added geoip filters to ingresses

actualbudget-system/actualbudget.yaml

@@ -98,6 +98,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: actualbudget.dooplex.hu,actualbudget.home
     nginx.ingress.kubernetes.io/proxy-body-size: 50m
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: actualbudget
     app.kubernetes.io/name: actualbudget

adventurelog-system/adventurelog.yaml

@@ -373,6 +373,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
     nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

arcade-system/romm.yaml

@@ -292,6 +292,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "5g"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

argocd-system/argocd-config.yaml

@@ -10,6 +10,10 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     external-dns.alpha.kubernetes.io/hostname: argocd.dooplex.hu,argocd.home
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

audiobookshelf-system/audiobookshelf.yaml

@@ -136,6 +136,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: audiobookshelf
     app.kubernetes.io/name: audiobookshelf

booking-system/booking.yaml

@@ -407,6 +407,10 @@ metadata:
     # Required for WebSocket connections (if using Cal.com video)
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
     nginx.ingress.kubernetes.io/proxy-set-headers: "booking-system/calcom-proxy-headers"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

bookstack-system/bookstack.yaml

@@ -339,6 +339,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: bookstack.dooplex.hu,bookstack.home
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: bookstack
     app.kubernetes.io/name: bookstack

calibre-system/calibre.yaml

@@ -253,6 +253,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:
@@ -297,6 +301,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

code-system/code.yaml

@@ -160,6 +160,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-signin: https://code.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

crafty-system/crafty.yaml

@@ -156,6 +156,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-snippet: 'proxy_set_header X-Forwarded-Host $http_host;
 
       '
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

fileshare-system/gokapi.yaml

@@ -158,6 +158,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "1g"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

gitea-system/gitea.yaml

@@ -210,6 +210,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: gitea.dooplex.hu,gitea.home
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: gitea
     app.kubernetes.io/name: gitea

glance-system/glance-kisfenyo.yaml

@@ -2200,6 +2200,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

glance-system/glance-orsi.yaml

@@ -751,6 +751,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

headlamp-system/headlamp.yaml

@@ -346,6 +346,10 @@ metadata:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
     nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
     # Homepage integration annotations
     gethomepage.dev/enabled: "true"
     gethomepage.dev/name: "Headlamp"

homepage-system/homepage.yaml

@@ -715,6 +715,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
     # Homepage auto-discovery annotation
     gethomepage.dev/enabled: "true"
     gethomepage.dev/name: "Homepage"

mon-system/monitoring.yaml

@@ -570,6 +570,10 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     external-dns.alpha.kubernetes.io/hostname: grafana.dooplex.hu,grafana.home
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

nextcloud-system/nextcloud.yaml

@@ -763,6 +763,9 @@ metadata:
     nginx.ingress.kubernetes.io/configuration-snippet: |
       proxy_hide_header Content-Security-Policy;
       add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https:; media-src 'self'; frame-ancestors 'self' https://home.dooplex.hu https://orsi.dooplex.hu https://kisfenyo.dooplex.hu;" always;
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: nextcloud
   namespace: nextcloud-system
 spec:

outline-system/outline.yaml

@@ -399,6 +399,9 @@ metadata:
       proxy_hide_header X-Frame-Options;
       proxy_hide_header Content-Security-Policy;
       add_header X-Frame-Options "ALLOW-FROM https://orsi.dooplex.hu" always;
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: outline
     app.kubernetes.io/name: outline

paperless-system/paperless.yaml

@@ -343,6 +343,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: paperless
     app.kubernetes.io/name: paperless

plantit-system/plantit.yaml

@@ -320,6 +320,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-signin: https://plantit.dooplex.hu/outpost.goauthentik.io/start?rd=$escaped_request_uri
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

privatebin-system/privatebin.yaml

@@ -371,6 +371,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
     nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
     nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "32k"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

servarr-system/servarr.yaml

@@ -389,6 +389,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: prowlarr
   namespace: servarr-system
 spec:
@@ -436,6 +440,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: radarr
   namespace: servarr-system
 spec:
@@ -482,6 +490,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: sonarr
   namespace: servarr-system
 spec:
@@ -528,6 +540,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: qbittorrent
   namespace: servarr-system
 spec:
@@ -755,6 +771,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-url: http://ak-outpost-arr-outpost.auth-system.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: radarrkids
   namespace: servarr-system
 spec:
@@ -918,6 +938,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: seerr.dooplex.hu,seerr.home
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   name: seerr
   namespace: servarr-system
 spec:

tandoor-system/tandoor.yaml

@@ -224,6 +224,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: tandoor.dooplex.hu,tandoor.home
     nginx.ingress.kubernetes.io/proxy-body-size: 128m
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: tandoor
     app.kubernetes.io/name: tandoor

termix-system/termix.yaml

@@ -119,6 +119,10 @@ metadata:
     # WebSocket support for SSH terminal
     nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

uptimekuma-system/uptimekuma.yaml

@@ -109,6 +109,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-response-headers: "Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid"
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: uptimekuma
     app.kubernetes.io/name: uptimekuma

vaultwarden-system/vaultwarden.yaml

@@ -161,6 +161,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: vaultwarden.dooplex.hu,vaultwarden.home
     nginx.ingress.kubernetes.io/proxy-body-size: 100m
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
   labels:
     app.kubernetes.io/instance: vaultwarden
     app.kubernetes.io/name: vaultwarden

wanderer-system/wanderer.yaml

@@ -297,6 +297,10 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
     # optional, only if you actually use external-dns:
     external-dns.alpha.kubernetes.io/hostname: wanderer.dooplex.hu
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

web-system/web.yaml

@@ -244,6 +244,10 @@ metadata:
     nginx.ingress.kubernetes.io/auth-response-headers: X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
     nginx.ingress.kubernetes.io/auth-snippet: |
       proxy_set_header X-Forwarded-Host $http_host;
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:
@@ -469,6 +473,10 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     external-dns.alpha.kubernetes.io/hostname: web.dooplex.hu
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls:

workout-system/workout.yaml

@@ -435,6 +435,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: workout.dooplex.hu,workout.home
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   rules:

zipline-system/zipline.yaml

@@ -130,6 +130,10 @@ metadata:
     external-dns.alpha.kubernetes.io/hostname: zipline.dooplex.hu,zipline.home
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     nginx.ingress.kubernetes.io/proxy-body-size: "100m"
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      if ($geoip2_city_country_code != "HU") {
+        return 403 "Access restricted to Hungary";
+      }
 spec:
   ingressClassName: nginx-internal
   tls: