refactor internal/api/server.go:getSystemStats to remove redundant calculation of network and port counts.
• Review the ON CONFLICT logic in internal/security/db.go:AddWhitelistEntry to ensure that internal whitelist entries are not unintentionally degraded by external updates.
• Consider adding more inline comments to the complex IPv6 CIDR matching logic in templates/infra/nginx/lua/security.lua for better future maintainability.

🚨 Critical Issues

• Compilation Failure: Several files in internal/security (db.go, manager.go, models.go) have incorrect package declarations (package traffic instead of package security), which will prevent the agent from building successfully.
• Unauthorized Internal API Access: The Nginx Lua handlers for internal security operations (handle_block_ip_request, handle_unblock_ip_request, handle_refresh_request) currently lack X-Internal-Token validation. This allows any authenticated or unauthenticated client (within the Docker network) to call these critical endpoints, posing a severe security risk.

[sourceant]

Review complete. See the overview comment for a summary.

[sourceant]

Review complete. See the overview comment for a summary.