From d0f978aeb05c571e897891cebfcfe6a35caf060b Mon Sep 17 00:00:00 2001
From: albert <albert@sysctl.io>
Date: Mon, 30 Sep 2024 05:01:20 +0200
Subject: [PATCH] Update firewalls

---
 nixos/hosts/frankfurt-linode-01/firewall.nix | 264 +-----------------
 nixos/hosts/osaka-linode-01/firewall.nix     | 266 +++++++++++++++++++
 2 files changed, 267 insertions(+), 263 deletions(-)

diff --git a/nixos/hosts/frankfurt-linode-01/firewall.nix b/nixos/hosts/frankfurt-linode-01/firewall.nix
index 49ae35a1..e204081c 100644
--- a/nixos/hosts/frankfurt-linode-01/firewall.nix
+++ b/nixos/hosts/frankfurt-linode-01/firewall.nix
@@ -52,266 +52,7 @@
 
   environment.systemPackages = [ pkgs.cacert ];
   
-  environment.etc."haproxy-blocked-ips" = ''
-    # https://openai.com/searchbot.json
-    20.42.10.176/28
-    172.203.190.128/28
-    51.8.102.0/24
-
-    # https://openai.com/chatgpt-user.json
-    23.98.142.176/28 
-    40.84.180.224/28 
-    13.65.240.240/28 
-    20.97.189.96/28 
-    20.161.75.208/28 
-    52.225.75.208/28 
-    52.156.77.144/28 
-    40.84.221.208/28 
-    40.84.221.224/28 
-    40.84.180.64/28 
-    23.98.179.16/28 
-
-    # https://openai.com/gptbot.json
-    52.230.152.0/24 
-    52.233.106.0/24 
-    20.171.206.0/24 
-
-    # https://developers.google.com/search/apis/ipranges/googlebot.json
-    2001:4860:4801:10::/64
-    2001:4860:4801:11::/64
-    2001:4860:4801:12::/64
-    2001:4860:4801:13::/64
-    2001:4860:4801:14::/64
-    2001:4860:4801:15::/64
-    2001:4860:4801:16::/64
-    2001:4860:4801:17::/64
-    2001:4860:4801:18::/64
-    2001:4860:4801:19::/64
-    2001:4860:4801:1a::/64
-    2001:4860:4801:1b::/64
-    2001:4860:4801:1c::/64
-    2001:4860:4801:1d::/64
-    2001:4860:4801:1e::/64
-    2001:4860:4801:1f::/64
-    2001:4860:4801:20::/64
-    2001:4860:4801:21::/64
-    2001:4860:4801:22::/64
-    2001:4860:4801:23::/64
-    2001:4860:4801:24::/64
-    2001:4860:4801:25::/64
-    2001:4860:4801:26::/64
-    2001:4860:4801:27::/64
-    2001:4860:4801:28::/64
-    2001:4860:4801:29::/64
-    2001:4860:4801:2::/64
-    2001:4860:4801:2a::/64
-    2001:4860:4801:2b::/64
-    2001:4860:4801:2c::/64
-    2001:4860:4801:2d::/64
-    2001:4860:4801:2e::/64
-    2001:4860:4801:2f::/64
-    2001:4860:4801:31::/64
-    2001:4860:4801:32::/64
-    2001:4860:4801:33::/64
-    2001:4860:4801:34::/64
-    2001:4860:4801:35::/64
-    2001:4860:4801:36::/64
-    2001:4860:4801:37::/64
-    2001:4860:4801:38::/64
-    2001:4860:4801:39::/64
-    2001:4860:4801:3a::/64
-    2001:4860:4801:3b::/64
-    2001:4860:4801:3c::/64
-    2001:4860:4801:3d::/64
-    2001:4860:4801:3e::/64
-    2001:4860:4801:40::/64
-    2001:4860:4801:41::/64
-    2001:4860:4801:42::/64
-    2001:4860:4801:43::/64
-    2001:4860:4801:44::/64
-    2001:4860:4801:45::/64
-    2001:4860:4801:46::/64
-    2001:4860:4801:47::/64
-    2001:4860:4801:48::/64
-    2001:4860:4801:49::/64
-    2001:4860:4801:4a::/64
-    2001:4860:4801:50::/64
-    2001:4860:4801:51::/64
-    2001:4860:4801:53::/64
-    2001:4860:4801:54::/64
-    2001:4860:4801:55::/64
-    2001:4860:4801:60::/64
-    2001:4860:4801:61::/64
-    2001:4860:4801:62::/64
-    2001:4860:4801:63::/64
-    2001:4860:4801:64::/64
-    2001:4860:4801:65::/64
-    2001:4860:4801:66::/64
-    2001:4860:4801:67::/64
-    2001:4860:4801:68::/64
-    2001:4860:4801:69::/64
-    2001:4860:4801:6a::/64
-    2001:4860:4801:6b::/64
-    2001:4860:4801:6c::/64
-    2001:4860:4801:6d::/64
-    2001:4860:4801:6e::/64
-    2001:4860:4801:6f::/64
-    2001:4860:4801:70::/64
-    2001:4860:4801:71::/64
-    2001:4860:4801:72::/64
-    2001:4860:4801:73::/64
-    2001:4860:4801:74::/64
-    2001:4860:4801:75::/64
-    2001:4860:4801:76::/64
-    2001:4860:4801:77::/64
-    2001:4860:4801:78::/64
-    2001:4860:4801:79::/64
-    2001:4860:4801:80::/64
-    2001:4860:4801:81::/64
-    2001:4860:4801:82::/64
-    2001:4860:4801:83::/64
-    2001:4860:4801:84::/64
-    2001:4860:4801:85::/64
-    2001:4860:4801:86::/64
-    2001:4860:4801:87::/64
-    2001:4860:4801:88::/64
-    2001:4860:4801:90::/64
-    2001:4860:4801:91::/64
-    2001:4860:4801:92::/64
-    2001:4860:4801:93::/64
-    2001:4860:4801:c::/64
-    2001:4860:4801:f::/64
-    192.178.5.0/27
-    192.178.6.0/27
-    34.100.182.96/28
-    34.101.50.144/28
-    34.118.254.0/28
-    34.118.66.0/28
-    34.126.178.96/28
-    34.146.150.144/28
-    34.147.110.144/28
-    34.151.74.144/28
-    34.152.50.64/28
-    34.154.114.144/28
-    34.155.98.32/28
-    34.165.18.176/28
-    34.175.160.64/28
-    34.176.130.16/28
-    34.22.85.0/27
-    34.64.82.64/28
-    34.65.242.112/28
-    34.80.50.80/28
-    34.88.194.0/28
-    34.89.10.80/28
-    34.89.198.80/28
-    34.96.162.48/28
-    35.247.243.240/28
-    66.249.64.0/27
-    66.249.64.128/27
-    66.249.64.160/27
-    66.249.64.224/27
-    66.249.64.32/27
-    66.249.64.64/27
-    66.249.64.96/27
-    66.249.65.0/27
-    66.249.65.160/27
-    66.249.65.192/27
-    66.249.65.224/27
-    66.249.65.32/27
-    66.249.65.64/27
-    66.249.65.96/27
-    66.249.66.0/27
-    66.249.66.160/27
-    66.249.66.192/27
-    66.249.66.32/27
-    66.249.66.64/27
-    66.249.66.96/27
-    66.249.68.0/27
-    66.249.68.32/27
-    66.249.68.64/27
-    66.249.69.0/27
-    66.249.69.128/27
-    66.249.69.160/27
-    66.249.69.192/27
-    66.249.69.224/27
-    66.249.69.32/27
-    66.249.69.64/27
-    66.249.69.96/27
-    66.249.70.0/27
-    66.249.70.128/27
-    66.249.70.160/27
-    66.249.70.192/27
-    66.249.70.224/27
-    66.249.70.32/27
-    66.249.70.64/27
-    66.249.70.96/27
-    66.249.71.0/27
-    66.249.71.128/27
-    66.249.71.160/27
-    66.249.71.192/27
-    66.249.71.224/27
-    66.249.71.32/27
-    66.249.71.64/27
-    66.249.71.96/27
-    66.249.72.0/27
-    66.249.72.128/27
-    66.249.72.160/27
-    66.249.72.192/27
-    66.249.72.224/27
-    66.249.72.32/27
-    66.249.72.64/27
-    66.249.72.96/27
-    66.249.73.0/27
-    66.249.73.128/27
-    66.249.73.160/27
-    66.249.73.192/27
-    66.249.73.224/27
-    66.249.73.32/27
-    66.249.73.64/27
-    66.249.73.96/27
-    66.249.74.0/27
-    66.249.74.128/27
-    66.249.74.32/27
-    66.249.74.64/27
-    66.249.74.96/27
-    66.249.75.0/27
-    66.249.75.128/27
-    66.249.75.160/27
-    66.249.75.192/27
-    66.249.75.224/27
-    66.249.75.32/27
-    66.249.75.64/27
-    66.249.75.96/27
-    66.249.76.0/27
-    66.249.76.128/27
-    66.249.76.160/27
-    66.249.76.192/27
-    66.249.76.224/27
-    66.249.76.32/27
-    66.249.76.64/27
-    66.249.76.96/27
-    66.249.77.0/27
-    66.249.77.128/27
-    66.249.77.160/27
-    66.249.77.192/27
-    66.249.77.224/27
-    66.249.77.32/27
-    66.249.77.64/27
-    66.249.77.96/27
-    66.249.78.0/27
-    66.249.78.32/27
-    66.249.79.0/27
-    66.249.79.128/27
-    66.249.79.160/27
-    66.249.79.192/27
-    66.249.79.224/27
-    66.249.79.32/27
-    66.249.79.64/27
-    66.249.79.96/27
-
-  '';
-
-  services.haproxy = {
+   services.haproxy = {
     enable = true;
     config = ''
       defaults
@@ -326,9 +67,6 @@
         bind :80
         bind :443 ssl crt /Storage/Data/Docker/sysctl.io/letsencrypt/external/*.sysctl.io/combined.pem
 
-        acl is-blocked-ip src -f /etc/haproxy-blocked-ips
-        http-request deny if is-blocked-ip
-
         http-request redirect scheme https unless { ssl_fc }
         default_backend backend_http
       backend backend_http
diff --git a/nixos/hosts/osaka-linode-01/firewall.nix b/nixos/hosts/osaka-linode-01/firewall.nix
index 569e4147..6c5f79ce 100644
--- a/nixos/hosts/osaka-linode-01/firewall.nix
+++ b/nixos/hosts/osaka-linode-01/firewall.nix
@@ -66,6 +66,10 @@
         mode http
         bind :80
         # bind :443 ssl crt /Storage/Data/Docker/sysctl.io/letsencrypt/external/*.sysctl.io/combined.pem
+        
+        acl is-blocked-ip src -f /etc/haproxy-blocked-ips
+        http-request deny if is-blocked-ip
+
         http-request redirect scheme https unless { ssl_fc }
         default_backend backend_http
       backend backend_http
@@ -80,6 +84,10 @@
         bind :25565 
         bind :4443  
         bind :443  
+        
+        acl is-blocked-ip src -f /etc/haproxy-blocked-ips
+        http-request deny if is-blocked-ip
+
         default_backend backend_tcp 
       backend backend_tcp
         mode tcp
@@ -107,4 +115,262 @@
         server vintage-story-wg 10.100.1.5
     '';
   };
+
+  environment.etc."haproxy-blocked-ips" = ''
+    # https://openai.com/searchbot.json
+    20.42.10.176/28
+    172.203.190.128/28
+    51.8.102.0/24
+
+    # https://openai.com/chatgpt-user.json
+    23.98.142.176/28 
+    40.84.180.224/28 
+    13.65.240.240/28 
+    20.97.189.96/28 
+    20.161.75.208/28 
+    52.225.75.208/28 
+    52.156.77.144/28 
+    40.84.221.208/28 
+    40.84.221.224/28 
+    40.84.180.64/28 
+    23.98.179.16/28 
+
+    # https://openai.com/gptbot.json
+    52.230.152.0/24 
+    52.233.106.0/24 
+    20.171.206.0/24 
+
+    # https://developers.google.com/search/apis/ipranges/googlebot.json
+    2001:4860:4801:10::/64
+    2001:4860:4801:11::/64
+    2001:4860:4801:12::/64
+    2001:4860:4801:13::/64
+    2001:4860:4801:14::/64
+    2001:4860:4801:15::/64
+    2001:4860:4801:16::/64
+    2001:4860:4801:17::/64
+    2001:4860:4801:18::/64
+    2001:4860:4801:19::/64
+    2001:4860:4801:1a::/64
+    2001:4860:4801:1b::/64
+    2001:4860:4801:1c::/64
+    2001:4860:4801:1d::/64
+    2001:4860:4801:1e::/64
+    2001:4860:4801:1f::/64
+    2001:4860:4801:20::/64
+    2001:4860:4801:21::/64
+    2001:4860:4801:22::/64
+    2001:4860:4801:23::/64
+    2001:4860:4801:24::/64
+    2001:4860:4801:25::/64
+    2001:4860:4801:26::/64
+    2001:4860:4801:27::/64
+    2001:4860:4801:28::/64
+    2001:4860:4801:29::/64
+    2001:4860:4801:2::/64
+    2001:4860:4801:2a::/64
+    2001:4860:4801:2b::/64
+    2001:4860:4801:2c::/64
+    2001:4860:4801:2d::/64
+    2001:4860:4801:2e::/64
+    2001:4860:4801:2f::/64
+    2001:4860:4801:31::/64
+    2001:4860:4801:32::/64
+    2001:4860:4801:33::/64
+    2001:4860:4801:34::/64
+    2001:4860:4801:35::/64
+    2001:4860:4801:36::/64
+    2001:4860:4801:37::/64
+    2001:4860:4801:38::/64
+    2001:4860:4801:39::/64
+    2001:4860:4801:3a::/64
+    2001:4860:4801:3b::/64
+    2001:4860:4801:3c::/64
+    2001:4860:4801:3d::/64
+    2001:4860:4801:3e::/64
+    2001:4860:4801:40::/64
+    2001:4860:4801:41::/64
+    2001:4860:4801:42::/64
+    2001:4860:4801:43::/64
+    2001:4860:4801:44::/64
+    2001:4860:4801:45::/64
+    2001:4860:4801:46::/64
+    2001:4860:4801:47::/64
+    2001:4860:4801:48::/64
+    2001:4860:4801:49::/64
+    2001:4860:4801:4a::/64
+    2001:4860:4801:50::/64
+    2001:4860:4801:51::/64
+    2001:4860:4801:53::/64
+    2001:4860:4801:54::/64
+    2001:4860:4801:55::/64
+    2001:4860:4801:60::/64
+    2001:4860:4801:61::/64
+    2001:4860:4801:62::/64
+    2001:4860:4801:63::/64
+    2001:4860:4801:64::/64
+    2001:4860:4801:65::/64
+    2001:4860:4801:66::/64
+    2001:4860:4801:67::/64
+    2001:4860:4801:68::/64
+    2001:4860:4801:69::/64
+    2001:4860:4801:6a::/64
+    2001:4860:4801:6b::/64
+    2001:4860:4801:6c::/64
+    2001:4860:4801:6d::/64
+    2001:4860:4801:6e::/64
+    2001:4860:4801:6f::/64
+    2001:4860:4801:70::/64
+    2001:4860:4801:71::/64
+    2001:4860:4801:72::/64
+    2001:4860:4801:73::/64
+    2001:4860:4801:74::/64
+    2001:4860:4801:75::/64
+    2001:4860:4801:76::/64
+    2001:4860:4801:77::/64
+    2001:4860:4801:78::/64
+    2001:4860:4801:79::/64
+    2001:4860:4801:80::/64
+    2001:4860:4801:81::/64
+    2001:4860:4801:82::/64
+    2001:4860:4801:83::/64
+    2001:4860:4801:84::/64
+    2001:4860:4801:85::/64
+    2001:4860:4801:86::/64
+    2001:4860:4801:87::/64
+    2001:4860:4801:88::/64
+    2001:4860:4801:90::/64
+    2001:4860:4801:91::/64
+    2001:4860:4801:92::/64
+    2001:4860:4801:93::/64
+    2001:4860:4801:c::/64
+    2001:4860:4801:f::/64
+    192.178.5.0/27
+    192.178.6.0/27
+    34.100.182.96/28
+    34.101.50.144/28
+    34.118.254.0/28
+    34.118.66.0/28
+    34.126.178.96/28
+    34.146.150.144/28
+    34.147.110.144/28
+    34.151.74.144/28
+    34.152.50.64/28
+    34.154.114.144/28
+    34.155.98.32/28
+    34.165.18.176/28
+    34.175.160.64/28
+    34.176.130.16/28
+    34.22.85.0/27
+    34.64.82.64/28
+    34.65.242.112/28
+    34.80.50.80/28
+    34.88.194.0/28
+    34.89.10.80/28
+    34.89.198.80/28
+    34.96.162.48/28
+    35.247.243.240/28
+    66.249.64.0/27
+    66.249.64.128/27
+    66.249.64.160/27
+    66.249.64.224/27
+    66.249.64.32/27
+    66.249.64.64/27
+    66.249.64.96/27
+    66.249.65.0/27
+    66.249.65.160/27
+    66.249.65.192/27
+    66.249.65.224/27
+    66.249.65.32/27
+    66.249.65.64/27
+    66.249.65.96/27
+    66.249.66.0/27
+    66.249.66.160/27
+    66.249.66.192/27
+    66.249.66.32/27
+    66.249.66.64/27
+    66.249.66.96/27
+    66.249.68.0/27
+    66.249.68.32/27
+    66.249.68.64/27
+    66.249.69.0/27
+    66.249.69.128/27
+    66.249.69.160/27
+    66.249.69.192/27
+    66.249.69.224/27
+    66.249.69.32/27
+    66.249.69.64/27
+    66.249.69.96/27
+    66.249.70.0/27
+    66.249.70.128/27
+    66.249.70.160/27
+    66.249.70.192/27
+    66.249.70.224/27
+    66.249.70.32/27
+    66.249.70.64/27
+    66.249.70.96/27
+    66.249.71.0/27
+    66.249.71.128/27
+    66.249.71.160/27
+    66.249.71.192/27
+    66.249.71.224/27
+    66.249.71.32/27
+    66.249.71.64/27
+    66.249.71.96/27
+    66.249.72.0/27
+    66.249.72.128/27
+    66.249.72.160/27
+    66.249.72.192/27
+    66.249.72.224/27
+    66.249.72.32/27
+    66.249.72.64/27
+    66.249.72.96/27
+    66.249.73.0/27
+    66.249.73.128/27
+    66.249.73.160/27
+    66.249.73.192/27
+    66.249.73.224/27
+    66.249.73.32/27
+    66.249.73.64/27
+    66.249.73.96/27
+    66.249.74.0/27
+    66.249.74.128/27
+    66.249.74.32/27
+    66.249.74.64/27
+    66.249.74.96/27
+    66.249.75.0/27
+    66.249.75.128/27
+    66.249.75.160/27
+    66.249.75.192/27
+    66.249.75.224/27
+    66.249.75.32/27
+    66.249.75.64/27
+    66.249.75.96/27
+    66.249.76.0/27
+    66.249.76.128/27
+    66.249.76.160/27
+    66.249.76.192/27
+    66.249.76.224/27
+    66.249.76.32/27
+    66.249.76.64/27
+    66.249.76.96/27
+    66.249.77.0/27
+    66.249.77.128/27
+    66.249.77.160/27
+    66.249.77.192/27
+    66.249.77.224/27
+    66.249.77.32/27
+    66.249.77.64/27
+    66.249.77.96/27
+    66.249.78.0/27
+    66.249.78.32/27
+    66.249.79.0/27
+    66.249.79.128/27
+    66.249.79.160/27
+    66.249.79.192/27
+    66.249.79.224/27
+    66.249.79.32/27
+    66.249.79.64/27
+    66.249.79.96/27
+  '';
 }