From db91c24d7f12bbd53cfb25747f23dc2ed22e01eb Mon Sep 17 00:00:00 2001
From: Owen Rummage <owen@rummage.cc>
Date: Mon, 17 Aug 2026 11:35:16 -0500
Subject: [PATCH] Default new access lists to allow-by-default

Basic-Auth-only access lists (no CIDR rules) were unreachable: with
Default allow off, checkAccess denied every IP with 403 before the
auth prompt ever ran. New lists now default to allow-by-default, and
the label clarifies the interaction with Basic Auth.
---
 internal/web/accesslists.go                  | 2 +-
 internal/web/templates/access_list_form.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/web/accesslists.go b/internal/web/accesslists.go
index 2e2f465..7ba9bd9 100644
--- a/internal/web/accesslists.go
+++ b/internal/web/accesslists.go
@@ -25,7 +25,7 @@ func (h *Web) handleAccessListsList(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Web) handleAccessListForm(w http.ResponseWriter, r *http.Request) {
-	var l models.AccessList
+	l := models.AccessList{DefaultAllow: true}
 	isNew := true
 	if idStr := r.PathValue("id"); idStr != "" {
 		isNew = false
diff --git a/internal/web/templates/access_list_form.html b/internal/web/templates/access_list_form.html
index 1d00cb5..b2fb119 100644
--- a/internal/web/templates/access_list_form.html
+++ b/internal/web/templates/access_list_form.html
@@ -11,7 +11,7 @@
     <div class="col-md-3 d-flex align-items-end">
       <div class="form-check form-switch">
         <input class="form-check-input" type="checkbox" name="default_allow" id="da" {{if $l.DefaultAllow}}checked{{end}}>
-        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed)</label>
+        <label class="form-check-label" for="da">Default allow (unmatched IPs are allowed) &mdash; leave this checked if you only want Basic Auth below and no IP restriction</label>
       </div>
     </div>
     <div class="col-12">