trying geoip2

Nginx.kube.yaml

@@ -22,7 +22,8 @@ spec:
     spec:
       nodeName: kube-master
       containers:
-      - image: nginx:alpine
+      #- image: nginx:alpine
+      - image: gitea.tryton.geeraert.eu/pi-ux-ce/geoip2-nginx:1.29.6
         imagePullPolicy: IfNotPresent
         name: reverse-proxy
         ports:
@@ -31,8 +32,6 @@ spec:
         - containerPort: 443
           name: rp-port-https
         volumeMounts:
-#        - name: reverse-proxy-conf-randomfile
-#          mountPath: /etc/nginx/conf.d/random.conf
         - name: nginx-sites-terraform
           mountPath: /etc/nginx/conf.d/
         - mountPath: /var/log/nginx/
@@ -41,6 +40,10 @@ spec:
           mountPath: /etc/nginx/extra.conf.d/
         - name: deny-ip-terraform
           mountPath: /etc/nginx/deny.d/
+        - name: blacklisted-sessions-map
+          mountPath: /etc/nginx/blacklisted.d/
+        - name: reverse-proxy-geoip
+          mountPath: /etc/nginx/geoip.d/
         - name: reverse-proxy-ssl
           mountPath: /etc/nginx/ssl/
         - mountPath: /etc/nginx/
@@ -60,11 +63,9 @@ spec:
       - name: reverse-proxy-ssl
         hostPath:
            path: /opt/kubernetes/Reverse_proxy_Nginx/certbot/conf/
-      - hostPath:
-          path: /opt/kubernetes/Reverse_proxy_Nginx/random.conf
-          type: File
-        name: reverse-proxy-conf-randomfile
-
+      - name: reverse-proxy-geoip
+        hostPath:
+           path: /opt/kubernetes/Reverse_proxy_Nginx/geoip
       - name: nginx-configfile
         configMap:
           name: nginx-config
@@ -87,6 +88,9 @@ spec:
       - name: secret-htpasswd
         secret:
           secretName: htpasswd
+      - name: blacklisted-sessions-map
+        persistentVolumeClaim:
+          claimName: blacklisted-sessions-map
 ---
 apiVersion: v1
 kind: Service

nginx-config.configmap.yaml

@@ -1,19 +1,19 @@
 apiVersion: v1
 data:
-  nginx.conf: "worker_processes 1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile
-    on;\n\tclient_max_body_size 1500M; \n\tserver_names_hash_bucket_size 1024;\n        proxy_http_version
-    \           1.1;\n        proxy_set_header              X-Forwarded-Scheme $scheme;\n
-    \       proxy_set_header              Accept-Encoding \"\";\n\tproxy_set_header
-    \  Host $host;\n\tproxy_set_header   X-Real-IP $remote_addr;\n\tproxy_set_header
-    \  X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header   X-Forwarded-Host
-    $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types text/plain
-    application/xml application/json image/svg+xml text/css;\n\tgzip_min_length 1000;\n
-    \       \n\t#custom log format to display the webiste visited and the IP used\n\tlog_format
-    my_custom_format '$http_host \\t $remote_addr - $remote_user [$time_local] \"$request\"
-    $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n        log_format
-    ip_audit '$remote_addr [$time_local]';\n        log_format backend_debug '$remote_addr
-    - $remote_user [$time_local] '\n                             '\"$request\" $status
-    $body_bytes_sent '\n                             '\"$http_referer\" \"$http_user_agent\"
+  nginx.conf: "load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;\nworker_processes
+    1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\tclient_max_body_size
+    1500M; \n\tserver_names_hash_bucket_size 1024;\n        proxy_http_version            1.1;\n
+    \       proxy_set_header              X-Forwarded-Scheme $scheme;\n        proxy_set_header
+    \             Accept-Encoding \"\";\n\tproxy_set_header   Host $host;\n\tproxy_set_header
+    \  X-Real-IP $remote_addr;\n\tproxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header
+    \  X-Forwarded-Host $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types
+    text/plain application/xml application/json image/svg+xml text/css;\n\tgzip_min_length
+    1000;\n        \n\t#custom log format to display the webiste visited and the IP
+    used\n\tlog_format my_custom_format '$http_host \\t $remote_addr - $remote_user
+    [$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n
+    \       log_format ip_audit '$remote_addr [$time_local]';\n        log_format
+    backend_debug '$remote_addr - $remote_user [$time_local] '\n                             '\"$request\"
+    $status $body_bytes_sent '\n                             '\"$http_referer\" \"$http_user_agent\"
     '\n                             'upstream_status=$upstream_status';\n\n\tserver
     {\n\tlisten 80;\n        listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
     # managed by$\n        ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
@@ -22,9 +22,20 @@ data:
     \           proxy_set_header   X-Real-IP $remote_addr;\n            proxy_set_header
     \  X-Forwarded-For $proxy_add_x_forwarded_for;\n            proxy_set_header   X-Forwarded-Host
     $server_name;\n\t\t}\n\t}\n\n\t# Connection header for WebSocket reverse proxy\n\tmap
-    $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n        ''      close;\n\t}\n\n\tinclude
-    /etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n\t\t\n\t#add extra
-    file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
+    $http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n        ''      close;\n\t}\n\n\tgeoip2
+    /data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
+    iso_code;\n\t        $geoip2_data_city_name city names en;\n\t        $geoip2_data_country_name
+    country names en;\n\t}\n     \n\tmap $geoip2_data_country_iso_code $allowed_country
+    {\n\t\tdefault yes;\n\t\tIN no;\n\t        CN      no;  # Block China\n\t\tRU
+    \     no;  # Block Russia\n\t\tKP      no;  # Block North Korea\n\t}\n\tlog_format
+    main_ext '$remote_addr - $remote_user [$time_local] '\n\t\t'\"$request\" $status
+    $body_bytes_sent '\n                '\"$http_referer\" \"$http_user_agent\" '\n
+    \               '$geoip2_data_city_name $geoip2_data_country_name';\n\n\n\t#add_header
+    X-Country-Code \"$geoip2_data_country_code\" always;\n\n\tinclude /etc/nginx/deny.d/*.conf;\n\tinclude
+    /etc/nginx/conf.d/*.conf;\n        include /etc/nginx/blacklisted.d/*.conf;\n\n\t#
+    adding this line for the fial2ban settings\t\n        #map  $cookie_session_id
+    $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }\n\t#add
+    extra file for any extra work \n        include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
     127.0.0.1 ipv6=off valid=40s;  # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
     /tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
 kind: ConfigMap

nginx.conf

@@ -1,3 +1,4 @@
+load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;
 worker_processes 1;
 events { worker_connections 1024; }
 
@@ -26,6 +27,11 @@ http {
                              '"$request" $status $body_bytes_sent '
                              '"$http_referer" "$http_user_agent" '
                              'upstream_status=$upstream_status';
+        log_format localization '$remote_addr - $remote_user [$time_local] '
+                '"$request" $status $body_bytes_sent '
+                '"$http_referer" "$http_user_agent" '
+                '$geoip2_data_city_name $geoip2_data_country_name';
+
 
 	server {
 	listen 80;
@@ -48,9 +54,26 @@ http {
         ''      close;
 	}
 
+	geoip2 /data/dbip-country-lite-2026-01.mmdb{
+		$geoip2_data_country_iso_code country iso_code;
+	        $geoip2_data_city_name city names en;
+	        $geoip2_data_country_name country names en;
+	}
+     
+	map $geoip2_data_country_iso_code $allowed_country {
+		default yes;
+		IN no;
+	        CN      no;  # Block China
+		RU      no;  # Block Russia
+		KP      no;  # Block North Korea
+	}
+
 	include /etc/nginx/deny.d/*.conf;
 	include /etc/nginx/conf.d/*.conf;
+        include /etc/nginx/blacklisted.d/*.conf;
 
+	# adding this line for the fial2ban settings	
+        #map  $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map; }
 	#add extra file for any extra work 
         include /etc/nginx/extra.conf.d/*.conf;