Allow real IP from loopback AND private

main.go

@@ -50,6 +50,8 @@ var (
 )
 
 func main() {
+	flag.Parse()
+
 	viper.SetDefault("bind", ":8080")
 
 	viper.SetConfigName("dlrouter")        // name of config file (without extension)
@@ -112,12 +114,13 @@ func main() {
 	r.Use(RealIPMiddleware)
 	r.Use(logger.Logger("router", log.StandardLogger()))
 
-	r.HandleFunc("/status", statusHandler)
-	r.HandleFunc("/mirrors", mirrorsHandler)
-	r.HandleFunc("/reload", reloadHandler)
-	r.HandleFunc("/dl_map", dlMapHandler)
-	r.Handle("/metrics", promhttp.Handler())
-	r.HandleFunc("/", redirectHandler)
+	r.Get("/status", statusHandler)
+	r.Get("/mirrors", mirrorsHandler)
+	r.Post("/reload", reloadHandler)
+	r.Get("/dl_map", dlMapHandler)
+	r.Get("/metrics", promhttp.Handler().ServeHTTP)
+
+	r.NotFound(redirectHandler)
 
 	go http.ListenAndServe(viper.GetString("bind"), r)
 

middleware.go

@@ -29,7 +29,9 @@ func RealIPMiddleware(f http.Handler) http.Handler {
 			return
 		}
 
-		if !net.ParseIP(host).IsPrivate() {
+		netIP := net.ParseIP(host)
+
+		if !netIP.IsLoopback() && !netIP.IsPrivate() {
 			f.ServeHTTP(w, r)
 			return
 		}