feat(haproxy): allowlist rds-allowed для RDS из ipdeny RU (0.7.5).

2026-06-13 19:06:54 +10:00
parent fc448fd589
commit 779bf0d921
9 changed files with 332 additions and 6 deletions
@@ -0,0 +1,178 @@
+#!/usr/bin/env bash
+# Deploy /etc/haproxy/rds-allowed from ipdeny.com ru.zone + rds-allowed-static.
+#
+# Адаптация scripts/mikrotik-ru-ipdeny/mikrotik-649-ru-ipdeny-deploy.sh (Answer.and.other.shit)
+# для HAProxy на haproxy.kalinamall.ru — вместо MikroTik: merge static, haproxy -c, reload.
+#
+# Установка:
+#   install -m 0755 haproxy-rds-allowed-deploy.sh haproxy_ru_ipdeny_lib.sh /usr/local/bin/
+#
+# Cron (ежедневно 01:00): scripts/haproxy-rds-allowed.cron -> /etc/cron.d/haproxy-rds-allowed
+#   0 1 * * * root /usr/local/bin/haproxy-rds-allowed-deploy.sh >> /var/log/haproxy-rds-allowed-deploy.log 2>&1
+#
+# Examples:
+#   ./haproxy-rds-allowed-deploy.sh
+#   ./haproxy-rds-allowed-deploy.sh --generate-only -o /tmp/rds-allowed
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=haproxy_ru_ipdeny_lib.sh
+source "$SCRIPT_DIR/haproxy_ru_ipdeny_lib.sh"
+
+ENV_FILE=${HAPROXY_ENV_FILE:-${SCRIPT_DIR}/env}
+ALLOWLIST=${HAPROXY_RDS_ALLOWED:-/etc/haproxy/rds-allowed}
+STATIC=${HAPROXY_RDS_STATIC:-/etc/haproxy/rds-allowed-static}
+HAPROXY_CFG=${HAPROXY_CFG:-/etc/haproxy/haproxy.cfg}
+LOCK_FILE=${HAPROXY_RDS_LOCK:-/run/lock/haproxy-rds-allowed-deploy.lock}
+LOG_TAG=haproxy-rds-allowed-deploy
+
+load_env_file() {
+    local file_path=$1
+    [[ -f $file_path ]] || return 0
+    set -a
+    # shellcheck source=/dev/null
+    source "$file_path"
+    set +a
+}
+
+log() {
+    logger -t "$LOG_TAG" "$*"
+    echo "$*"
+}
+
+usage() {
+    cat <<'EOF'
+Usage: haproxy-rds-allowed-deploy.sh [options]
+
+  --allowlist PATH       output allowlist (default: /etc/haproxy/rds-allowed)
+  --static PATH          static IP/CIDR file (default: /etc/haproxy/rds-allowed-static)
+  --haproxy-cfg PATH     haproxy config for -c (default: /etc/haproxy/haproxy.cfg)
+  --zone-url URL         ipdeny zone URL (default: ru.zone)
+  --min-entries N        minimum subnet count from zone (default: 8000)
+  --env-file PATH        optional env (HAPROXY_* overrides)
+  -o, --output PATH      keep generated list at this path
+  --generate-only        download/merge only; no install/reload
+  -h, --help
+EOF
+}
+
+install_allowlist() {
+    local new_list=$1
+    local line_count=${2:-0}
+
+    if [[ -f $ALLOWLIST ]]; then
+        cp -a "$ALLOWLIST" "${ALLOWLIST}.bak-$(date +%Y%m%d-%H%M%S)"
+    fi
+
+    install -m 0644 -o root -g root "$new_list" "$ALLOWLIST"
+
+    if ! haproxy -c -f "$HAPROXY_CFG" >/tmp/haproxy-rds-check.log 2>&1; then
+        log "ERROR: haproxy -c failed: $(tail -3 /tmp/haproxy-rds-check.log | tr '\n' ' ')"
+        local latest_bak
+        latest_bak=$(ls -t "${ALLOWLIST}.bak-"* 2>/dev/null | head -1 || true)
+        if [[ -n $latest_bak ]]; then
+            cp -a "$latest_bak" "$ALLOWLIST"
+        fi
+        die "haproxy config check failed; restored previous allowlist if backup exists"
+    fi
+
+    systemctl reload haproxy
+    log "done: allowlist=${ALLOWLIST} total=${line_count} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"
+}
+
+main() {
+    local zone_url=$DEFAULT_ZONE_URL
+    local min_entries=$DEFAULT_MIN_LINES
+    local output_path=
+    local generate_only=0
+    local temp_list=
+    local remove_temp_list=0
+
+    load_env_file "$ENV_FILE"
+
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --allowlist)
+                ALLOWLIST=$2
+                shift 2
+                ;;
+            --static)
+                STATIC=$2
+                shift 2
+                ;;
+            --haproxy-cfg)
+                HAPROXY_CFG=$2
+                shift 2
+                ;;
+            --zone-url)
+                zone_url=$2
+                shift 2
+                ;;
+            --min-entries)
+                min_entries=$2
+                shift 2
+                ;;
+            --env-file)
+                ENV_FILE=$2
+                load_env_file "$ENV_FILE"
+                shift 2
+                ;;
+            -o | --output)
+                output_path=$2
+                shift 2
+                ;;
+            --generate-only)
+                generate_only=1
+                shift
+                ;;
+            -h | --help)
+                usage
+                exit 0
+                ;;
+            *)
+                die "unknown option: $1"
+                ;;
+        esac
+    done
+
+    command -v curl >/dev/null 2>&1 || die "curl not found (apt install curl)"
+
+    exec 9>"$LOCK_FILE"
+    if ! flock -n 9; then
+        log "already running, exit"
+        exit 0
+    fi
+
+    if [[ -z $output_path ]]; then
+        if [[ $generate_only -eq 1 ]]; then
+            die "use -o/--output with --generate-only"
+        fi
+        temp_list=$(mktemp)
+        output_path=$temp_list
+        remove_temp_list=1
+        trap "rm -f '${temp_list}'" EXIT
+    fi
+
+    echo "downloading zone: ${zone_url}"
+    generate_allowlist_bundle "$zone_url" "$output_path" "$STATIC" "$min_entries"
+    echo "generated entries=${GENERATED_ENTRIES} zone_entries=${GENERATED_ZONE_ENTRIES} bytes=${GENERATED_BYTES}"
+
+    if [[ $generate_only -eq 1 ]]; then
+        echo "wrote ${output_path}"
+        if [[ $remove_temp_list -eq 1 ]]; then
+            rm -f "$temp_list"
+            trap - EXIT
+        fi
+        exit 0
+    fi
+
+    command -v haproxy >/dev/null 2>&1 || die "haproxy not found"
+    install_allowlist "$output_path" "$GENERATED_ENTRIES"
+
+    if [[ $remove_temp_list -eq 1 ]]; then
+        rm -f "$temp_list"
+        trap - EXIT
+    fi
+}
+
+main "$@"
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Build HAProxy rds-allowed from ipdeny ru.zone + static (generate only).
+# Аналог mikrotik-649-ru-ipdeny-generate.sh.
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+exec "$SCRIPT_DIR/haproxy-rds-allowed-deploy.sh" --generate-only "$@"
@@ -0,0 +1,4 @@
+# /etc/cron.d/haproxy-rds-allowed — обновление rds-allowed из ipdeny (RU) + static
+SHELL=/bin/bash
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+0 1 * * * root /usr/local/bin/haproxy-rds-allowed-deploy.sh >> /var/log/haproxy-rds-allowed-deploy.log 2>&1
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Shared helpers: ipdeny ru.zone -> HAProxy src -f allowlist (bash, no pip).
+# Логика из Answer.and.other.shit/scripts/mikrotik-ru-ipdeny/mikrotik_ru_ipdeny_lib.sh
+set -Eeuo pipefail
+
+DEFAULT_ZONE_URL="${IPDENY_ZONE_URL:-https://www.ipdeny.com/ipblocks/data/countries/ru.zone}"
+DEFAULT_MIN_LINES="${HAPROXY_MIN_ENTRIES:-8000}"
+
+die() {
+    echo "error: $*" >&2
+    exit 1
+}
+
+fetch_zone() {
+    local url=$1
+    local dest=$2
+    curl -fsSL --max-time 120 -A "haproxy-ru-ipdeny/1.0" "$url" -o "$dest"
+}
+
+count_subnets_in_zone() {
+    local zone_file=$1
+    local count=0
+    local line
+    while IFS= read -r line || [[ -n $line ]]; do
+        line="${line//$'\r'/}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z $line || $line == \#* ]] && continue
+        [[ $line != */* ]] && continue
+        count=$((count + 1))
+    done <"$zone_file"
+    printf '%s' "$count"
+}
+
+write_zone_allowlist() {
+    local zone_file=$1
+    local output_path=$2
+
+    {
+        while IFS= read -r line || [[ -n $line ]]; do
+            line="${line//$'\r'/}"
+            line="${line#"${line%%[![:space:]]*}"}"
+            line="${line%"${line##*[![:space:]]}"}"
+            [[ -z $line || $line == \#* ]] && continue
+            [[ $line != */* ]] && continue
+            printf '%s\n' "$line"
+        done <"$zone_file"
+    } >"$output_path"
+}
+
+append_static_allowlist() {
+    local static_file=$1
+    local output_path=$2
+
+    [[ -f $static_file ]] || return 0
+    while IFS= read -r line || [[ -n $line ]]; do
+        line="${line//$'\r'/}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z $line || $line == \#* ]] && continue
+        printf '%s\n' "$line"
+    done <"$static_file" >>"$output_path"
+}
+
+generate_allowlist_bundle() {
+    local zone_url=${1:-$DEFAULT_ZONE_URL}
+    local output_path=${2:-}
+    local static_file=${3:-}
+    local min_lines=${4:-$DEFAULT_MIN_LINES}
+
+    [[ -n $output_path ]] || die "output path required"
+
+    local tmp_zone merged
+    tmp_zone=$(mktemp)
+    merged=$(mktemp)
+    trap "rm -f '${tmp_zone}' '${merged}'" RETURN
+
+    fetch_zone "$zone_url" "$tmp_zone"
+
+    local zone_entries
+    zone_entries=$(count_subnets_in_zone "$tmp_zone")
+    if [[ $zone_entries -lt $min_lines ]]; then
+        die "too few subnets: ${zone_entries} (expected at least ${min_lines})"
+    fi
+
+    write_zone_allowlist "$tmp_zone" "$merged"
+    append_static_allowlist "$static_file" "$merged"
+    sort -u "$merged" >"$output_path"
+
+    local total_entries bytes
+    total_entries=$(wc -l <"$output_path" | tr -d '[:space:]')
+    bytes=$(wc -c <"$output_path" | tr -d '[:space:]')
+
+    rm -f "$tmp_zone" "$merged"
+    trap - RETURN
+
+    GENERATED_ZONE_ENTRIES=$zone_entries
+    GENERATED_ENTRIES=$total_entries
+    GENERATED_BYTES=$bytes
+    GENERATED_OUTPUT=$output_path
+}