caddy: geoip first attempt

seb4itik/byow/roles/caddy/defaults/main.yml

@@ -24,6 +24,13 @@ caddy_email: null
 # If a custom CA root have to be used
 caddy_ca_root: null
 
+# See: https://dev.maxmind.com/geoip/updating-databases/
+caddy_geoip_account_id: null
+caddy_geoip_license_key: null
+caddy_geoip_edition_ids: "GeoLite2-ASN,GeoLite2-Country,GeoLite2-City"
+caddy_geoip_update_frequency: 86400   # In seconds
+
+
 # Cf.: https://github.com/coreruleset/plugin-registry
 caddy_crs_plugins:
   - name: "drupal-rule-exclusions"

seb4itik/byow/roles/caddy/handlers/main.yml

@@ -2,3 +2,7 @@
   ansible.builtin.service:
     name: "{{ caddy_my_name }}"
     state: "restarted"
+
+# - name: Update GeoIP databases
+#   ansible.builtin.command:
+#     cmd: "/usr/bin/geoipupdate"

seb4itik/byow/roles/caddy/tasks/caddy_config.yml

@@ -76,6 +76,15 @@
   notify:
     - "Restart Caddy"
 
+# - name: Generate GeoIP config file
+#   when: "caddy_geoip_account_id != None and caddy_geoip_license_key != None"
+#   ansible.builtin.template:
+#     src: "templates/GeoIP.conf"
+#     dest: "/etc/GeoIP.conf"
+#     mode: "0640"
+#   notify:
+#     - "Update GeoIP databases"
+
 - name: Enable and start Caddy
   ansible.builtin.service:
     name: "{{ caddy_my_name }}"

seb4itik/byow/roles/caddy/tasks/caddy_install.yml

@@ -1,9 +1,10 @@
 - name: Install requirements
-  ansible.builtin.apt:
+  ansible.builtin.package:
     name:
       - "git"
       - "libnss3-tools"
       - "ssl-cert"
+#     - "geoipupdate"
 
 - name: Create Go directory
   ansible.builtin.file:
@@ -37,6 +38,7 @@
       --with github.com/corazawaf/coraza-caddy/v2@v{{ caddy_coraza_caddy_version }}
       --with github.com/mholt/caddy-ratelimit
       --with github.com/steffenbusch/caddy-bot-barrier
+      --with github.com/zhangjiayin/caddy-geoip2
       --output /usr/local/bin/{{ caddy_my_name }}
 
 - name: Remember and test Caddy version

seb4itik/byow/roles/caddy/templates/Caddyfile

@@ -2,10 +2,23 @@
   http_port {{ caddy_http_port }}
   https_port {{ caddy_https_port }}
   default_bind {{ caddy_default_bind }}
+  order geoip2_vars first
   order coraza_waf first
   admin off
   persist_config off
 
+{% if caddy_geoip_account_id != None and caddy_geoip_license_key != None %}
+  geoip2 {
+    accountId         "{{ caddy_geoip_account_id }}"
+    licenseKey        "{{ caddy_geoip_license_key }}"
+    databaseDirectory "{{ caddy_home_dir }}"
+    lockFile          "{{ caddy_home_dir }}/.geoip2.lock"
+    editionID         "{{ caddy_geoip_edition_ids }}"
+    updateUrl         "https://updates.maxmind.com"
+    updateFrequency   {{ caddy_geoip_update_frequency }}
+  }
+{% endif %}
+
 {% if caddy_email | default(None) != None %}
   email "{{ caddy_email }}"
 {% endif %}
@@ -82,6 +95,83 @@
 {% endfor %}
   }
   respond @blocked "Access Denied" 403
+{% endif %}
+
+{% if site.geoip | default(caddy_sites_defaults.geoip) %}
+  geoip2_vars strict
+  @geofilter expression {{ site.geoip_filter_expression | default(caddy_sites_defaults.geoip_filter_expression) }}
+  respond @geofilter "Access Denied" 403
+
+{% if site.geoip_debug | default(caddy_sites_defaults.geoip_debug) %}
+  header geoip-is_anonymous              "{geoip2.is_anonymous}"
+  header geoip-is_anonymous_vpn          "{geoip2.is_anonymous_vpn}"
+  header geoip-is_hosting_provider       "{geoip2.is_hosting_provider}"
+  header geoip-is_public_proxy           "{geoip2.is_public_proxy}"
+  header geoip-is_residential_proxy      "{geoip2.is_residential_proxy}"
+  header geoip-is_tor_exit_node          "{geoip2.is_tor_exit_node}"
+  header geoip-connection_type           "{geoip2.connection_type}"
+  header geoip-domain                    "{geoip2.domain}"
+  header geoip-country_code              "{geoip2.country_code}"
+  header geoip-country_confidence        "{geoip2.country_confidence}"
+  header geoip-country_eu                "{geoip2.country_eu}"
+  header geoip-country_geoname_id        "{geoip2.country_geoname_id}"
+  header geoip-country_name              "{geoip2.country_name}"
+  header geoip-continent_code            "{geoip2.continent_code}"
+  header geoip-continent_geoname_id      "{geoip2.continent_geoname_id}"
+  header geoip-continent_name            "{geoip2.continent_name}"
+  header geoip-city_confidence           "{geoip2.city_confidence}"
+  header geoip-city_geoname_id           "{geoip2.city_geoname_id}"
+  header geoip-city_name                 "{geoip2.city_name}"
+  header geoip-location_time_zone        "{geoip2.location_time_zone}"
+  header geoip-autonomous_system_number  "{geoip2.autonomous_system_number}"
+  header geoip-autonomous_system_organization  "{geoip2.autonomous_system_organization}"
+  header geoip-isp                       "{geoip2.isp}"
+  header geoip-mobile_country_code       "{geoip2.mobile_country_code}"
+  header geoip-mobile_network_code       "{geoip2.mobile_network_code}"
+  header geoip-organization              "{geoip2.organization}"
+  header geoip-ip_address                "{geoip2.ip_address}"
+{% endif %}
+
+# {% if site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | length > 0 %}
+#   @deny_countries {
+#     maxmind_geolocation {
+#       db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
+#       deny_countries {{ site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | joint(" ") }}
+#     }
+#   }
+#   respond @deny_countries "Access Denied" 403
+# {% endif %}
+# 
+# {% if site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | length > 0 %}
+#   @not_allow_countries not {
+#     maxmind_geolocation {
+#       db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
+#       allow_countries {{ site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | joint(" ") }}
+#     }
+#   }
+#   respond @not_allow_countries "Access Denied" 403
+# {% endif %}
+# 
+# {% if site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | length > 0 %}
+#   @deny_asn {
+#     maxmind_geolocation {
+#       db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
+#       deny_asn {{ site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | joint(" ") }}
+#     }
+#   }
+#   respond @deny_asn "Access Denied" 403
+# {% endif %}
+# 
+# {% if site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | length > 0 %}
+#   @not_allow_asn not {
+#     maxmind_geolocation {
+#       db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
+#       allow_asn {{ site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | joint(" ") }}
+#     }
+#   }
+#   respond @not_allow_asn "Access Denied" 403
+# {% endif %}
+
 {% endif %}
 
   @not_whitelisted not {

seb4itik/byow/roles/caddy/templates/GeoIP.conf

@@ -0,0 +1,3 @@
+AccountID {{ caddy_geoip_account_id }}
+LicenseKey {{ caddy_geoip_license_key }}
+EditionIDs {{ caddy_geoip_edition_ids }}

seb4itik/byow/roles/caddy/vars/main.yml

@@ -385,3 +385,13 @@ caddy_global_sites_defaults:
     - "|iso-8859-1|"
     - "|iso-8859-15|"
     - "|windows-1252|"
+
+
+  # github.com/zhangjiayin/caddy-geoip2
+  geoip: false
+  geoip_debug: false
+  geoip_filter_expression: '{geopii2.country_code == "UNK"}'
+# geoip_deny_countries: []    # ISO country codes (2 letters), "UNK" for unknown country
+# geoip_allow_countries: []   # ISO country codes (2 letters), "UNK" for unknown country
+# geopip_deny_asn: []
+# geopip_allow_asn: []