added geoip annotations to immich and opengist ingresses

2026-01-20 16:58:18 +01:00
parent d35f6b490a
commit d0f24ade78
2 changed files with 97 additions and 0 deletions
@@ -474,6 +474,51 @@ metadata:
    external-dns.alpha.kubernetes.io/hostname: photos.dooplex.hu
    nginx.ingress.kubernetes.io/proxy-body-size: "0"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    # GeoIP-based access control
+    nginx.ingress.kubernetes.io/configuration-snippet: |
+      # GeoIP-based access control for Immich
+      # Allows Hungarian traffic everywhere, worldwide only for /share/* paths
+      
+      set $geo_allowed 0;
+      
+      # Allow all Hungarian traffic
+      if ($geoip2_city_country_code = "HU") {
+        set $geo_allowed 1;
+      }
+      
+      # Allow public share paths from anywhere
+      if ($request_uri ~* "^/share/") {
+        set $geo_allowed 1;
+      }
+      
+      # API endpoints needed for shared content
+      if ($request_uri ~* "^/api/shared-links") {
+        set $geo_allowed 1;
+      }
+      
+      # Assets for shared albums (thumbnails and originals)
+      if ($request_uri ~* "^/api/assets/.*/thumbnail") {
+        set $geo_allowed 1;
+      }
+      if ($request_uri ~* "^/api/assets/.*/original") {
+        set $geo_allowed 1;
+      }
+      
+      # Static assets needed for share page rendering
+      if ($request_uri ~* "^/_app/") {
+        set $geo_allowed 1;
+      }
+      if ($request_uri ~* "^/favicon") {
+        set $geo_allowed 1;
+      }
+      if ($request_uri ~* "\.(js|css|woff2?|ttf|svg|png|ico)$") {
+        set $geo_allowed 1;
+      }
+      
+      # Block non-allowed requests
+      if ($geo_allowed = 0) {
+        return 403 "Access restricted to Hungary";
+      }
  namespace: immich-system
 spec:
  ingressClassName: nginx-internal