DESKTOP-L8OUL9F\gfl0034
94dd2d819c
Nginx auth_request plus MaxMind City lookup blocks non-Shanghai mainland CN with a fixed notice page for sparkmessenger/sparkmsg (and deploy helpers for the shared Singapore host). Co-authored-by: Cursor <cursoragent@cursor.com>
39 lines
1.4 KiB
Bash
39 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Install / update wyrs-geo-guard on the Singapore ECS (run on host or via SSH).
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")" && pwd)"
|
|
DST=/opt/wyrs-geo-guard
|
|
|
|
need_pkg() {
|
|
if ! rpm -q "$1" >/dev/null 2>&1; then
|
|
dnf install -y "$1"
|
|
fi
|
|
}
|
|
|
|
need_pkg python3-geoip2
|
|
# maxminddb usually pulled in; ensure present
|
|
need_pkg python3-maxminddb || true
|
|
|
|
if [[ ! -f /usr/share/GeoIP/GeoLite2-City.mmdb ]]; then
|
|
echo "missing /usr/share/GeoIP/GeoLite2-City.mmdb" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$DST" /etc/nginx/snippets /var/www/wyrs-geo-deny
|
|
install -m 0755 "$ROOT/wyrs_geo_guard.py" "$DST/wyrs_geo_guard.py"
|
|
install -m 0644 "$ROOT/wyrs-geo-guard.service" /etc/systemd/system/wyrs-geo-guard.service
|
|
install -m 0644 "$ROOT/../nginx/snippets/wyrs-cn-geo-access.conf" /etc/nginx/snippets/wyrs-cn-geo-access.conf
|
|
install -m 0644 "$ROOT/../nginx/static/cn-mainland-denied.html" /var/www/wyrs-geo-deny/index.html
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now wyrs-geo-guard.service
|
|
systemctl restart wyrs-geo-guard.service
|
|
sleep 0.3
|
|
curl -fsS "http://127.0.0.1:18099/healthz" >/dev/null
|
|
echo "geo-guard ok"
|
|
# quick probes
|
|
curl -sS -o /dev/null -w "shanghai:%{http_code}\n" "http://127.0.0.1:18099/check?ip=114.80.80.80"
|
|
curl -sS -o /dev/null -w "hangzhou:%{http_code}\n" "http://127.0.0.1:18099/check?ip=223.5.5.5"
|
|
curl -sS -o /dev/null -w "us:%{http_code}\n" "http://127.0.0.1:18099/check?ip=8.8.8.8"
|