Problem with ip_access option for mod_register when using append_host_config

[Dunedan]

I want to disallow registrations for one virtual host from certain networks. However, I noticed this only works when configuring the ACL for all hosts, but gets silently ignored when configuring it as host-specific option using append_host_config.

I'm able to reproduce that behavior with the ghcr.io/processone/ejabberd Docker image with the following diff compared to the default config:

--- a/ejabberd.yml.orig
+++ b/ejabberd.yml
@@ -88,37 +88,50 @@ listen:
 
 s2s_use_starttls: optional
 
 acl:
   local:
     user_regexp: ""
   loopback:
     ip:
       - 127.0.0.0/8
       - ::1/128
+#  blocked_networks:
+#    ip:
+#      - 0.0.0.0/0
+#      - ::/0
+
+append_host_config:
+  localhost:
+    acl:
+      blocked_networks:
+        ip:
+          - 0.0.0.0/0
+          - ::/0
 
 access_rules:
   local:
     allow: local
   c2s:
     deny: blocked
     allow: all
   announce:
     allow: admin
   configure:
     allow: admin
   muc_create:
     allow: local
   pubsub_createnode:
     allow: local
   trusted_network:
-    allow: loopback
+    deny: blocked_networks
+    allow: all
 
 api_permissions:
   "console commands":
     from:
       - ejabberd_ctl
     who: all
     what: "*"
   "admin access":
     who:
       access:

When using the commented out blocked_networks ACL, registrations get properly blocked, however when using the one in append_host_config instead, registrations are still possible.

Am I doing something wrong here or is this a bug?
Is the host maybe not considered for unregistered/unauthenticated connections?

[Neustradamus]

@badlop, @prefiks, @weiss: What do you think?

[prefiks]

mod_register has also option access that i think you could use like this:

modules:
  mod_register:
    access:
      - deny:
        - server: "blocked.domain.com"
      - allow: all

[Dunedan]

I'm trying to block by IP CIDRs, so I don't get how using the access option instead would help. Aside from that: Wouldn't I encounter the same problem regarding the use of virtual hosts with that as well?

[prefiks]

Ah, didn't notice that "blocking only some ip" part. I think you could do that by having different value of ip_acces in mod_register per host:

append_host_config:
  "host1.example.org"
    modules:
      mod_register:
        ip_access: access_for_host1
  "host2.example.org"
    modules:
      mod_register:
        ip_access: access_for_host2

[Dunedan]

While that to works, this doesn't have the CIDRs defined as part of the host config anymore.

From my understanding having them as part of the host config would be a prerequisite for being able to move them to a separate file and include them using include_config_file, which is something I'd like to do to keep the main config file short and clear. Is there a way to achieve that?