From 3570e436f82a0d3c10849c351a5fdd1b7a71ed69 Mon Sep 17 00:00:00 2001 From: pierre Date: Fri, 13 Mar 2026 00:33:43 +0000 Subject: [PATCH] success with geoip2 --- nginx-config.configmap.yaml | 25 +++++++------ nginx.conf | 18 ++++++---- terraform/nginx_config.tftpl | 13 +++++++ terraform/variables.auto.tfvars | 62 +++++++++++++++++---------------- 4 files changed, 70 insertions(+), 48 deletions(-) diff --git a/nginx-config.configmap.yaml b/nginx-config.configmap.yaml index 625f7e2..1a80cc5 100644 --- a/nginx-config.configmap.yaml +++ b/nginx-config.configmap.yaml @@ -14,7 +14,12 @@ data: \ log_format ip_audit '$remote_addr [$time_local]';\n log_format backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\" $status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" - '\n 'upstream_status=$upstream_status';\n\n\tserver + '\n 'upstream_status=$upstream_status';\n log_format + localization '$remote_addr - $remote_user [$time_local] '\n '\"$request\" + $status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" + '\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format + blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country: + $geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tserver {\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; # managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed $\n location / {\n proxy_pass http://1.1.1.1;\n @@ -26,16 +31,14 @@ data: /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country - {\n\t\tdefault yes;\n\t\tIN no;\n\t CN no; # Block China\n\t\tRU - \ no; # Block Russia\n\t\tKP no; # Block North Korea\n\t}\n\tlog_format - main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status - $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" '\n - \ '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header - X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude - /etc/nginx/conf.d/*.conf;\n include /etc/nginx/blacklisted.d/*.conf;\n\n\t# - adding this line for the fial2ban settings\t\n #map $cookie_session_id - $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add - extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver + {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n #NL + \ yes; # Allow netherland\n\t\t#IN\tyes; # Allow India\n\t}\n\t# Full list + of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap + $allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude + /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include + /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n + \ #map $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; + }\n\t#add extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver 127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n" kind: ConfigMap diff --git a/nginx.conf b/nginx.conf index 7aae8be..b681ba5 100755 --- a/nginx.conf +++ b/nginx.conf @@ -31,7 +31,9 @@ http { '"$request" $status $body_bytes_sent ' '"$http_referer" "$http_user_agent" ' '$geoip2_data_city_name $geoip2_data_country_name'; - + log_format blocked_fmt '$http_host \t $remote_addr - [$time_local] ' + 'Blocked Country: $geoip2_data_country_iso_code ' + '"$request" $status'; server { listen 80; @@ -62,16 +64,18 @@ http { map $geoip2_data_country_iso_code $allowed_country { default no; - #NL yes; # Allow netherland FR yes; # Allow France GB yes; # Allow UK - NL no; # Block netherland - IN no; # Block India - CN no; # Block China - RU no; # Block Russia - KP no; # Block North Korea + #NL yes; # Allow netherland + #IN yes; # Allow India } # Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes + + map $allowed_country $should_log_blocked { + no 1; + default 0; + } + include /etc/nginx/deny.d/*.conf; include /etc/nginx/conf.d/*.conf; include /etc/nginx/blacklisted.d/*.conf; diff --git a/terraform/nginx_config.tftpl b/terraform/nginx_config.tftpl index 161fb89..4cddf1a 100644 --- a/terraform/nginx_config.tftpl +++ b/terraform/nginx_config.tftpl @@ -9,6 +9,12 @@ upstream ${name_site}_backend { server { server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu; + if ($allowed_country = no) { + return 444; # Forbidden + # Or use 'return 444;' to close the connection without a response + # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header. + } + location / { proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend; proxy_set_header Upgrade $http_upgrade; @@ -31,10 +37,17 @@ server { location /.well-known/acme-challenge/ { root /var/www/certbot; } + location @f2b-banned { + default_type text/html; + return 403 "
+ + You are banned!
"; + } access_log /var/log/nginx/access.log my_custom_format; access_log /var/log/nginx/ip_audit.log ip_audit; access_log /var/log/nginx/backend_debug.log backend_debug; + access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked; ${extra-value} %{~ if http2_bool~} http2 on; diff --git a/terraform/variables.auto.tfvars b/terraform/variables.auto.tfvars index dd02889..3aedaad 100644 --- a/terraform/variables.auto.tfvars +++ b/terraform/variables.auto.tfvars @@ -1,13 +1,13 @@ nginx_sites = { bitwarden = { - service = "nginx.bitwarden.svc:8080" + #service = "nginx.bitwarden.svc:8080" #extra-value-location = <