pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

trying geoip2
Gitea Actions Demo / Explore-Gitea-Actions (push) Failing after 47s
Details

Browse Source
This commit is contained in:
pi-ux-ce
2026-03-12 23:59:39 +00:00
parent b09999a8d0
commit 79ef0ab640
3 changed files with 54 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Nginx.kube.yaml
+2 -2
View File
@@ -22,8 +22,8 @@ spec:
spec: spec:
nodeName: kube-master nodeName: kube-master
containers: containers:
- image: nginx:alpine #- image: nginx:alpine
#- image: gitea.tryton.geeraert.eu/pi-ux-ce/nginx-geoip2:latest - image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
name: reverse-proxy name: reverse-proxy
ports: ports:
nginx-config.configmap.yaml
+28 -17
View File
@@ -1,19 +1,19 @@
apiVersion: v1 apiVersion: v1
data: data:
nginx.conf: "worker_processes 1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile nginx.conf: "load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;\nworker_processes
on;\n\tclient_max_body_size 1500M; \n\tserver_names_hash_bucket_size 1024;\n proxy_http_version 1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\tclient_max_body_size
\ 1.1;\n proxy_set_header X-Forwarded-Scheme $scheme;\n 1500M; \n\tserver_names_hash_bucket_size 1024;\n proxy_http_version 1.1;\n
\ proxy_set_header Accept-Encoding \"\";\n\tproxy_set_header \ proxy_set_header X-Forwarded-Scheme $scheme;\n proxy_set_header
\ Host $host;\n\tproxy_set_header X-Real-IP $remote_addr;\n\tproxy_set_header \ Accept-Encoding \"\";\n\tproxy_set_header Host $host;\n\tproxy_set_header
\ X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header X-Forwarded-Host \ X-Real-IP $remote_addr;\n\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header
$server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types text/plain \ X-Forwarded-Host $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types
application/xml application/json image/svg+xml text/css;\n\tgzip_min_length 1000;\n text/plain application/xml application/json image/svg+xml text/css;\n\tgzip_min_length
\ \n\t#custom log format to display the webiste visited and the IP used\n\tlog_format 1000;\n \n\t#custom log format to display the webiste visited and the IP
my_custom_format '$http_host \\t $remote_addr - $remote_user [$time_local] \"$request\" used\n\tlog_format my_custom_format '$http_host \\t $remote_addr - $remote_user
$status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n log_format [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n
ip_audit '$remote_addr [$time_local]';\n log_format backend_debug '$remote_addr \ log_format ip_audit '$remote_addr [$time_local]';\n log_format
- $remote_user [$time_local] '\n '\"$request\" $status backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
$body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" $status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
'\n 'upstream_status=$upstream_status';\n\n\tserver '\n 'upstream_status=$upstream_status';\n\n\tserver
{\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem; {\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
# managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem; # managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
@@ -22,9 +22,20 @@ data:
\ proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header \ proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header
\ X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Host \ X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Host
$server_name;\n\t\t}\n\t}\n\n\t# Connection header for WebSocket reverse proxy\n\tmap $server_name;\n\t\t}\n\t}\n\n\t# Connection header for WebSocket reverse proxy\n\tmap
$http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tinclude $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2
/etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n\t\t\n\t#add extra /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country
{\n\t\tdefault yes;\n\t\tIN no;\n\t CN no; # Block China\n\t\tRU
\ no; # Block Russia\n\t\tKP no; # Block North Korea\n\t}\n\tlog_format
main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status
$body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" '\n
\ '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header
X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude
/etc/nginx/conf.d/*.conf;\n include /etc/nginx/blacklisted.d/*.conf;\n\n\t#
adding this line for the fial2ban settings\t\n #map $cookie_session_id
$blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path 127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
/tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n" /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
kind: ConfigMap kind: ConfigMap
nginx.conf
+24 -1
View File
@@ -1,3 +1,4 @@
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
worker_processes 1; worker_processes 1;
events { worker_connections 1024; } events { worker_connections 1024; }
@@ -26,6 +27,11 @@ http {
'"$request" $status $body_bytes_sent ' '"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" ' '"$http_referer" "$http_user_agent" '
'upstream_status=$upstream_status'; 'upstream_status=$upstream_status';
log_format localization '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'$geoip2_data_city_name $geoip2_data_country_name';
server { server {
listen 80; listen 80;
@@ -48,9 +54,26 @@ http {
'' close; '' close;
} }
geoip2 /data/dbip-country-lite-2026-01.mmdb{
$geoip2_data_country_iso_code country iso_code;
$geoip2_data_city_name city names en;
$geoip2_data_country_name country names en;
}
map $geoip2_data_country_iso_code $allowed_country {
default yes;
IN no;
CN no; # Block China
RU no; # Block Russia
KP no; # Block North Korea
}
include /etc/nginx/deny.d/*.conf; include /etc/nginx/deny.d/*.conf;
include /etc/nginx/conf.d/*.conf; include /etc/nginx/conf.d/*.conf;
include /etc/nginx/blacklisted.d/*.conf;
# adding this line for the fial2ban settings
#map $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }
#add extra file for any extra work #add extra file for any extra work
include /etc/nginx/extra.conf.d/*.conf; include /etc/nginx/extra.conf.d/*.conf;