is there a way to restrict access by ip to the dashboard but not the api now that caddy is default ?