#SPDX-License-Identifier: MIT-0
---
# tasks file for ansible-role-ingress-nginx

- name: Add Ingress Nginx repository
  kubernetes.core.helm_repository:
    name: ingress-nginx
    repo_url: https://kubernetes.github.io/ingress-nginx

- name: Deploy Ingress Nginx
  kubernetes.core.helm:
    name: ingress-nginx
    chart_ref: ingress-nginx/ingress-nginx
    release_namespace: ingress-nginx
    create_namespace: true
    values:
      controller:
        annotations:
          acme.cert-manager.io/http01-edit-in-place: 'true'
        extraArgs:
          update-status: "false"
        config:
          use-forwarded-headers: "true"
          compute-full-forwarded-for: "true"
          allow-snippet-annotations: "true"
          annotations-risk-level: "Critical"
          # Abusive address ranges, refused with 403 on every host.
          http-snippet: |
            geo $blocked_ip {
              default 0;
              102.165.1.0/24 1;
              102.165.5.0/24 1;
              185.176.207.0/24 1;
              185.213.247.0/24 1;
              193.58.104.0/24 1;
              194.53.140.0/24 1;
              5.45.36.0/24 1;
              86.105.185.0/24 1;
            }
            map $blocked_ip $block {
              1 1;
              default 0;
            }
            server {
              if ($block) {
                return 403;
              }
            }
        metrics:
          enabled: true