CDNCA
Browse all docs

ICP filing lookup

When a supplier requires ICP filing, subscriber domains are checked with your chosen lookup service; unfiled domains cannot use such offers.

What it solves

Domains without an ICP filing get blocked by carriers on nodes in mainland China, and the supplier's IPs can be blacklisted as a result. A supplier can tick "subscriber domains must be ICP-filed" on an offer; the subscriber's control plane, the market and the supplier's control plane each check, and unfiled domains cannot use the offer. Filing is judged on the registrable domain, subdomains inherit it, and it is re-checked periodically.

Turning it on

ICP filing lookup is an official, free module built into both editions. The supplier chooses and pays for the lookup service; the key stays on the supplier's control plane and is never uploaded to the market.

  1. Sign up with a lookup provider (TianAPI, ALAPI) and get a key, or prepare another provider's HTTP API.
  2. On the control plane server, edit /etc/cdnca-control/optional.env, set MARKET_ICP_PROVIDER (tianapi, alapi or custom_http) and MARKET_ICP_KEY_FILE (the path of the file holding the key), then restart the control plane services.
  3. Edit the offer under Node market → My listings and tick the filing requirement.

A third-party ICP lookup plugin also works: enable it under Third-party provider plugins once its contract test passes.

Main settings

SettingWhat it does
Lookup providerTianAPI, ALAPI or custom HTTP (custom URLs cannot point at internal addresses)
Key fileRead locally only, never written to logs or errors
Offer filing requirementSet per node pool or offer; an offer with any part requiring filing is marked "filing required"

Typical uses

  • Selling nodes in mainland China: require filing so unfiled domains do not put your node IPs at risk.
  • Reselling upstream nodes that require filing: the requirement must be kept on resale.

Limits and notes

  • An offer that requires filing cannot be listed until a working lookup is configured.
  • The two built-in providers have been checked for address and response format only, not end to end with a real key; test with a domain you know is filed first.
  • Results are cached (7 days by default) and refreshed when they expire; subscribers are notified when a filing lapses.
  • Administrators can mark a domain filed or not filed by hand to correct mistakes.