Alter ingress setup

9 files changed, 141 insertions, 56 deletions

diff --git a/data.d/k3s-master/manifests.d/personal-services/nextcloud/ingress.yaml b/data.d/k3s-master/manifests.d/personal-services/nextcloud/ingress.yaml
index c4c397a..ca5ae1a 100644
--- a/data.d/k3s-master/manifests.d/personal-services/nextcloud/ingress.yaml
+++ b/data.d/k3s-master/manifests.d/personal-services/nextcloud/ingress.yaml
@@ -13,7 +13,7 @@ metadata:
     cert-manager.io/cluster-issuer: "letsencrypt"
     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
 spec:
-  ingressClassName: nginx
+  ingressClassName: haproxy
   tls:
   - hosts:
     - cloud.tyil.nl
diff --git a/data.d/k3s-master/manifests.d/personal-services/prosody/ingress.yaml b/data.d/k3s-master/manifests.d/personal-services/prosody/ingress.yaml
index dfb78cd..c030d73 100644
--- a/data.d/k3s-master/manifests.d/personal-services/prosody/ingress.yaml
+++ b/data.d/k3s-master/manifests.d/personal-services/prosody/ingress.yaml
@@ -12,7 +12,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt"
 spec:
-  ingressClassName: nginx
+  ingressClassName: nginx-proxy
   tls:
   - hosts:
     - chat.tyil.nl
diff --git a/data.d/k3s-master/manifests.d/servarr/jellyfin/ingress.yaml b/data.d/k3s-master/manifests.d/servarr/jellyfin/ingress.yaml
index f4997d4..e00272f 100644
--- a/data.d/k3s-master/manifests.d/servarr/jellyfin/ingress.yaml
+++ b/data.d/k3s-master/manifests.d/servarr/jellyfin/ingress.yaml
@@ -12,7 +12,7 @@ metadata:
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt"
 spec:
-  ingressClassName: nginx
+  ingressClassName: nginx-proxy
   tls:
   - hosts:
     - tv.tyil.nl
diff --git a/data.d/k3s-master/manifests.d/websites/proxy-kodi/ingress.yaml b/data.d/k3s-master/manifests.d/websites/proxy-kodi/ingress.yaml
index 7b18b39..3ae3937 100644
--- a/data.d/k3s-master/manifests.d/websites/proxy-kodi/ingress.yaml
+++ b/data.d/k3s-master/manifests.d/websites/proxy-kodi/ingress.yaml
@@ -17,7 +17,7 @@ metadata:
     app.kubernetes.io/name: proxy-kodi
     app.kubernetes.io/part-of: websites
 spec:
-  ingressClassName: nginx
+  ingressClassName: nginx-proxy
   tls:
   - hosts:
     - kodi.tyil.nl
diff --git a/data.d/k3s-master/src-tf/cert-manager.tf b/data.d/k3s-master/src-tf/cert-manager.tf
index e709a3f..b0f3b89 100644
--- a/data.d/k3s-master/src-tf/cert-manager.tf
+++ b/data.d/k3s-master/src-tf/cert-manager.tf
@@ -14,7 +14,8 @@ resource "helm_release" "cert_manager" {
 
   depends_on = [
     helm_release.ingress_haproxy,
-    helm_release.ingress_nginx,
+    helm_release.ingress_nginx_direct,
+    helm_release.ingress_nginx_proxy,
   ]
 }
 
diff --git a/data.d/k3s-master/src-tf/ingress-haproxy.tf b/data.d/k3s-master/src-tf/ingress-haproxy.tf
index cd29329..c9d81a3 100644
--- a/data.d/k3s-master/src-tf/ingress-haproxy.tf
+++ b/data.d/k3s-master/src-tf/ingress-haproxy.tf
@@ -21,11 +21,16 @@ resource "helm_release" "ingress_haproxy" {
           ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256
 
         frontend-config-snippet: |
+          # Track request rates
+          stick-table  type ipv6  size 100k  expire 30s  store http_req_rate(10s)
+          http-request track-sc0 src
+
           # Block known bad actors
           acl ai_spam req.fhdr(User-Agent) -m sub -i ahrefsbot
           acl ai_spam req.fhdr(User-Agent) -m sub -i amazonbot
           acl ai_spam req.fhdr(User-Agent) -m sub -i applebot-extended
           acl ai_spam req.fhdr(User-Agent) -m sub -i barkrowler
+          acl ai_spam req.fhdr(User-Agent) -m sub -i fxios
           acl ai_spam req.fhdr(User-Agent) -m sub -i bytespider
           acl ai_spam req.fhdr(User-Agent) -m sub -i ccbot
           acl ai_spam req.fhdr(User-Agent) -m sub -i chatgpt-user
@@ -45,10 +50,12 @@ resource "helm_release" "ingress_haproxy" {
           acl ai_spam req.fhdr(User-Agent) -m sub -i omgili
           acl ai_spam req.fhdr(User-Agent) -m sub -i perplexitybot
           acl ai_spam req.fhdr(User-Agent) -m sub -i petalbot
+          acl ai_spam req.fhdr(User-Agent) -m sub -i presto
           acl ai_spam req.fhdr(User-Agent) -m sub -i semrushbot
           acl ai_spam req.fhdr(User-Agent) -m sub -i timpibot
 
           http-request deny if ai_spam
+          #http-request deny if { sc_http_req_rate(0) gt 20 }
         cookie-persistence: "tyilnet_k8s_haproxy_persistence"
         forwarded-for: "true"
         proxy-protocol: >
diff --git a/data.d/k3s-master/src-tf/ingress-nginx-direct.tf b/data.d/k3s-master/src-tf/ingress-nginx-direct.tf
new file mode 100644
index 0000000..beb1bcb
--- /dev/null
+++ b/data.d/k3s-master/src-tf/ingress-nginx-direct.tf
@@ -0,0 +1,64 @@
+resource "helm_release" "ingress_nginx_direct" {
+  name      = "ingress-nginx-direct"
+  namespace = kubernetes_namespace.all["base-system"].metadata[0].name
+
+  repository = "https://kubernetes.github.io/ingress-nginx"
+  chart      = "ingress-nginx"
+  version    = "4.7.1"
+
+  values = [
+    <<-YAML
+    controller:
+      kind: DaemonSet
+      nodeSelector:
+        node-role.kubernetes.io/master: "true"
+      allowSnippetAnnotations: true
+      watchIngressWithoutClass: false
+      ingressClassByName: false
+      ingressClassResource:
+        enabled: true
+        name: nginx-direct
+      config:
+        block-user-agents: >
+          ~*.*ahrefsbot.*,
+          ~*.*amazonbot.*,
+          ~*.*applebot-extended.*,
+          ~*.*barkrowler.*,
+          ~*.*fxios.*,
+          ~*.*bytespider.*,
+          ~*.*ccbot.*,
+          ~*.*chatgpt-user.*,
+          ~*.*claude-web.*,
+          ~*.*claudebot.*,
+          ~*.*diffbot.*,
+          ~*.*dotbot.*,
+          ~*.*facebookbot.*,
+          ~*.*facebookexternalhit.*,
+          ~*.*friendlycrawler.*,
+          ~*.*google-extended.*,
+          ~*.*gptbot.*,
+          ~*.*image2dataset.*,
+          ~*.*imagesiftbot.*,
+          ~*.*meta-externalagent.*,
+          ~*.*mozilla\/5\.0\ \(linux\;\ android\ 6\.0\.1\;\ nexus\ 5x\ build\/mmb29p\).*,
+          ~*.*omgili.*,
+          ~*.*perplexitybot.*,
+          ~*.*petalbot.*,
+          ~*.*presto.*,
+          ~*.*semrushbot.*,
+          ~*.*timpibot.*
+        use-forwarded-headers: true
+      service:
+        type: NodePort
+        ipFamilyPolicy: PreferDualStack
+        externalTrafficPolicy: Local
+        nodePorts:
+          http: 32081
+          https: 32082
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+    YAML
+  ]
+}
diff --git a/data.d/k3s-master/src-tf/ingress-nginx-proxy.tf b/data.d/k3s-master/src-tf/ingress-nginx-proxy.tf
new file mode 100644
index 0000000..89c24ad
--- /dev/null
+++ b/data.d/k3s-master/src-tf/ingress-nginx-proxy.tf
@@ -0,0 +1,64 @@
+resource "helm_release" "ingress_nginx_proxy" {
+  name      = "ingress-nginx-proxy"
+  namespace = kubernetes_namespace.all["base-system"].metadata[0].name
+
+  repository = "https://kubernetes.github.io/ingress-nginx"
+  chart      = "ingress-nginx"
+  version    = "4.7.1"
+
+  values = [
+    <<-YAML
+    controller:
+      kind: DaemonSet
+      allowSnippetAnnotations: true
+      watchIngressWithoutClass: false
+      ingressClassByName: false
+      ingressClassResource:
+        enabled: true
+        name: nginx-proxy
+      config:
+        block-user-agents: >
+          ~*.*ahrefsbot.*,
+          ~*.*amazonbot.*,
+          ~*.*applebot-extended.*,
+          ~*.*barkrowler.*,
+          ~*.*fxios.*,
+          ~*.*bytespider.*,
+          ~*.*ccbot.*,
+          ~*.*chatgpt-user.*,
+          ~*.*claude-web.*,
+          ~*.*claudebot.*,
+          ~*.*diffbot.*,
+          ~*.*dotbot.*,
+          ~*.*facebookbot.*,
+          ~*.*facebookexternalhit.*,
+          ~*.*friendlycrawler.*,
+          ~*.*google-extended.*,
+          ~*.*gptbot.*,
+          ~*.*image2dataset.*,
+          ~*.*imagesiftbot.*,
+          ~*.*meta-externalagent.*,
+          ~*.*mozilla\/5\.0\ \(linux\;\ android\ 6\.0\.1\;\ nexus\ 5x\ build\/mmb29p\).*,
+          ~*.*omgili.*,
+          ~*.*perplexitybot.*,
+          ~*.*petalbot.*,
+          ~*.*presto.*,
+          ~*.*semrushbot.*,
+          ~*.*timpibot.*
+        proxy-real-ip-cidr: 10.57.0.0/16,fd68:1057:1992:3381::/48,192.168.178.0/24
+        use-forwarded-headers: true
+        use-proxy-protocol: true
+      service:
+        type: NodePort
+        ipFamilyPolicy: PreferDualStack
+        externalTrafficPolicy: Local
+        nodePorts:
+          http: 32080
+          https: 32443
+      metrics:
+        enabled: true
+        serviceMonitor:
+          enabled: true
+    YAML
+  ]
+}
diff --git a/data.d/k3s-master/src-tf/ingress-nginx.tf b/data.d/k3s-master/src-tf/ingress-nginx.tf
deleted file mode 100644
index 7a0804f..0000000
--- a/data.d/k3s-master/src-tf/ingress-nginx.tf
+++ /dev/null
@@ -1,51 +0,0 @@
-resource "helm_release" "ingress_nginx" {
-  name      = "ingress-nginx"
-  namespace = kubernetes_namespace.all["base-system"].metadata[0].name
-
-  repository = "https://kubernetes.github.io/ingress-nginx"
-  chart      = "ingress-nginx"
-  version    = "4.7.1"
-
-  values = [
-    <<-YAML
-    controller:
-      kind: DaemonSet
-      config:
-        use-forwarded-headers: true
-      allowSnippetAnnotations: true
-      #config:
-      #  block-user-agents: >
-      #    ~*.*ahrefsbot.*
-      #    ~*.*amazonbot.*
-      #    ~*.*applebot-extended.*
-      #    ~*.*barkrowler.*
-      #    ~*.*bytespider.*
-      #    ~*.*ccbot.*
-      #    ~*.*chatgpt-user.*
-      #    ~*.*claude-web.*
-      #    ~*.*claudebot.*
-      #    ~*.*diffbot.*
-      #    ~*.*dotbot.*
-      #    ~*.*facebookbot.*
-      #    ~*.*facebookexternalhit.*
-      #    ~*.*friendlycrawler.*
-      #    ~*.*google-extended.*
-      #    ~*.*gptbot.*
-      #    ~*.*image2dataset.*
-      #    ~*.*imagesiftbot.*
-      #    ~*.*meta-externalagent.*
-      #    ~*.*mozilla\/5\.0\ \(linux\;\ android\ 6\.0\.1\;\ nexus\ 5x\ build\/mmb29p\).*
-      #    ~*.*omgili.*
-      #    ~*.*perplexitybot.*
-      #    ~*.*petalbot.*
-      #    ~*.*semrushbot.*
-      #    ~*.*timpibot.*
-      service:
-        type: NodePort
-        nodePorts:
-          http: 32080
-          https: 32443
-        ipFamilyPolicy: PreferDualStack
-    YAML
-  ]
-}