diff options
| -rw-r--r-- | .gitignore | 1 | ||||
| -rw-r--r-- | caddy/Caddyfile | 1 | ||||
| -rw-r--r-- | caddy/Dockerfile | 4 | ||||
| -rw-r--r-- | caddy/entrypoint.sh | 27 |
4 files changed, 27 insertions, 6 deletions
@@ -2,3 +2,4 @@ .DS_Store hetzner-admin/id_rsa hetzner-admin/id_rsa.pub +caddy/GeoLite2-Country.mmdb diff --git a/caddy/Caddyfile b/caddy/Caddyfile index d5624c5..9aff8c9 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -1,5 +1,6 @@ { order forward_proxy before redir + order geoip before forward_proxy } golive.yyamashita.com { diff --git a/caddy/Dockerfile b/caddy/Dockerfile index 295437b..c7f4ac8 100644 --- a/caddy/Dockerfile +++ b/caddy/Dockerfile @@ -1,5 +1,7 @@ FROM caddy:2-builder-alpine AS builder -RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2 +RUN xcaddy build \ + --with github.com/caddyserver/forwardproxy@caddy2 \ + --with github.com/porech/caddy-maxmind-geoip FROM caddy:2-alpine COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh index ecf2e90..3e1ab8a 100644 --- a/caddy/entrypoint.sh +++ b/caddy/entrypoint.sh @@ -14,18 +14,35 @@ if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then fi AUTH_BLOCK=$(printf '%b' "$AUTH_LINES") +# GeoIP Japan-only filter (active only if DB file is present) +GEOIP_BLOCK="" +if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then + GEOIP_BLOCK=' geoip /etc/caddy/GeoLite2-Country.mmdb + @not_japan { + not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32 + not expression `{http.vars.geoip_country_code} == "JP"` + } + respond @not_japan 403' +fi + cat > "$PROXY_CONF" <<EOF http:// { - forward_proxy { -${AUTH_BLOCK} } - redir https://{host}{uri} 308 + route { +${GEOIP_BLOCK} + forward_proxy { +${AUTH_BLOCK} } + redir https://{host}{uri} 308 + } } https://proxy.yyamashita.com { tls { key_type rsa4096 } - forward_proxy { -${AUTH_BLOCK} } + route { +${GEOIP_BLOCK} + forward_proxy { +${AUTH_BLOCK} } + } } EOF |