diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-03 00:40:17 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-03 00:40:17 +0900 |
| commit | c39ec05968656aaa893ed7e4b20b7d5f5ccbe5b5 (patch) | |
| tree | 43547361706d8a696a05996fa944b45cbb92a8be | |
| parent | 39d30042f0c9925ad3ba446311128c7e530680ce (diff) | |
Add GeoIP Japan-only filter to forward proxy
Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs.
DB file (GeoLite2-Country.mmdb) must be placed manually on the server.
Filter is inactive when DB file is absent, allowing safe rollout.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | caddy/Caddyfile | 1 | ||||
| -rw-r--r-- | caddy/Dockerfile | 4 | ||||
| -rw-r--r-- | caddy/entrypoint.sh | 27 |
4 files changed, 27 insertions, 6 deletions
@@ -2,3 +2,4 @@ .DS_Store hetzner-admin/id_rsa hetzner-admin/id_rsa.pub +caddy/GeoLite2-Country.mmdb diff --git a/caddy/Caddyfile b/caddy/Caddyfile index d5624c5..9aff8c9 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -1,5 +1,6 @@ { order forward_proxy before redir + order geoip before forward_proxy } golive.yyamashita.com { diff --git a/caddy/Dockerfile b/caddy/Dockerfile index 295437b..c7f4ac8 100644 --- a/caddy/Dockerfile +++ b/caddy/Dockerfile @@ -1,5 +1,7 @@ FROM caddy:2-builder-alpine AS builder -RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2 +RUN xcaddy build \ + --with github.com/caddyserver/forwardproxy@caddy2 \ + --with github.com/porech/caddy-maxmind-geoip FROM caddy:2-alpine COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh index ecf2e90..3e1ab8a 100644 --- a/caddy/entrypoint.sh +++ b/caddy/entrypoint.sh @@ -14,18 +14,35 @@ if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then fi AUTH_BLOCK=$(printf '%b' "$AUTH_LINES") +# GeoIP Japan-only filter (active only if DB file is present) +GEOIP_BLOCK="" +if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then + GEOIP_BLOCK=' geoip /etc/caddy/GeoLite2-Country.mmdb + @not_japan { + not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32 + not expression `{http.vars.geoip_country_code} == "JP"` + } + respond @not_japan 403' +fi + cat > "$PROXY_CONF" <<EOF http:// { - forward_proxy { -${AUTH_BLOCK} } - redir https://{host}{uri} 308 + route { +${GEOIP_BLOCK} + forward_proxy { +${AUTH_BLOCK} } + redir https://{host}{uri} 308 + } } https://proxy.yyamashita.com { tls { key_type rsa4096 } - forward_proxy { -${AUTH_BLOCK} } + route { +${GEOIP_BLOCK} + forward_proxy { +${AUTH_BLOCK} } + } } EOF |