question: Work with maxmind-geolocation

[noobydp]

Hi,
I want to implement geolocation filtering provided by https://github.com/porech/caddy-maxmind-geolocation, but I don't understand how to get the filtering to work before the auth / login page is loaded?

I use caddy to reverse proxy a number of internal hosts, and I was able to get the geo filtering on each reverse proxy endpoint (not shown below), but the auth page is always available.

Here's part of my caddy file

{
	order authenticate before respond
	order authorize before basicauth
	order geo_ip first

	debug

	security {
		local identity store localdb {
			realm local
			path {$HOME}/.config/caddy/users.json
		}

		authentication portal myportal {
			crypto default token lifetime 86400
			cookie lifetime 2592000
			crypto key sign-verify {env.JWT_SHARED_KEY}
			enable identity store localdb

			ui {
				links {
				}
				# password_recovery_enabled no
			}
		}

		authorization policy users_policy {
			allow roles authp/admin authp/user
			crypto key verify {env.JWT_SHARED_KEY}
			acl rule {
				comment allow users
				match role authp/user
				allow stop log info
			}
			acl rule {
				comment default deny
				match any
				deny log warn
			}
		}
	}
}
my.domain.com {
	@mygeofilter {
		maxmind_geolocation {
			db_path "/Users/me/.config/caddy/GeoLite2_Country/GeoLite2-Country.mmdb"
			allow_countries JP
		}
		not remote_ip 192.168.1.1
	}
	authenticate with myportal
	redir /myhost /myhost/
       route /myhost/* {
		authorize with users_policy
		reverse_proxy localhost:7878
	}
}

[greenpau]

@noobydp , try this. Editibg in iphone browser.

my.domain.com {
	route /auth* {
		maxmind_geolocation {
			db_path "/Users/me/.config/caddy/GeoLite2_Country/GeoLite2-Country.mmdb"
			allow_countries JP
		}
		not remote_ip 192.168.1.1
authenticate with myportal
	}
	
	
       route /myhost/* {
		authorize with users_policy
		reverse_proxy localhost:7878
	}
route {
redir /myhost/ 302
}
}

[greenpau]

@noobydp, in short, I think you need to better understand the difference between routes, matchers, conditionals in caddy.

above, I converted your config to be “route-based”

[noobydp]

Thank you. I struggled to understand how routes, matchers and conditionals worked in this scenario but your example was helpful.

Adding maxmind_geolocation {..} threw errors, I ended up adding this to my config:

route /* {
		respond @mygeofilter 404
		authenticate with myportal
	}

[greenpau]

@noobydp , @dbranco , I am looking to add testimonial sections to https://authcrunch.com. Could you please write one and send it to me at greenpau@outlook.com?