DBC22-5324: Logic to block IP's using Env variable

Author: wmuldergov

compose/frontend/StaticBuild

@@ -34,6 +34,7 @@ COPY ./compose/frontend/default.conf /etc/nginx/conf.d
 COPY ./compose/frontend/default_maintenance.txt /etc/nginx
 COPY ./compose/frontend/legacy_redirects.conf /etc/nginx
 COPY ./compose/frontend/security_headers.conf /etc/nginx/conf.d
+COPY ./compose/frontend/blocked_ips.conf /etc/nginx/conf.d
 COPY --from=buildnode /app/build /usr/share/nginx/html
 RUN chmod -R 777 /run /var/log/nginx /var/cache/nginx /usr/share/nginx/html/static/js /usr/share/nginx/html/static/css /usr/share/nginx/html/static/media /etc/nginx/conf.d
 

compose/frontend/blocked_ips.conf

@@ -56,6 +56,10 @@ error_log /var/log/nginx/error.log;
 
 open_log_file_cache max=1000 inactive=20s valid=1m min_uses=2;
 
+# Trust OpenShift Router IP range
+set_real_ip_from 10.0.0.0/8; 
+real_ip_header X-Forwarded-For;
+
 # --- CONSOLIDATED REDIRECTS BLOCK ---
 server {
     listen 3000;
@@ -82,6 +86,7 @@ server {
     root         /usr/share/nginx/html;
     access_log /logs/$hostname-$formatted_date-access.log drivebc;
     server_tokens off;
+    include /etc/nginx/conf.d/blocked_ips.conf;
     include /etc/nginx/conf.d/security_headers.conf;
 
     location ~* \.(?:css|js|woff|woff2|ttf|eot|svg|png|jpe?g|gif|ico)$ {

compose/frontend/default.conf

@@ -48,6 +48,20 @@ else
     echo "Environment is not 'prod', keeping X-Robots-Tag noindex header."
 fi
 
+# Create blocked IPs configuration file
+BLOCKED_CONF="/etc/nginx/conf.d/blocked_ips.conf"
+> "$BLOCKED_CONF"
+if [ -n "$BLOCKED_IPS" ]; then
+    echo "Processing blocked IPs..."
+    for ip in $(echo "$BLOCKED_IPS" | tr ';' ' '); do
+        CLEAN_IP=$(echo "$ip" | tr -d ' ')
+        if [ -n "$CLEAN_IP" ]; then
+            echo "deny $CLEAN_IP;" >> "$BLOCKED_CONF"
+        fi
+    done
+    echo "Blocked IPs configuration updated."
+fi
+
 #precompress the main js and css files to improve performance
 gzip -k $MAIN
 gzip -k $MAINCSS