This is Work-in-progress - the Geofencing works, but the rest needs some tweaking regading the bind part
I looked everywhere for good Apache2 or Nginx possibilities - no luck; in generelt its was old, deprecated or just way to complications.
Then I fell over https://wetmore.ca/ip/ and downloaded the file.
And replaced Apache2 with HaProxy - see also: https://www.haproxy.com/documentation/haproxy-configuration-tutorials/security/traffic-policing/
My HAPRoxy Docker:
version: '3.4'
services:
haproxy:
image: haproxy
ports:
- 80:80
- 443:443
environment:
- TZ=Europe/Copenhagen
volumes:
- /data/haproxy/:/usr/local/etc/haproxy:ro
A sample of my HA Proxy Config:
haproxy.cfg
defaults
timeout connect 30s
timeout client 1m
timeout server 1m
frontend port80
mode http
bind *:80
http-request redirect scheme https unless { ssl_fc }
default_backend confluence_backend
frontend port443
bind *:443 ssl crt /usr/local/etc/haproxy/wildcard.mos-eisley.dk.crt
mode http
option forwardfor
option http-server-close
log global
option httplog
maxconn 150
acl acl_geoloc_block src,map_ip(/usr/local/etc/haproxy/haproxy_geo_ip.txt) -m reg -i (CN|RU|IR|KP)
http-request silent-drop if acl_geoloc_block
acl acl_matomo hdr(host) -i matomo.mos-eisley.dk
use_backend matomo_backend if acl_matomo
acl acl_plex hdr(host) -i camera.mos-eisley.dk
use_backend plex_backend if acl_plex
acl acl_slangereden hdr(host) -i www.slangereden.dk
http-request redirect code 301 location https://www.mos-eisley.dk/spaces/slangereden/overview if acl_slangereden
default_backend confluence_backend
backend confluence_backend
log global
mode http
balance roundrobin
option httpchk
http-check send meth GET uri /status
http-check expect string RUNNING
cookie confluence insert indirect nocache
server confluence 77.243.53.199:8090 check cookie confluence
Blocking (a part of) IP-Addresses from CN -China, RU -Russia
And a short script to update the file:
getFile.sh
#!/bin/bash
cd /data/haproxy
cp haproxy_geo_ip.txt haproxy_geo_ip.txt.1
cd /data/haproxy/tmp
rm haproxy_geo_ip.txt
wget https://wetmore.ca/ip/haproxy_geo_ip.txt
if [ $? -eq 0 ]
then
if [ -s haproxy_geo_ip.txt ]
then
cp haproxy_geo_ip.txt /data/haproxy
fi
fi