feat(haproxy): allowlist rds-allowed для RDS из ipdeny RU (0.7.5).

2026-06-13 19:06:54 +10:00
parent fc448fd589
commit 779bf0d921
9 changed files with 332 additions and 6 deletions
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Shared helpers: ipdeny ru.zone -> HAProxy src -f allowlist (bash, no pip).
+# Логика из Answer.and.other.shit/scripts/mikrotik-ru-ipdeny/mikrotik_ru_ipdeny_lib.sh
+set -Eeuo pipefail
+
+DEFAULT_ZONE_URL="${IPDENY_ZONE_URL:-https://www.ipdeny.com/ipblocks/data/countries/ru.zone}"
+DEFAULT_MIN_LINES="${HAPROXY_MIN_ENTRIES:-8000}"
+
+die() {
+    echo "error: $*" >&2
+    exit 1
+}
+
+fetch_zone() {
+    local url=$1
+    local dest=$2
+    curl -fsSL --max-time 120 -A "haproxy-ru-ipdeny/1.0" "$url" -o "$dest"
+}
+
+count_subnets_in_zone() {
+    local zone_file=$1
+    local count=0
+    local line
+    while IFS= read -r line || [[ -n $line ]]; do
+        line="${line//$'\r'/}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z $line || $line == \#* ]] && continue
+        [[ $line != */* ]] && continue
+        count=$((count + 1))
+    done <"$zone_file"
+    printf '%s' "$count"
+}
+
+write_zone_allowlist() {
+    local zone_file=$1
+    local output_path=$2
+
+    {
+        while IFS= read -r line || [[ -n $line ]]; do
+            line="${line//$'\r'/}"
+            line="${line#"${line%%[![:space:]]*}"}"
+            line="${line%"${line##*[![:space:]]}"}"
+            [[ -z $line || $line == \#* ]] && continue
+            [[ $line != */* ]] && continue
+            printf '%s\n' "$line"
+        done <"$zone_file"
+    } >"$output_path"
+}
+
+append_static_allowlist() {
+    local static_file=$1
+    local output_path=$2
+
+    [[ -f $static_file ]] || return 0
+    while IFS= read -r line || [[ -n $line ]]; do
+        line="${line//$'\r'/}"
+        line="${line#"${line%%[![:space:]]*}"}"
+        line="${line%"${line##*[![:space:]]}"}"
+        [[ -z $line || $line == \#* ]] && continue
+        printf '%s\n' "$line"
+    done <"$static_file" >>"$output_path"
+}
+
+generate_allowlist_bundle() {
+    local zone_url=${1:-$DEFAULT_ZONE_URL}
+    local output_path=${2:-}
+    local static_file=${3:-}
+    local min_lines=${4:-$DEFAULT_MIN_LINES}
+
+    [[ -n $output_path ]] || die "output path required"
+
+    local tmp_zone merged
+    tmp_zone=$(mktemp)
+    merged=$(mktemp)
+    trap "rm -f '${tmp_zone}' '${merged}'" RETURN
+
+    fetch_zone "$zone_url" "$tmp_zone"
+
+    local zone_entries
+    zone_entries=$(count_subnets_in_zone "$tmp_zone")
+    if [[ $zone_entries -lt $min_lines ]]; then
+        die "too few subnets: ${zone_entries} (expected at least ${min_lines})"
+    fi
+
+    write_zone_allowlist "$tmp_zone" "$merged"
+    append_static_allowlist "$static_file" "$merged"
+    sort -u "$merged" >"$output_path"
+
+    local total_entries bytes
+    total_entries=$(wc -l <"$output_path" | tr -d '[:space:]')
+    bytes=$(wc -c <"$output_path" | tr -d '[:space:]')
+
+    rm -f "$tmp_zone" "$merged"
+    trap - RETURN
+
+    GENERATED_ZONE_ENTRIES=$zone_entries
+    GENERATED_ENTRIES=$total_entries
+    GENERATED_BYTES=$bytes
+    GENERATED_OUTPUT=$output_path
+}