refactor: update whitelists to replace Openfactory with Init7 and adjust related configurations

app/firewall.py

@@ -272,7 +272,7 @@ def get_scan_report(report_dir: str = REPORT_DIR) -> dict[str, list[str]]:
         "/ip firewall address-list": [],
         "/ipv6 firewall address-list": [],
     }
-    # add list=Cloudflare or list=Openfactory to whitelist sections, list=Blocked to blocked section
+    # add list=Cloudflare or list=Init7 to whitelist sections, list=Blocked to blocked section
     with open(report_path, "r", encoding="utf-8") as f:
         current_section = None
         for line in f:

app/utils/constants.py

@@ -73,7 +73,8 @@ REPORT_RETENTION_MAX_FILES = int(
 # Log sources (configurable via environment)
 # ---------------------------------------------------------------------------
 
-COPYPARTY_LOG_PATH = os.environ.get("COPYPARTY_LOG_PATH", "/srv/projects/copyparty")
+COPYPARTY_LOG_PATH = os.environ.get(
+    "COPYPARTY_LOG_PATH", "/srv/projects/copyparty")
 NPM_LOG_PATH = os.environ.get("NPM_LOG_PATH", "/mnt/backups/npm/logs")
 
 # ---------------------------------------------------------------------------
@@ -91,7 +92,7 @@ BLOCKLIST_NAME = os.environ.get("BLOCKLIST_NAME", "Blocked")
 WHITELIST_NAMES = [
     name.strip()
     for name in os.environ.get(
-        "WHITELIST_NAMES", "Cloudflare,Openfactory").split(",")
+        "WHITELIST_NAMES", "Cloudflare,Init7").split(",")
     if name.strip()
 ]
 
@@ -131,8 +132,6 @@ WEB_PORT = int(os.environ.get("WEB_PORT", "54666"))
 # Whitelist sources (configurable via environment)
 # ---------------------------------------------------------------------------
 
-OPENFACTORY_URL = os.environ.get(
-    "OPENFACTORY_URL", "https://openfactory.net/geofeed.csv")
 CLOUDFLARE_URL_V4 = os.environ.get(
     "CLOUDFLARE_URL_V4", "https://www.cloudflare.com/ips-v4")
 CLOUDFLARE_URL_V6 = os.environ.get(
@@ -143,7 +142,6 @@ PALOALTO_URL = os.environ.get(
 )
 
 # Local whitelist files (checked before remote download)
-OPENFACTORY_FILE = os.path.join(DATA_DIR, "openfactory", "geofeed.csv")
 CLOUDFLARE_V4_FILE = os.path.join(DATA_DIR, "cloudflare", "ips-v4.txt")
 CLOUDFLARE_V6_FILE = os.path.join(DATA_DIR, "cloudflare", "ips-v6.txt")
 PALOALTO_FILE = os.path.join(DATA_DIR, "paloalto", "scanner-ips.txt")

app/utils/whitelists.py

@@ -23,8 +23,6 @@ from .constants import (
     CLOUDFLARE_URL_V6,
     CLOUDFLARE_V4_FILE,
     CLOUDFLARE_V6_FILE,
-    OPENFACTORY_FILE,
-    OPENFACTORY_URL,
     PALOALTO_FILE,
     PALOALTO_URL,
 )
@@ -40,15 +38,26 @@ CIDR_RE = re.compile(
 # Local file paths (checked first, before remote download)
 # ---------------------------------------------------------------------------
 
-# (paths live in app/constants.py as OPENFACTORY_FILE, CLOUDFLARE_V4_FILE,
-#  CLOUDFLARE_V6_FILE, PALOALTO_FILE; URLs as OPENFACTORY_URL, ...)
+# (paths live in app/constants.py as CLOUDFLARE_V4_FILE,
+#  CLOUDFLARE_V6_FILE, PALOALTO_FILE; URLs as CLOUDFLARE_URL_V4, ...)
 
 # ---------------------------------------------------------------------------
 # Built-in fallback CIDR lists
 # ---------------------------------------------------------------------------
 
-#: Openfactory AS58299 colocation IP range (https://openfactory.net/geofeed.csv)
-OPENFACTORY_IPV4 = ["5.226.144.0/21"]
+#: Init7 (Switzerland) Ltd. ranges — AS13030, verified via RIPE RDAP 2026-09-08.
+#: Includes the Hybrid7 WAN /24 (router WAN 77.74.80.159), init7 DNS
+#: infrastructure, and the PPPoE gateway. init7 publishes no geofeed, so
+#: these are maintained here rather than downloaded.
+INIT7_IPV4 = [
+    "77.74.80.0/24",      # Hybrid7 WAN /24
+    "77.109.128.0/18",    # init7 DNS / infrastructure
+    "213.144.128.0/19",   # init7 DNS / infrastructure
+    "5.180.132.0/22",     # init7 PPPoE gateway
+]
+
+#: init7 IPv6 allocation (contains delegated /48 2001:1620:549f::/48)
+INIT7_IPV6 = ["2001:1620::/30"]
 
 #: https://www.cloudflare.com/ips-v4
 CLOUDFLARE_IPV4 = [
@@ -85,7 +94,7 @@ PALOALTO_IPV6 = [
 
 #: address-list name -> CIDR ranges (v4 + v6 mixed, split at render time)
 WHITELISTS: dict[str, list[str]] = {
-    "Openfactory": OPENFACTORY_IPV4,
+    "Init7": INIT7_IPV4 + INIT7_IPV6,
     "Cloudflare": CLOUDFLARE_IPV4 + CLOUDFLARE_IPV6,
     "PaloAlto": PALOALTO_IPV4 + PALOALTO_IPV6,
 }
@@ -141,9 +150,7 @@ def _load_local_whitelists() -> dict[str, list[str]]:
     successfully parsed CIDRs are included.
     """
     out: dict[str, list[str]] = {}
-    cidrs = _read_local_file(OPENFACTORY_FILE)
-    if cidrs:
-        out["Openfactory"] = cidrs
+    # Init7 has no published geofeed; its ranges are built-in (INIT7_IPV4/6).
     cf_v4 = _read_local_file(CLOUDFLARE_V4_FILE)
     cf_v6 = _read_local_file(CLOUDFLARE_V6_FILE)
     if cf_v4 or cf_v6:
@@ -190,14 +197,7 @@ def _download_whitelists() -> dict[str, list[str]]:
     Saves each download to the corresponding local file on success.
     """
     out: dict[str, list[str]] = {}
-    try:
-        text = _download_text(OPENFACTORY_URL)
-        cidrs = extract_cidrs(text)
-        if cidrs:
-            out["Openfactory"] = cidrs
-            _save_local_file(OPENFACTORY_FILE, text)
-    except Exception as e:
-        print(f"Error downloading Openfactory whitelist: {e}")
+    # Init7 has no published geofeed; its ranges are built-in (INIT7_IPV4/6).
     try:
         text_v4 = _download_text(CLOUDFLARE_URL_V4)
         text_v6 = _download_text(CLOUDFLARE_URL_V6)
@@ -242,7 +242,7 @@ def update_whitelists() -> None:
 
     # Start from built-in fallbacks, then layer local, then remote
     WHITELISTS = {
-        "Openfactory": OPENFACTORY_IPV4,
+        "Init7": INIT7_IPV4 + INIT7_IPV6,
         "Cloudflare": CLOUDFLARE_IPV4 + CLOUDFLARE_IPV6,
         "PaloAlto": PALOALTO_IPV4 + PALOALTO_IPV6,
     }