From c68715b304d4aebd24fe0404f1143fb81929bbab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= <sebastien@itik.fr>
Date: Fri, 23 Jan 2026 17:47:21 +0300
Subject: [PATCH] geoip: fixes

---
 seb4itik/byow/roles/caddy/templates/Caddyfile | 41 -------------------
 seb4itik/byow/roles/caddy/vars/main.yml       |  4 +-
 2 files changed, 2 insertions(+), 43 deletions(-)

diff --git a/seb4itik/byow/roles/caddy/templates/Caddyfile b/seb4itik/byow/roles/caddy/templates/Caddyfile
index 1c24de9..8102edd 100644
--- a/seb4itik/byow/roles/caddy/templates/Caddyfile
+++ b/seb4itik/byow/roles/caddy/templates/Caddyfile
@@ -131,47 +131,6 @@
   header geoip-organization              "{geoip2.organization}"
   header geoip-ip_address                "{geoip2.ip_address}"
 {% endif %}
-
-# {% if site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | length > 0 %}
-#   @deny_countries {
-#     maxmind_geolocation {
-#       db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
-#       deny_countries {{ site.geoip_deny_countries | default(caddy_sites_defaults.geoip_deny_countries) | joint(" ") }}
-#     }
-#   }
-#   respond @deny_countries "Access Denied" 403
-# {% endif %}
-# 
-# {% if site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | length > 0 %}
-#   @not_allow_countries not {
-#     maxmind_geolocation {
-#       db_path "/var/lib/GeoIP/GeoLite2-Country.mmdb"
-#       allow_countries {{ site.geoip_allow_countries | default(caddy_sites_defaults.geoip_allow_countries) | joint(" ") }}
-#     }
-#   }
-#   respond @not_allow_countries "Access Denied" 403
-# {% endif %}
-# 
-# {% if site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | length > 0 %}
-#   @deny_asn {
-#     maxmind_geolocation {
-#       db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
-#       deny_asn {{ site.geopip_deny_asn | default(caddy_sites_defaults.geopip_deny_asn) | joint(" ") }}
-#     }
-#   }
-#   respond @deny_asn "Access Denied" 403
-# {% endif %}
-# 
-# {% if site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | length > 0 %}
-#   @not_allow_asn not {
-#     maxmind_geolocation {
-#       db_path "/var/lib/GeoIP/GeoLite2-ASN.mmdb"
-#       allow_asn {{ site.geopip_allow_asn | default(caddy_sites_defaults.geopip_allow_asn) | joint(" ") }}
-#     }
-#   }
-#   respond @not_allow_asn "Access Denied" 403
-# {% endif %}
-
 {% endif %}
 
   @not_whitelisted not {
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index c1a1aea..0864291 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -28,8 +28,8 @@ caddy_global_sites_defaults:
 
 
   # Filters
-  filter_whitelist: ["127.0.0.1"]
   filter_blacklist: []   # Superseeds filter_whitelist
+  filter_whitelist: ["127.0.0.1"]
 
 
   # Security headers
@@ -390,7 +390,7 @@ caddy_global_sites_defaults:
   # github.com/zhangjiayin/caddy-geoip2
   geoip: false
   geoip_debug: false
-  geoip_filter_expression: '{geopii2.country_code == "UNK"}'
+  geoip_filter_expression: '{geoip2.country_code} == "UNK"'
 # geoip_deny_countries: []    # ISO country codes (2 letters), "UNK" for unknown country
 # geoip_allow_countries: []   # ISO country codes (2 letters), "UNK" for unknown country
 # geopip_deny_asn: []