From c39ec05968656aaa893ed7e4b20b7d5f5ccbe5b5 Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Fri, 3 Jul 2026 00:40:17 +0900
Subject: Add GeoIP Japan-only filter to forward proxy

Uses caddy-maxmind-geoip module to restrict proxy access to JP IPs.
DB file (GeoLite2-Country.mmdb) must be placed manually on the server.
Filter is inactive when DB file is absent, allowing safe rollout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 caddy/entrypoint.sh | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

(limited to 'caddy/entrypoint.sh')

diff --git a/caddy/entrypoint.sh b/caddy/entrypoint.sh
index ecf2e90..3e1ab8a 100644
--- a/caddy/entrypoint.sh
+++ b/caddy/entrypoint.sh
@@ -14,18 +14,35 @@ if [ "${PROXY_NO_AUTH:-0}" != "1" ] && [ -f /etc/proxy/users.conf ]; then
 fi
 AUTH_BLOCK=$(printf '%b' "$AUTH_LINES")
 
+# GeoIP Japan-only filter (active only if DB file is present)
+GEOIP_BLOCK=""
+if [ -f "/etc/caddy/GeoLite2-Country.mmdb" ]; then
+    GEOIP_BLOCK='    geoip /etc/caddy/GeoLite2-Country.mmdb
+    @not_japan {
+        not remote_ip 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 127.0.0.1/32
+        not expression `{http.vars.geoip_country_code} == "JP"`
+    }
+    respond @not_japan 403'
+fi
+
 cat > "$PROXY_CONF" <<EOF
 http:// {
-    forward_proxy {
-${AUTH_BLOCK}    }
-    redir https://{host}{uri} 308
+    route {
+${GEOIP_BLOCK}
+        forward_proxy {
+${AUTH_BLOCK}        }
+        redir https://{host}{uri} 308
+    }
 }
 https://proxy.yyamashita.com {
     tls {
         key_type rsa4096
     }
-    forward_proxy {
-${AUTH_BLOCK}    }
+    route {
+${GEOIP_BLOCK}
+        forward_proxy {
+${AUTH_BLOCK}        }
+    }
 }
 EOF
 
-- 
cgit v1.2.3