pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

success with geoip2
Gitea Actions Demo / Explore-Gitea-Actions (push) Failing after 50s
Details

Browse Source
This commit is contained in:
pi-ux-ce
2026-03-13 00:33:43 +00:00
parent 2ea483265b
commit 3570e436f8
4 changed files with 70 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx-config.configmap.yaml
+14 -11
View File
@@ -14,7 +14,12 @@ data:
\ log_format ip_audit '$remote_addr [$time_local]';\n log_format \ log_format ip_audit '$remote_addr [$time_local]';\n log_format
backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\" backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
$status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" $status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
'\n 'upstream_status=$upstream_status';\n\n\tserver '\n 'upstream_status=$upstream_status';\n log_format
localization '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
$status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
'\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format
blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country:
$geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tserver
{\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; {\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
# managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
# managed $\n location / {\n proxy_pass http://1.1.1.1;\n # managed $\n location / {\n proxy_pass http://1.1.1.1;\n
@@ -26,16 +31,14 @@ data:
/data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country
{\n\t\tdefault yes;\n\t\tIN no;\n\t CN no; # Block China\n\t\tRU {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n #NL
\ no; # Block Russia\n\t\tKP no; # Block North Korea\n\t}\n\tlog_format \ yes; # Allow netherland\n\t\t#IN\tyes; # Allow India\n\t}\n\t# Full list
main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
$body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" '\n $allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude
\ '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include
X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
/etc/nginx/conf.d/*.conf;\n include /etc/nginx/blacklisted.d/*.conf;\n\n\t# \ #map $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map;
adding this line for the fial2ban settings\t\n #map $cookie_session_id }\n\t#add extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
$blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path 127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
/tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n" /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
kind: ConfigMap kind: ConfigMap
nginx.conf
+11 -7
View File
@@ -31,7 +31,9 @@ http {
'"$request" $status $body_bytes_sent ' '"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" ' '"$http_referer" "$http_user_agent" '
'$geoip2_data_city_name $geoip2_data_country_name'; '$geoip2_data_city_name $geoip2_data_country_name';
log_format blocked_fmt '$http_host \t $remote_addr - [$time_local] '
'Blocked Country: $geoip2_data_country_iso_code '
'"$request" $status';
server { server {
listen 80; listen 80;
@@ -62,16 +64,18 @@ http {
map $geoip2_data_country_iso_code $allowed_country { map $geoip2_data_country_iso_code $allowed_country {
default no; default no;
#NL yes; # Allow netherland
FR yes; # Allow France FR yes; # Allow France
GB yes; # Allow UK GB yes; # Allow UK
NL no; # Block netherland #NL yes; # Allow netherland
IN no; # Block India #IN yes; # Allow India
CN no; # Block China
RU no; # Block Russia
KP no; # Block North Korea
} }
# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes # Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes
map $allowed_country $should_log_blocked {
no 1;
default 0;
}
include /etc/nginx/deny.d/*.conf; include /etc/nginx/deny.d/*.conf;
include /etc/nginx/conf.d/*.conf; include /etc/nginx/conf.d/*.conf;
include /etc/nginx/blacklisted.d/*.conf; include /etc/nginx/blacklisted.d/*.conf;
terraform/nginx_config.tftpl
+13
View File
@@ -9,6 +9,12 @@ upstream ${name_site}_backend {
server { server {
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu; server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
if ($allowed_country = no) {
return 444; # Forbidden
# Or use 'return 444;' to close the connection without a response
# The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
}
location / { location / {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend; proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
@@ -31,10 +37,17 @@ server {
location /.well-known/acme-challenge/ { location /.well-known/acme-challenge/ {
root /var/www/certbot; root /var/www/certbot;
} }
location @f2b-banned {
default_type text/html;
return 403 "<br/><center>
<b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
You are banned!</b></center>";
}
access_log /var/log/nginx/access.log my_custom_format; access_log /var/log/nginx/access.log my_custom_format;
access_log /var/log/nginx/ip_audit.log ip_audit; access_log /var/log/nginx/ip_audit.log ip_audit;
access_log /var/log/nginx/backend_debug.log backend_debug; access_log /var/log/nginx/backend_debug.log backend_debug;
access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked;
${extra-value} ${extra-value}
%{~ if http2_bool~} %{~ if http2_bool~}
http2 on; http2 on;
terraform/variables.auto.tfvars
+32 -30
View File
@@ -1,13 +1,13 @@
nginx_sites = { nginx_sites = {
bitwarden = { bitwarden = {
service = "nginx.bitwarden.svc:8080" #service = "nginx.bitwarden.svc:8080"
#extra-value-location = <<EOT #extra-value-location = <<EOT
#proxy_set_header Host $host; #proxy_set_header Host $host;
#proxy_set_header X-Real-IP $remote_addr; #proxy_set_header X-Real-IP $remote_addr;
#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#proxy_set_header Proxy ""; #proxy_set_header Proxy "";
# EOT # EOT
#service = "bitwarden-nginx-svc.bitwardent.svc:8080" service = "bitwarden-nginx-svc.bitwarden.svc:8080"
http2_bool = true http2_bool = true
} }
@@ -36,38 +36,38 @@ nginx_sites = {
proxy_cache = true proxy_cache = true
http2_bool = true http2_bool = true
extra-value-location = <<EOT #extra-value-location = <<EOT
auth_request /oauth2/auth; # auth_request /oauth2/auth;
error_page 401 = @oauth2_signin; # error_page 401 = @oauth2_signin;
proxy_set_header X-Auth-Request-Redirect $request_uri; # proxy_set_header X-Auth-Request-Redirect $request_uri;
EOT # EOT
extra-value = <<EOT #extra-value = <<EOT
location = /oauth2/auth { # location = /oauth2/auth {
internal; # internal;
proxy_pass http://oauthn_backend; #proxy_pass http://oauthn_backend;
# proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth; ## proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
proxy_pass_request_body off; # proxy_pass_request_body off;
proxy_set_header Content-Length ""; # proxy_set_header Content-Length "";
proxy_set_header X-Original-URI $request_uri; # proxy_set_header X-Original-URI $request_uri;
proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme; # proxy_set_header X-Scheme $scheme;
} #}
location @oauth2_signin { #location @oauth2_signin {
return 302 https://$host/oauth2/start?rd=https://$host$request_uri; # return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
#return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri; # #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
} #}
location /oauth2/ { #location /oauth2/ {
proxy_pass http://oauthn_backend; #proxy_pass http://oauthn_backend;
proxy_set_header Host $host; #proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; #proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Scheme $scheme; #proxy_set_header X-Scheme $scheme;
proxy_set_header X-Auth-Request-Redirect $request_uri; #proxy_set_header X-Auth-Request-Redirect $request_uri;
} #}
EOT # EOT
} }
@@ -75,6 +75,7 @@ proxy_pass http://oauthn_backend;
service = "webserver.gitlab.svc:443" service = "webserver.gitlab.svc:443"
proxy_cache = true proxy_cache = true
extra_value_bool = true extra_value_bool = true
enabled = false
extra-value = <<EOT extra-value = <<EOT
client_max_body_size 20m; client_max_body_size 20m;
proxy_request_buffering off; proxy_request_buffering off;
@@ -192,6 +193,7 @@ client_max_body_size 20m;
} }
dupeguru = { dupeguru = {
service = "dupeguru.dupeguru.svc:5800" service = "dupeguru.dupeguru.svc:5800"
enabled = false
authentication_required = true authentication_required = true
} }