Description of feature
dokku_http_auth_allowed_ip is additive. Its present-state plan reports "N allowed ip(s) to add" and only ever adds, so an address on the server but absent from the recipe stays in the allow-list forever. Its sibling dokku_http_auth_domain already declares options:"present,absent,set,clear" and can express the complete set, because http-auth:set-domains exists upstream. The inconsistency between the two tasks is a direct consequence of the plugin having a whole-set command for one collection and not the other.
dokku/dokku-http-auth#43 asks for http-auth:set-allowed-ips, modelled on cmd-http-auth-set-domains. Once it lands, this task should gain set and clear states so it matches its sibling, and the two should read identically in a recipe.
An interim without upstream is an add/remove loop over the difference. For an access-control list I would rather not: a malformed address partway through leaves the app with a partially rewritten allow-list, and the upstream command exists precisely so validation happens before any mutation. That argument is the reason the upstream issue quotes the validate-before-mutate comment in cmd-http-auth-set-domains.
Blocked on dokku/dokku-http-auth#43.
Description of feature
dokku_http_auth_allowed_ipis additive. Its present-state plan reports "N allowed ip(s) to add" and only ever adds, so an address on the server but absent from the recipe stays in the allow-list forever. Its siblingdokku_http_auth_domainalready declaresoptions:"present,absent,set,clear"and can express the complete set, becausehttp-auth:set-domainsexists upstream. The inconsistency between the two tasks is a direct consequence of the plugin having a whole-set command for one collection and not the other.dokku/dokku-http-auth#43 asks for
http-auth:set-allowed-ips, modelled oncmd-http-auth-set-domains. Once it lands, this task should gainsetandclearstates so it matches its sibling, and the two should read identically in a recipe.An interim without upstream is an add/remove loop over the difference. For an access-control list I would rather not: a malformed address partway through leaves the app with a partially rewritten allow-list, and the upstream command exists precisely so validation happens before any mutation. That argument is the reason the upstream issue quotes the validate-before-mutate comment in
cmd-http-auth-set-domains.Blocked on dokku/dokku-http-auth#43.