release/sprint-87 -> main

bin/cf_deploy.sh

@@ -50,6 +50,9 @@ fi
   fi
 )
 
+# Call blocklist generator before deploy
+./generate_blockips.sh "${app}" "${space}" "${org}"
+
 # Target space
 cf version
 cf target -o ${org} -s ${space}

blockips.conf

@@ -1,5 +1,5 @@
 # The entire if condition is needed to block an IP
 
-# if ($http_x_forwarded_for ~* x.x.x.x) {
+# if ($http_x_forwarded_for ~* "(^|,\s*)x\.x\.x\.x(\s*,|$)") {
 #    return 403;
 # }

generate_blockips.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -euo pipefail
+
+app=${1}
+space=${2}
+org=${3}
+
+# Target space
+cf target -o ${org} -s ${space}
+
+echo "Generating blockips.conf from cloud.gov environment variable"
+APP_GUID=$(cf app "$app" --guid)
+VCAP_SERVICES=$(cf curl "/v3/apps/${APP_GUID}/env" | jq -r '.system_env_json.VCAP_SERVICES')
+
+BLOCKED_IPS=$(echo "$VCAP_SERVICES" | jq -r '
+  .["user-provided"][]? 
+  | select(.credentials.BLOCKED_IPS != null) 
+  | .credentials.BLOCKED_IPS' | head -n 1)
+
+if [[ -z "$BLOCKED_IPS" || "$BLOCKED_IPS" == "null" ]]; then
+  echo "No BLOCKED_IPS set in cloud.gov for app '${app}', skipping blockips.conf generation"
+  echo "# No blocked IPs configured" > blockips.conf
+else
+  echo "# Auto-generated list of blocked IPs" > blockips.conf
+  IFS=',' read -ra IPS <<< "$BLOCKED_IPS"
+  for ip in "${IPS[@]}"; do
+    escaped_ip=$(echo "$ip" | sed 's/\./\\./g')
+    echo "if (\$http_x_forwarded_for ~* \"(^|,\\s*)${escaped_ip}(\\s*,|$)\") {" >> blockips.conf
+    echo "    return 403;" >> blockips.conf
+    echo "}" >> blockips.conf
+  done
+fi

manifest_dev.yml

@@ -4,6 +4,8 @@ applications:
     instances: 2
     memory: 1G
     disk_quota: 1G
+    services:
+      - fecfile-api-creds-dev
     routes:
       - route: dev-api.fecfile.fec.gov
     stack: cflinuxfs4

manifest_prod.yml

@@ -4,6 +4,8 @@ applications:
     instances: 2
     memory: 1G
     disk_quota: 1G
+    services:
+      - fecfile-api-creds-prod
     routes:
       - route: api.fecfile.fec.gov
     stack: cflinuxfs4

manifest_stage.yml

@@ -4,6 +4,8 @@ applications:
     instances: 2
     memory: 1G
     disk_quota: 1G
+    services:
+      - fecfile-api-creds-stage
     routes:
       - route: stage-api.fecfile.fec.gov
     stack: cflinuxfs4

manifest_test.yml

@@ -4,6 +4,8 @@ applications:
     instances: 2
     memory: 1G
     disk_quota: 1G
+    services:
+      - fecfile-api-creds-test
     routes:
       - route: test-api.fecfile.fec.gov
     stack: cflinuxfs4

nginx.conf

@@ -37,6 +37,12 @@ http {
 
     client_max_body_size 300K;
 
+    location = /robots.txt {
+      default_type text/plain;
+      return 200 "User-agent: *\nContent-Signal: search=yes, ai-input=no, ai-train=no\nAllow: /api/docs\nAllow: /static/drf_spectacular_sidecar/\nDisallow: /\n";
+
+  }
+
     location / {
       resolver {{nameservers}} ipv6=off valid=1s;
       set $backend "{{env "FECFILE_WEB_API"}}";