This commit is contained in:
+2
-2
@@ -22,8 +22,8 @@ spec:
|
||||
spec:
|
||||
nodeName: kube-master
|
||||
containers:
|
||||
- image: nginx:alpine
|
||||
#- image: gitea.tryton.geeraert.eu/pi-ux-ce/nginx-geoip2:latest
|
||||
#- image: nginx:alpine
|
||||
- image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: reverse-proxy
|
||||
ports:
|
||||
|
||||
+28
-17
@@ -1,19 +1,19 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
nginx.conf: "worker_processes 1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile
|
||||
on;\n\tclient_max_body_size 1500M; \n\tserver_names_hash_bucket_size 1024;\n proxy_http_version
|
||||
\ 1.1;\n proxy_set_header X-Forwarded-Scheme $scheme;\n
|
||||
\ proxy_set_header Accept-Encoding \"\";\n\tproxy_set_header
|
||||
\ Host $host;\n\tproxy_set_header X-Real-IP $remote_addr;\n\tproxy_set_header
|
||||
\ X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header X-Forwarded-Host
|
||||
$server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types text/plain
|
||||
application/xml application/json image/svg+xml text/css;\n\tgzip_min_length 1000;\n
|
||||
\ \n\t#custom log format to display the webiste visited and the IP used\n\tlog_format
|
||||
my_custom_format '$http_host \\t $remote_addr - $remote_user [$time_local] \"$request\"
|
||||
$status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n log_format
|
||||
ip_audit '$remote_addr [$time_local]';\n log_format backend_debug '$remote_addr
|
||||
- $remote_user [$time_local] '\n '\"$request\" $status
|
||||
$body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
|
||||
nginx.conf: "load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;\nworker_processes
|
||||
1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\tclient_max_body_size
|
||||
1500M; \n\tserver_names_hash_bucket_size 1024;\n proxy_http_version 1.1;\n
|
||||
\ proxy_set_header X-Forwarded-Scheme $scheme;\n proxy_set_header
|
||||
\ Accept-Encoding \"\";\n\tproxy_set_header Host $host;\n\tproxy_set_header
|
||||
\ X-Real-IP $remote_addr;\n\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header
|
||||
\ X-Forwarded-Host $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types
|
||||
text/plain application/xml application/json image/svg+xml text/css;\n\tgzip_min_length
|
||||
1000;\n \n\t#custom log format to display the webiste visited and the IP
|
||||
used\n\tlog_format my_custom_format '$http_host \\t $remote_addr - $remote_user
|
||||
[$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n
|
||||
\ log_format ip_audit '$remote_addr [$time_local]';\n log_format
|
||||
backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
|
||||
$status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
|
||||
'\n 'upstream_status=$upstream_status';\n\n\tserver
|
||||
{\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
|
||||
# managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
|
||||
@@ -22,9 +22,20 @@ data:
|
||||
\ proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header
|
||||
\ X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Host
|
||||
$server_name;\n\t\t}\n\t}\n\n\t# Connection header for WebSocket reverse proxy\n\tmap
|
||||
$http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tinclude
|
||||
/etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n\t\t\n\t#add extra
|
||||
file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
|
||||
$http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2
|
||||
/data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
|
||||
iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
|
||||
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country
|
||||
{\n\t\tdefault yes;\n\t\tIN no;\n\t CN no; # Block China\n\t\tRU
|
||||
\ no; # Block Russia\n\t\tKP no; # Block North Korea\n\t}\n\tlog_format
|
||||
main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status
|
||||
$body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\" '\n
|
||||
\ '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header
|
||||
X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude
|
||||
/etc/nginx/conf.d/*.conf;\n include /etc/nginx/blacklisted.d/*.conf;\n\n\t#
|
||||
adding this line for the fial2ban settings\t\n #map $cookie_session_id
|
||||
$blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
|
||||
extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
|
||||
127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
|
||||
/tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
|
||||
kind: ConfigMap
|
||||
|
||||
+23
@@ -1,3 +1,4 @@
|
||||
load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
|
||||
worker_processes 1;
|
||||
events { worker_connections 1024; }
|
||||
|
||||
@@ -26,6 +27,11 @@ http {
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" '
|
||||
'upstream_status=$upstream_status';
|
||||
log_format localization '$remote_addr - $remote_user [$time_local] '
|
||||
'"$request" $status $body_bytes_sent '
|
||||
'"$http_referer" "$http_user_agent" '
|
||||
'$geoip2_data_city_name $geoip2_data_country_name';
|
||||
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
@@ -48,9 +54,26 @@ http {
|
||||
'' close;
|
||||
}
|
||||
|
||||
geoip2 /data/dbip-country-lite-2026-01.mmdb{
|
||||
$geoip2_data_country_iso_code country iso_code;
|
||||
$geoip2_data_city_name city names en;
|
||||
$geoip2_data_country_name country names en;
|
||||
}
|
||||
|
||||
map $geoip2_data_country_iso_code $allowed_country {
|
||||
default yes;
|
||||
IN no;
|
||||
CN no; # Block China
|
||||
RU no; # Block Russia
|
||||
KP no; # Block North Korea
|
||||
}
|
||||
|
||||
include /etc/nginx/deny.d/*.conf;
|
||||
include /etc/nginx/conf.d/*.conf;
|
||||
include /etc/nginx/blacklisted.d/*.conf;
|
||||
|
||||
# adding this line for the fial2ban settings
|
||||
#map $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }
|
||||
#add extra file for any extra work
|
||||
include /etc/nginx/extra.conf.d/*.conf;
|
||||
|
||||
|
||||
Reference in New Issue
Block a user