feat: Add IP-based access control for Stream Hosts

[Kiryuumaru]

Summary

This PR implements IP-based access control for Stream Hosts, addressing feature request #5125.

Changes

Backend

• Database Migration: Added access_list_id column to the stream table
• Models: Added access_list relation to Stream model and streams relation to AccessList model
• Internal Logic:
  • Updated stream CRUD operations to handle access_list expansion
  • Updated access-list internal to regenerate stream configs when access lists are modified or deleted
• API Schemas: Added access_list_id to stream POST/PUT endpoints
• Nginx Templates:
  • Created _access_stream.conf template for IP-based allow/deny rules
  • Updated stream.conf to include the access template for both TCP and UDP blocks

Frontend

• Added StreamExpansion type for API calls
• Added accessListId and accessList to Stream interface
• Added Access tab to Stream modal with AccessField component
• Added Access List column to Streams table

Implementation Notes

• Only IP-based rules are applied - The nginx stream module does not support HTTP basic authentication or the satisfy directive, so only allow/deny rules from the Access List clients are used
• When an Access List is assigned to a stream, the generated nginx config includes:
  • allow directives for each client IP/CIDR in the access list
  • A final deny all; directive
• When an Access List is deleted or modified, all associated stream configs are automatically regenerated

Example Generated Config

server {
  listen 55555;
  listen [::]:55555;

  # Stream Access Control (IP-based only)
  # Note: nginx stream module does not support basic auth or satisfy directives
  # Access Rules: 1 total
  allow 100.64.0.0/10;
  deny all;

  proxy_pass 192.168.1.100:5555;
  ...
}

Screenshots:

[nginxproxymanagerci]

Docker Image for build 5 is available on DockerHub:

nginxproxymanager/nginx-proxy-manager-dev:pr-5211

Note

Ensure you backup your NPM instance before testing this image! Especially if there are database changes.
This is a different docker image namespace than the official image.

Warning

Changes and additions to DNS Providers require verification by at least 2 members of the community!

[Kiryuumaru]

This PR is tested and ready for review 🚀