diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-03 00:45:51 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-03 00:45:51 +0900 |
| commit | e14f9edcb95875e2519461690915ab3e25740e96 (patch) | |
| tree | 12ca3858cbb40c71893599e13b54df9b34afe2f5 | |
| parent | c39ec05968656aaa893ed7e4b20b7d5f5ccbe5b5 (diff) | |
Restrict proxy to Japan IPs using ipdeny.com CIDR list
Downloads jp-aggregated.zone from ipdeny.com at container startup (no
account required). Falls back to open access if download fails.
Removed caddy-maxmind-geoip module (no longer needed).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | caddy/Caddyfile | 1 | ||||
| -rw-r--r-- | caddy/Dockerfile | 5 | ||||
| -rw-r--r-- | caddy/entrypoint.sh | 20 |
4 files changed, 12 insertions, 15 deletions
@@ -2,4 +2,3 @@ .DS_Store hetzner-admin/id_rsa hetzner-admin/id_rsa.pub -caddy/GeoLite2-Country.mmdb diff --git a/caddy/Caddyfile b/caddy/Caddyfile index 9aff8c9..d5624c5 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -1,6 +1,5 @@ { order forward_proxy before redir - order geoip before forward_proxy } golive.yyamashita.com { diff --git a/caddy/Dockerfile b/caddy/Dockerfile index c7f4ac8..e6e20b6 100644 --- a/caddy/Dockerfile +++ b/caddy/Dockerfile @@ -1,9 +1,8 @@ FROM caddy:2-builder-alpine AS builder -RUN xcaddy build \ - --with github.com/caddyserver/forwardproxy@caddy2 \ - --with github.com/porech/caddy-maxmind-geoip +RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2 FROM caddy:2-alpine +RUN apk add --no-cache wget COPY --from=builder /usr/bin/caddy /usr/bin/caddy COPY entrypoint.sh /entrypoint.sh RUN chmod +x /entrypoint.sh diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh index 3e1ab8a..bba0fab 100644 --- a/caddy/entrypoint.sh +++ b/caddy/entrypoint.sh @@ -14,21 +14,21 @@ if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then fi AUTH_BLOCK=$(printf '%b' "$AUTH_LINES") -# GeoIP Japan-only filter (active only if DB file is present) -GEOIP_BLOCK="" -if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then - GEOIP_BLOCK=' geoip /etc/caddy/GeoLite2-Country.mmdb - @not_japan { - not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32 - not expression `{http.vars.geoip_country_code} == "JP"` +# JP-only filter: download CIDR list from ipdeny.com (no account required) +JP_FILTER="" +JP_ZONE=/tmp/jp.zone +if wget -q -O "$JP_ZONE" --timeout=15 "https://www.ipdeny.com/ipblocks/data/aggregated/jp-aggregated.zone" 2>/dev/null && [ -s "$JP_ZONE" ]; then + JP_IPS=$(tr '\n' ' ' < "$JP_ZONE") + JP_FILTER=" @not_japan { + not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32 ${JP_IPS} } - respond @not_japan 403' + respond @not_japan 403" fi cat > "$PROXY_CONF" <<EOF http:// { route { -${GEOIP_BLOCK} +${JP_FILTER} forward_proxy { ${AUTH_BLOCK} } redir https://{host}{uri} 308 @@ -39,7 +39,7 @@ https://proxy.yyamashita.com { key_type rsa4096 } route { -${GEOIP_BLOCK} +${JP_FILTER} forward_proxy { ${AUTH_BLOCK} } } |