itik/bgwaf
Private
Public Access
2
0
Fork 0
Code Issues Pull Requests Releases 9 Activity

caddy: geoip first attempt

Browse Source
This commit is contained in:
Sébastien NAMECHE
2026-01-23 14:08:31 +03:00
parent dde28095b2
commit 06198aca2c
7 changed files with 126 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
seb4itik/byow/roles/caddy/templates/Caddyfile
View File

@@ -2,10 +2,23 @@
http_port {{ caddy_http_port }}
https_port {{ caddy_https_port }}
default_bind {{ caddy_default_bind }}
order geoip2_vars first
order coraza_waf first
admin off
persist_config off
{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
geoip2 {
accountId "{{ caddy_geoip_account_id }}"
licenseKey "{{ caddy_geoip_license_key }}"
databaseDirectory "{{ caddy_home_dir }}"
lockFile "{{ caddy_home_dir }}/.geoip2.lock"
editionID "{{ caddy_geoip_edition_ids }}"
updateUrl "https://updates.maxmind.com"
updateFrequency {{ caddy_geoip_update_frequency }}
}
{% endif %}
{% if caddy_email | default(None) != None %}
email "{{ caddy_email }}"
{% endif %}
@@ -82,6 +95,83 @@
{% endfor %}
}
respond @blocked "Access Denied" 403
{% endif %}
{% if site.geoip | default(caddy_sites_defaults.geoip) %}
geoip2_vars strict
@geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }}
respond @geofilter "Access Denied" 403
{% if site.geoip_debug | default(caddy_sites_defaults.geoip_debug) %}
header geoip-is_anonymous "{geoip2.is_anonymous}"
header geoip-is_anonymous_vpn "{geoip2.is_anonymous_vpn}"
header geoip-is_hosting_provider "{geoip2.is_hosting_provider}"
header geoip-is_public_proxy "{geoip2.is_public_proxy}"
header geoip-is_residential_proxy "{geoip2.is_residential_proxy}"
header geoip-is_tor_exit_node "{geoip2.is_tor_exit_node}"
header geoip-connection_type "{geoip2.connection_type}"
header geoip-domain "{geoip2.domain}"
header geoip-country_code "{geoip2.country_code}"
header geoip-country_confidence "{geoip2.country_confidence}"
header geoip-country_eu "{geoip2.country_eu}"
header geoip-country_geoname_id "{geoip2.country_geoname_id}"
header geoip-country_name "{geoip2.country_name}"
header geoip-continent_code "{geoip2.continent_code}"
header geoip-continent_geoname_id "{geoip2.continent_geoname_id}"
header geoip-continent_name "{geoip2.continent_name}"
header geoip-city_confidence "{geoip2.city_confidence}"
header geoip-city_geoname_id "{geoip2.city_geoname_id}"
header geoip-city_name "{geoip2.city_name}"
header geoip-location_time_zone "{geoip2.location_time_zone}"
header geoip-autonomous_system_number "{geoip2.autonomous_system_number}"
header geoip-autonomous_system_organization "{geoip2.autonomous_system_organization}"
header geoip-isp "{geoip2.isp}"
header geoip-mobile_country_code "{geoip2.mobile_country_code}"
header geoip-mobile_network_code "{geoip2.mobile_network_code}"
header geoip-organization "{geoip2.organization}"
header geoip-ip_address "{geoip2.ip_address}"
{% endif %}
# {% if site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | length > 0 %}
# @deny_countries {
# maxmind_geolocation {
# db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
# deny_countries {{ site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | joint(" ") }}
# }
# }
# respond @deny_countries "Access Denied" 403
# {% endif %}
#
# {% if site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | length > 0 %}
# @not_allow_countries not {
# maxmind_geolocation {
# db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
# allow_countries {{ site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | joint(" ") }}
# }
# }
# respond @not_allow_countries "Access Denied" 403
# {% endif %}
#
# {% if site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | length > 0 %}
# @deny_asn {
# maxmind_geolocation {
# db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
# deny_asn {{ site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | joint(" ") }}
# }
# }
# respond @deny_asn "Access Denied" 403
# {% endif %}
#
# {% if site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | length > 0 %}
# @not_allow_asn not {
# maxmind_geolocation {
# db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
# allow_asn {{ site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | joint(" ") }}
# }
# }
# respond @not_allow_asn "Access Denied" 403
# {% endif %}
{% endif %}
@not_whitelisted not {