refactor: reuse IsTrustedProxy for loopback check; promote go-systemd to direct dep

commit: 9e9308cf2a924de4e519b67b5572f58655b0fe78
author: brice · 6mo ago · 2026-04-03 15:26 UTC
parent: c9b8983
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +4 -13

M go.mod +2 -2


@@ -7,6 +7,7 @@ require (
7	7		github.com/charmbracelet/bubbles v1.0.0
8	8		github.com/charmbracelet/bubbletea v1.3.10
9	9		github.com/charmbracelet/lipgloss v1.1.0
	10	+	github.com/coreos/go-systemd/v22 v22.7.0
10	11		github.com/docker/docker v28.5.2+incompatible
11	12		github.com/docker/go-connections v0.6.0
12	13		github.com/golang-jwt/jwt/v5 v5.3.1

@@ -25,6 +26,7 @@ require (
25	26		go.opentelemetry.io/otel/sdk/log v0.18.0
26	27		go.opentelemetry.io/otel/sdk/metric v1.42.0
27	28		golang.org/x/mod v0.34.0
	29	+	golang.org/x/sync v0.20.0
28	30		gopkg.in/natefinch/lumberjack.v2 v2.2.1
29	31		)
30	32

@@ -42,7 +44,6 @@ require (
42	44		github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
43	45		github.com/containerd/log v0.1.0 // indirect
44	46		github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
45		-	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
46	47		github.com/docker/cli v29.3.0+incompatible // indirect
47	48		github.com/docker/docker-credential-helpers v0.9.3 // indirect
48	49		github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect

@@ -64,7 +65,6 @@ require (
64	65		go.opentelemetry.io/proto/otlp v1.9.0 // indirect
65	66		go.yaml.in/yaml/v3 v3.0.4 // indirect
66	67		golang.org/x/net v0.52.0 // indirect
67		-	golang.org/x/sync v0.20.0 // indirect
68	68		google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
69	69		google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
70	70		google.golang.org/grpc v1.79.3 // indirect

 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/docker/docker v28.5.2+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	go.opentelemetry.io/otel/sdk/log v0.18.0
 	go.opentelemetry.io/otel/sdk/metric v1.42.0
 	golang.org/x/mod v0.34.0
+	golang.org/x/sync v0.20.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 )
 	github.com/clipperhouse/uax29/v2 v2.5.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect
-	github.com/coreos/go-systemd/v22 v22.7.0 // indirect
 	github.com/docker/cli v29.3.0+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	go.opentelemetry.io/proto/otlp v1.9.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.52.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect
 	google.golang.org/grpc v1.79.3 // indirect

M internal/adapters/in/http/middleware/accesslog.go +2 -11


@@ -18,18 +18,9 @@ var loopbackNets = func() []*net.IPNet {
18	18		return []*net.IPNet{ipv4Loopback, ipv6Loopback}
19	19		}()
20	20
21		-	// isLoopback reports whether the given IP string is a loopback address.
	21	+	// isLoopback reports whether ip is a loopback address.
22	22		func isLoopback(ip string) bool {
23		-	parsed := net.ParseIP(ip)
24		-	if parsed == nil {
25		-	return false
26		-	}
27		-	for _, n := range loopbackNets {
28		-	if n.Contains(parsed) {
29		-	return true
30		-	}
31		-	}
32		-	return false
	23	+	return IsTrustedProxy(ip, loopbackNets)
33	24		}
34	25
35	26		// AccessLogWriter is the interface the middleware needs from the output adapter.

 	return []*net.IPNet{ipv4Loopback, ipv6Loopback}
 }()
-// isLoopback reports whether the given IP string is a loopback address.
+// isLoopback reports whether ip is a loopback address.
 func isLoopback(ip string) bool {
-	parsed := net.ParseIP(ip)
+	return IsTrustedProxy(ip, loopbackNets)
-	if parsed == nil {
-		return false
-	}
-	for _, n := range loopbackNets {
-		if n.Contains(parsed) {
-			return true
-		}
-	}
-	return false
 }
 // AccessLogWriter is the interface the middleware needs from the output adapter.