feat: protect IPFS WebUI and RPC API with basic auth

Author: Canvinus

nginx/enode.conf.template

@@ -44,6 +44,36 @@ server {
         proxy_set_header X-Real-IP $remote_addr;
     }
 
+    # IPFS WebUI CID (protected with basic auth)
+    location /ipfs/bafybeidsjptidvb6wf6benznq2pxgnt5iyksgtecpmjoimlmswhtx2u5ua {
+        auth_basic "IPFS Admin";
+        auth_basic_user_file /etc/nginx/.htpasswd;
+
+        proxy_pass http://ipfs_gateway/ipfs/bafybeidsjptidvb6wf6benznq2pxgnt5iyksgtecpmjoimlmswhtx2u5ua;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+
+    # IPFS RPC API (protected with basic auth, for WebUI access)
+    location /api/v0 {
+        auth_basic "IPFS Admin";
+        auth_basic_user_file /etc/nginx/.htpasswd;
+
+        proxy_pass http://ipfs_api/api/v0;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_http_version 1.1;
+        proxy_buffering off;
+        proxy_request_buffering off;
+
+        proxy_connect_timeout 300s;
+        proxy_send_timeout 300s;
+        proxy_read_timeout 300s;
+    }
+
     # IPFS WebUI & API (protected with basic auth)
     location /ipfs-admin/ {
         auth_basic "IPFS Admin";