v2.0.0: Network allow/deny CIDRs + source-port allowlist - #14
Merged
Conversation
Enterprises can keep chorus-relay off the open internet with CIDR/IP allowlists, private bind addresses, and refuse-open-bind. Docs cover corporate VPN, Tailscale, AWS VPC, Azure VNet, and GCP VPC patterns. Co-authored-by: Steven Roomberg <sroomberg@users.noreply.github.com>
Promote the network allowlist work to a major release: plugin and chorus-relay 2.0.0, CHANGELOG section ready for the tag-triggered GitHub release workflow. Co-authored-by: Steven Roomberg <sroomberg@users.noreply.github.com>
cursor
Bot
changed the title
Support explicit deny CIDRs (deny wins) and peer source-port allowlisting for single-machine constrained testing. Add scripts/network-e2e.ts covering ports A/B allow and C deny plus deny-loopback, and document chorus.json fields. Co-authored-by: Steven Roomberg <sroomberg@users.noreply.github.com>
cursor
Bot
changed the title
sroomberg
marked this pull request as ready for review
August 21, 2026 19:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Major release prep for enterprise network lockdown: keep
chorus-relayoff the open internet with CIDR allow/deny, source-port allowlisting (single-machine e2e), private bind, and VPN/VPC docs.Relay network policy
--allow-cidr/relay.allowedCidrs)--deny-cidr/relay.deniedCidrs) — deny wins--allow-port/relay.allowedPorts) — peers A/B allowed, C denied on one machinerelay.bind;allowOpenBind: falserefuses0.0.0.0/::/statusreports{ allowlist, denylist, allowedPorts, restricted }Config (
chorus.json){ "relay": { "bind": "10.0.12.4", "allowOpenBind": false, "allowedCidrs": ["10.0.0.0/8"], "deniedCidrs": ["203.0.113.0/24"], "allowedPorts": [18201, 18202], "allowLoopback": true } }v2.0.0
@chorus/plugin→2.0.0,chorus-relay→2.0.0## v2.0.0ready for tag-triggered releaseTests
cargo test -p chorus-relay(incl. port A/B allow, C deny + deny-loopback)bun run test:network-e2e(single-machine constrained e2e) — passed locally and on two independent cloud agentsbun run test:ts+ typecheckAfter merge
git tag v2.0.0 && git push origin v2.0.0Test plan
bun run test:network-e2elocallyv2.0.0and verify GitHub release body