From 7974d2bad8ce056396159b598ba8943a72c14880 Mon Sep 17 00:00:00 2001
From: Claude <claude@localhost.local>
Date: Fri, 6 Nov 2026 19:31:26 -0500
Subject: [PATCH] Bring kubectl-edited controller config into the role

The live ConfigMap carries compute-full-forwarded-for and the http-snippet
geo block of abusive ranges, added with kubectl edit on 2026-03-31. Record
them here so a fresh install keeps them; values match the live ConfigMap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tasks/main.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/tasks/main.yml b/tasks/main.yml
index a506a20..35f1cb0 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -21,8 +21,31 @@
           update-status: "false"
         config:
           use-forwarded-headers: "true"
+          compute-full-forwarded-for: "true"
           allow-snippet-annotations: "true"
           annotations-risk-level: "Critical"
+          # Abusive address ranges, refused with 403 on every host.
+          http-snippet: |
+            geo $blocked_ip {
+              default 0;
+              102.165.1.0/24 1;
+              102.165.5.0/24 1;
+              185.176.207.0/24 1;
+              185.213.247.0/24 1;
+              193.58.104.0/24 1;
+              194.53.140.0/24 1;
+              5.45.36.0/24 1;
+              86.105.185.0/24 1;
+            }
+            map $blocked_ip $block {
+              1 1;
+              default 0;
+            }
+            server {
+              if ($block) {
+                return 403;
+              }
+            }
         metrics:
           enabled: true