diff options
Diffstat (limited to 'bundles/go-away/files/config')
17 files changed, 523 insertions, 0 deletions
diff --git a/bundles/go-away/files/config/config.yml b/bundles/go-away/files/config/config.yml new file mode 100644 index 0000000..df731a7 --- /dev/null +++ b/bundles/go-away/files/config/config.yml @@ -0,0 +1,90 @@ +bind: + # XXX: coordinate with traefik + address: "0.0.0.0:${node.metadata.get('go-away/port')}" + network: "tcp" + + # Enable PROXY mode on this listener, to allow passing origin info. Default false + proxy: true + + # Enable passthrough mode, which will allow traffic onto the backends while rules load. Default false + #passthrough: true + +# Bind the Go debug port +#bind-debug: ":6060" + +# Bind the Prometheus metrics onto /metrics path on this port +bind-metrics: "0.0.0.0:${node.metadata.get('go-away-metrics/port')}" + + +# Advanced backend configuration +# Backends setup via cmdline will be added here +backends: + "gzr.im": + url: "http://${node.metadata.get('container_gateway', '10.89.0.1')}:${node.metadata.get('www/gzr-im/port')}" + http2-enabled: true + "gnzler.de": + url: "http://${node.metadata.get('container_gateway', '10.89.0.1')}:${node.metadata.get('www/gzr-im/port')}" + http2-enabled: true + "gnzler.io": + url: "http://${node.metadata.get('container_gateway', '10.89.0.1')}:${node.metadata.get('www/gzr-im/port')}" + http2-enabled: true + "gonca.me": + url: "http://${node.metadata.get('container_gateway', '10.89.0.1')}:${node.metadata.get('www/gonca-me/port')}" + http2-enabled: true + + +# These links will be shown on the presented challenge or error pages +links: + #- name: Privacy + # url: "/privacy.html" + #- name: Contact + # url: "mailto:admin@example.com" + #- name: Donations + # url: "https://donations.example.com/abcd" + +# HTML Template to use for challenge or error pages +# External templates can be included by providing a disk path +# Bundled templates: +# anubis: An Anubis-like template with no configuration parameters +# forgejo: Looks like native Forgejo. Includes logos and resources from your instance. Supports Theme. +# +challenge-template: "anubis" + +# Allows overriding specific settings set on templates. Key-Values will be passed to templates as-is +challenge-template-overrides: + # Set template theme if supported + #Theme: "forgejo-auto" + +# List of strings you can replace to alter the presentation on challenge/error templates +# Can use other languages. +# Note raw HTML is allowed, be careful with it. +# Default strings exist in code, uncomment any to set it +strings: + #title_challenge: "Checking you are not a bot" + #title_error: "Oh no!" + #noscript_warning: "<p>Sadly, you may need to enable JavaScript to get past this challenge. This is required because AI companies have changed the social contract around how website hosting works.</p>" + #details_title: "Why am I seeing this?" + #details_text: > + # <p> + # You are seeing this because the administrator of this website has set up <a href="https://git.gammaspectra.live/git/go-away">go-away</a> + # to protect the server against the scourge of <a href="https://thelibre.news/foss-infrastructure-is-under-attack-by-ai-companies/">AI companies aggressively scraping websites</a>. + # </p> + # <p> + # Mass scraping can and does cause downtime for the websites, which makes their resources inaccessible for everyone. + # </p> + # <p> + # Please note that some challenges requires the use of modern JavaScript features and some plugins may disable these. + # Disable such plugins for this domain (for example, JShelter) if you encounter any issues. + # </p> + + #details_contact_admin_with_request_id: "If you have any issues contact the site administrator and provide the following Request Id" + + #button_refresh_page: "Refresh page" + + #status_loading_challenge: "Loading challenge" + #status_starting_challenge: "Starting challenge" + #status_loading: "Loading..." + #status_calculating: "Calculating..." + #status_challenge_success: "Challenge success!" + #status_challenge_done_took: "Done! Took" + #status_error: "Error:" diff --git a/bundles/go-away/files/config/policy.yml b/bundles/go-away/files/config/policy.yml new file mode 100644 index 0000000..a403c38 --- /dev/null +++ b/bundles/go-away/files/config/policy.yml @@ -0,0 +1,183 @@ +# Define networks to be used later below +networks: + # Networks will get included from snippets + + +challenges: + # Challenges will get included from snippets + +conditions: + # Conditions will get replaced on rules AST when found as ($condition-name) + + # Conditions will get included from snippets + + + is-static-asset: + - 'path == "/apple-touch-icon.png"' + - 'path == "/apple-touch-icon-precomposed.png"' + - 'path.matches("\\.(manifest|ttf|woff|woff2|jpg|jpeg|gif|png|webp|avif|svg|mp4|webm|css|js|mjs|wasm)$")' + + is-suspicious-crawler: + - 'userAgent.contains("Presto/") || userAgent.contains("Trident/")' + # Old IE browsers + - 'userAgent.matches("MSIE ([2-9]|10|11)\\.")' + # Old Linux browsers + - 'userAgent.matches("Linux i[63]86") || userAgent.matches("FreeBSD i[63]86")' + # Old Windows browsers + - 'userAgent.matches("Windows (3|95|98|CE)") || userAgent.matches("Windows NT [1-5]\\.")' + # Old mobile browsers + - 'userAgent.matches("Android [1-5]\\.") || userAgent.matches("(iPad|iPhone) OS [1-9]_")' + # Old generic browsers + - 'userAgent.startsWith("Opera/")' + #- 'userAgent.matches("Gecko/(201[0-9]|200[0-9])")' + - 'userAgent.matches("^Mozilla/[1-4]")' + + +# Rules are checked sequentially in order, from top to bottom +rules: + - name: allow-well-known-resources + conditions: + - '($is-well-known-asset)' + action: pass + + - name: allow-static-resources + conditions: + - '($is-static-asset)' + action: pass + + - name: desired-crawlers + conditions: + - *is-bot-googlebot + - *is-bot-bingbot + - *is-bot-duckduckbot + - *is-bot-kagibot + - *is-bot-qwantbot + - *is-bot-yandexbot + action: pass + + # Matches private networks and localhost. + # Uncomment this if you want to let your own tools this way + # - name: allow-private-networks + # conditions: + # # Allows localhost and private networks CIDR + # - *is-network-localhost + # - *is-network-private + # action: pass + + - name: undesired-crawlers + conditions: + - '($is-headless-chromium)' + - 'userAgent.startsWith("Lightpanda/")' + - 'userAgent.startsWith("masscan/")' + # Typo'd opera botnet + - 'userAgent.matches("^Opera/[0-9.]+\\.\\(")' + # AI bullshit stuff, they do not respect robots.txt even while they read it + # TikTok Bytedance AI training + - 'userAgent.contains("Bytedance") || userAgent.contains("Bytespider") || userAgent.contains("TikTokSpider")' + # Meta AI training; The Meta-ExternalAgent crawler crawls the web for use cases such as training AI models or improving products by indexing content directly. + - 'userAgent.contains("meta-externalagent/") || userAgent.contains("meta-externalfetcher/") || userAgent.contains("FacebookBot")' + # Anthropic AI training and usage + - 'userAgent.contains("ClaudeBot") || userAgent.contains("Claude-User")|| userAgent.contains("Claude-SearchBot")' + # Common Crawl AI crawlers + - 'userAgent.contains("CCBot")' + # ChatGPT AI crawlers https://platform.openai.com/docs/bots + - 'userAgent.contains("GPTBot") || userAgent.contains("OAI-SearchBot") || userAgent.contains("ChatGPT-User")' + # Other AI crawlers + - 'userAgent.contains("Amazonbot") || userAgent.contains("Google-Extended") || userAgent.contains("PanguBot") || userAgent.contains("AI2Bot") || userAgent.contains("Diffbot") || userAgent.contains("cohere-training-data-crawler") || userAgent.contains("Applebot-Extended")' + # SEO / Ads and marketing + - 'userAgent.contains("BLEXBot")' + action: drop + + - name: unknown-crawlers + conditions: + # No user agent set + - 'userAgent == ""' + action: deny + + # check a sequence of challenges + - name: suspicious-crawlers + conditions: ['($is-suspicious-crawler)'] + action: none + children: + - name: 0 + action: check + settings: + challenges: [js-refresh] + - name: 1 + action: check + settings: + challenges: [preload-link, resource-load] + - name: 2 + action: check + settings: + challenges: [header-refresh] + + - name: homesite + conditions: + - 'path == "/"' + - 'path == "/links/~ssh"' + - 'path == "/links/~pgp"' + action: pass + + # check DNSBL and serve harder challenges + # todo: make this specific to score + - name: undesired-dnsbl + action: check + settings: + challenges: [dnsbl] + # if DNSBL fails, check additional challenges + fail: check + fail-settings: + challenges: [js-refresh] + + - name: suspicious-fetchers + action: check + settings: + challenges: [js-refresh] + conditions: + - 'userAgent.contains("facebookexternalhit/") || userAgent.contains("facebookcatalog/")' + + # Allow PUT/DELETE/PATCH/POST requests in general + - name: non-get-request + action: pass + conditions: + - '!(method == "HEAD" || method == "GET")' + + # Enable fetching OpenGraph and other tags from backend on these paths + - name: enable-meta-tags + action: context + settings: + context-set: + # Map OpenGraph or similar <meta> tags back to the reply, even if denied/challenged + proxy-meta-tags: "true" + + # Set additional response headers + #response-headers: + # X-Clacks-Overhead: + # - GNU Terry Pratchett + + - name: plaintext-browser + action: challenge + settings: + challenges: [meta-refresh, cookie] + conditions: + - 'userAgent.startsWith("Lynx/")' + + # Uncomment this rule out to challenge tool-like user agents + #- name: standard-tools + # action: challenge + # settings: + # challenges: [cookie] + # conditions: + # - '($is-generic-robot-ua)' + # - '($is-tool-ua)' + # - '!($is-generic-browser)' + + - name: standard-browser + action: challenge + settings: + challenges: [preload-link, meta-refresh, resource-load, js-refresh, js-pow-sha256] + conditions: + - '($is-generic-browser)' + +# If end of rules is reached, default is PASS diff --git a/bundles/go-away/files/config/snippets/bot-betterstack.yml b/bundles/go-away/files/config/snippets/bot-betterstack.yml new file mode 100644 index 0000000..41bd2a1 --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-betterstack.yml @@ -0,0 +1,8 @@ +networks: + betterstack: + - url: https://uptime.betterstack.com/ips-by-cluster.json + jq-path: '.[] | .[]' + +conditions: + is-bot-betterstack: + - &is-bot-betterstack '((userAgent.startsWith("Better Stack Better Uptime Bot") || userAgent.startsWith("Better Uptime Bot") || userAgent == "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.17 Safari/537.36")) && remoteAddress.network("betterstack")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-bingbot.yml b/bundles/go-away/files/config/snippets/bot-bingbot.yml new file mode 100644 index 0000000..98fb3db --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-bingbot.yml @@ -0,0 +1,8 @@ +networks: + bingbot: + - url: https://www.bing.com/toolbox/bingbot.json + jq-path: '(.prefixes[] | select(has("ipv4Prefix")) | .ipv4Prefix), (.prefixes[] | select(has("ipv6Prefix")) | .ipv6Prefix)' + +conditions: + is-bot-bingbot: + - &is-bot-bingbot 'userAgent.contains("+http://www.bing.com/bingbot.htm") && remoteAddress.network("bingbot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-duckduckbot.yml b/bundles/go-away/files/config/snippets/bot-duckduckbot.yml new file mode 100644 index 0000000..b5f45e1 --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-duckduckbot.yml @@ -0,0 +1,8 @@ +networks: + duckduckbot: + - url: https://duckduckgo.com/duckduckgo-help-pages/results/duckduckbot + regex: "<li><div>(?P<prefix>[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)</div></li>" + +conditions: + is-bot-duckduckbot: + - &is-bot-duckduckbot 'userAgent.contains("+http://duckduckgo.com/duckduckbot.html") && remoteAddress.network("duckduckbot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-googlebot.yml b/bundles/go-away/files/config/snippets/bot-googlebot.yml new file mode 100644 index 0000000..da26884 --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-googlebot.yml @@ -0,0 +1,8 @@ +networks: + googlebot: + - url: https://developers.google.com/static/search/apis/ipranges/googlebot.json + jq-path: '(.prefixes[] | select(has("ipv4Prefix")) | .ipv4Prefix), (.prefixes[] | select(has("ipv6Prefix")) | .ipv6Prefix)' + +conditions: + is-bot-googlebot: + - &is-bot-googlebot '(userAgent.contains("+http://www.google.com/bot.html") || userAgent.contains("Google-PageRenderer") || userAgent.contains("Google-InspectionTool") || userAgent.contains("Googlebot")) && remoteAddress.network("googlebot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-kagibot.yml b/bundles/go-away/files/config/snippets/bot-kagibot.yml new file mode 100644 index 0000000..8edb3c3 --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-kagibot.yml @@ -0,0 +1,8 @@ +networks: + kagibot: + - url: https://kagi.com/bot + regex: "\\n(?P<prefix>[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+) " + +conditions: + is-bot-kagibot: + - &is-bot-kagibot 'userAgent.contains("+https://kagi.com/bot") && remoteAddress.network("kagibot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-qwantbot.yml b/bundles/go-away/files/config/snippets/bot-qwantbot.yml new file mode 100644 index 0000000..095e1be --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-qwantbot.yml @@ -0,0 +1,8 @@ +networks: + qwantbot: + - url: https://help.qwant.com/wp-content/uploads/sites/2/2025/01/qwantbot.json + jq-path: '(.prefixes[] | select(has("ipv4Prefix")) | .ipv4Prefix), (.prefixes[] | select(has("ipv6Prefix")) | .ipv6Prefix)' + +conditions: + is-bot-qwantbot: + - &is-bot-qwantbot 'userAgent.contains("+https://help.qwant.com/bot/") && remoteAddress.network("qwantbot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/bot-uptimerobot.yml b/bundles/go-away/files/config/snippets/bot-uptimerobot.yml new file mode 100644 index 0000000..848424c --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-uptimerobot.yml @@ -0,0 +1,8 @@ +networks: + uptimerobot: + - url: https://uptimerobot.com/inc/files/ips/IPv4andIPv6.txt + regex: "(?P<prefix>[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+(/[0-9]+)?|[0-9a-f:]+:.+)" + +conditions: + is-bot-uptimerobot: + - &is-bot-uptimerobot 'userAgent.contains("http://www.uptimerobot.com/") && remoteAddress.network("uptimerobot")' diff --git a/bundles/go-away/files/config/snippets/bot-yandexbot.yml b/bundles/go-away/files/config/snippets/bot-yandexbot.yml new file mode 100644 index 0000000..981ee42 --- /dev/null +++ b/bundles/go-away/files/config/snippets/bot-yandexbot.yml @@ -0,0 +1,24 @@ +networks: + yandexbot: + # todo: detected as bot + # - url: https://yandex.com/ips + # regex: "<span>(?P<prefix>(([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)|([0-9a-f:]+::))/[0-9]+)[ \\\\t]*</span><br/>" + - prefixes: + - "5.45.192.0/18" + - "5.255.192.0/18" + - "37.9.64.0/18" + - "37.140.128.0/18" + - "77.88.0.0/18" + - "84.252.160.0/19" + - "87.250.224.0/19" + - "90.156.176.0/22" + - "93.158.128.0/18" + - "95.108.128.0/17" + - "141.8.128.0/18" + - "178.154.128.0/18" + - "185.32.187.0/24" + - "2a02:6b8::/29" + +conditions: + is-bot-yandexbot: + - &is-bot-yandexbot 'userAgent.contains("+http://yandex.com/bots") && remoteAddress.network("yandexbot")' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/challenge-dnsbl.yml b/bundles/go-away/files/config/snippets/challenge-dnsbl.yml new file mode 100644 index 0000000..893116c --- /dev/null +++ b/bundles/go-away/files/config/snippets/challenge-dnsbl.yml @@ -0,0 +1,6 @@ +challenges: + dnsbl: + runtime: dnsbl + parameters: + dnsbl-decay: 1h + dnsbl-timeout: 1s \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/challenge-js-pow-sha256.yml b/bundles/go-away/files/config/snippets/challenge-js-pow-sha256.yml new file mode 100644 index 0000000..78f57f0 --- /dev/null +++ b/bundles/go-away/files/config/snippets/challenge-js-pow-sha256.yml @@ -0,0 +1,15 @@ +challenges: + js-pow-sha256: + runtime: js + parameters: + # specifies the folder path that assets are under + # can be either embedded or external path + # defaults to name of challenge + path: "js-pow-sha256" + # needs to be under static folder + js-loader: load.mjs + # needs to be under runtime folder + wasm-runtime: runtime.wasm + wasm-runtime-settings: + difficulty: 20 + verify-probability: 0.1 diff --git a/bundles/go-away/files/config/snippets/challenge-js-refresh.yml b/bundles/go-away/files/config/snippets/challenge-js-refresh.yml new file mode 100644 index 0000000..73ba729 --- /dev/null +++ b/bundles/go-away/files/config/snippets/challenge-js-refresh.yml @@ -0,0 +1,6 @@ +challenges: + js-refresh: + # Challenges with a redirect via window.location (requires HTML parsing and JavaScript logic) + runtime: "refresh" + parameters: + refresh-via: "javascript" \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/challenges-non-js.yml b/bundles/go-away/files/config/snippets/challenges-non-js.yml new file mode 100644 index 0000000..b8aff89 --- /dev/null +++ b/bundles/go-away/files/config/snippets/challenges-non-js.yml @@ -0,0 +1,28 @@ +challenges: + # Challenges with a cookie, self redirect (non-JS, requires HTTP parsing) + cookie: + runtime: "cookie" + + # Challenges with a redirect via Link header with rel=preload and early hints (non-JS, requires HTTP parsing, fetching and logic) + # Works on HTTP/2 and above! + preload-link: + condition: '"Sec-Fetch-Mode" in headers && headers["Sec-Fetch-Mode"] == "navigate"' + runtime: "preload-link" + parameters: + preload-early-hint-deadline: 2s + + # Challenges with a redirect via Refresh header (non-JS, requires HTTP parsing and logic) + header-refresh: + runtime: "refresh" + parameters: + refresh-via: "header" + + # Challenges with a redirect via Refresh meta (non-JS, requires HTML parsing and logic) + meta-refresh: + runtime: "refresh" + parameters: + refresh-via: "meta" + + # Challenges with loading a random CSS or image document (non-JS, requires HTML parsing and logic) + resource-load: + runtime: "resource-load" \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/conditions-generic.yml b/bundles/go-away/files/config/snippets/conditions-generic.yml new file mode 100644 index 0000000..4e64cca --- /dev/null +++ b/bundles/go-away/files/config/snippets/conditions-generic.yml @@ -0,0 +1,56 @@ +conditions: + is-well-known-asset: + # general txt files or scraper + - 'path == "/robots.txt" || path == "/security.txt"' + + # ads txt files + - 'path == "/app-ads.txt" || path == "/ads.txt"' + + # generally requested by browsers + - 'path == "/favicon.ico"' + + # used by some applications + - 'path == "/crossdomain.xml"' + + # well-known paths + - 'path.startsWith("/.well-known/")' + + is-git-ua: + - 'userAgent.startsWith("git/") || userAgent.contains("libgit")' + - 'userAgent.startsWith("go-git")' + - 'userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")' + # Golang proxy and initial fetch + - 'userAgent.startsWith("GoModuleMirror/")' + - 'userAgent.startsWith("Go-http-client/") && "go-get" in query && query["go-get"] == "1"' + - '"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"' + + is-generic-browser: + - 'userAgent.startsWith("Mozilla/") || userAgent.startsWith("Opera/")' + + is-generic-robot-ua: + - 'userAgent.matches("compatible[;)]") && !userAgent.contains("Trident/")' + - 'userAgent.matches("\\+https?://")' + - 'userAgent.contains("@")' + - 'userAgent.matches("[bB]ot/[0-9]")' + + is-tool-ua: + - 'userAgent.startsWith("python-requests/")' + - 'userAgent.startsWith("Python-urllib/")' + - 'userAgent.startsWith("python-httpx/")' + - 'userAgent.contains("aoihttp/")' + - 'userAgent.startsWith("http.rb/")' + - 'userAgent.startsWith("curl/")' + - 'userAgent.startsWith("Wget/")' + - 'userAgent.startsWith("libcurl/")' + - 'userAgent.startsWith("okhttp/")' + - 'userAgent.startsWith("Java/")' + - 'userAgent.startsWith("Apache-HttpClient//")' + - 'userAgent.startsWith("Go-http-client/")' + - 'userAgent.startsWith("node-fetch/")' + - 'userAgent.startsWith("reqwest/")' + + # Checks to detect a headless chromium via headers only + is-headless-chromium: + - 'userAgent.contains("HeadlessChrome") || userAgent.contains("HeadlessChromium")' + - '"Sec-Ch-Ua" in headers && (headers["Sec-Ch-Ua"].contains("HeadlessChrome") || headers["Sec-Ch-Ua"].contains("HeadlessChromium"))' + #- '(userAgent.contains("Chrome/") || userAgent.contains("Chromium/")) && (!("Accept-Language" in headers) || !("Accept-Encoding" in headers))' \ No newline at end of file diff --git a/bundles/go-away/files/config/snippets/networks-other.yml b/bundles/go-away/files/config/snippets/networks-other.yml new file mode 100644 index 0000000..c5ffdda --- /dev/null +++ b/bundles/go-away/files/config/snippets/networks-other.yml @@ -0,0 +1,37 @@ +networks: + aws-cloud: + - url: https://ip-ranges.amazonaws.com/ip-ranges.json + jq-path: '(.prefixes[] | select(has("ip_prefix")) | .ip_prefix), (.prefixes[] | select(has("ipv6_prefix")) | .ipv6_prefix)' + google-cloud: + - url: https://www.gstatic.com/ipranges/cloud.json + jq-path: '(.prefixes[] | select(has("ipv4Prefix")) | .ipv4Prefix), (.prefixes[] | select(has("ipv6Prefix")) | .ipv6Prefix)' + oracle-cloud: + - url: https://docs.oracle.com/en-us/iaas/tools/public_ip_ranges.json + jq-path: '.regions[] | .cidrs[] | .cidr' + azure-cloud: + # todo: https://www.microsoft.com/en-us/download/details.aspx?id=56519 does not provide direct JSON + - url: https://raw.githubusercontent.com/femueller/cloud-ip-ranges/refs/heads/master/microsoft-azure-ip-ranges.json + jq-path: '.values[] | .properties.addressPrefixes[]' + + digitalocean: + - url: https://www.digitalocean.com/geo/google.csv + regex: "(?P<prefix>(([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)|([0-9a-f:]+::))/[0-9]+)," + linode: + - url: https://geoip.linode.com/ + regex: "(?P<prefix>(([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)|([0-9a-f:]+::))/[0-9]+)," + vultr: + - url: "https://geofeed.constant.com/?json" + jq-path: '.subnets[] | .ip_prefix' + cloudflare: + - url: https://www.cloudflare.com/ips-v4 + regex: "(?P<prefix>[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+/[0-9]+)" + - url: https://www.cloudflare.com/ips-v6 + regex: "(?P<prefix>[0-9a-f:]+::/[0-9]+)" + + icloud-private-relay: + - url: https://mask-api.icloud.com/egress-ip-ranges.csv + regex: "(?P<prefix>(([0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+)|([0-9a-f:]+::))/[0-9]+)," + tunnelbroker-relay: + # HE Tunnelbroker + - url: https://tunnelbroker.net/export/google + regex: "(?P<prefix>([0-9a-f:]+::)/[0-9]+)," diff --git a/bundles/go-away/files/config/snippets/networks-private.yml b/bundles/go-away/files/config/snippets/networks-private.yml new file mode 100644 index 0000000..4d81b6a --- /dev/null +++ b/bundles/go-away/files/config/snippets/networks-private.yml @@ -0,0 +1,22 @@ +networks: + localhost: + # localhost and loopback addresses + - prefixes: + - "127.0.0.0/8" + - "::1/128" + private: + # Private network CIDR blocks + - prefixes: + # private networks + - "10.0.0.0/8" + - "172.16.0.0/12" + - "192.168.0.0/16" + - "fc00::/7" + # CGNAT + - "100.64.0.0/10" + +conditions: + is-network-localhost: + - &is-network-localhost 'remoteAddress.network("localhost")' + is-network-private: + - &is-network-private 'remoteAddress.network("private")' \ No newline at end of file |