# LDAP Access & NGINX IP Whitelisting

# New Page

<table id="bkmrk-1%EF%B8%8F%E2%83%A3-load-notflix.pkn" style="border-collapse:collapse;width:100%;height:983.2px;"><colgroup><col style="width:33.0137%;"></col><col style="width:66.9864%;"></col></colgroup><tbody><tr style="height:62.7px;"><td style="height:62.7px;">[![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/5Oximage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/5Oximage.png) [![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/crfimage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/crfimage.png)

</td><td style="height:62.7px;">  
</td></tr><tr style="height:29.8px;"><td style="height:29.8px;"></td><td style="height:29.8px;">  
</td></tr><tr style="height:109.25px;"><td style="height:109.25px;">##### **1️⃣ load notflix.pknw1.co.uk**

</td><td style="height:109.25px;">- [x] user loads [https://notflix.pknw1.co.uk](https://notflix.pknw1.co.uk)
- [x] notflix.pknw1.co.uk proxy\_hiost @ proxymanager
- [ ] <span style="color:rgb(224,62,45);">is IP in not all-allowed-blacklist-failled-whitelist-attemps ACL -&gt; **quicklogin**</span>

</td></tr><tr style="height:120.45px;"><td style="height:120.45px;">##### 2️⃣ attempt **quicklogin**

</td><td style="height:120.45px;">- [ ] proxymanager advanced\_config 401 detected
- [ ] passed to error\_handler in the advanced config
- [x] if cookie **notflixuid** exists, redirect user to /quicklogin
- [ ] if cookie **notflixuid does not exist, user cannot quicklogin**
- [ ] <span style="color:rgb(224,62,45);">**redirect user to standndar login**</span>

</td></tr><tr style="height:103.65px;"><td style="height:103.65px;">##### 3️⃣ process **quicklogin**

</td><td style="height:103.65px;">- [ ] load user\_ip from current session
- [ ] add IP to ACL
- [ ] restart proxynaner nginx to load allowed\_ips.conf
- [x] <span style="color:rgb(22,145,121);">redirect user to notflix.pknw1.co.uk</span>

</td></tr><tr style="height:147.7px;"><td style="height:147.7px;">##### 4️⃣ process auth at /auth

</td><td style="height:147.7px;">- [ ] user is locate at /auth page
- [ ] user login is sent api.notflix.pknw1.co.uk for authentication against LDAP
- [ ] <span style="color:rgb(224,62,45);">if the user is not\_autenticated, redirect to errro</span>

- [ ] if the user is authenticated, whitelist their current IP
- [x] <span style="color:rgb(22,145,121);">redirect to notflix.pknw1.co.uk</span>

</td></tr><tr style="height:70.05px;"><td style="height:70.05px;">##### 5️⃣ process **post-auth** 

</td><td style="height:70.05px;">- [ ] request current IP whiitelist
- [ ] reload ACL

</td></tr><tr style="height:72.7px;"><td style="height:72.7px;">##### **7️⃣ Load [Jellyfin](https://notflix.pknw1.co.uk/login)** 

</td><td style="height:72.7px;">  
</td></tr><tr style="height:103.65px;"><td style="height:103.65px;">##### ✅ **jellyfin post-login**

  
</td><td style="height:103.65px;">- [ ] after login check if **notflixuid** cookie exists
- [ ] if **notflixuid** exists, do northing
- [ ] if **notflixuid** does not exist, create the **notflixuid** cookie enabling quicklogin

</td></tr></tbody></table>

####  

#### Load notflix.pknw1.co.uk with a vaiid <span style="color:rgb(22,145,121);">user\_account</span> and a valid <span style="color:rgb(22,145,121);">IP</span>

<table id="bkmrk-user-loading-site-us" style="border-collapse:collapse;width:100%;height:445.95px;"><colgroup><col style="width:33.7474%;"></col><col style="width:66.2506%;"></col></colgroup><tbody><tr style="height:29.8px;"><td style="height:29.8px;">  
</td><td style="height:29.8px;">  
</td></tr><tr style="height:109.25px;"><td style="height:109.25px;">User Loading site</td><td style="height:109.25px;">- [ ] user loads [https://notflix.pknw1.co.uk](https://notflix.pknw1.co.uk)
- [ ] notflix.pknw1.co.uk proxy\_hiost @ proxymanager
- [ ] is IP in all-allowed-blacklist-failled-whitelist-attemps ACL
- [ ] True = reverse\_proxy to jellyfin:8096/

</td></tr><tr style="height:70.05px;"><td style="height:70.05px;">User Login to Jellyfin</td><td style="height:70.05px;">- [ ] useer enters username and password from LDAP
- [ ] True = username is a member iof users\_users group

</td></tr><tr style="height:86.85px;"><td style="height:86.85px;">After successful login</td><td style="height:86.85px;">- [ ] check if ookie **notflixuid** exists
- [ ] True = no\_action
- [ ] False = create cookie **notflixuid for .pknw1.co.uk valid 1 year**

</td></tr></tbody></table>

aaaa

#### Load notflix.pknw1.co.uk with a vaiid <span style="color:rgb(22,145,121);">user\_account</span> and an invalid <span style="color:rgb(224,62,45);">IP</span>

#### Quicklogin initial configuration

# Access Layers

Authentication and.Access

<table id="bkmrk-" style="border-collapse:collapse;width:100%;height:98.2px;"><colgroup><col style="width:11.1034%;"></col><col style="width:88.8966%;"></col></colgroup><tbody><tr style="height:98.2px;"><td style="height:98.2px;">[![ovh.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/ovh.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/ovh.png)</td><td style="height:98.2px;">#### OVH Service

</td></tr></tbody></table>

<table id="bkmrk--1" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:10.6079%;"></col><col style="width:44.6961%;"></col><col style="width:44.6961%;"></col></colgroup><tbody><tr><td>[![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/H79image.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/H79image.png)</td><td>#### **proxymanager**

</td><td>#### **proxymanager-admin**

</td></tr></tbody></table>

<table id="bkmrk--3" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:9.06004%;"></col><col style="width:90.938%;"></col></colgroup><tbody><tr><td>[![ovh.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/ovh.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/ovh.png)</td><td>  
</td></tr></tbody></table>

<table id="bkmrk-single-ip" style="border-collapse:collapse;width:100%;height:29.8px;"><colgroup><col style="width:8.8196%;"></col><col style="width:91.1804%;"></col></colgroup><tbody><tr style="height:29.8px;"><td style="height:29.8px;">[![IP.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/ip.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/ip.png) </td><td>  
</td></tr></tbody></table>

<table id="bkmrk-public-ip-tailscale-" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:7.86635%;"></col><col style="width:42.0731%;"></col><col style="width:7.64835%;"></col><col style="width:42.4103%;"></col></colgroup><tbody><tr><td>[![IP.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/ip.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/ip.png)</td><td>  
</td><td>[![tailscale.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/tailscale.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/tailscale.png)</td><td>  
</td></tr></tbody></table>

<table id="bkmrk-docker-%C2%A0-%2Fhome%2Fapps%2F" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:99.881%;"></col></colgroup></table>

<table id="bkmrk-tailscale-100.100.69" style="border-collapse:collapse;width:100%;border-width:1px;"><colgroup><col style="width:6.7938%;"></col><col style="width:25.8641%;"></col><col style="width:5.83901%;"></col><col style="width:28.13%;"></col><col style="width:5.48272%;"></col><col style="width:27.8903%;"></col></colgroup><tbody><tr><td style="border-width:1px;">#### [![tailscale.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/tailscale.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/tailscale.png)

</td><td style="border-width:1px;">**Tailscale**

#### **`100.100.69.0/16`**

</td><td style="border-width:1px;">##### [![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/rhQimage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/rhQimage.png)

</td><td style="border-width:1px;">**Proxy**

##### **`172.22.20.0/16`**


</td><td style="border-width:1px;">##### [![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/rhQimage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/rhQimage.png)

</td><td style="border-width:1px;">**Admin**

##### `172.22.22.0/16`


</td></tr></tbody></table>

<table id="bkmrk-%C2%A0-%C2%A0-%2Fhome%2Fapps%2Fcore-" style="border-collapse:collapse;width:100%;"><colgroup><col style="width:99.881%;"></col></colgroup><tbody><tr><td><table style="border-collapse:collapse;width:100.122%;border-width:0px;"><colgroup><col style="width:16.325%;"></col><col style="width:83.673%;"></col></colgroup><tbody><tr><td style="border-width:0px;">[![image.png](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/scaled-1680-/rhQimage.png)](https://bookstack.notflix.pknw1.co.uk/uploads/images/gallery/2026-04/rhQimage.png)</td><td style="border-width:0px;">  
</td></tr></tbody></table>

<details><summary>/home/apps/core</summary>

```
 - ./api.notflix.pknw1.co.uk/docker-compose.yml
 - ./caddy/docker-compose.yml
 - ./internal-proxy/docker-compose.yml
 - ./proxymanager-admin/docker-compose.yml
 - ./dockmon/docker-compose.yml
 - ./lldap/docker-compose.yml
 - ./proxymanager/docker-compose.yml
 - ./squid/docker-compose.yml
 - ./pihole/docker-compose.yml
```

<table style="border-collapse:collapse;width:100%;"><colgroup><col style="width:22.8824%;"></col><col style="width:25.6787%;"></col><col style="width:51.4389%;"></col></colgroup><thead><tr><td>##### **Service**

</td><td>##### **Docker**

</td><td>
</td></tr></thead><tbody><tr><td>`api.notflix`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`caddy`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`internal_proxy`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`proxymanafer`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`proxymanager-admin`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`dockmon`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`lldap`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`pihole`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>`squid`</td><td>`proxy/172.22.20.1`  
`dmz/172.22.21.1`  
`admin/172.22.22.1`</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr><tr><td>  
</td><td>  
</td><td>  
</td></tr></tbody></table>

</details><details><summary>/home/apps/frontend</summary>

</details><details><summary>/home/apps/backend</summary>

</details><details><summary>/home/apps/user-apps</summary>

</details><details><summary>/home/apps/admin-apps</summary>

</details></td></tr></tbody></table>