Docs

Introduction

What is rune

Philosophy

Why rune

Architecture

Getting Started

Installation

Quick start

Project structure

The dev loop

Tutorial: build an app

1. Create the app

2. Pages & routes

3. Layouts

4. State with Mimir

5. SSR & data

6. API routes

7. Styling

8. Build & deploy

Core Concepts

The application object

Rendering pipeline

Hydration

The build manifest

Configuration (ekko.json)

Permissions

Conventions

Routing

File-based routing

Dynamic routes

The router (useRouter)

Navigation & Link

Guards & redirects

Programmatic routes

Server-Side Rendering

Overview

The ssr() function

Strategies (eager/lazy)

SSR → hydration

Caching & invalidation

SEO

Mimir, state management

Overview

Atoms

Reading & writing

Selectors (derived state)

Subscriptions & the store

SSR & hydration

Persistence & sessions

Patterns & recipes

Pitfalls

Pages & Layouts

Pages

Layouts

Error & not-found

API Routes

Defining routes

Request & response

Middleware

helmet

cors

rateLimit

bodyLimit

validateContentType

csrf

requestId

timeout

errorHandler

httpsRedirect

secureCookies

ipFilter

safePath

Validation & options

Styling & Theming

SCSS

Theming (light/dark)

Asgard integration

No flash (no-FOUC)

Building & Deploying

The build

Static assets

Production deploy

API Reference

ekko:rune

ekko:rune/router

ekko:rune/mimir

ekko:rune/seo

ekko:ssr / css

ekko.json schema

CLI commands

Guides

Rune app from scratch

Recipes

Dark mode

Forms

Data fetching

Authentication

Pagination

FAQ (use cases)

`ipFilter()`

Allow or deny requests by client IP, with 403 for anything blocked.

ipFilter request flow

Use case

Some surfaces should not be open to the whole internet: an admin panel, an internal dashboard, a webhook that only one provider calls. An IP filter restricts access to a known set of addresses, or blocks a set of known-bad ones, without touching your auth logic.

How it works

It reads req.ip and checks the deny list first (a match is rejected immediately), then the allow list (if set, only listed IPs pass; everyone else is rejected). A blocked request replies 403 Forbidden; an allowed one calls next().

Configuration

Option	Default	Notes
`allow`	`null`	If set, only these IPs pass.
`deny`	`[]`	These IPs are always rejected (checked before `allow`).

Example

00000000001
2
3
4
5
6
import { ipFilter } from "ekko:web";
 
app.use(ipFilter({ allow: ["203.0.113.10", "203.0.113.11"] })); // only these IPs
app.use(ipFilter({ deny: ["198.51.100.23"] }));                 // block one IP
 
// scope it to an admin area with a custom middleware wrapper, or mount it per-route.

Notes

Behind a proxy, make sure req.ip reflects the real client (the proxy must forward it), otherwise you are filtering the proxy's own IP and either letting everyone through or blocking everyone. IP allow-lists are a useful extra layer, not a replacement for authentication.

Next: safePath.

On this page

Use case How it works Configuration Example Notes