ClaudeandClaude Opus 5.5
7974d2bad8
The live ConfigMap carries compute-full-forwarded-for and the http-snippet geo block of abusive ranges, added with kubectl edit on 2026-03-31. Record them here so a fresh install keeps them; values match the live ConfigMap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
1.4 KiB
YAML
52 lines
1.4 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# tasks file for ansible-role-ingress-nginx
|
|
|
|
- name: Add Ingress Nginx repository
|
|
kubernetes.core.helm_repository:
|
|
name: ingress-nginx
|
|
repo_url: https://kubernetes.github.io/ingress-nginx
|
|
|
|
- name: Deploy Ingress Nginx
|
|
kubernetes.core.helm:
|
|
name: ingress-nginx
|
|
chart_ref: ingress-nginx/ingress-nginx
|
|
release_namespace: ingress-nginx
|
|
create_namespace: true
|
|
values:
|
|
controller:
|
|
annotations:
|
|
acme.cert-manager.io/http01-edit-in-place: 'true'
|
|
extraArgs:
|
|
update-status: "false"
|
|
config:
|
|
use-forwarded-headers: "true"
|
|
compute-full-forwarded-for: "true"
|
|
allow-snippet-annotations: "true"
|
|
annotations-risk-level: "Critical"
|
|
# Abusive address ranges, refused with 403 on every host.
|
|
http-snippet: |
|
|
geo $blocked_ip {
|
|
default 0;
|
|
102.165.1.0/24 1;
|
|
102.165.5.0/24 1;
|
|
185.176.207.0/24 1;
|
|
185.213.247.0/24 1;
|
|
193.58.104.0/24 1;
|
|
194.53.140.0/24 1;
|
|
5.45.36.0/24 1;
|
|
86.105.185.0/24 1;
|
|
}
|
|
map $blocked_ip $block {
|
|
1 1;
|
|
default 0;
|
|
}
|
|
server {
|
|
if ($block) {
|
|
return 403;
|
|
}
|
|
}
|
|
metrics:
|
|
enabled: true
|
|
|