success with geoip2

terraform/nginx_config.tftpl

@@ -9,6 +9,12 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
+        if ($allowed_country = no) {
+            return 444; # Forbidden
+            # Or use 'return 444;' to close the connection without a response
+	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
+        }
+
         location / {
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
                 proxy_set_header    Upgrade     $http_upgrade;
@@ -31,10 +37,17 @@ server {
         location /.well-known/acme-challenge/ {
                 root /var/www/certbot;
         }
+	location @f2b-banned {
+	       default_type text/html;
+	       return 403 "<br/><center>
+	         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
+	         You are banned!</b></center>";
+	     }
 
 	access_log /var/log/nginx/access.log my_custom_format;
         access_log /var/log/nginx/ip_audit.log ip_audit;
         access_log /var/log/nginx/backend_debug.log backend_debug;
+        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked; 
 	${extra-value}
         %{~ if http2_bool~}
         http2 on;

terraform/variables.auto.tfvars

@@ -1,13 +1,13 @@
 nginx_sites = {
   bitwarden = {
-    service = "nginx.bitwarden.svc:8080"
+    #service = "nginx.bitwarden.svc:8080"
     #extra-value-location = <<EOT
     #proxy_set_header      Host $host;
     #proxy_set_header      X-Real-IP $remote_addr;
     #proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
     #proxy_set_header      Proxy "";
     #            EOT
-    #service    = "bitwarden-nginx-svc.bitwardent.svc:8080"
+    service    = "bitwarden-nginx-svc.bitwarden.svc:8080"
     http2_bool = true
   }
 
@@ -36,38 +36,38 @@ nginx_sites = {
     proxy_cache = true
     http2_bool  = true
 
-    extra-value-location = <<EOT
-      auth_request /oauth2/auth;
-      error_page 401 = @oauth2_signin;
-      proxy_set_header X-Auth-Request-Redirect $request_uri;
-                EOT
+    #extra-value-location = <<EOT
+    #  auth_request /oauth2/auth;
+    #  error_page 401 = @oauth2_signin;
+    #  proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #            EOT
 
-    extra-value = <<EOT
-      location = /oauth2/auth {
-      internal;
-proxy_pass http://oauthn_backend;
-#        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
-      proxy_pass_request_body off;
-      proxy_set_header Content-Length "";
-      proxy_set_header X-Original-URI $request_uri;
-      proxy_set_header X-Real-IP $remote_addr;
-      proxy_set_header X-Scheme $scheme;
-    }
+    #extra-value = <<EOT
+    #  location = /oauth2/auth {
+    #  internal;
+#proxy_pass http://oauthn_backend;
+##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
+    # proxy_pass_request_body off;
+    #  proxy_set_header Content-Length "";
+    #  proxy_set_header X-Original-URI $request_uri;
+    #  proxy_set_header X-Real-IP $remote_addr;
+    #  proxy_set_header X-Scheme $scheme;
+    #}
 
-    location @oauth2_signin {
-      return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
-      #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
-    }
+    #location @oauth2_signin {
+    #  return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
+    #  #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
+    #}
 
-    location /oauth2/ {
-    proxy_pass http://oauthn_backend;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Scheme $scheme;
-    proxy_set_header X-Auth-Request-Redirect $request_uri;
-    }
+    #location /oauth2/ {
+    #proxy_pass http://oauthn_backend;
+    #proxy_set_header Host $host;
+    #proxy_set_header X-Real-IP $remote_addr;
+    #proxy_set_header X-Scheme $scheme;
+    #proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #}
 
-                EOT
+    #            EOT
 
 
   }
@@ -75,6 +75,7 @@ proxy_pass http://oauthn_backend;
     service          = "webserver.gitlab.svc:443"
     proxy_cache      = true
     extra_value_bool = true
+    enabled          = false
     extra-value      = <<EOT
 client_max_body_size 20m;
 	proxy_request_buffering off;
@@ -192,6 +193,7 @@ client_max_body_size 20m;
   }
   dupeguru = {
     service                 = "dupeguru.dupeguru.svc:5800"
+    enabled                 = false
     authentication_required = true
   }