diff --git a/seb4itik/byow/roles/caddy/defaults/main.yml b/seb4itik/byow/roles/caddy/defaults/main.yml index e42365f..02f7f61 100644 --- a/seb4itik/byow/roles/caddy/defaults/main.yml +++ b/seb4itik/byow/roles/caddy/defaults/main.yml @@ -24,6 +24,13 @@ caddy_email: null # If a custom CA root have to be used caddy_ca_root: null +# See: https://dev.maxmind.com/geoip/updating-databases/ +caddy_geoip_account_id: null +caddy_geoip_license_key: null +caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City" +caddy_geoip_update_frequency: 86400 # In seconds + + # Cf.: https://github.com/coreruleset/plugin-registry caddy_crs_plugins: - name: "drupal-rule-exclusions" diff --git a/seb4itik/byow/roles/caddy/handlers/main.yml b/seb4itik/byow/roles/caddy/handlers/main.yml index f4ec056..f73f5cb 100644 --- a/seb4itik/byow/roles/caddy/handlers/main.yml +++ b/seb4itik/byow/roles/caddy/handlers/main.yml @@ -2,3 +2,7 @@ ansible.builtin.service: name: "{{ caddy_my_name }}" state: "restarted" + +# - name: Update GeoIP databases +# ansible.builtin.command: +# cmd: "/usr/bin/geoipupdate" diff --git a/seb4itik/byow/roles/caddy/tasks/caddy_config.yml b/seb4itik/byow/roles/caddy/tasks/caddy_config.yml index 13f359c..dfb6af6 100644 --- a/seb4itik/byow/roles/caddy/tasks/caddy_config.yml +++ b/seb4itik/byow/roles/caddy/tasks/caddy_config.yml @@ -76,6 +76,15 @@ notify: - "Restart Caddy" +# - name: Generate GeoIP config file +# when: "caddy_geoip_account_id != None and caddy_geoip_license_key != None" +# ansible.builtin.template: +# src: "templates/GeoIP.conf" +# dest: "/etc/GeoIP.conf" +# mode: "0640" +# notify: +# - "Update GeoIP databases" + - name: Enable and start Caddy ansible.builtin.service: name: "{{ caddy_my_name }}" diff --git a/seb4itik/byow/roles/caddy/tasks/caddy_install.yml b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml index 1517904..e859cf7 100644 --- a/seb4itik/byow/roles/caddy/tasks/caddy_install.yml +++ b/seb4itik/byow/roles/caddy/tasks/caddy_install.yml @@ -1,9 +1,10 @@ - name: Install requirements - ansible.builtin.apt: + ansible.builtin.package: name: - "git" - "libnss3-tools" - "ssl-cert" +# - "geoipupdate" - name: Create Go directory ansible.builtin.file: @@ -37,6 +38,7 @@ --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }} --with github.com/mholt/caddy-ratelimit --with github.com/steffenbusch/caddy-bot-barrier + --with github.com/zhangjiayin/caddy-geoip2 --output /usr/local/bin/{{ caddy_my_name }} - name: Remember and test Caddy version diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile index 90ff8cd..1c24de9 100644 --- a/seb4itik/byow/roles/caddy/templates/Caddyfile +++ b/seb4itik/byow/roles/caddy/templates/Caddyfile @@ -2,10 +2,23 @@ http_port {{ caddy_http_port }} https_port {{ caddy_https_port }} default_bind {{ caddy_default_bind }} + order geoip2_vars first order coraza_waf first admin off persist_config off +{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %} + geoip2 { + accountId "{{ caddy_geoip_account_id }}" + licenseKey "{{ caddy_geoip_license_key }}" + databaseDirectory "{{ caddy_home_dir }}" + lockFile "{{ caddy_home_dir }}/.geoip2.lock" + editionID "{{ caddy_geoip_edition_ids }}" + updateUrl "https://updates.maxmind.com" + updateFrequency {{ caddy_geoip_update_frequency }} + } +{% endif %} + {% if caddy_email | default(None) != None %} email "{{ caddy_email }}" {% endif %} @@ -82,6 +95,83 @@ {% endfor %} } respond @blocked "Access Denied" 403 +{% endif %} + +{% if site.geoip | default(caddy_sites_defaults.geoip) %} + geoip2_vars strict + @geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }} + respond @geofilter "Access Denied" 403 + +{% if site.geoip_debug | default(caddy_sites_defaults.geoip_debug) %} + header geoip-is_anonymous "{geoip2.is_anonymous}" + header geoip-is_anonymous_vpn "{geoip2.is_anonymous_vpn}" + header geoip-is_hosting_provider "{geoip2.is_hosting_provider}" + header geoip-is_public_proxy "{geoip2.is_public_proxy}" + header geoip-is_residential_proxy "{geoip2.is_residential_proxy}" + header geoip-is_tor_exit_node "{geoip2.is_tor_exit_node}" + header geoip-connection_type "{geoip2.connection_type}" + header geoip-domain "{geoip2.domain}" + header geoip-country_code "{geoip2.country_code}" + header geoip-country_confidence "{geoip2.country_confidence}" + header geoip-country_eu "{geoip2.country_eu}" + header geoip-country_geoname_id "{geoip2.country_geoname_id}" + header geoip-country_name "{geoip2.country_name}" + header geoip-continent_code "{geoip2.continent_code}" + header geoip-continent_geoname_id "{geoip2.continent_geoname_id}" + header geoip-continent_name "{geoip2.continent_name}" + header geoip-city_confidence "{geoip2.city_confidence}" + header geoip-city_geoname_id "{geoip2.city_geoname_id}" + header geoip-city_name "{geoip2.city_name}" + header geoip-location_time_zone "{geoip2.location_time_zone}" + header geoip-autonomous_system_number "{geoip2.autonomous_system_number}" + header geoip-autonomous_system_organization "{geoip2.autonomous_system_organization}" + header geoip-isp "{geoip2.isp}" + header geoip-mobile_country_code "{geoip2.mobile_country_code}" + header geoip-mobile_network_code "{geoip2.mobile_network_code}" + header geoip-organization "{geoip2.organization}" + header geoip-ip_address "{geoip2.ip_address}" +{% endif %} + +# {% if site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | length > 0 %} +# @deny_countries { +# maxmind_geolocation { +# db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb" +# deny_countries {{ site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | joint(" ") }} +# } +# } +# respond @deny_countries "Access Denied" 403 +# {% endif %} +# +# {% if site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | length > 0 %} +# @not_allow_countries not { +# maxmind_geolocation { +# db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb" +# allow_countries {{ site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | joint(" ") }} +# } +# } +# respond @not_allow_countries "Access Denied" 403 +# {% endif %} +# +# {% if site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | length > 0 %} +# @deny_asn { +# maxmind_geolocation { +# db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb" +# deny_asn {{ site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | joint(" ") }} +# } +# } +# respond @deny_asn "Access Denied" 403 +# {% endif %} +# +# {% if site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | length > 0 %} +# @not_allow_asn not { +# maxmind_geolocation { +# db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb" +# allow_asn {{ site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | joint(" ") }} +# } +# } +# respond @not_allow_asn "Access Denied" 403 +# {% endif %} + {% endif %} @not_whitelisted not { diff --git a/seb4itik/byow/roles/caddy/templates/GeoIP.conf b/seb4itik/byow/roles/caddy/templates/GeoIP.conf new file mode 100644 index 0000000..dd9e813 --- /dev/null +++ b/seb4itik/byow/roles/caddy/templates/GeoIP.conf @@ -0,0 +1,3 @@ +AccountID {{ caddy_geoip_account_id }} +LicenseKey {{ caddy_geoip_license_key }} +EditionIDs {{ caddy_geoip_edition_ids }} diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml index dd7d61d..c1a1aea 100644 --- a/seb4itik/byow/roles/caddy/vars/main.yml +++ b/seb4itik/byow/roles/caddy/vars/main.yml @@ -385,3 +385,13 @@ caddy_global_sites_defaults: - "|iso-8859-1|" - "|iso-8859-15|" - "|windows-1252|" + + + # github.com/zhangjiayin/caddy-geoip2 + geoip: false + geoip_debug: false + geoip_filter_expression: '{geopii2.country_code == "UNK"}' +# geoip_deny_countries: [] # ISO country codes (2 letters), "UNK" for unknown country +# geoip_allow_countries: [] # ISO country codes (2 letters), "UNK" for unknown country +# geopip_deny_asn: [] +# geopip_allow_asn: []