Bypass ACL default for one container?

[JPDVM2014]

Before I try and figure out middlewares, I wanted to see if there was a way to bypass the default ACL rule for only one container? I have my default access set to deny except for local addresses.

I'm always on a VPN outside of my lan, so I don't need public access. But, I want immich to be more open to be able to share albums with friends. I know I can do this with the CIDRwhitelist middleware, but is there any other way?

If I go the CIDRwhitelist route, I guess I would set my ACL default back to allow? Thanks for any help!

[yusing]

If I go the CIDRwhitelist route, I guess I would set my ACL default back to allow?

Yes, with CIDRWhitelist approach:

Set ACL to default: allow. Use CIDRWhitelist on the entrypoint with bypass rules like - route immich.

Layer 4 vs Layer 7 rules:

• ACL (Layer 4): Can only filter by IP address. Works on TCP/UDP level before HTTP parsing.
• CIDRWhitelist (Layer 7): Runs at HTTP level, so hostname based bypass (route immich) works.

Adding SNI matching:

I could add allow: [sni public.example.com] at Layer 5 (TLS), but it gets tricky - Layer 5 rules would need to override Layer 4 ACL rules, which complicates the logic.

[JPDVM2014]

I thought I'd have to go the whitelist route, but figured I would check first. Thanks for the quick reply!