44713e4ca0
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018BAUeCFpDkRD6tU5wGsc1C
89 lines
3.0 KiB
Bash
Executable File
89 lines
3.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# =============================================================================
|
|
# Rafraichissement des rangs d'IP Cloudflare
|
|
# =============================================================================
|
|
# Cloudflare fait evoluer ses rangs. Deux endroits en dependent :
|
|
# - terraform/firewall.tf (qui peut atteindre 80/443 sur app-01)
|
|
# - la configuration Traefik (quelles IP ont le droit d'ecrire X-Forwarded-For)
|
|
#
|
|
# Une liste perimee produit deux pannes distinctes et peu evidentes :
|
|
# - du trafic legitime rejete par le firewall Hetzner ;
|
|
# - une IP client mal identifiee, donc une limitation de debit qui frappe
|
|
# tout le monde et des audit_logs faux.
|
|
#
|
|
# A relancer tous les trimestres, et systematiquement avant un `terraform apply`.
|
|
#
|
|
# bash scripts/refresh-cloudflare-ips.sh # compare et affiche
|
|
# bash scripts/refresh-cloudflare-ips.sh --write # met a jour firewall.tf
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
TF_FILE="${HERE}/../terraform/firewall.tf"
|
|
WRITE=false
|
|
[[ "${1:-}" == "--write" ]] && WRITE=true
|
|
|
|
echo ">>> Recuperation des rangs officiels Cloudflare"
|
|
V4="$(curl -fsS --max-time 15 https://www.cloudflare.com/ips-v4)"
|
|
V6="$(curl -fsS --max-time 15 https://www.cloudflare.com/ips-v6)"
|
|
|
|
[[ -n "$V4" && -n "$V6" ]] || { echo "Reponse vide de Cloudflare, abandon." >&2; exit 1; }
|
|
|
|
echo
|
|
echo "IPv4 ($(echo "$V4" | wc -l | tr -d ' ') rangs) :"
|
|
echo "$V4" | sed 's/^/ /'
|
|
echo
|
|
echo "IPv6 ($(echo "$V6" | wc -l | tr -d ' ') rangs) :"
|
|
echo "$V6" | sed 's/^/ /'
|
|
|
|
echo
|
|
echo ">>> Rangs actuellement declares dans firewall.tf :"
|
|
grep -oE '"[0-9a-f:.]+/[0-9]+"' "$TF_FILE" | tr -d '"' | sort -u | sed 's/^/ /'
|
|
|
|
DIFF=$(diff <(printf '%s\n%s\n' "$V4" "$V6" | sort -u) \
|
|
<(grep -oE '"[0-9a-f:.]+/[0-9]+"' "$TF_FILE" | tr -d '"' | sort -u) || true)
|
|
|
|
if [[ -z "$DIFF" ]]; then
|
|
echo
|
|
echo ">>> Aucune difference : rien a faire."
|
|
exit 0
|
|
fi
|
|
|
|
echo
|
|
echo ">>> DIFFERENCES DETECTEES :"
|
|
echo "$DIFF"
|
|
|
|
if ! $WRITE; then
|
|
cat <<'MSG'
|
|
|
|
Relancez avec --write pour mettre a jour terraform/firewall.tf, puis :
|
|
cd terraform && terraform plan && terraform apply
|
|
|
|
Pensez aussi a reporter la liste dans la configuration Traefik :
|
|
/var/lib/rancher/k3s/server/manifests/traefik-config.yaml (sur app-01)
|
|
puis : sudo systemctl restart k3s
|
|
MSG
|
|
exit 2
|
|
fi
|
|
|
|
BLOCK_V4=$(echo "$V4" | sed 's/^/ "/; s/$/",/')
|
|
BLOCK_V6=$(echo "$V6" | sed 's/^/ "/; s/$/",/')
|
|
|
|
python3 - "$TF_FILE" <<PY
|
|
import re, sys
|
|
path = sys.argv[1]
|
|
src = open(path).read()
|
|
src = re.sub(r'(cloudflare_ipv4 = \[\n).*?(\n \])',
|
|
lambda m: m.group(1) + """${BLOCK_V4}""".rstrip(',') + m.group(2),
|
|
src, flags=re.S)
|
|
src = re.sub(r'(cloudflare_ipv6 = \[\n).*?(\n \])',
|
|
lambda m: m.group(1) + """${BLOCK_V6}""".rstrip(',') + m.group(2),
|
|
src, flags=re.S)
|
|
open(path, 'w').write(src)
|
|
print("firewall.tf mis a jour")
|
|
PY
|
|
|
|
echo
|
|
echo ">>> Verifiez le diff avant d'appliquer :"
|
|
echo " git diff infra/prod/terraform/firewall.tf"
|
|
echo " cd infra/prod/terraform && terraform plan"
|