Global and Organization-level Access Control (IP, Geo-IP, Paths)

[Enzo1603]

Summary

First of all, I want to say thank you for this amazing project! I am very happy with Pangolin and really appreciate the work you’ve put into it. It’s a great tool.

I am writing to suggest an enhancement for the Access Control system. Currently, we can set rules for IPs, IP ranges, Countries, and Paths on a per-resource basis. I would love to see the option to define these rules at the Organization level or even globally for the entire server.

Motivation

I love the fact that Pangolin offers these security features natively. While I am aware of the CrowdSec integration, I am not very experienced with CrowdSec yet, and more importantly, my current VPS is quite limited in terms of RAM and CPU.

Since the logic for IP, Geo-IP, and Path filtering is already perfectly implemented at the resource level, it would be a huge quality-of-life improvement if we could apply these rules more broadly.

Currently, if I want to block a specific country or a "noisy" IP range that is sniffing multiple domains, I have to add those rules to every single public resource manually. This becomes quite time-consuming as the number of services grows.

Proposed Solution

Since the functionality already exists for individual resources, I hope it might be feasible to "lift" or mirror this logic to higher levels:

1. Global Level: Rules that apply to everything on the Pangolin instance.

2. Organization Level: Rules that apply to all resources within that specific Org.

3. Inheritance: Resources would ideally inherit the "Blacklist/Whitelist" from the Org or Global level, so we don't have to repeat the same configuration.

It would be great if this included all the current options: IP, IP Range, Country, and Path.

Alternatives Considered

I’ve looked into CrowdSec, but as mentioned, it’s a bit too heavy for my current small VPS setup and a bit complex for my needs. Using Pangolin’s native filtering feels much more "lightweight" and integrated.

Additional Context

I hope I haven't overlooked an existing way to do this! If this isn't planned, no worries – I just thought it would be a logical extension of the great work already done on the resource-level filters.

Keep up the great work!

[radh21301]

I definitely need something like this.

My thought was that we have 'rule groups'. Say a group for IPs to be blocked. Another for all ASN to be blocked etc. Now, we would also need a way to toggle one or more of these rule groups as default. So, they would apply to any new resource that is created. But one should also have the option to remove them from a resource if they dont want it.

So, setting default groups only helps to prefil the rules so it is easy and that is mostly what many would use. But if I dont want it, I can remove it on a resource basis.