adding specifiy geoip option

terraform/geoip.conf.tftpl

@@ -0,0 +1,13 @@
+map $geoip2_data_country_iso_code $allowed_country_${name} {
+	default no;
+	%{ for country in  allowed_country_list}
+	${country}   yes;
+	%{ endfor ~}
+}
+
+map $allowed_country_${name} $should_log_blocked_${upper(join("_", sort(allowed_country_list)))} {
+        no       1;
+        default 0;
+}
+
+

terraform/module.tf

@@ -14,7 +14,8 @@ variable "nginx_sites" {
     authentication_required = optional(bool, false)
     redirect_to_https_bool  = optional(bool, true)
     listen_port_80_bool     = optional(bool, false)
-
+    geoip_blocking          = optional(bool, true)
+    geoip_allow             = optional(list(string), ["FR", "GB"])
   }))
 
 }
@@ -22,6 +23,23 @@ variable "deny_ip" {
   type = list(string)
 }
 
+locals {
+  geoip_allow_list = distinct(flatten([
+    for key, value in var.nginx_sites : [{
+      name         = join("_", sort(value.geoip_allow))
+      country_list = sort(value.geoip_allow)
+    }] if value.enabled == true && value.geoip_allow != null
+  ]))
+
+  geoip_allow_list_test = distinct([
+    for key, value in var.nginx_sites : [{
+      value = sort(value.geoip_allow)
+    }] if value.enabled == true && value.geoip_allow != null
+  ])
+
+}
+
+
 resource "kubernetes_config_map" "deny_ip_configmap" {
   metadata {
     name      = "deny-ip-terraform"
@@ -72,11 +90,32 @@ resource "kubernetes_config_map" "automatic-configmap" {
       authentication_required = value.authentication_required
       redirect_to_https_bool  = value.redirect_to_https_bool
       listen_port_80_bool     = value.listen_port_80_bool
+      geoip_blocking          = value.geoip_blocking
+      geoip_allow             = value.geoip_allow
     }) if value.enabled == true
   }
 
 }
 
+resource "kubernetes_config_map" "automatic-geoip-allow" {
+  metadata {
+    name      = "geoip-allow"
+    namespace = "reverse-proxy"
+    annotations = {
+      "reloader.stakater.com/match" : "true",
+    }
+  }
+
+  data = {
+    for key, value in local.geoip_allow_list :
+    "${value.name}.conf" => templatefile("geoip.conf.tftpl", {
+      name                 = value.name
+      allowed_country_list = value.country_list
+    })
+  }
+}
+
+
 
 #resource "null_resource" "cluster" {
 #  provisioner "local-exec" {

terraform/nginx_config.tftpl

@@ -9,11 +9,13 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-        if ($allowed_country = no) {
+	%{ if geoip_blocking}
+        if ($allowed_country_${upper(join("_", sort(geoip_allow)))} = no) {
             return 444; # Forbidden
             # Or use 'return 444;' to close the connection without a response
 	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
-        } 
+        }
+	%{ endif }
 
         location / {
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
@@ -55,7 +57,7 @@ server {
 	access_log /var/log/nginx/access.log my_custom_format;
         access_log /var/log/nginx/ip_audit.log ip_audit;
         access_log /var/log/nginx/backend_debug.log backend_debug;
-        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked; 
+        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked_${upper(join("_", sort(geoip_allow)))}; 
 	${extra-value}
         %{~ if http2_bool~}
         http2 on;

terraform/variables.auto.tfvars

@@ -9,6 +9,7 @@ nginx_sites = {
     #            EOT
     service    = "bitwarden-nginx-svc.bitwarden.svc:8080"
     http2_bool = true
+
   }
 
   bookstack = {
@@ -22,6 +23,7 @@ nginx_sites = {
     service     = "django-svc.django:8000"
     proxy_cache = true
     http2_bool  = true
+
   }
   redirect = {
     #enabled     = false
@@ -31,6 +33,8 @@ nginx_sites = {
     #service     = "django-testing-svc.django-testing.svc:8000"
     proxy_cache = true
     http2_bool  = true
+    geoip_allow = ["FR", "GB", "NL"]
+
   }
   reverse = {
     service     = "django-svc.django:8000"
@@ -341,7 +345,8 @@ proxy_set_header Connection "upgrade";
   }
   stash = {
     #  enabled              = false
-    service = "stash-svc.stash.svc:9999"
+    service        = "stash-svc.stash.svc:9999"
+    #geoip_blocking = false
     #extra-value= <<EOT
     #   proxy_protocol on;
     #EOT
@@ -363,6 +368,7 @@ proxy_set_header Connection "upgrade";
     #end of working
     EOT
 
+    geoip_allow = ["FR", "GB", "NL"]
   }
   neko = {
     enabled              = false
@@ -480,6 +486,8 @@ proxy_set_header Connection "upgrade";
                 EOT
 
   }
-
+  overleaf = {
+    service = "overleaf-svc.overleaf.svc:80"
+  }
 }
 deny_ip = ["1.2.3.4"]