Ability to define "rule groups" and use them to apply to resources

[rsaffi]

Summary

In the "access rules" section of a resource, adding individual entries is repetitive and error prone. There are many scenarios that every resource (or a large subset of them) naturally require the same access rules. It would be convenient to be able to predefine groups of rules and on the access rules page of the resources, be able to toggle whether you want or not one or more of the predefined groups to apply to that resource or not.

Motivation

I currently have 66 public resources in my pangolin instance. For the vast majority of them, I apply specific access rules, like:

• "bypass auth" if the IP range of the request source is within my trusted networks/VPN
• "pass to auth" if the request comes from 2 specific countries
• "block access" as a last/fallback rule, for "all countries"

For each of the 66 resources I need to add each individual rule. I realized it would be very convenient if the idea of having rule groups existed, then I could simply check them to be applied to the ruleset of a resource and be done with it. And if I ever want to add a new CIDR of a trusted network, instead of doing so in each resource, I could simply add it to the rule group and every resource that include/enable that rule group, would automatically inherit the newly added IP range (or country, thinking from a geoip perspective).

Proposed Solution

I'm not entirely sure how to propose a solution, other than what I have already wrote. I'm typically not a person with a UI mindset, so I'm not good at conceiving how would be the best way for this to be shown on the Pangolin webui. Regardless, I tried to mock something using the browser inspector and editing elements, to try and give a visual idea of what I'm proposing.

In this example, the access rules for the public resource include two groups: first the "Trusted Networks" group and second the "Trusted Countries" group. For the sake of this example, there are also two additional and individual rules, one allowing for an extra country to have the "pass to auth" action and a final/last rule for "block access" to any other countries.

This is how it would look like from the public resource's "Access Rules" section:

Inspecting each of the groups, we can see their own list of actions:

Trusted Networks:

Trusted Countries:

The place to define rule groups should live in its own section on the sidebar, since these are globally scoped and can be assigned to any resource.

Alternatives Considered

No response

Additional Context

No response

[oschwartz10612]

I think this use case is covered by the resource policies https://pangolin.net/news/1-19-release

[rsaffi]

You're absolutely right and I apologize for having overlooked it. I'm already running the latest version but hadn't yet caught up with the addition of the Resource Policies and what they'd allow me to achieve. Perfect!!

Thank you very much for the prompt reply and keep up the great work! Pangolin rocks!