feat: missing ip_restrictions

feat: testing ip restrictions

chore: remove ip restrictions

Author: florianow

modules/seaweedfs-instance/ingress.tf

@@ -122,30 +122,9 @@ resource "kubernetes_config_map" "keycloak_modsec" {
   }
 }
 
-resource "kubernetes_config_map" "seaweedfs_ip_whitelist_geo" {
+resource "kubernetes_config_map" "seaweedfs_ip_whitelist" {
   metadata {
-    name      = "seaweedfs-ip-whitelist-geo"
-    namespace = kubernetes_namespace.this.metadata[0].name
-
-    annotations = {
-      "bunkerweb.io/CONFIG_TYPE" = "http"
-      "bunkerweb.io/CONFIG_SITE" = var.seaweedfs_domain
-    }
-  }
-
-  data = {
-    "geo-block.conf" = <<-EOT
-      geo $seaweedfs_ip_whitelist {
-        default 0;
-        ${join("\n        ", [for cidr in split(",", var.allowed_ip_addresses) : "${trimspace(cidr)} 1;"])}
-      }
-    EOT
-  }
-}
-
-resource "kubernetes_config_map" "seaweedfs_ip_whitelist_check" {
-  metadata {
-    name      = "seaweedfs-ip-whitelist-check"
+    name      = "seaweedfs-ip-whitelist"
     namespace = kubernetes_namespace.this.metadata[0].name
 
     annotations = {
@@ -155,38 +134,16 @@ resource "kubernetes_config_map" "seaweedfs_ip_whitelist_check" {
   }
 
   data = {
-    "ip-check.conf" = <<-EOT
-      if ($seaweedfs_ip_whitelist = 0) {
-        return 403;
-      }
-    EOT
-  }
-}
-
-resource "kubernetes_config_map" "keycloak_ip_whitelist_geo" {
-  metadata {
-    name      = "keycloak-ip-whitelist-geo"
-    namespace = kubernetes_namespace.this.metadata[0].name
-
-    annotations = {
-      "bunkerweb.io/CONFIG_TYPE" = "http"
-      "bunkerweb.io/CONFIG_SITE" = var.keycloak_domain
-    }
-  }
-
-  data = {
-    "geo-block.conf" = <<-EOT
-      geo $keycloak_ip_whitelist {
-        default 0;
-        ${join("\n        ", [for cidr in split(",", var.allowed_ip_addresses) : "${trimspace(cidr)} 1;"])}
-      }
+    "ip-whitelist.conf" = <<-EOT
+      ${join("\n      ", [for cidr in split(",", var.allowed_ip_addresses) : "allow ${trimspace(cidr)};"])}
+      deny all;
     EOT
   }
 }
 
-resource "kubernetes_config_map" "keycloak_ip_whitelist_check" {
+resource "kubernetes_config_map" "keycloak_ip_whitelist" {
   metadata {
-    name      = "keycloak-ip-whitelist-check"
+    name      = "keycloak-ip-whitelist"
     namespace = kubernetes_namespace.this.metadata[0].name
 
     annotations = {
@@ -196,10 +153,9 @@ resource "kubernetes_config_map" "keycloak_ip_whitelist_check" {
   }
 
   data = {
-    "ip-check.conf" = <<-EOT
-      if ($keycloak_ip_whitelist = 0) {
-        return 403;
-      }
+    "ip-whitelist.conf" = <<-EOT
+      ${join("\n      ", [for cidr in split(",", var.allowed_ip_addresses) : "allow ${trimspace(cidr)};"])}
+      deny all;
     EOT
   }
 }