pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

trying the certifcate check as well

Browse Source
This commit is contained in:
pi-ux-ce
2026-03-19 23:05:37 +00:00
parent f96e93eab1
commit 1ea92b8e6d
14 changed files with 249 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Nginx.kube.yaml
+9
View File
@@ -54,6 +54,9 @@ spec:
mountPath: /tmp/cache/ mountPath: /tmp/cache/
- name: secret-htpasswd - name: secret-htpasswd
mountPath: /authentication-htpasswd/ mountPath: /authentication-htpasswd/
- name: myprivatecacrt
mountPath: /etc/nginx/certs/
resources: resources:
limits: limits:
cpu: 250m cpu: 250m
@@ -120,6 +123,12 @@ spec:
- name: blacklisted-memory-volume - name: blacklisted-memory-volume
emptyDir: emptyDir:
medium: Memory medium: Memory
- name: myprivatecacrt
configMap:
name: myprivatecacrt
defaultMode: 0555
--- ---
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
certificates/MyPrivateCA.crt
+32
View File
@@ -0,0 +1,32 @@
-----BEGIN CERTIFICATE-----
MIIFgzCCA2ugAwIBAgIUOE2Ww1c9ZZnbcA21fKrhzyQvpZUwDQYJKoZIhvcNAQEL
BQAwUTELMAkGA1UEBhMCVUsxDjAMBgNVBAgMBWxlZWRzMQ4wDAYDVQQHDAVsZWVk
czERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMMBnBpZXJyZTAeFw0yNjAzMTky
MjQ3MDBaFw0zNjAzMTYyMjQ3MDBaMFExCzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVs
ZWVkczEOMAwGA1UEBwwFbGVlZHMxETAPBgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQD
DAZwaWVycmUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGdhzM2nxE
XNYLQ8hqeh6NAl8qwd7HFcJ+ckq+QxkBQtR2CZA0Z2TAKffRKZafYHiAI8MEoT4I
XKbYmP5+9JhzhdgmymwXCKqbDPSVc+nnyOxfmX383gIq0SZHjJC/6z+8QlsDkI+A
4/yttSJNY7o7bPm9FT3uv/orpD867+1pS2wXwQCdbxlj2ctACfjTkDAPe3eAVzNs
eeL1jerS4OvyvVZbnspXsUiFF8lceLV4pVWi4SHQtVbjoNtyuUlTlDrGRdfjUUvl
koKEtChhK0YXEDm2CHYRIswFtCFkqBITHKbwfGVxn+tlNZMP/DEAmYHUkX5fSrPZ
nKZ4J0i1IqjcmfYtJfVlJxLDaA6zrlOtfvloOQEMoDxXSNu9x2eIP5xu16kJzaL5
eva5AswWaeNtdJKQgxPaYkZlvILuqo1oI6/re6JMgBSD6udsNttAHfOCoSWd75tZ
6JrweyPnAeXto7NisN6Xn6TufC6bZqF2ibrLODfI00SHBMv7OwdCiPeoIeVeSDpa
m4QRCyqO8NmJYrw7xGrm4bh6/ECJXGGahC+aBZORrUTA5ZaKrLRb/GkIcRd2b6Dl
Fp1AoHWjG7DfZJiWFefAxU9CYevo5I9LfMTIxyAS3QLw591t9He7OYFgiLioQugZ
i3lP1PzzGSZeqJQkGYcjVaupZb0oc343PQIDAQABo1MwUTAdBgNVHQ4EFgQUV5Pj
MEQzbTr6AN81gSvyPv+CppYwHwYDVR0jBBgwFoAUV5PjMEQzbTr6AN81gSvyPv+C
ppYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAt1Do3rc6AqgJ
CcfpeRcuTS7zPH1f3g/RwfossTd+sSJeCp8hwqOsCGFP8oqNE5KkRuLucRYBvbFF
JwOZi/aaSkzP4VJXx4Q+VFM+bjyxLD5WSyeevvDZwU3isk1KLfrxZ2pHTYSR+bG/
alXxStFEQ7ZKO2xuh7LTQjKVG9tkkmQmh3RFFDzH1qZcpP2iQSaRrgejgNF+nQQR
ZE9SWxV+j7BgOVo6zWoF2vTW3KUmmvSoPsdrvcRnFw+aK2biMfcUDETC21ELO7j2
VPm8OB/hqnzlAL8Dqe1eXoMUW3Mo7tt++CE8uBgNFjdQRfbo0NI6NFR7K0Hhl/20
JxqZ9ep4C60ZOPPj2QPxbb4Z0y2LUPMk5SrnW3x4TYPsxcqtYJJEKSDunJFuSuq7
B+xEtYLM/xZZSp7JtaeomQ1ktzhHAz6mLzVqulXT0iGOzX4DY5vDXFEHBgogSK1h
qfo3d5Vzj+GI5XPREerk8b7O50mAkC24XZ7UBBejtoSrqPrh9kiPNEv/CdSVsCWu
L1B29byKlDZ5ZRP0Ab3SR4aho6vDj07wMtJ+hxfMYbIC/ey3JziHbAx2E/733NFM
+1QudCsGjTLsA++K+mBI6oDUDUYDDA2kWpGSHY6L8dPTeDlxm9nZ8jdpJaI8+C02
xEILze2e9CR1k/h7WD0w04qE/FMDskA=
-----END CERTIFICATE-----
certificates/MyPrivateCA.crt.configmap.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: v1
data:
MyPrivateCA.crt: |
-----BEGIN CERTIFICATE-----
MIIFgzCCA2ugAwIBAgIUOE2Ww1c9ZZnbcA21fKrhzyQvpZUwDQYJKoZIhvcNAQEL
BQAwUTELMAkGA1UEBhMCVUsxDjAMBgNVBAgMBWxlZWRzMQ4wDAYDVQQHDAVsZWVk
czERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMMBnBpZXJyZTAeFw0yNjAzMTky
MjQ3MDBaFw0zNjAzMTYyMjQ3MDBaMFExCzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVs
ZWVkczEOMAwGA1UEBwwFbGVlZHMxETAPBgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQD
DAZwaWVycmUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGdhzM2nxE
XNYLQ8hqeh6NAl8qwd7HFcJ+ckq+QxkBQtR2CZA0Z2TAKffRKZafYHiAI8MEoT4I
XKbYmP5+9JhzhdgmymwXCKqbDPSVc+nnyOxfmX383gIq0SZHjJC/6z+8QlsDkI+A
4/yttSJNY7o7bPm9FT3uv/orpD867+1pS2wXwQCdbxlj2ctACfjTkDAPe3eAVzNs
eeL1jerS4OvyvVZbnspXsUiFF8lceLV4pVWi4SHQtVbjoNtyuUlTlDrGRdfjUUvl
koKEtChhK0YXEDm2CHYRIswFtCFkqBITHKbwfGVxn+tlNZMP/DEAmYHUkX5fSrPZ
nKZ4J0i1IqjcmfYtJfVlJxLDaA6zrlOtfvloOQEMoDxXSNu9x2eIP5xu16kJzaL5
eva5AswWaeNtdJKQgxPaYkZlvILuqo1oI6/re6JMgBSD6udsNttAHfOCoSWd75tZ
6JrweyPnAeXto7NisN6Xn6TufC6bZqF2ibrLODfI00SHBMv7OwdCiPeoIeVeSDpa
m4QRCyqO8NmJYrw7xGrm4bh6/ECJXGGahC+aBZORrUTA5ZaKrLRb/GkIcRd2b6Dl
Fp1AoHWjG7DfZJiWFefAxU9CYevo5I9LfMTIxyAS3QLw591t9He7OYFgiLioQugZ
i3lP1PzzGSZeqJQkGYcjVaupZb0oc343PQIDAQABo1MwUTAdBgNVHQ4EFgQUV5Pj
MEQzbTr6AN81gSvyPv+CppYwHwYDVR0jBBgwFoAUV5PjMEQzbTr6AN81gSvyPv+C
ppYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAt1Do3rc6AqgJ
CcfpeRcuTS7zPH1f3g/RwfossTd+sSJeCp8hwqOsCGFP8oqNE5KkRuLucRYBvbFF
JwOZi/aaSkzP4VJXx4Q+VFM+bjyxLD5WSyeevvDZwU3isk1KLfrxZ2pHTYSR+bG/
alXxStFEQ7ZKO2xuh7LTQjKVG9tkkmQmh3RFFDzH1qZcpP2iQSaRrgejgNF+nQQR
ZE9SWxV+j7BgOVo6zWoF2vTW3KUmmvSoPsdrvcRnFw+aK2biMfcUDETC21ELO7j2
VPm8OB/hqnzlAL8Dqe1eXoMUW3Mo7tt++CE8uBgNFjdQRfbo0NI6NFR7K0Hhl/20
JxqZ9ep4C60ZOPPj2QPxbb4Z0y2LUPMk5SrnW3x4TYPsxcqtYJJEKSDunJFuSuq7
B+xEtYLM/xZZSp7JtaeomQ1ktzhHAz6mLzVqulXT0iGOzX4DY5vDXFEHBgogSK1h
qfo3d5Vzj+GI5XPREerk8b7O50mAkC24XZ7UBBejtoSrqPrh9kiPNEv/CdSVsCWu
L1B29byKlDZ5ZRP0Ab3SR4aho6vDj07wMtJ+hxfMYbIC/ey3JziHbAx2E/733NFM
+1QudCsGjTLsA++K+mBI6oDUDUYDDA2kWpGSHY6L8dPTeDlxm9nZ8jdpJaI8+C02
xEILze2e9CR1k/h7WD0w04qE/FMDskA=
-----END CERTIFICATE-----
kind: ConfigMap
metadata:
creationTimestamp: null
name: myprivatecacrt
namespace: reverse-proxy
certificates/MyPrivateCA.key
+51
View File
@@ -0,0 +1,51 @@
-----BEGIN RSA PRIVATE KEY-----
MIIJKQIBAAKCAgEAxnYczNp8RFzWC0PIanoejQJfKsHexxXCfnJKvkMZAULUdgmQ
NGdkwCn30SmWn2B4gCPDBKE+CFym2Jj+fvSYc4XYJspsFwiqmwz0lXPp58jsX5l9
/N4CKtEmR4yQv+s/vEJbA5CPgOP8rbUiTWO6O2z5vRU97r/6K6Q/Ou/taUtsF8EA
nW8ZY9nLQAn405AwD3t3gFczbHni9Y3q0uDr8r1WW57KV7FIhRfJXHi1eKVVouEh
0LVW46DbcrlJU5Q6xkXX41FL5ZKChLQoYStGFxA5tgh2ESLMBbQhZKgSExym8Hxl
cZ/rZTWTD/wxAJmB1JF+X0qz2ZymeCdItSKo3Jn2LSX1ZScSw2gOs65TrX75aDkB
DKA8V0jbvcdniD+cbtepCc2i+Xr2uQLMFmnjbXSSkIMT2mJGZbyC7qqNaCOv63ui
TIAUg+rnbDbbQB3zgqElne+bWeia8Hsj5wHl7aOzYrDel5+k7nwum2ahdom6yzg3
yNNEhwTL+zsHQoj3qCHlXkg6WpuEEQsqjvDZiWK8O8Rq5uG4evxAiVxhmoQvmgWT
ka1EwOWWiqy0W/xpCHEXdm+g5RadQKB1oxuw32SYlhXnwMVPQmHr6OSPS3zEyMcg
Et0C8OfdbfR3uzmBYIi4qELoGYt5T9T88xkmXqiUJBmHI1WrqWW9KHN+Nz0CAwEA
AQKCAgA6RbYBJGn2fLfQiO+Q7BiKWNburAwosqfwDskJgpQV/bR6kCZKbM11ax07
yhVS6LWZEmcRtfKL7ACFeq7HQjR9PyCPi0IfpUjKzAwI0gctKp7VFzGaDOnf/pdZ
zNk3sPB+65DjxA+OzeKEcroGtTCagE34CgOsVaw0Ij76pDY2g5HSi7YNg/CVk/6M
6CCqphymfx9AjNopkMRmS2xWzPoaxSNVNZO+GezsP2a9gyftq8YwVCBksso3fiTR
U7xHETAMxbc1JMq/NryiEHAGz/j9jqMTYvqf33K+ffyMHJlqCTCvTidPLKCmkAuF
VwxgW7J2Yt4TRtD2JXvvrcE4hlvEHTOzKAjgOaxnu8yf7FTyAAc7lqo08vD2+5rw
1QKwQ853drDMC3PUkAEU2Hp3M+7L0fTiGBCbRKQK75/oZtc7QlQ5WtiW/lzheJqv
nu1V0JwEIbm38GPHaBW9bxDliqSN6i8ya/yTUog4vjVGED8h4cQJ2HdHFOuaIuiL
13vF5C5TsDdqj5PjB61Ig8Jtpp9O9MoM15PsEdMXsyx3TJuuq37pk3xf0ZqswGOO
ir/JxiqpcLt9TotZCkGnaFjEDW3IjmxXveSrfGClAUzSiEqoBCUkAAGoDSGrkYlR
Qa9+rTSFvDCrAC1MFA0T82dQzmT13+ELFg0/9mLnh5vcJaFsoQKCAQEA/AHdI8bh
6Ob2156L922MNAxPPNBIrU8X9oNs155UUnVvklp9oDReMq+aFCmF3hyZvtfUTAHD
QkLCanu8Iu+OUmD9cqkoRB/yz5Qx5n8/p5LzeyDbdABVGs7pTJueKoxh9CI+w9d5
1gRBmc7tjNCo0FUh3g1qhYnNo+t3dA8F4L8CPGnlaI7EiBldFCn2rs3FvELrKJac
UWu0XDjinF7xTugT2Z5U1PoYmJVhbRglpWf9aj6KeBQTfhoF0w1aKzOy8qia3zyq
/mLZkmkd5+4ujXcGl80xBYYvrUlbf2b1X0rCYjRArR6gas2hKLgNv0LISJjGLqGJ
J+lknq60U6AAuQKCAQEAyZsRT/5gg2hZ85WpWD7631ZcPGH+YEhxsc/sJlLTBE3X
Axrd6T1iHoXSiSovZfRof/yxiHc4KvIR0vRs/SUbSkjGRRRPO1u87BGgAuS5yAzD
fPInCvfd62HRqgm7smDDFdEED7ycyCFiJw9IPqrLL0EU/APEfEhdvKK/73iEmm+X
6DwY2U4iU9rgOaP4VeHPfTgy7vdZzLIg6aZDXyJfdthEAgafELErdaSK9Xp+f7UE
wWrH/mfu/RCY+mXKtnzawjLy+buMv/2XrgBoO6+ERBkxvxK0hPgb9Mogi7K5rwOc
4Ixsk3R1zA7cNFxcTUstsQc1HUXd0Ztlly9le+vApQKCAQEA7FKLIIvXOmOtQ9KI
i0WN3xlUDUF9hhjP7fqdTS5LAPDj6ik1+dBiLcIDCblOslW7z/3yNjzI8RBN5TGX
4mMn4hTWWHpNKmWTfBoLGY5nESx7bBIJ+iR9qqAypAajMl9nVFvw5BLjTFG9exFU
L2NVi9jp46RNKmFqGLgt0wZrirFU1XaxDXYk00SFxuz7Sj3pmnxerjde6/PGtV0b
FWzregWk58TU5MyL2DrtnDKyywRT3xg7HhQlm3Gn2J2C21SmEW0PnxzzdY8ZXXV5
+A+iVEM0SZLAz99gQm6ygSz6GZyv4QwDQtWftciTwu2m5p8n1vx9jSkqx+TU2QIY
VPuM8QKCAQA1ZNFP+1H6W4+/OHryOTPeJJQnFdj2DRm3exbTC4qBkFAKrXnqROyQ
ouagl0CYYwOuKfGm79Q7Y4Me+MdIwCQbJ20DbJ6TXPeLGhvjyEn/1omLtOJsQDtR
FMYfn5ZLZt8kDwhhVpW7V0QUjjKXDkrjx/vTxvep5syUohHtTWDpOfbkdc4q90uW
I9jQy0GBFV4Lju/GZFIvKVoYJ4WeU48u/ZX9Z12HYTTeYma/HuMT1ZBd3Xb8RPCB
q3yojH8El8qkNjQtueNMEdCzL75rWE/SbU3EiiKvOLrGuSWnef09gdpxih9Tajus
gJ8HaxKzEd8XDI6foxpdYiekw9O/3y9VAoIBAQDfopVGqMsg3B2UtAjN/5KpS/19
o4M0q2LhVAwPV0kG7ZPyEkSVdhqzvIUnXXsEFpZZaZsev1my0yIlNKZIYIWLhrHO
oy6fVyuAUwaI4eGrTg/FU6yN4o62m6W/tTUlF6POyCeSf1+IntwVunK9NghBUZrX
kU4mt4c68rmbkIlPwSJO9a8bCR6ZuqN1BgCU4XfUfTSFPkDuTyWBxrwsvvHlhrvY
kOFuCL5FaRVghwmsC/pkX/I20T95NynD7yIRrJRuuz+9KEIidIfj34ubGZFWAsT5
mVaDz4SvLhOo3JiaQaqkkkzO9UMIznbC+XAPG5AVfSH0MfN2ij0/koMqFoNk
-----END RSA PRIVATE KEY-----
certificates/MyPrivateCA.srl
+1
View File
@@ -0,0 +1 @@
73327357EB4C41C62E4B770857BD1589239D7A7D
certificates/phone.crt
+25
View File
@@ -0,0 +1,25 @@
-----BEGIN CERTIFICATE-----
MIIEMjCCAhoCFHMyc1frTEHGLkt3CFe9FYkjnXp9MA0GCSqGSIb3DQEBCwUAMFEx
CzAJBgNVBAYTAlVLMQ4wDAYDVQQIDAVsZWVkczEOMAwGA1UEBwwFbGVlZHMxETAP
BgNVBAoMCGdlZXJhZXJ0MQ8wDQYDVQQDDAZwaWVycmUwHhcNMjYwMzE5MjI0NzQy
WhcNMjcwMzE5MjI0NzQyWjBaMQswCQYDVQQGEwJVSzEXMBUGA1UECAwOd2VzdC15
b3Jrc2hpcmUxDjAMBgNVBAcMBWxlZWRzMREwDwYDVQQKDAhnZWVyYWVydDEPMA0G
A1UEAwwGcGllcnJlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6Z8
98GHTXXb2B/eMCg1UmwDxyi7e4Y60oACA7mwV7goxp7Lndc2rhHl1TW+f7pwD+yE
dpIsW530achGHa/ghN0JVKVwkI9mR/5y5JNbruOGCXQ1inDL+nAvVsF0Bo4nkNAS
rsfW7qEsSOk3ClyycjVTN0hEP/GaW6eBuUIJOaM5r+hNPoMvc5Mzts+zrzyTqvf+
WwxtlBFQR4nyM3gD3uEBuDGXLSF2RsFvZNHAVOwlKlm4T/Qqsl0p+16YKxpVYAIT
J1AZL8t3GeKavLgR+CUzsoauv+q4T4VNngnP/zHOPSQ+O+MZzWnwvr42+2hea0GI
R37DwxLe+Db2UVKv8QIDAQABMA0GCSqGSIb3DQEBCwUAA4ICAQAcruGRPu0oQZ4t
VDAwt8GY0HmEV/v/xhzIGu9diwSepWoJvmB9MreYJcdZ9cEzzr1o/u0zRfzX/ORt
NMjR+n45bnQt/z1+A9dWJnAMXbv2T7X8hyDlxumDOqtePV2XrdiMMu+P6qumMYtu
MhukpEboyiNxrspsREw30pnprUHey+GWF9xPNGhTcjMQUq+4Oz1uEnmOt6kw074z
CPOw8pyd/rzAXaJDc9zwQFQA9ONOXVlxV7qq774aX6e9JAkQLyZ95YK4Xq/0C/CI
oinsT4j69uK42TKKqqP3PuORh3TgoFO6sKzY1wX82yipfwLQBjtFNqrgYITX2lYT
v0A2druhDZf8TEaTSXPsCrnY3IirbHDvLC8keqen2uwHl5wftfQ131SBijeS9vR7
snOgN2uCALpl7MO5Yaxag5ZRXtp/P+lBK72B9khINn6kLE9z6VtrWnDXBMUNWrCI
eBJBHR9Tk2Dim3vHlggudq1tcJyJLS2pbezepLXNTZz7t3jwpOhGANOEuPxvaTuS
AQ5mtIsnyH77SY+Pv5V53bKvewns79cziGepJdR0IdPN61yzeFL4YSJBZzwOvR7q
HisNthyssriIbk2zXLxQ62WXDw8wWx06+xIYPveLlnOEqpzRZz0Il2HELIavC4Gn
shlMOIDSO3EDsY//rGDA0rkUbDd2KQ==
-----END CERTIFICATE-----
certificates/phone.csr
+17
View File
@@ -0,0 +1,17 @@
-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwWjELMAkGA1UEBhMCVUsxFzAVBgNVBAgMDndlc3QteW9ya3No
aXJlMQ4wDAYDVQQHDAVsZWVkczERMA8GA1UECgwIZ2VlcmFlcnQxDzANBgNVBAMM
BnBpZXJyZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMumfPfBh011
29gf3jAoNVJsA8cou3uGOtKAAgO5sFe4KMaey53XNq4R5dU1vn+6cA/shHaSLFud
9GnIRh2v4ITdCVSlcJCPZkf+cuSTW67jhgl0NYpwy/pwL1bBdAaOJ5DQEq7H1u6h
LEjpNwpcsnI1UzdIRD/xmlungblCCTmjOa/oTT6DL3OTM7bPs688k6r3/lsMbZQR
UEeJ8jN4A97hAbgxly0hdkbBb2TRwFTsJSpZuE/0KrJdKftemCsaVWACEydQGS/L
dxnimry4EfglM7KGrr/quE+FTZ4Jz/8xzj0kPjvjGc1p8L6+NvtoXmtBiEd+w8MS
3vg29lFSr/ECAwEAAaAdMBsGCSqGSIb3DQEJBzEODAxkaW5uZXJfc2xAdjMwDQYJ
KoZIhvcNAQELBQADggEBAGuWgPganzkNItRoIetwYEs+MZisskMolDUxDJXrct9m
9gRDUQdccLswR5Cf1FcDiMVKqJUa8ZqaaA5eFGhbn25Ze9I7qm0kiNxiy9CebBX/
w9AhEJkyeWUdt4xEKF7aH8/IsdOY4ggUNbeEaec4vzDarvmrl/8Gen4JUWNX+8Re
V1QaHAFW4/ku/J/QcK2acNTPmEdqkYMzRFYzHDYqr/OUD7LFD386SjEZtAgYXLc6
UJa/q8RxLsoKSfM66PNRmK/xqM1GhTi45cnD5Vhe8a+UsmjmFK2+G4vr5qpevy9D
A3KZSw9cJS4ihfKAchG7/0E78K5B0IRhHrhYSrqpFmw=
-----END CERTIFICATE REQUEST-----
certificates/phone.key
+27
View File
@@ -0,0 +1,27 @@
-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAy6Z898GHTXXb2B/eMCg1UmwDxyi7e4Y60oACA7mwV7goxp7L
ndc2rhHl1TW+f7pwD+yEdpIsW530achGHa/ghN0JVKVwkI9mR/5y5JNbruOGCXQ1
inDL+nAvVsF0Bo4nkNASrsfW7qEsSOk3ClyycjVTN0hEP/GaW6eBuUIJOaM5r+hN
PoMvc5Mzts+zrzyTqvf+WwxtlBFQR4nyM3gD3uEBuDGXLSF2RsFvZNHAVOwlKlm4
T/Qqsl0p+16YKxpVYAITJ1AZL8t3GeKavLgR+CUzsoauv+q4T4VNngnP/zHOPSQ+
O+MZzWnwvr42+2hea0GIR37DwxLe+Db2UVKv8QIDAQABAoIBAC1uKpqqlaB2FmEU
WuCrV5nXdtBLCef4fc7Pt6NVHT20W4RTkGDZzdzvKTJzFtgvoygqPzKkUTju98NR
ZjLhNVjuZlJ3xbC6DLsqzD6pkN5m61PYlMkZeKeZtzXHWjbMJ49qm4BaHFyHn/Vz
8U9idnx74OCIQpFxOFoR+CJ31M8CcKC+CN902HcTb4O0FRrzZoo0xzrxtsRCtpRP
p0IJIbVOOeW1vmQBqG4U2WkUpaewrG0gnNUmm96NL2BhpJ6kFJ+F+SGtqh4aQO+c
+IEMY4CFIUoajRrZL+kMH7FeNTaZv6Q2WoEvVRojox1c0d8R2slz22A0BWYScdlJ
qX1YMwECgYEA8pJORyb3iy7zzb7HOhI7GzKhnjcQFcID9MGWaK9Dfr+peokA7RDH
fqMXLcSYsSRsFQDbG6MMU5KaRv61+cENbPJrrVxR/uwgmMmUAtu2Kex26UI6i0Uu
hdnwSW2Qr7h9BJN8Htzg8uKtY+AIpMzjqE/7cbLPIBP5fX/byl31OkkCgYEA1uyY
qiwJk6tx04c0PI3wJPP4xouhQn5TxOHOWllnO/TX3a+m0mx6P6VkyNdhEy0HB7nC
zDPQf7FJwH/T4vq+MdaIlowv1dabZ/tQV52usCMQPxr9fxGQO6pkdwfQ6Y9bYEli
qg96yu1imHqxGhAyB8lZeZ4m9hXsEMmcwGKPiGkCgYEAkSR17iEk0YVAoIVc1CSA
dV+wUOkFmN9EWrlS9ESakEbCc+1yPmdh1yZjAiG2c5gli9O9RyYihAcehQh3fn/D
NsM/JrYs4eoL/x/ujl9E+oThCeV0/kxg7/pdyrHidyJeu9Q72oOzneGAelhdE679
MYLaI0goozsQd8V/j/D0gPECgYB0DJ7GTC8DoHA+0mN/SvjfSykKM/zoBYQ/69lb
aajXc/ZXSnAecNp1oV3RIJLXItoH7uLjFhs/x7/WBG+pwNCP4pIwEBQIN/AD7mxM
UuUvUE+Gc5FrWlVyEihbKUpBwtmJHTb8Mo2QIyu4v47/Tr1k/PCmPaI2AFJOIj7U
lqN/+QKBgHDCMigvtN1r6QgqPPU3U+h3PbjgvmI2lK0kM5XmbJi9YuGGHIk3qDzi
WYAmwTLHOs735PepNrrVEgqIYdYcOQlwJRLOhbE39iGCIkazAWKz4LVcQIqsgJ59
A113xZ7o3qBSNwun+F8ffdPe4pgbjC69oh4T7GueUYI9VGD0ZT4B
-----END RSA PRIVATE KEY-----
certificates/phone.p12
BIN
View File
Binary file not shown.
nginx-config.configmap.yaml
+7 -6
View File
@@ -20,8 +20,8 @@ data:
'\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format '\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format
blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country: blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country:
$geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tlog_format $geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tlog_format
deny_style 'deny $remote_addr;';\n\n\tserver {\n\tlisten 80;\n listen 443 deny_style 'deny $remote_addr; #$geoip2_data_city_name $geoip2_data_country_name';\n\n\tserver
default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; {\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
# managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
# managed $\n location / {\n proxy_pass http://1.1.1.1;\n # managed $\n location / {\n proxy_pass http://1.1.1.1;\n
\ proxy_redirect off;\n proxy_set_header Host $host;\n \ proxy_redirect off;\n proxy_set_header Host $host;\n
@@ -31,10 +31,11 @@ data:
$http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2 $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2
/data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code::$ssl_client_verify
{\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n #NL $allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes;
\ yes; # Allow netherland\n\t\t#IN\tyes; # Allow India\n\t}\n\t# Full list # Allow UK\n \"~:SUCCESS$\" yes; # Allow anyone with a valid
of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap certificate (regardless of country)\n #NL yes; # Allow netherland\n\t\t#IN\tyes;
\ # Allow India\n\t}\n\t# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
$allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude $allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude
/etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include
/etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
nginx.conf
+2 -1
View File
@@ -64,10 +64,11 @@ http {
$geoip2_data_country_name country names en; $geoip2_data_country_name country names en;
} }
map $geoip2_data_country_iso_code $allowed_country { map $geoip2_data_country_iso_code::$ssl_client_verify $allowed_country {
default no; default no;
FR yes; # Allow France FR yes; # Allow France
GB yes; # Allow UK GB yes; # Allow UK
"~:SUCCESS$" yes; # Allow anyone with a valid certificate (regardless of country)
#NL yes; # Allow netherland #NL yes; # Allow netherland
#IN yes; # Allow India #IN yes; # Allow India
} }
terraform/module.tf
+10 -10
View File
@@ -37,17 +37,17 @@ resource "kubernetes_config_map" "deny_ip_configmap" {
} }
} }
resource "kubernetes_config_map" "websites_configmap" { #resource "kubernetes_config_map" "websites_configmap" {
metadata { # metadata {
name = "sites-terraform" # name = "sites-terraform"
namespace = "django-python" # namespace = "django-python"
} # }
data = { # data = {
"websites.json" = templatefile("websites_terraform.json.tftpl", { # "websites.json" = templatefile("websites_terraform.json.tftpl", {
map_of_params = var.nginx_sites }) # map_of_params = var.nginx_sites })
} # }
} #}
resource "kubernetes_config_map" "automatic-configmap" { resource "kubernetes_config_map" "automatic-configmap" {
terraform/nginx_config.tftpl
+6
View File
@@ -46,6 +46,7 @@ server {
location ^~ /wp-content { location ^~ /wp-content {
# Logs the IP in "deny IP;" format to your specific file # Logs the IP in "deny IP;" format to your specific file
access_log /etc/nginx/blacklisted.d/blacklisted-sessions.conf deny_style; access_log /etc/nginx/blacklisted.d/blacklisted-sessions.conf deny_style;
access_log /etc/nginx/blacklisted.memory.d/blacklisted-sessions.conf deny_style;
return 444; return 444;
} }
@@ -67,6 +68,11 @@ server {
ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
# Client Certificate Config
ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt;
ssl_verify_client optional; # 'optional' so we can check the result manually
} }
%{~ if redirect_to_https_bool~} %{~ if redirect_to_https_bool~}
terraform/variables.auto.tfvars
+22 -12
View File
@@ -23,8 +23,22 @@ nginx_sites = {
proxy_cache = true proxy_cache = true
http2_bool = true http2_bool = true
} }
django-dev = { redirect = {
service = "webserver.django-dev.svc:8000" #enabled = false
#main django
service = "django-svc.django:8000"
#testing django
#service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true
http2_bool = true
}
reverse = {
service = "django-svc.django:8000"
proxy_cache = true
http2_bool = true
}
django-testing = {
service = "django-testing-svc.django-testing.svc:8000"
proxy_cache = true proxy_cache = true
http2_bool = true http2_bool = true
} }
@@ -45,8 +59,8 @@ nginx_sites = {
#extra-value = <<EOT #extra-value = <<EOT
# location = /oauth2/auth { # location = /oauth2/auth {
# internal; # internal;
#proxy_pass http://oauthn_backend; #proxy_pass http://oauthn_backend;
## proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth; ## proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
# proxy_pass_request_body off; # proxy_pass_request_body off;
# proxy_set_header Content-Length ""; # proxy_set_header Content-Length "";
# proxy_set_header X-Original-URI $request_uri; # proxy_set_header X-Original-URI $request_uri;
@@ -171,10 +185,10 @@ client_max_body_size 20m;
service = "recommendarr-svc.servarr.svc:3000" service = "recommendarr-svc.servarr.svc:3000"
enabled = false enabled = false
} }
reverse = { #reverse = {
service = "192.168.88.50:8888" # service = "192.168.88.50:8888"
enabled = false # enabled = false
} #}
sickchill = { sickchill = {
service = "sickchill.servarr.svc" service = "sickchill.servarr.svc"
enabled = false enabled = false
@@ -254,10 +268,6 @@ proxy_set_header Connection "upgrade";
service = "vulcan.vulcan.svc:80" service = "vulcan.vulcan.svc:80"
enabled = false enabled = false
} }
djangoterra = {
enabled = false
service = "djangoterra-svc.djangoterra.svc:8000"
}
nginx = { nginx = {
enabled = false enabled = false