trying the certifcate check as well

terraform/module.tf

@@ -37,17 +37,17 @@ resource "kubernetes_config_map" "deny_ip_configmap" {
   }
 }
 
-resource "kubernetes_config_map" "websites_configmap" {
-  metadata {
-    name      = "sites-terraform"
-    namespace = "django-python"
-  }
+#resource "kubernetes_config_map" "websites_configmap" {
+#  metadata {
+#    name      = "sites-terraform"
+#    namespace = "django-python"
+#  }
 
-  data = {
-    "websites.json" = templatefile("websites_terraform.json.tftpl", {
-    map_of_params = var.nginx_sites })
-  }
-}
+#  data = {
+#    "websites.json" = templatefile("websites_terraform.json.tftpl", {
+#    map_of_params = var.nginx_sites })
+#  }
+#}
 
 
 resource "kubernetes_config_map" "automatic-configmap" {

terraform/nginx_config.tftpl

@@ -46,6 +46,7 @@ server {
 	location ^~ /wp-content {
         # Logs the IP in "deny IP;" format to your specific file
 		access_log /etc/nginx/blacklisted.d/blacklisted-sessions.conf deny_style;
+                access_log /etc/nginx/blacklisted.memory.d/blacklisted-sessions.conf deny_style;
 		return 444; 
 	}
 
@@ -67,6 +68,11 @@ server {
         ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
         ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
 
+        # Client Certificate Config
+        ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt;
+        ssl_verify_client optional; # 'optional' so we can check the result manually
+
+
 }
 %{~ if redirect_to_https_bool~}
 

terraform/variables.auto.tfvars

@@ -23,8 +23,22 @@ nginx_sites = {
     proxy_cache = true
     http2_bool  = true
   }
-  django-dev = {
-    service     = "webserver.django-dev.svc:8000"
+  redirect = {
+    #enabled     = false
+    #main django
+    service = "django-svc.django:8000"
+    #testing django
+    #service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+  reverse = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+  django-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
     proxy_cache = true
     http2_bool  = true
   }
@@ -45,8 +59,8 @@ nginx_sites = {
     #extra-value = <<EOT
     #  location = /oauth2/auth {
     #  internal;
-#proxy_pass http://oauthn_backend;
-##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
+    #proxy_pass http://oauthn_backend;
+    ##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
     # proxy_pass_request_body off;
     #  proxy_set_header Content-Length "";
     #  proxy_set_header X-Original-URI $request_uri;
@@ -171,10 +185,10 @@ client_max_body_size 20m;
     service = "recommendarr-svc.servarr.svc:3000"
     enabled = false
   }
-  reverse = {
-    service = "192.168.88.50:8888"
-    enabled = false
-  }
+  #reverse = {
+  #  service = "192.168.88.50:8888"
+  #  enabled = false
+  #}
   sickchill = {
     service = "sickchill.servarr.svc"
     enabled = false
@@ -254,10 +268,6 @@ proxy_set_header Connection "upgrade";
     service = "vulcan.vulcan.svc:80"
     enabled = false
   }
-  djangoterra = {
-    enabled = false
-    service = "djangoterra-svc.djangoterra.svc:8000"
-  }
 
   nginx = {
     enabled = false