adding specifiy geoip option

Nginx.kube.yaml

@@ -44,6 +44,8 @@ spec:
           mountPath: /etc/nginx/deny.d/
         - name: blacklisted-sessions-map
           mountPath: /etc/nginx/blacklisted.d/
+        - name: geoip-allow-terraform
+          mountPath: /etc/nginx/geoip.d/
         - name: blacklisted-memory-volume
           mountPath: /etc/nginx/blacklisted.memory.d/
         - name: reverse-proxy-ssl
@@ -111,6 +113,10 @@ spec:
         configMap:
           name: deny-ip-terraform
           defaultMode: 0555
+      - name: geoip-allow-terraform
+        configMap:
+          name: geoip-allow
+          defaultMode: 0555
       - name: proxy-cache-path-volume
         emptyDir:
           medium: Memory

nginx-config.configmap.yaml

@@ -1,19 +1,20 @@
 apiVersion: v1
 data:
   nginx.conf: "load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;\nworker_processes
-    1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\tclient_max_body_size
+    1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\t#client_max_body_size
-    1500M; \n\tserver_names_hash_bucket_size 1024;\n        proxy_http_version            1.1;\n
+    1500M;\n        client_max_body_size 15000M; \n\tserver_names_hash_bucket_size
-    \       proxy_set_header              X-Forwarded-Scheme $scheme;\n        proxy_set_header
+    1024;\n        proxy_http_version            1.1;\n        proxy_set_header              X-Forwarded-Scheme
-    \             Accept-Encoding \"\";\n\tproxy_set_header   Host $host;\n\tproxy_set_header
+    $scheme;\n        proxy_set_header              Accept-Encoding \"\";\n\tproxy_set_header
-    \  X-Real-IP $remote_addr;\n\tproxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header
+    \  Host $host;\n\tproxy_set_header   X-Real-IP $remote_addr;\n\tproxy_set_header
-    \  X-Forwarded-Host $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types
+    \  X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header   X-Forwarded-Host
-    text/plain application/xml application/json image/svg+xml text/css;\n\tgzip_min_length
+    $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types text/plain
-    1000;\n        \n\t#custom log format to display the webiste visited and the IP
+    application/xml application/json image/svg+xml text/css;\n\tgzip_min_length 1000;\n
-    used\n\tlog_format my_custom_format '$http_host \\t $remote_addr - $remote_user
+    \       \n\t#custom log format to display the webiste visited and the IP used\n\tlog_format
-    [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n
+    my_custom_format '$http_host \\t $remote_addr - $remote_user [$time_local] \"$request\"
-    \       log_format ip_audit '$remote_addr [$time_local]';\n        log_format
+    $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n        log_format
-    backend_debug '$remote_addr - $remote_user [$time_local] '\n                             '\"$request\"
+    ip_audit '$remote_addr [$time_local]';\n        log_format backend_debug '$remote_addr
-    $status $body_bytes_sent '\n                             '\"$http_referer\" \"$http_user_agent\"
+    - $remote_user [$time_local] '\n                             '\"$request\" $status
+    $body_bytes_sent '\n                             '\"$http_referer\" \"$http_user_agent\"
     '\n                             'upstream_status=$upstream_status';\n        log_format
     localization '$remote_addr - $remote_user [$time_local] '\n                '\"$request\"
     $status $body_bytes_sent '\n                '\"$http_referer\" \"$http_user_agent\"
@@ -37,9 +38,10 @@ data:
     of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
     $allowed_country $should_log_blocked {\n\t\tno       1;\n\t\tdefault 0;\n\t}\n\n\tinclude
     /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n        include
-    /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
+    /etc/nginx/blacklisted.d/*.conf;\n        include /etc/nginx/geoip.d/*.conf;\n\n\t#
-    \       #map  $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map;
+    adding this line for the fial2ban settings\t\n        #map  $cookie_session_id
-    }\n\t#add extra file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
+    $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
+    extra file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
     127.0.0.1 ipv6=off valid=40s;  # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
     /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
 kind: ConfigMap

nginx.conf

@@ -5,7 +5,8 @@ events { worker_connections 1024; }
 http {
 
 	sendfile on;
-	client_max_body_size 1500M; 
+	#client_max_body_size 1500M;
+        client_max_body_size 15000M; 
 	server_names_hash_bucket_size 1024;
         proxy_http_version            1.1;
         proxy_set_header              X-Forwarded-Scheme $scheme;
@@ -81,6 +82,7 @@ http {
 	include /etc/nginx/deny.d/*.conf;
 	include /etc/nginx/conf.d/*.conf;
         include /etc/nginx/blacklisted.d/*.conf;
+        include /etc/nginx/geoip.d/*.conf;
 
 	# adding this line for the fial2ban settings	
         #map  $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }

terraform/geoip.conf.tftpl

@@ -0,0 +1,13 @@
+map $geoip2_data_country_iso_code $allowed_country_${name} {
+	default no;
+	%{ for country in  allowed_country_list}
+	${country}   yes;
+	%{ endfor ~}
+}
+
+map $allowed_country_${name} $should_log_blocked_${upper(join("_", sort(allowed_country_list)))} {
+        no       1;
+        default 0;
+}
+
+

terraform/module.tf

@@ -14,7 +14,8 @@ variable "nginx_sites" {
     authentication_required = optional(bool, false)
     redirect_to_https_bool  = optional(bool, true)
     listen_port_80_bool     = optional(bool, false)
-
+    geoip_blocking          = optional(bool, true)
+    geoip_allow             = optional(list(string), ["FR", "GB"])
   }))
 
 }
@@ -22,6 +23,23 @@ variable "deny_ip" {
   type = list(string)
 }
 
+locals {
+  geoip_allow_list = distinct(flatten([
+    for key, value in var.nginx_sites : [{
+      name         = join("_", sort(value.geoip_allow))
+      country_list = sort(value.geoip_allow)
+    }] if value.enabled == true && value.geoip_allow != null
+  ]))
+
+  geoip_allow_list_test = distinct([
+    for key, value in var.nginx_sites : [{
+      value = sort(value.geoip_allow)
+    }] if value.enabled == true && value.geoip_allow != null
+  ])
+
+}
+
+
 resource "kubernetes_config_map" "deny_ip_configmap" {
   metadata {
     name      = "deny-ip-terraform"
@@ -72,11 +90,32 @@ resource "kubernetes_config_map" "automatic-configmap" {
       authentication_required = value.authentication_required
       redirect_to_https_bool  = value.redirect_to_https_bool
       listen_port_80_bool     = value.listen_port_80_bool
+      geoip_blocking          = value.geoip_blocking
+      geoip_allow             = value.geoip_allow
     }) if value.enabled == true
   }
 
 }
 
+resource "kubernetes_config_map" "automatic-geoip-allow" {
+  metadata {
+    name      = "geoip-allow"
+    namespace = "reverse-proxy"
+    annotations = {
+      "reloader.stakater.com/match" : "true",
+    }
+  }
+
+  data = {
+    for key, value in local.geoip_allow_list :
+    "${value.name}.conf" => templatefile("geoip.conf.tftpl", {
+      name                 = value.name
+      allowed_country_list = value.country_list
+    })
+  }
+}
+
+
 
 #resource "null_resource" "cluster" {
 #  provisioner "local-exec" {

terraform/nginx_config.tftpl

@@ -9,11 +9,13 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-        if ($allowed_country = no) {
+	%{ if geoip_blocking}
+        if ($allowed_country_${upper(join("_", sort(geoip_allow)))} = no) {
             return 444; # Forbidden
             # Or use 'return 444;' to close the connection without a response
 	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
         }
+	%{ endif }
 
         location / {
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
@@ -55,7 +57,7 @@ server {
 	access_log /var/log/nginx/access.log my_custom_format;
         access_log /var/log/nginx/ip_audit.log ip_audit;
         access_log /var/log/nginx/backend_debug.log backend_debug;
-        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked; 
+        access_log /var/log/nginx/blocked_countries.log blocked_fmt if=$should_log_blocked_${upper(join("_", sort(geoip_allow)))}; 
 	${extra-value}
         %{~ if http2_bool~}
         http2 on;

terraform/variables.auto.tfvars

@@ -9,6 +9,7 @@ nginx_sites = {
     #            EOT
     service    = "bitwarden-nginx-svc.bitwarden.svc:8080"
     http2_bool = true
+
   }
 
   bookstack = {
@@ -22,6 +23,7 @@ nginx_sites = {
     service     = "django-svc.django:8000"
     proxy_cache = true
     http2_bool  = true
+
   }
   redirect = {
     #enabled     = false
@@ -31,6 +33,8 @@ nginx_sites = {
     #service     = "django-testing-svc.django-testing.svc:8000"
     proxy_cache = true
     http2_bool  = true
+    geoip_allow = ["FR", "GB", "NL"]
+
   }
   reverse = {
     service     = "django-svc.django:8000"
@@ -341,7 +345,8 @@ proxy_set_header Connection "upgrade";
   }
   stash = {
     #  enabled              = false
-    service = "stash-svc.stash.svc:9999"
+    service        = "stash-svc.stash.svc:9999"
+    #geoip_blocking = false
     #extra-value= <<EOT
     #   proxy_protocol on;
     #EOT
@@ -363,6 +368,7 @@ proxy_set_header Connection "upgrade";
     #end of working
     EOT
 
+    geoip_allow = ["FR", "GB", "NL"]
   }
   neko = {
     enabled              = false
@@ -480,6 +486,8 @@ proxy_set_header Connection "upgrade";
                 EOT
 
   }
-
+  overleaf = {
+    service = "overleaf-svc.overleaf.svc:80"
+  }
 }
 deny_ip = ["1.2.3.4"]