diff --git a/Nginx.kube.yaml b/Nginx.kube.yaml index c9d2749..952001b 100644 --- a/Nginx.kube.yaml +++ b/Nginx.kube.yaml @@ -54,6 +54,9 @@ spec: mountPath: /tmp/cache/ - name: secret-htpasswd mountPath: /authentication-htpasswd/ + - name: myprivatecacrt + mountPath: /etc/nginx/certs/ + resources: limits: cpu: 250m @@ -120,6 +123,12 @@ spec: - name: blacklisted-memory-volume emptyDir: medium: Memory + - name: myprivatecacrt + configMap: + name: myprivatecacrt + defaultMode: 0555 + + --- apiVersion: v1 kind: Service diff --git a/certificates/MyPrivateCA.crt b/certificates/MyPrivateCA.crt new file mode 100644 index 0000000..bcb9ea0 --- /dev/null +++ b/certificates/MyPrivateCA.crt @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFgzCCA2ugAwIBAgIUOE2Ww1c9ZZnbcA21fKrhzyQvpZUwDQYJKoZIhvcNAQEL +BQAwUTELMAkGA1UEBhMCVUsxDjAMBgNVBAgMBWxlZWRzMQ4wDAYDVQQHDAVsZWVk +czERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMMBnBpZXJyZTAeFw0yNjAzMTky +MjQ3MDBaFw0zNjAzMTYyMjQ3MDBaMFExCzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVs +ZWVkczEOMAwGA1UEBwwFbGVlZHMxETAPBgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQD +DAZwaWVycmUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGdhzM2nxE +XNYLQ8hqeh6NAl8qwd7HFcJ+ckq+QxkBQtR2CZA0Z2TAKffRKZafYHiAI8MEoT4I +XKbYmP5+9JhzhdgmymwXCKqbDPSVc+nnyOxfmX383gIq0SZHjJC/6z+8QlsDkI+A +4/yttSJNY7o7bPm9FT3uv/orpD867+1pS2wXwQCdbxlj2ctACfjTkDAPe3eAVzNs +eeL1jerS4OvyvVZbnspXsUiFF8lceLV4pVWi4SHQtVbjoNtyuUlTlDrGRdfjUUvl +koKEtChhK0YXEDm2CHYRIswFtCFkqBITHKbwfGVxn+tlNZMP/DEAmYHUkX5fSrPZ +nKZ4J0i1IqjcmfYtJfVlJxLDaA6zrlOtfvloOQEMoDxXSNu9x2eIP5xu16kJzaL5 +eva5AswWaeNtdJKQgxPaYkZlvILuqo1oI6/re6JMgBSD6udsNttAHfOCoSWd75tZ +6JrweyPnAeXto7NisN6Xn6TufC6bZqF2ibrLODfI00SHBMv7OwdCiPeoIeVeSDpa +m4QRCyqO8NmJYrw7xGrm4bh6/ECJXGGahC+aBZORrUTA5ZaKrLRb/GkIcRd2b6Dl +Fp1AoHWjG7DfZJiWFefAxU9CYevo5I9LfMTIxyAS3QLw591t9He7OYFgiLioQugZ +i3lP1PzzGSZeqJQkGYcjVaupZb0oc343PQIDAQABo1MwUTAdBgNVHQ4EFgQUV5Pj +MEQzbTr6AN81gSvyPv+CppYwHwYDVR0jBBgwFoAUV5PjMEQzbTr6AN81gSvyPv+C +ppYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAt1Do3rc6AqgJ +CcfpeRcuTS7zPH1f3g/RwfossTd+sSJeCp8hwqOsCGFP8oqNE5KkRuLucRYBvbFF +JwOZi/aaSkzP4VJXx4Q+VFM+bjyxLD5WSyeevvDZwU3isk1KLfrxZ2pHTYSR+bG/ +alXxStFEQ7ZKO2xuh7LTQjKVG9tkkmQmh3RFFDzH1qZcpP2iQSaRrgejgNF+nQQR +ZE9SWxV+j7BgOVo6zWoF2vTW3KUmmvSoPsdrvcRnFw+aK2biMfcUDETC21ELO7j2 +VPm8OB/hqnzlAL8Dqe1eXoMUW3Mo7tt++CE8uBgNFjdQRfbo0NI6NFR7K0Hhl/20 +JxqZ9ep4C60ZOPPj2QPxbb4Z0y2LUPMk5SrnW3x4TYPsxcqtYJJEKSDunJFuSuq7 +B+xEtYLM/xZZSp7JtaeomQ1ktzhHAz6mLzVqulXT0iGOzX4DY5vDXFEHBgogSK1h +qfo3d5Vzj+GI5XPREerk8b7O50mAkC24XZ7UBBejtoSrqPrh9kiPNEv/CdSVsCWu +L1B29byKlDZ5ZRP0Ab3SR4aho6vDj07wMtJ+hxfMYbIC/ey3JziHbAx2E/733NFM ++1QudCsGjTLsA++K+mBI6oDUDUYDDA2kWpGSHY6L8dPTeDlxm9nZ8jdpJaI8+C02 +xEILze2e9CR1k/h7WD0w04qE/FMDskA= +-----END CERTIFICATE----- diff --git a/certificates/MyPrivateCA.crt.configmap.yaml b/certificates/MyPrivateCA.crt.configmap.yaml new file mode 100644 index 0000000..748dd9f --- /dev/null +++ b/certificates/MyPrivateCA.crt.configmap.yaml @@ -0,0 +1,40 @@ +apiVersion: v1 +data: + MyPrivateCA.crt: | + -----BEGIN CERTIFICATE----- + MIIFgzCCA2ugAwIBAgIUOE2Ww1c9ZZnbcA21fKrhzyQvpZUwDQYJKoZIhvcNAQEL + BQAwUTELMAkGA1UEBhMCVUsxDjAMBgNVBAgMBWxlZWRzMQ4wDAYDVQQHDAVsZWVk + czERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMMBnBpZXJyZTAeFw0yNjAzMTky + MjQ3MDBaFw0zNjAzMTYyMjQ3MDBaMFExCzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVs + ZWVkczEOMAwGA1UEBwwFbGVlZHMxETAPBgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQD + DAZwaWVycmUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGdhzM2nxE + XNYLQ8hqeh6NAl8qwd7HFcJ+ckq+QxkBQtR2CZA0Z2TAKffRKZafYHiAI8MEoT4I + XKbYmP5+9JhzhdgmymwXCKqbDPSVc+nnyOxfmX383gIq0SZHjJC/6z+8QlsDkI+A + 4/yttSJNY7o7bPm9FT3uv/orpD867+1pS2wXwQCdbxlj2ctACfjTkDAPe3eAVzNs + eeL1jerS4OvyvVZbnspXsUiFF8lceLV4pVWi4SHQtVbjoNtyuUlTlDrGRdfjUUvl + koKEtChhK0YXEDm2CHYRIswFtCFkqBITHKbwfGVxn+tlNZMP/DEAmYHUkX5fSrPZ + nKZ4J0i1IqjcmfYtJfVlJxLDaA6zrlOtfvloOQEMoDxXSNu9x2eIP5xu16kJzaL5 + eva5AswWaeNtdJKQgxPaYkZlvILuqo1oI6/re6JMgBSD6udsNttAHfOCoSWd75tZ + 6JrweyPnAeXto7NisN6Xn6TufC6bZqF2ibrLODfI00SHBMv7OwdCiPeoIeVeSDpa + m4QRCyqO8NmJYrw7xGrm4bh6/ECJXGGahC+aBZORrUTA5ZaKrLRb/GkIcRd2b6Dl + Fp1AoHWjG7DfZJiWFefAxU9CYevo5I9LfMTIxyAS3QLw591t9He7OYFgiLioQugZ + i3lP1PzzGSZeqJQkGYcjVaupZb0oc343PQIDAQABo1MwUTAdBgNVHQ4EFgQUV5Pj + MEQzbTr6AN81gSvyPv+CppYwHwYDVR0jBBgwFoAUV5PjMEQzbTr6AN81gSvyPv+C + ppYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAt1Do3rc6AqgJ + CcfpeRcuTS7zPH1f3g/RwfossTd+sSJeCp8hwqOsCGFP8oqNE5KkRuLucRYBvbFF + JwOZi/aaSkzP4VJXx4Q+VFM+bjyxLD5WSyeevvDZwU3isk1KLfrxZ2pHTYSR+bG/ + alXxStFEQ7ZKO2xuh7LTQjKVG9tkkmQmh3RFFDzH1qZcpP2iQSaRrgejgNF+nQQR + ZE9SWxV+j7BgOVo6zWoF2vTW3KUmmvSoPsdrvcRnFw+aK2biMfcUDETC21ELO7j2 + VPm8OB/hqnzlAL8Dqe1eXoMUW3Mo7tt++CE8uBgNFjdQRfbo0NI6NFR7K0Hhl/20 + JxqZ9ep4C60ZOPPj2QPxbb4Z0y2LUPMk5SrnW3x4TYPsxcqtYJJEKSDunJFuSuq7 + B+xEtYLM/xZZSp7JtaeomQ1ktzhHAz6mLzVqulXT0iGOzX4DY5vDXFEHBgogSK1h + qfo3d5Vzj+GI5XPREerk8b7O50mAkC24XZ7UBBejtoSrqPrh9kiPNEv/CdSVsCWu + L1B29byKlDZ5ZRP0Ab3SR4aho6vDj07wMtJ+hxfMYbIC/ey3JziHbAx2E/733NFM + +1QudCsGjTLsA++K+mBI6oDUDUYDDA2kWpGSHY6L8dPTeDlxm9nZ8jdpJaI8+C02 + xEILze2e9CR1k/h7WD0w04qE/FMDskA= + -----END CERTIFICATE----- +kind: ConfigMap +metadata: + creationTimestamp: null + name: myprivatecacrt + namespace: reverse-proxy diff --git a/certificates/MyPrivateCA.key b/certificates/MyPrivateCA.key new file mode 100644 index 0000000..6fbbf57 --- /dev/null +++ b/certificates/MyPrivateCA.key @@ -0,0 +1,51 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIJKQIBAAKCAgEAxnYczNp8RFzWC0PIanoejQJfKsHexxXCfnJKvkMZAULUdgmQ +NGdkwCn30SmWn2B4gCPDBKE+CFym2Jj+fvSYc4XYJspsFwiqmwz0lXPp58jsX5l9 +/N4CKtEmR4yQv+s/vEJbA5CPgOP8rbUiTWO6O2z5vRU97r/6K6Q/Ou/taUtsF8EA +nW8ZY9nLQAn405AwD3t3gFczbHni9Y3q0uDr8r1WW57KV7FIhRfJXHi1eKVVouEh +0LVW46DbcrlJU5Q6xkXX41FL5ZKChLQoYStGFxA5tgh2ESLMBbQhZKgSExym8Hxl +cZ/rZTWTD/wxAJmB1JF+X0qz2ZymeCdItSKo3Jn2LSX1ZScSw2gOs65TrX75aDkB +DKA8V0jbvcdniD+cbtepCc2i+Xr2uQLMFmnjbXSSkIMT2mJGZbyC7qqNaCOv63ui +TIAUg+rnbDbbQB3zgqElne+bWeia8Hsj5wHl7aOzYrDel5+k7nwum2ahdom6yzg3 +yNNEhwTL+zsHQoj3qCHlXkg6WpuEEQsqjvDZiWK8O8Rq5uG4evxAiVxhmoQvmgWT +ka1EwOWWiqy0W/xpCHEXdm+g5RadQKB1oxuw32SYlhXnwMVPQmHr6OSPS3zEyMcg +Et0C8OfdbfR3uzmBYIi4qELoGYt5T9T88xkmXqiUJBmHI1WrqWW9KHN+Nz0CAwEA +AQKCAgA6RbYBJGn2fLfQiO+Q7BiKWNburAwosqfwDskJgpQV/bR6kCZKbM11ax07 +yhVS6LWZEmcRtfKL7ACFeq7HQjR9PyCPi0IfpUjKzAwI0gctKp7VFzGaDOnf/pdZ +zNk3sPB+65DjxA+OzeKEcroGtTCagE34CgOsVaw0Ij76pDY2g5HSi7YNg/CVk/6M +6CCqphymfx9AjNopkMRmS2xWzPoaxSNVNZO+GezsP2a9gyftq8YwVCBksso3fiTR +U7xHETAMxbc1JMq/NryiEHAGz/j9jqMTYvqf33K+ffyMHJlqCTCvTidPLKCmkAuF +VwxgW7J2Yt4TRtD2JXvvrcE4hlvEHTOzKAjgOaxnu8yf7FTyAAc7lqo08vD2+5rw +1QKwQ853drDMC3PUkAEU2Hp3M+7L0fTiGBCbRKQK75/oZtc7QlQ5WtiW/lzheJqv +nu1V0JwEIbm38GPHaBW9bxDliqSN6i8ya/yTUog4vjVGED8h4cQJ2HdHFOuaIuiL +13vF5C5TsDdqj5PjB61Ig8Jtpp9O9MoM15PsEdMXsyx3TJuuq37pk3xf0ZqswGOO +ir/JxiqpcLt9TotZCkGnaFjEDW3IjmxXveSrfGClAUzSiEqoBCUkAAGoDSGrkYlR +Qa9+rTSFvDCrAC1MFA0T82dQzmT13+ELFg0/9mLnh5vcJaFsoQKCAQEA/AHdI8bh +6Ob2156L922MNAxPPNBIrU8X9oNs155UUnVvklp9oDReMq+aFCmF3hyZvtfUTAHD +QkLCanu8Iu+OUmD9cqkoRB/yz5Qx5n8/p5LzeyDbdABVGs7pTJueKoxh9CI+w9d5 +1gRBmc7tjNCo0FUh3g1qhYnNo+t3dA8F4L8CPGnlaI7EiBldFCn2rs3FvELrKJac +UWu0XDjinF7xTugT2Z5U1PoYmJVhbRglpWf9aj6KeBQTfhoF0w1aKzOy8qia3zyq +/mLZkmkd5+4ujXcGl80xBYYvrUlbf2b1X0rCYjRArR6gas2hKLgNv0LISJjGLqGJ +J+lknq60U6AAuQKCAQEAyZsRT/5gg2hZ85WpWD7631ZcPGH+YEhxsc/sJlLTBE3X +Axrd6T1iHoXSiSovZfRof/yxiHc4KvIR0vRs/SUbSkjGRRRPO1u87BGgAuS5yAzD +fPInCvfd62HRqgm7smDDFdEED7ycyCFiJw9IPqrLL0EU/APEfEhdvKK/73iEmm+X +6DwY2U4iU9rgOaP4VeHPfTgy7vdZzLIg6aZDXyJfdthEAgafELErdaSK9Xp+f7UE +wWrH/mfu/RCY+mXKtnzawjLy+buMv/2XrgBoO6+ERBkxvxK0hPgb9Mogi7K5rwOc +4Ixsk3R1zA7cNFxcTUstsQc1HUXd0Ztlly9le+vApQKCAQEA7FKLIIvXOmOtQ9KI +i0WN3xlUDUF9hhjP7fqdTS5LAPDj6ik1+dBiLcIDCblOslW7z/3yNjzI8RBN5TGX +4mMn4hTWWHpNKmWTfBoLGY5nESx7bBIJ+iR9qqAypAajMl9nVFvw5BLjTFG9exFU +L2NVi9jp46RNKmFqGLgt0wZrirFU1XaxDXYk00SFxuz7Sj3pmnxerjde6/PGtV0b +FWzregWk58TU5MyL2DrtnDKyywRT3xg7HhQlm3Gn2J2C21SmEW0PnxzzdY8ZXXV5 ++A+iVEM0SZLAz99gQm6ygSz6GZyv4QwDQtWftciTwu2m5p8n1vx9jSkqx+TU2QIY +VPuM8QKCAQA1ZNFP+1H6W4+/OHryOTPeJJQnFdj2DRm3exbTC4qBkFAKrXnqROyQ +ouagl0CYYwOuKfGm79Q7Y4Me+MdIwCQbJ20DbJ6TXPeLGhvjyEn/1omLtOJsQDtR +FMYfn5ZLZt8kDwhhVpW7V0QUjjKXDkrjx/vTxvep5syUohHtTWDpOfbkdc4q90uW +I9jQy0GBFV4Lju/GZFIvKVoYJ4WeU48u/ZX9Z12HYTTeYma/HuMT1ZBd3Xb8RPCB +q3yojH8El8qkNjQtueNMEdCzL75rWE/SbU3EiiKvOLrGuSWnef09gdpxih9Tajus +gJ8HaxKzEd8XDI6foxpdYiekw9O/3y9VAoIBAQDfopVGqMsg3B2UtAjN/5KpS/19 +o4M0q2LhVAwPV0kG7ZPyEkSVdhqzvIUnXXsEFpZZaZsev1my0yIlNKZIYIWLhrHO +oy6fVyuAUwaI4eGrTg/FU6yN4o62m6W/tTUlF6POyCeSf1+IntwVunK9NghBUZrX +kU4mt4c68rmbkIlPwSJO9a8bCR6ZuqN1BgCU4XfUfTSFPkDuTyWBxrwsvvHlhrvY +kOFuCL5FaRVghwmsC/pkX/I20T95NynD7yIRrJRuuz+9KEIidIfj34ubGZFWAsT5 +mVaDz4SvLhOo3JiaQaqkkkzO9UMIznbC+XAPG5AVfSH0MfN2ij0/koMqFoNk +-----END RSA PRIVATE KEY----- diff --git a/certificates/MyPrivateCA.srl b/certificates/MyPrivateCA.srl new file mode 100644 index 0000000..684439f --- /dev/null +++ b/certificates/MyPrivateCA.srl @@ -0,0 +1 @@ +73327357EB4C41C62E4B770857BD1589239D7A7D diff --git a/certificates/phone.crt b/certificates/phone.crt new file mode 100644 index 0000000..a9d5f63 --- /dev/null +++ b/certificates/phone.crt @@ -0,0 +1,25 @@ +-----BEGIN CERTIFICATE----- +MIIEMjCCAhoCFHMyc1frTEHGLkt3CFe9FYkjnXp9MA0GCSqGSIb3DQEBCwUAMFEx +CzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVsZWVkczEOMAwGA1UEBwwFbGVlZHMxETAP +BgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQDDAZwaWVycmUwHhcNMjYwMzE5MjI0NzQy +WhcNMjcwMzE5MjI0NzQyWjBaMQswCQYDVQQGEwJVSzEXMBUGA1UECAwOd2VzdC15 +b3Jrc2hpcmUxDjAMBgNVBAcMBWxlZWRzMREwDwYDVQQKDAhnZWVyYWVydDEPMA0G +A1UEAwwGcGllcnJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6Z8 +98GHTXXb2B/eMCg1UmwDxyi7e4Y60oACA7mwV7goxp7Lndc2rhHl1TW+f7pwD+yE +dpIsW530achGHa/ghN0JVKVwkI9mR/5y5JNbruOGCXQ1inDL+nAvVsF0Bo4nkNAS +rsfW7qEsSOk3ClyycjVTN0hEP/GaW6eBuUIJOaM5r+hNPoMvc5Mzts+zrzyTqvf+ +WwxtlBFQR4nyM3gD3uEBuDGXLSF2RsFvZNHAVOwlKlm4T/Qqsl0p+16YKxpVYAIT +J1AZL8t3GeKavLgR+CUzsoauv+q4T4VNngnP/zHOPSQ+O+MZzWnwvr42+2hea0GI +R37DwxLe+Db2UVKv8QIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQAcruGRPu0oQZ4t +VDAwt8GY0HmEV/v/xhzIGu9diwSepWoJvmB9MreYJcdZ9cEzzr1o/u0zRfzX/ORt +NMjR+n45bnQt/z1+A9dWJnAMXbv2T7X8hyDlxumDOqtePV2XrdiMMu+P6qumMYtu +MhukpEboyiNxrspsREw30pnprUHey+GWF9xPNGhTcjMQUq+4Oz1uEnmOt6kw074z +CPOw8pyd/rzAXaJDc9zwQFQA9ONOXVlxV7qq774aX6e9JAkQLyZ95YK4Xq/0C/CI +oinsT4j69uK42TKKqqP3PuORh3TgoFO6sKzY1wX82yipfwLQBjtFNqrgYITX2lYT +v0A2druhDZf8TEaTSXPsCrnY3IirbHDvLC8keqen2uwHl5wftfQ131SBijeS9vR7 +snOgN2uCALpl7MO5Yaxag5ZRXtp/P+lBK72B9khINn6kLE9z6VtrWnDXBMUNWrCI +eBJBHR9Tk2Dim3vHlggudq1tcJyJLS2pbezepLXNTZz7t3jwpOhGANOEuPxvaTuS +AQ5mtIsnyH77SY+Pv5V53bKvewns79cziGepJdR0IdPN61yzeFL4YSJBZzwOvR7q +HisNthyssriIbk2zXLxQ62WXDw8wWx06+xIYPveLlnOEqpzRZz0Il2HELIavC4Gn +shlMOIDSO3EDsY//rGDA0rkUbDd2KQ== +-----END CERTIFICATE----- diff --git a/certificates/phone.csr b/certificates/phone.csr new file mode 100644 index 0000000..9abf011 --- /dev/null +++ b/certificates/phone.csr @@ -0,0 +1,17 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIICvDCCAaQCAQAwWjELMAkGA1UEBhMCVUsxFzAVBgNVBAgMDndlc3QteW9ya3No +aXJlMQ4wDAYDVQQHDAVsZWVkczERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMM +BnBpZXJyZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMumfPfBh011 +29gf3jAoNVJsA8cou3uGOtKAAgO5sFe4KMaey53XNq4R5dU1vn+6cA/shHaSLFud +9GnIRh2v4ITdCVSlcJCPZkf+cuSTW67jhgl0NYpwy/pwL1bBdAaOJ5DQEq7H1u6h +LEjpNwpcsnI1UzdIRD/xmlungblCCTmjOa/oTT6DL3OTM7bPs688k6r3/lsMbZQR +UEeJ8jN4A97hAbgxly0hdkbBb2TRwFTsJSpZuE/0KrJdKftemCsaVWACEydQGS/L +dxnimry4EfglM7KGrr/quE+FTZ4Jz/8xzj0kPjvjGc1p8L6+NvtoXmtBiEd+w8MS +3vg29lFSr/ECAwEAAaAdMBsGCSqGSIb3DQEJBzEODAxkaW5uZXJfc2xAdjMwDQYJ +KoZIhvcNAQELBQADggEBAGuWgPganzkNItRoIetwYEs+MZisskMolDUxDJXrct9m +9gRDUQdccLswR5Cf1FcDiMVKqJUa8ZqaaA5eFGhbn25Ze9I7qm0kiNxiy9CebBX/ +w9AhEJkyeWUdt4xEKF7aH8/IsdOY4ggUNbeEaec4vzDarvmrl/8Gen4JUWNX+8Re +V1QaHAFW4/ku/J/QcK2acNTPmEdqkYMzRFYzHDYqr/OUD7LFD386SjEZtAgYXLc6 +UJa/q8RxLsoKSfM66PNRmK/xqM1GhTi45cnD5Vhe8a+UsmjmFK2+G4vr5qpevy9D +A3KZSw9cJS4ihfKAchG7/0E78K5B0IRhHrhYSrqpFmw= +-----END CERTIFICATE REQUEST----- diff --git a/certificates/phone.key b/certificates/phone.key new file mode 100644 index 0000000..1845e21 --- /dev/null +++ b/certificates/phone.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAy6Z898GHTXXb2B/eMCg1UmwDxyi7e4Y60oACA7mwV7goxp7L +ndc2rhHl1TW+f7pwD+yEdpIsW530achGHa/ghN0JVKVwkI9mR/5y5JNbruOGCXQ1 +inDL+nAvVsF0Bo4nkNASrsfW7qEsSOk3ClyycjVTN0hEP/GaW6eBuUIJOaM5r+hN +PoMvc5Mzts+zrzyTqvf+WwxtlBFQR4nyM3gD3uEBuDGXLSF2RsFvZNHAVOwlKlm4 +T/Qqsl0p+16YKxpVYAITJ1AZL8t3GeKavLgR+CUzsoauv+q4T4VNngnP/zHOPSQ+ +O+MZzWnwvr42+2hea0GIR37DwxLe+Db2UVKv8QIDAQABAoIBAC1uKpqqlaB2FmEU +WuCrV5nXdtBLCef4fc7Pt6NVHT20W4RTkGDZzdzvKTJzFtgvoygqPzKkUTju98NR +ZjLhNVjuZlJ3xbC6DLsqzD6pkN5m61PYlMkZeKeZtzXHWjbMJ49qm4BaHFyHn/Vz +8U9idnx74OCIQpFxOFoR+CJ31M8CcKC+CN902HcTb4O0FRrzZoo0xzrxtsRCtpRP +p0IJIbVOOeW1vmQBqG4U2WkUpaewrG0gnNUmm96NL2BhpJ6kFJ+F+SGtqh4aQO+c ++IEMY4CFIUoajRrZL+kMH7FeNTaZv6Q2WoEvVRojox1c0d8R2slz22A0BWYScdlJ +qX1YMwECgYEA8pJORyb3iy7zzb7HOhI7GzKhnjcQFcID9MGWaK9Dfr+peokA7RDH +fqMXLcSYsSRsFQDbG6MMU5KaRv61+cENbPJrrVxR/uwgmMmUAtu2Kex26UI6i0Uu +hdnwSW2Qr7h9BJN8Htzg8uKtY+AIpMzjqE/7cbLPIBP5fX/byl31OkkCgYEA1uyY +qiwJk6tx04c0PI3wJPP4xouhQn5TxOHOWllnO/TX3a+m0mx6P6VkyNdhEy0HB7nC +zDPQf7FJwH/T4vq+MdaIlowv1dabZ/tQV52usCMQPxr9fxGQO6pkdwfQ6Y9bYEli +qg96yu1imHqxGhAyB8lZeZ4m9hXsEMmcwGKPiGkCgYEAkSR17iEk0YVAoIVc1CSA +dV+wUOkFmN9EWrlS9ESakEbCc+1yPmdh1yZjAiG2c5gli9O9RyYihAcehQh3fn/D +NsM/JrYs4eoL/x/ujl9E+oThCeV0/kxg7/pdyrHidyJeu9Q72oOzneGAelhdE679 +MYLaI0goozsQd8V/j/D0gPECgYB0DJ7GTC8DoHA+0mN/SvjfSykKM/zoBYQ/69lb +aajXc/ZXSnAecNp1oV3RIJLXItoH7uLjFhs/x7/WBG+pwNCP4pIwEBQIN/AD7mxM +UuUvUE+Gc5FrWlVyEihbKUpBwtmJHTb8Mo2QIyu4v47/Tr1k/PCmPaI2AFJOIj7U +lqN/+QKBgHDCMigvtN1r6QgqPPU3U+h3PbjgvmI2lK0kM5XmbJi9YuGGHIk3qDzi +WYAmwTLHOs735PepNrrVEgqIYdYcOQlwJRLOhbE39iGCIkazAWKz4LVcQIqsgJ59 +A113xZ7o3qBSNwun+F8ffdPe4pgbjC69oh4T7GueUYI9VGD0ZT4B +-----END RSA PRIVATE KEY----- diff --git a/certificates/phone.p12 b/certificates/phone.p12 new file mode 100644 index 0000000..378ad98 Binary files /dev/null and b/certificates/phone.p12 differ diff --git a/nginx-config.configmap.yaml b/nginx-config.configmap.yaml index 7587ef9..ce9003a 100644 --- a/nginx-config.configmap.yaml +++ b/nginx-config.configmap.yaml @@ -20,8 +20,8 @@ data: '\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country: $geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tlog_format - deny_style 'deny $remote_addr;';\n\n\tserver {\n\tlisten 80;\n listen 443 - default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; + deny_style 'deny $remote_addr; #$geoip2_data_city_name $geoip2_data_country_name';\n\n\tserver + {\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; # managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed $\n location / {\n proxy_pass http://1.1.1.1;\n \ proxy_redirect off;\n proxy_set_header Host $host;\n @@ -31,10 +31,11 @@ data: $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2 /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name - country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country - {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n #NL - \ yes; # Allow netherland\n\t\t#IN\tyes; # Allow India\n\t}\n\t# Full list - of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap + country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code::$ssl_client_verify + $allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; + # Allow UK\n \"~:SUCCESS$\" yes; # Allow anyone with a valid + certificate (regardless of country)\n #NL yes; # Allow netherland\n\t\t#IN\tyes; + \ # Allow India\n\t}\n\t# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap $allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n diff --git a/nginx.conf b/nginx.conf index f750e8c..ff0bb85 100755 --- a/nginx.conf +++ b/nginx.conf @@ -64,10 +64,11 @@ http { $geoip2_data_country_name country names en; } - map $geoip2_data_country_iso_code $allowed_country { + map $geoip2_data_country_iso_code::$ssl_client_verify $allowed_country { default no; FR yes; # Allow France GB yes; # Allow UK + "~:SUCCESS$" yes; # Allow anyone with a valid certificate (regardless of country) #NL yes; # Allow netherland #IN yes; # Allow India } diff --git a/terraform/module.tf b/terraform/module.tf index ae1ad39..2d7d4e3 100644 --- a/terraform/module.tf +++ b/terraform/module.tf @@ -37,17 +37,17 @@ resource "kubernetes_config_map" "deny_ip_configmap" { } } -resource "kubernetes_config_map" "websites_configmap" { - metadata { - name = "sites-terraform" - namespace = "django-python" - } +#resource "kubernetes_config_map" "websites_configmap" { +# metadata { +# name = "sites-terraform" +# namespace = "django-python" +# } - data = { - "websites.json" = templatefile("websites_terraform.json.tftpl", { - map_of_params = var.nginx_sites }) - } -} +# data = { +# "websites.json" = templatefile("websites_terraform.json.tftpl", { +# map_of_params = var.nginx_sites }) +# } +#} resource "kubernetes_config_map" "automatic-configmap" { diff --git a/terraform/nginx_config.tftpl b/terraform/nginx_config.tftpl index 5d65111..2e7217e 100644 --- a/terraform/nginx_config.tftpl +++ b/terraform/nginx_config.tftpl @@ -46,6 +46,7 @@ server { location ^~ /wp-content { # Logs the IP in "deny IP;" format to your specific file access_log /etc/nginx/blacklisted.d/blacklisted-sessions.conf deny_style; + access_log /etc/nginx/blacklisted.memory.d/blacklisted-sessions.conf deny_style; return 444; } @@ -67,6 +68,11 @@ server { ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + # Client Certificate Config + ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt; + ssl_verify_client optional; # 'optional' so we can check the result manually + + } %{~ if redirect_to_https_bool~} diff --git a/terraform/variables.auto.tfvars b/terraform/variables.auto.tfvars index 3aedaad..13f3b6f 100644 --- a/terraform/variables.auto.tfvars +++ b/terraform/variables.auto.tfvars @@ -23,8 +23,22 @@ nginx_sites = { proxy_cache = true http2_bool = true } - django-dev = { - service = "webserver.django-dev.svc:8000" + redirect = { + #enabled = false + #main django + service = "django-svc.django:8000" + #testing django + #service = "django-testing-svc.django-testing.svc:8000" + proxy_cache = true + http2_bool = true + } + reverse = { + service = "django-svc.django:8000" + proxy_cache = true + http2_bool = true + } + django-testing = { + service = "django-testing-svc.django-testing.svc:8000" proxy_cache = true http2_bool = true } @@ -45,8 +59,8 @@ nginx_sites = { #extra-value = <