50 lines
4.0 KiB
YAML
50 lines
4.0 KiB
YAML
apiVersion: v1
|
|
data:
|
|
nginx.conf: "load_module /usr/lib/nginx/modules/ngx_http_geoip2_module.so;\nworker_processes
|
|
1;\nevents { worker_connections 1024; }\n\nhttp {\n\n\tsendfile on;\n\tclient_max_body_size
|
|
1500M; \n\tserver_names_hash_bucket_size 1024;\n proxy_http_version 1.1;\n
|
|
\ proxy_set_header X-Forwarded-Scheme $scheme;\n proxy_set_header
|
|
\ Accept-Encoding \"\";\n\tproxy_set_header Host $host;\n\tproxy_set_header
|
|
\ X-Real-IP $remote_addr;\n\tproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n\tproxy_set_header
|
|
\ X-Forwarded-Host $server_name;\n\n\t#compression settings\n\tgzip on;\n\tgzip_types
|
|
text/plain application/xml application/json image/svg+xml text/css;\n\tgzip_min_length
|
|
1000;\n \n\t#custom log format to display the webiste visited and the IP
|
|
used\n\tlog_format my_custom_format '$http_host \\t $remote_addr - $remote_user
|
|
[$time_local] \"$request\" $status $body_bytes_sent \"$http_referer\" \"$http_user_agent\"';\n
|
|
\ log_format ip_audit '$remote_addr [$time_local]';\n log_format
|
|
backend_debug '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
|
|
$status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
|
|
'\n 'upstream_status=$upstream_status';\n log_format
|
|
localization '$remote_addr - $remote_user [$time_local] '\n '\"$request\"
|
|
$status $body_bytes_sent '\n '\"$http_referer\" \"$http_user_agent\"
|
|
'\n '$geoip2_data_city_name $geoip2_data_country_name';\n\tlog_format
|
|
blocked_fmt '$http_host \\t $remote_addr - [$time_local] '\n\t\t'Blocked Country:
|
|
$geoip2_data_country_iso_code '\n '\"$request\" $status';\n\n\tlog_format
|
|
deny_style 'deny $remote_addr; #$geoip2_data_city_name $geoip2_data_country_name';\n\n\tserver
|
|
{\n\tlisten 80;\n listen 443 default ssl;\n\tssl_certificate /etc/nginx/ssl/live/default.tryton.geeraert.eu/fullchain.pem;
|
|
# managed by$\n ssl_certificate_key /etc/nginx/ssl/live/default.tryton.geeraert.eu/privkey.pem;
|
|
# managed $\n location / {\n proxy_pass http://1.1.1.1;\n
|
|
\ proxy_redirect off;\n proxy_set_header Host $host;\n
|
|
\ proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header
|
|
\ X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Host
|
|
$server_name;\n\t\t}\n\t}\n\n\t# Connection header for WebSocket reverse proxy\n\tmap
|
|
$http_upgrade $connection_upgrade {\n\t\tdefault upgrade;\n '' close;\n\t}\n\n\tgeoip2
|
|
/data/dbip-country-lite-2026-01.mmdb{\n\t\t$geoip2_data_country_iso_code country
|
|
iso_code;\n\t $geoip2_data_city_name city names en;\n\t $geoip2_data_country_name
|
|
country names en;\n\t}\n \n\tmap $geoip2_data_country_iso_code $allowed_country
|
|
{\n\t\tdefault no;\n\t\tFR\tyes; # Allow France\n\t\tGB\tyes; # Allow UK\n #NL
|
|
\ yes; # Allow netherland\n\t\t#IN\tyes; # Allow India\n\t}\n\t# Full list
|
|
of country codes: https://en.wikipedia.org/wiki/List_of_ISO_3166_country_codes\n\n\tmap
|
|
$allowed_country $should_log_blocked {\n\t\tno 1;\n\t\tdefault 0;\n\t}\n\n\tinclude
|
|
/etc/nginx/deny.d/*.conf;\n\tinclude /etc/nginx/conf.d/*.conf;\n include
|
|
/etc/nginx/blacklisted.d/*.conf;\n\n\t# adding this line for the fial2ban settings\t\n
|
|
\ #map $cookie_session_id $blck_lst_ses { include /etc/nginx/blacklisted.d/blacklisted-sessions.map;
|
|
}\n\t#add extra file for any extra work \n include /etc/nginx/extra.conf.d/*.conf;\n\n\n\tresolver
|
|
127.0.0.1 ipv6=off valid=40s; # The DNS IP server\n\t\n\t#https://www.tweaked.io/guide/nginx-proxying/\n\tproxy_cache_path
|
|
/tmp/cache levels=1:2 keys_zone=cache:60m max_size=1G;\n\n\n}\n\n\n"
|
|
kind: ConfigMap
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: nginx-config
|
|
namespace: reverse-proxy
|