pi-ux-ce/Reverse_proxy_Nginx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert the change made

Browse Source
This commit is contained in:
pi-ux-ce
2026-03-19 23:20:32 +00:00
parent d6b428258e
commit b61f613e3c
3 changed files with 7 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx-config.configmap.yaml
+2 -3
View File
@@ -33,9 +33,8 @@ data:
iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code:$ssl_client_verify country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code:$ssl_client_verify
$allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; $allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes;
# Allow UK\n \"~:SUCCESS$\" yes; # Allow anyone with a valid # Allow UK\n #NL yes; # Allow netherland\n\t\t#IN\tyes; #
certificate (regardless of country)\n #NL yes; # Allow netherland\n\t\t#IN\tyes; Allow India\n\t}\n\t# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
\ # Allow India\n\t}\n\t# Full list of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
$allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude $allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude
/etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include
/etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n /etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
nginx.conf
-1
View File
@@ -68,7 +68,6 @@ http {
default no; default no;
FR yes; # Allow France FR yes; # Allow France
GB yes; # Allow UK GB yes; # Allow UK
"~:SUCCESS$" yes; # Allow anyone with a valid certificate (regardless of country)
#NL yes; # Allow netherland #NL yes; # Allow netherland
#IN yes; # Allow India #IN yes; # Allow India
} }
terraform/nginx_config.tftpl
+5 -18
View File
@@ -9,19 +9,14 @@ upstream ${name_site}_backend {
server { server {
server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu; server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
# if ($allowed_country = no) { if ($allowed_country = no) {
# return 444; # Forbidden return 444; # Forbidden
# # Or use 'return 444;' to close the connection without a response # Or use 'return 444;' to close the connection without a response
# # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header. # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
# } }
location / { location / {
if ($allowed_country = yes) {
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend; proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
break;
}
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Host $host; proxy_set_header Host $host;
${extra-value-location} ${extra-value-location}
@@ -39,14 +34,6 @@ server {
} }
%{ endif } %{ endif }
if ($ssl_client_verify != "SUCCESS") {
# Not UK AND no valid cert? Blocked.
return 403;
}
# 3. If NOT from UK but HAS cert, let them in.
proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
} }
location /.well-known/acme-challenge/ { location /.well-known/acme-challenge/ {