Initial ansible onboard

ansible/roles/geoip/templates/etc/GeoIP.conf.j2

@@ -0,0 +1,5 @@
+# {{ ansible_managed }}
+
+AccountID {{ geoip_account_id }}
+LicenseKey {{ geoip_license_key }}
+EditionIDs {{ geoip_editions_ids | join(" ") }}

ansible/roles/geoip/templates/etc/hosts.allow.j2

@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+sshd: ALL: aclexec /usr/bin/sshfilter.sh %a
+ALL: LOCAL, 127.0.0.1

ansible/roles/geoip/templates/etc/hosts.deny.j2

@@ -0,0 +1,3 @@
+# {{ ansible_managed }}
+
+ALL: ALL

ansible/roles/geoip/templates/usr/bin/sshfilter.sh.j2

@@ -0,0 +1,43 @@
+#!/bin/bash
+# {{ ansible_managed }}
+
+if [ $# -ne 1 ]; then
+  echo "Usage: `basename $0` <ip>" 1>&2
+  exit 0 # return true in case of config issue
+fi
+
+NETWORKS="{{ ssh_allowed_networks | join(" ") }}"
+ALLOW_COUNTRIES="{{ ssh_allowed_zones | join(" ") }}"
+GEOIPTOOL=$(which geoiplookup)
+
+# Fetch the GitHub runner IP ranges
+GITHUB_RUNNER_IP_RANGES=$(curl -s https://api.github.com/meta | jq -r '.actions[]')
+
+# Priority: Check if the IP is a GitHub runner IP
+if grepcidr "$GITHUB_RUNNER_IP_RANGES" <(echo "$1") >/dev/null; then
+  logger "GitHub runner IP detected: $1"
+  exit 0
+fi
+
+# Proceed with regular checks if it's not a GitHub runner IP
+
+# All countries are allowed, only check CIDR
+if [ "$ALLOW_COUNTRIES" = "ALL" ]; then 
+  # Check if the IP is in allowed subnets
+  logger "All countries allowed"
+  grepcidr "$NETWORKS" <(echo "$1") >/dev/null && exit 0
+fi
+
+# Get the country of the IP using geoiplookup
+COUNTRY=`$GEOIPTOOL $1 | awk -F ": " '{ print $2 }' | awk -F "," '{ print $1 }' | head -n 1`
+
+# Check if the country is allowed
+[[ $ALLOW_COUNTRIES =~ $COUNTRY ]] && RESPONSE="ALLOW" || RESPONSE="DENY"
+
+if [ $RESPONSE = "ALLOW" ]; then
+  # Check if the IP is in allowed subnets
+  grepcidr "$NETWORKS" <(echo "$1") >/dev/null && exit 0
+fi
+
+logger "$RESPONSE sshd connection from $1 ($COUNTRY)"
+exit 1

ansible/roles/geoip/templates/usr/bin/update_geoip.sh.j2

@@ -0,0 +1,40 @@
+#!/bin/bash
+# {{ ansible_managed }}
+set -e -o pipefail 
+
+# Create temporary directory
+WORKFOLDER=$(mktemp -d)
+mkdir -p $WORKFOLDER
+mkdir -p $WORKFOLDER/ip2loc/
+
+# Download latest from db-ip.com
+cd $WORKFOLDER
+/usr/libexec/xtables-addons/xt_geoip_dl
+
+# Download maxmind legacy csv and process
+wget https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country-CSV&license_key={{ geoip_license_key }}&suffix=zip -O $WORKFOLDER/GeoLite2-Country-CSV.zip
+unzip -d $WORKFOLDER -j $WORKFOLDER/GeoLite2-Country-CSV.zip
+wget https://mailfud.org/geoip-legacy/GeoIP-legacy.csv.gz -O $WORKFOLDER/GeoIP-legacy.csv.gz
+gunzip $WORKFOLDER/GeoIP-legacy.csv.gz
+cat $WORKFOLDER/GeoIP-legacy.csv | tr -d '"' | cut -d, -f1,2,5 > $WORKFOLDER/GeoIP-legacy-processed.csv
+rm $WORKFOLDER/GeoIP-legacy.csv
+
+# Download latest from https://github.com/sapics/ip-location-db
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/geo-whois-asn-country/geo-whois-asn-country-ipv4.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/geo-whois-asn-country/geo-whois-asn-country-ipv6.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/iptoasn-country/iptoasn-country-ipv4.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/iptoasn-country/iptoasn-country-ipv6.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/dbip-country/dbip-country-ipv4.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/dbip-country/dbip-country-ipv6.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-country/geolite2-country-ipv4.csv
+wget -P $WORKFOLDER https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-country/geolite2-country-ipv6.csv
+
+# Combine all csv and remove duplicates
+cd $WORKFOLDER
+cat *.csv > geoip.csv
+sort -u geoip.csv -o {{ xt_geoip_home }}/dbip-country-lite.csv
+
+# Remove temp directory and update geoip xtables
+rm -r $WORKFOLDER
+/usr/libexec/xtables-addons/xt_geoip_build -D {{ xt_geoip_home }}/ -i {{ xt_geoip_home }}/xt_geoip_build
+rm {{ xt_geoip_home }}/dbip-country-lite.csv