LibrePortal IP

What it's good for#

A machine at home behind a router doesn't know its own internet address. Only the router has it. The usual answer is to ask one of the many "what's my IP" websites, which means telling a stranger every time you look. LibrePortal IP is the same service, run by you: it looks at who's asking and sends their address back, and that's all it does.

LibrePortal itself needs this answer now and then, for example to check whether a domain points at your server or to offer to add the address you're browsing from to your trusted places. By default it asks the one the LibrePortal project runs at ip.libreportal.org. Nothing else is asked, on purpose. The Public Address Lookup setting in LibrePortal's network settings is where that address lives, and emptying it means LibrePortal never asks anyone.

Asking it#

There's nothing to sign in to and nothing to set up. Press the Your IP Address button on its page to see it in a browser, or ask from a terminal:

curl http://192.168.1.50:5170/

Use your server's address and the port shown on the app's Config tab. The answer is the address and a new line, nothing more, so a script can use it as it is:

MY_IP=$(curl -fsS https://ip.example.com/)

With a domain and Traefik, it's served at ip.<your domain> over HTTPS. Its own port stays on plain http:// whatever your server's HTTPS setting, because scripts ask it with a bare curl, and a redirect to a certificate they don't trust would break every one of them.

To point LibrePortal on another server at your copy, put its address (for example https://ip.example.com/) in that server's Public Address Lookup setting.

Good to know#

• It keeps nothing. There's no access log, and even refused or rate-limited requests leave no address behind. There's nothing to back up, so it's left out of backups.
• It stays public. Other people's servers are the ones asking, so "new apps start private" leaves it alone. It only ever says a caller's own address back to them.
• One caller, ten questions a second. Each address can ask ten times a second, with a little leeway for a script that asks a few times in a row. Beyond that it answers 429 until the caller slows down.
• Only this server's Traefik is believed. When a request comes through Traefik, the real caller's address is taken from the header Traefik adds, and from no one else, so nobody can choose their own answer. If Traefik is installed or removed later, LibrePortal IP notices the next time it starts. Behind any other proxy or relay, it answers with that proxy's address instead, as the note at the top says.
• Web pages can ask it too. It allows requests from any site, so a page in someone's browser can fetch the answer directly. Only GET and HEAD are accepted.
• One per server, updated automatically. It's nginx's own unprivileged image with a small configuration file from LibrePortal, which is rewritten on every install and start, so edits to it don't last.