Having a goroutine that updates the whitelist every so often with an interval specified in the config sounds pretty KISS. The other option is indeed a luascript which adds some complexity.