From ceb7fb647911432be225dba6483a0cd31140959c Mon Sep 17 00:00:00 2001
From: pierre <pierre@geeraert.eu>
Date: Fri, 13 Mar 2026 10:21:51 +0000
Subject: [PATCH] building a sidecar to watch the blacklisted file

---
 Nginx.kube.yaml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/Nginx.kube.yaml b/Nginx.kube.yaml
index 53aed33..5a02216 100644
--- a/Nginx.kube.yaml
+++ b/Nginx.kube.yaml
@@ -21,6 +21,8 @@ spec:
         app: reverse-proxy
     spec:
       nodeName: kube-master
+      # Allows the sidecar to see and signal the Nginx process
+      shareProcessNamespace: true
       containers:
       #- image: nginx:alpine
       - image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
@@ -56,6 +58,23 @@ spec:
             limits:
               cpu: 250m
               memory: 250Mi
+      - name: sidecar-watcher
+        image: alpine:latest
+        command: ["/bin/sh", "-c"]
+        args:
+          - |
+            apk add --no-cache inotify-tools;
+            echo "Watcher started..."
+            while inotifywait -e close_write /etc/nginx/blacklisted.d/blacklisted-sessions.conf; do
+              echo "Change detected in deny.conf, reloading Nginx..."
+              # Find the Nginx master process and send SIGHUP (reload)
+              pkill -HUP nginx
+            done
+        volumeMounts:
+        - name: blacklisted-sessions-map
+          mountPath: /etc/nginx/blacklisted.d/
+
+
       volumes:
       - name: reverse-proxy-log
         persistentVolumeClaim: