feat(traefik): add geoblock middleware (#4396)

* feat(traefik): add geoblock middleware

* add the required args

* add UI

* fix indentaiton

.github/scripts/updateTraefikMiddlewareVersions.sh

@@ -42,8 +42,12 @@ update_plugin() {
 }
 # Example
 # update_plugin "repo" "key_holding_version_in_values.yaml" "plugin_name_used_for_verbose_printing_only"
+
 # Real IP
 update_plugin "soulbalz/traefik-real-ip" "realIPVersion" "RealIP"
 
 # Theme Park
 update_plugin "packruler/traefik-themepark" "themeParkVersion" "ThemePark"
+
+# GeoBlock
+update_plugin "PascalMinder/geoblock" "geoBlockVersion" "GeoBlock"

charts/stable/traefik/Chart.yaml

@@ -23,7 +23,7 @@ sources:
   - https://github.com/traefik/traefik-helm-chart
   - https://traefik.io/
 type: application
-version: 15.0.1
+version: 15.1.0
 annotations:
   truecharts.org/catagories: |
     - network

charts/stable/traefik/questions.yaml

@@ -182,6 +182,7 @@ questions:
 # Include{ipWhitelistMiddleware}
 # Include{themeParkMiddleware}
 # Include{realIPMiddleware}
+# Include{geoBlockMiddleware}
 # Include{addPrefixMiddleware}
   - variable: service
     group: "Networking and Services"

charts/stable/traefik/templates/_args.tpl

@@ -158,6 +158,12 @@ args:
   - "--experimental.plugins.traefik-themepark.version={{ .Values.middlewares.themeParkVersion }}"
   {{- end }}
   {{/* End of theme.park */}}
+  {{/* GeoBlock */}}
+  {{- if .Values.middlewares.geoBlock }}
+  - "--experimental.plugins.GeoBlock.modulename=github.com/PascalMinder/geoblock"
+  - "--experimental.plugins.GeoBlock.version={{ .Values.middlewares.geoBlockVersion }}"
+  {{- end }}
+  {{/* End of GeoBlock */}}
   {{/* RealIP */}}
   {{- if .Values.middlewares.realIP }}
   - "--experimental.plugins.traefik-real-ip.modulename=github.com/soulbalz/traefik-real-ip"

charts/stable/traefik/templates/middlewares/geoblock.yaml

@@ -0,0 +1,34 @@
+{{- $values := .Values }}
+{{- $namespace := ( printf "ix-%s" .Release.Name ) }}
+{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }}
+{{- $namespace = "default" }}
+{{- end }}
+{{- range $index, $middlewareData := .Values.middlewares.geoBlock }}
+
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $middlewareData.name }}
+  namespace: {{ $namespace }}
+spec:
+  plugin:
+    GeoBlock:
+      allowLocalRequests: {{ $middlewareData.allowLocalRequests }}
+      logLocalRequests: {{ $middlewareData.logLocalRequests }}
+      logAllowedRequests: {{ $middlewareData.logAllowedRequests }}
+      logApiRequests: {{ $middlewareData.logApiRequests }}
+      api: {{ $middlewareData.api }}
+      apiTimeoutMs: {{ $middlewareData.apiTimeoutMs }}
+      cacheSize: {{ $middlewareData.cacheSize }}
+      forceMonthlyUpdate: {{ $middlewareData.forceMonthlyUpdate }}
+      allowUnknownCountries: {{ $middlewareData.allowUnknownCountries }}
+      unknownCountryApiResponse: {{ $middlewareData.unknownCountryApiResponse }}
+      {{- if not $middlewareData.countries }}
+        {{- fail "You have to define at least one country..." }}
+      {{- end }}
+      countries:
+        {{- range $middlewareData.countries }}
+        - {{ . }}
+        {{- end }}
+{{- end }}

charts/stable/traefik/values.yaml

@@ -376,6 +376,22 @@ middlewares:
   addPrefix: []
   # - name: addPrefixName
   #   prefix: "/foo"
+  geoBlockVersion: v0.2.3
+  geoBlock: []
+  # -- https://github.com/PascalMinder/geoblock
+  # - name: geoBlockName
+  #   allowLocalRequests: true
+  #   logLocalRequests: false
+  #   logAllowedRequests: false
+  #   logApiRequests: false
+  #   api: https://get.geojs.io/v1/ip/country/{ip}
+  #   apiTimeoutMs: 500
+  #   cacheSize: 25
+  #   forceMonthlyUpdate: true
+  #   allowUnknownCountries: false
+  #   unknownCountryApiResponse: nil
+  #   countries:
+  #     - RU
 
 portalhook:
   enabled: true

templates/questions/traefik/geoBlockMiddleware.yaml

@@ -0,0 +1,99 @@
+        - variable: geoBlock
+          label: GeoBlock
+          schema:
+            type: list
+            default: []
+            items:
+              - variable: geoBlockEntry
+                label: ""
+                schema:
+                  additional_attrs: true
+                  type: dict
+                  attrs:
+                    - variable: name
+                      label: Name
+                      description: This is a 3rd party plugin and not maintained by TrueCharts,
+                        for more information go to <a href="https://github.com/PascalMinder/geoblock">geoblock</a>
+                      schema:
+                        type: string
+                        required: true
+                        default: ""
+                    - variable: allowLocalRequests
+                      label: Allow Local Requests
+                      description: If set to true, will not block request from Private IP Ranges
+                      schema:
+                        type: boolean
+                        default: true
+                    - variable: logLocalRequests
+                      label: Log Local Requests
+                      description: If set to true, will log every connection from any IP in the private IP range
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: logAllowedRequests
+                      label: Log Allowed Requests
+                      description: If set to true, will show a log message with the IP and the country of origin if a request is allowed.
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: logApiRequests
+                      label: Log API Requests
+                      description: If set to true, will show a log message for every API hit.
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: api
+                      label: API
+                      description: Defines the API URL for the IP to Country resolution. The IP to fetch can be added with {ip} to the URL.
+                      schema:
+                        type: string
+                        required: true
+                        default: https://get.geojs.io/v1/ip/country/{ip}
+                    - variable: apiTimeoutMs
+                      label: API Timeout in ms
+                      description: Timeout for the call to the api uri.
+                      schema:
+                        type: int
+                        required: true
+                        default: 500
+                    - variable: cacheSize
+                      label: Cache Size
+                      description: Defines the max size of the LRU (least recently used) cache.
+                      schema:
+                        type: int
+                        required: true
+                        default: 25
+                    - variable: forceMonthlyUpdate
+                      label: Force Monthly Update
+                      description: Even if an IP stays in the cache for a period of a month (about 30 x 24 hours), it must be fetch again after a month.
+                      schema:
+                        type: boolean
+                        default: true
+                    - variable: allowUnknownCountries
+                      label: Allow Unknown Countries
+                      description: Some IP addresses have no country associated with them. If this option is set to true, all IPs with no associated country are also allowed.
+                      schema:
+                        type: boolean
+                        default: false
+                    - variable: unknownCountryApiResponse
+                      label: Unknown Countries API Response
+                      description: The API uri can be customized. This options allows to customize the response string of the API when a IP with no associated country is requested.
+                      schema:
+                        type: string
+                        required: true
+                        default: nil
+                    - variable: countries
+                      label: Blocked Countries
+                      schema:
+                        type: list
+                        default: []
+                        items:
+                          - variable: blockedCountryEntry
+                            label: Blocked Country
+                            description: Country codes (2 characters) from which connections to the service should be allowed.
+                            schema:
+                              type: string
+                              required: true
+                              # Allow only 2 Characters
+                              valid_chars: '^[a-zA-Z]{2}$'
+                              default: ""