From c39ec05968656aaa893ed7e4b20b7d5f5ccbe5b5 Mon Sep 17 00:00:00 2001 From: yyamashita Date: Fri, 3 Jul 2026 00:40:17 +0900 Subject: Add GeoIP Japan-only filter to forward proxy Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs. DB file (GeoLite2-Country.mmdb) must be placed manually on the server. Filter is inactive when DB file is absent, allowing safe rollout. Co-Authored-By: Claude Sonnet 4.6 --- .gitignore | 1 + caddy/Caddyfile | 1 + caddy/Dockerfile | 4 +++- caddy/entrypoint.sh | 27 ++++++++++++++++++++++----- 4 files changed, 27 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index fd755d9..1c4e2de 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ .DS_Store hetzner-admin/id_rsa hetzner-admin/id_rsa.pub +caddy/GeoLite2-Country.mmdb diff --git a/caddy/Caddyfile b/caddy/Caddyfile index d5624c5..9aff8c9 100644 --- a/caddy/Caddyfile +++ b/caddy/Caddyfile @@ -1,5 +1,6 @@ { order forward_proxy before redir + order geoip before forward_proxy } golive.yyamashita.com { diff --git a/caddy/Dockerfile b/caddy/Dockerfile index 295437b..c7f4ac8 100644 --- a/caddy/Dockerfile +++ b/caddy/Dockerfile @@ -1,5 +1,7 @@ FROM caddy:2-builder-alpine AS builder -RUN xcaddy build --with github.com/caddyserver/forwardproxy@caddy2 +RUN xcaddy build \ + --with github.com/caddyserver/forwardproxy@caddy2 \ + --with github.com/porech/caddy-maxmind-geoip FROM caddy:2-alpine COPY --from=builder /usr/bin/caddy /usr/bin/caddy diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh index ecf2e90..3e1ab8a 100644 --- a/caddy/entrypoint.sh +++ b/caddy/entrypoint.sh @@ -14,18 +14,35 @@ if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then fi AUTH_BLOCK=$(printf '%b' "$AUTH_LINES") +# GeoIP Japan-only filter (active only if DB file is present) +GEOIP_BLOCK="" +if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then + GEOIP_BLOCK=' geoip /etc/caddy/GeoLite2-Country.mmdb + @not_japan { + not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32 + not expression `{http.vars.geoip_country_code} == "JP"` + } + respond @not_japan 403' +fi + cat > "$PROXY_CONF" <