Allow list of IPs for the IP Whitelist to be brought in from a central file, possibly a URL.

[kierenevans]

We have a list of IPs that should be able to bypass basic authentication. It would be nice to be able to configure this centrally instead of having to configure each deployment.

[tonypiper]

@andytson-inviqa would a Gist be OK? or prefer a more private way?

[andytson-inviqa]

A private gist would be fine if it doesn't change when we need to update it. The URL for it shouldn't go in these repositories however. It's important however that the gist (or other http url) be owned by the organisation rather than an individual still, so will not be lost if staff leave

[andytson-inviqa]

the gist or other shouldn't be editable by everyone who can view it though.

[andytson-inviqa]

a raw link to an organisation git repo with a read-only token might be the way to do it

[andytson-inviqa]

even better would be to have a proper SSO

[sroze]

HTTPLabs Auth0 middleware is really going to a good direction :)

[richardmiller-zz]

We should start trying it out then :)