Sidehistorik
| Tip |
|---|
This is Work-in-progress - the Geofencing works, but the rest needs some tweaking regading the bind part |
I looked everywhere for good Apache2 or Nginx possibilities - no real luck; in generelt its was old, deprecated or just way to complications - OR part of an Enterprice (=payable) pack.
Then I fell over https://wetmore.ca/ip/ and downloaded the file.
And replaced my trusted long time friend Apache2 with HaProxy HAProxy - see also: https://www.haproxy.com/documentation/haproxy-configuration-tutorials/security/traffic-policing/
My HAPRoxy HAProxy Docker:
| Kodeblok |
|---|
version: '3.4'
services:
haproxy:
image: haproxy
ports:
- 80:80
- 443:443
environment:
- TZ=Europe/Copenhagen
volumes:
- /data/haproxy/:/usr/local/etc/haproxy:ro |
...
| Kodeblok | ||
|---|---|---|
| ||
defaults timeout connect 30s timeout client 1m timeout server 1m frontend confluencefrontend port80 mode http bind *:44380 name www.mos-eisley.dkhttp-request redirect scheme https unless { ssl_fc } default_backend confluence_backend frontend port443 bind *:443 ssl crt /usr/local/etc/haproxy/wildcard.mos-eisley.dk.crt mode http option forwardfor option http-server-close log global option httplog maxconn 150 acl acl_geoloc_block src,map_ip(/usr/local/etc/haproxy/haproxy_geo_ip.txt) -m reg -i (CN|RU|IR|KP) http-request silent-drop if acl_geoloc_block acl acl_matomo hdr(host) -i matomo.mos-eisley.dk use_backend matomo_backend if acl_matomo acl acl_plex hdr(host) -i camera.mos-eisley.dk use_backend plex_backend if acl_plex acl acl_slangereden hdr(host) -i www.slangereden.dk http-request redirect code 301 location https://www.mos-eisley.dk/spaces/slangereden/overview if acl_slangereden default_backend confluence_backend backend confluence_backend log global mode http balance roundrobin option httpchk http-check send meth GET uri /status http-check expect string RUNNING cookie confluence insert indirect nocache server confluence 77.243.53.199:8090 check cookie confluence |
Blocking (a part of) IP-Addresses from CN -China, RU -Russia, IR - Iran, KP - North Korea
And a short script to update the file (via /etc/crontab):
| Kodeblok | ||
|---|---|---|
| ||
#!/bin/bash
cd /data/haproxy
cp haproxy_geo_ip.txt haproxy_geo_ip.txt.1
cd /data/haproxy/tmp
rm haproxy_geo_ip.txt
wget https://wetmore.ca/ip/haproxy_geo_ip.txt
if [ $? -eq 0 ]
then
if [ -s haproxy_geo_ip.txt ]
then
cp haproxy_geo_ip.txt /data/haproxy
fi
fi |
The if's check if wget exited ok - got a file and if the filesize is not 0 (zero)