From d6b428258ed266fe158c2c49b93531757fe36d30 Mon Sep 17 00:00:00 2001
From: pierre <pierre@geeraert.eu>
Date: Thu, 19 Mar 2026 23:19:07 +0000
Subject: [PATCH] try this but too much restriction, probaly gonna use this
 safety in the future though

---
 nginx-config.configmap.yaml           |  2 +-
 nginx.conf                            |  2 +-
 terraform/nginx-config.configmap.yaml |  0
 terraform/nginx_config.tftpl          | 27 +++++++++++++++++++++------
 4 files changed, 23 insertions(+), 8 deletions(-)
 create mode 100644 terraform/nginx-config.configmap.yaml

diff --git a/nginx-config.configmap.yaml b/nginx-config.configmap.yaml
index ce9003a..7fdfb49 100644
--- a/nginx-config.configmap.yaml
+++ b/nginx-config.configmap.yaml
@@ -31,7 +31,7 @@ data:
     $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n        ''      close;\n\t}\n\n\tgeoip2
     /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
     iso_code;\n\t        $geoip2_data_city_name city names en;\n\t        $geoip2_data_country_name
-    country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code::$ssl_client_verify
+    country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code:$ssl_client_verify
     $allowed_country {\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes;
     # Allow UK\n                \"~:SUCCESS$\"  yes;   # Allow anyone with a valid
     certificate (regardless of country)\n                #NL     yes; # Allow netherland\n\t\t#IN\tyes;
diff --git a/nginx.conf b/nginx.conf
index ff0bb85..a71fed7 100755
--- a/nginx.conf
+++ b/nginx.conf
@@ -64,7 +64,7 @@ http {
 	        $geoip2_data_country_name country names en;
 	}
      
-	map $geoip2_data_country_iso_code::$ssl_client_verify $allowed_country {
+	map $geoip2_data_country_iso_code:$ssl_client_verify $allowed_country {
 		default no;
 		FR	yes; # Allow France
 		GB	yes; # Allow UK
diff --git a/terraform/nginx-config.configmap.yaml b/terraform/nginx-config.configmap.yaml
new file mode 100644
index 0000000..e69de29
diff --git a/terraform/nginx_config.tftpl b/terraform/nginx_config.tftpl
index 2e7217e..6aef59e 100644
--- a/terraform/nginx_config.tftpl
+++ b/terraform/nginx_config.tftpl
@@ -9,14 +9,19 @@ upstream ${name_site}_backend {
 
 server {
         server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
-        if ($allowed_country = no) {
-            return 444; # Forbidden
-            # Or use 'return 444;' to close the connection without a response
-	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
-        }
+#        if ($allowed_country = no) {
+#            return 444; # Forbidden
+#            # Or use 'return 444;' to close the connection without a response
+#	    # The 444 Status: If you want to save bandwidth and "ghost" attackers, use return 444;. It drops the connection immediately without even sending a "Forbidden" header.
+#        } 
 
         location / {
+		if ($allowed_country = yes) {
+
                 proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+                break;
+        }
+
                 proxy_set_header    Upgrade     $http_upgrade;
 		proxy_set_header Host $host;
                 ${extra-value-location}
@@ -33,6 +38,16 @@ server {
 	                proxy_pass  %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
 		}
                 %{ endif }
+
+        if ($ssl_client_verify != "SUCCESS") {
+            # Not UK AND no valid cert? Blocked.
+            return 403;
+        }
+
+        # 3. If NOT from UK but HAS cert, let them in.
+                proxy_pass %{ if proxy_pass_https}https%{else}http%{ endif }://${name_site}_backend;
+
+
         }
         location /.well-known/acme-challenge/ {
                 root /var/www/certbot;
@@ -69,7 +84,7 @@ server {
         ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
 
         # Client Certificate Config
-        ssl_client_certificate /etc/nginx/certs/MyPrivateCA.crt;
+        ssl_trusted_certificate /etc/nginx/certs/MyPrivateCA.crt;
         ssl_verify_client optional; # 'optional' so we can check the result manually