chore(envoy-gateway): add geoblock exclusions

gabe565 · gabe565 · commit d6336979c99e · 2026-08-11T03:58:28.000-05:00
diff --git a/kubernetes/gabernetes/apps/adguard-home/app/helmrelease.yaml b/kubernetes/gabernetes/apps/adguard-home/app/helmrelease.yaml
@@ -178,6 +178,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/authentik/app/kustomization.yaml b/kubernetes/gabernetes/apps/authentik/app/kustomization.yaml
@@ -7,4 +7,5 @@ resources:
   - helmrelease.yaml
   - pvc.yaml
   - oidc-rbac.yaml
+  - securitypolicy.yaml
   - webfinger.yaml
diff --git a/kubernetes/gabernetes/apps/authentik/app/securitypolicy.yaml b/kubernetes/gabernetes/apps/authentik/app/securitypolicy.yaml
@@ -0,0 +1,12 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: authentik-no-geoblock
+  namespace: authentik
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: authentik-server
+  authorization:
+    defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/authentik/app/webfinger.yaml b/kubernetes/gabernetes/apps/authentik/app/webfinger.yaml
@@ -73,3 +73,17 @@ spec:
                   value: /.well-known/webfinger
             backendRefs:
               - identifier: webfinger
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/bookstack/app/helmrelease.yaml b/kubernetes/gabernetes/apps/bookstack/app/helmrelease.yaml
@@ -112,3 +112,17 @@ spec:
                   remove:
                     - Server
                     - X-Powered-By
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/change-detection/app/helmrelease.yaml b/kubernetes/gabernetes/apps/change-detection/app/helmrelease.yaml
@@ -100,6 +100,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/cilium/app/httproute.yaml b/kubernetes/gabernetes/apps/cilium/app/httproute.yaml
@@ -23,6 +23,7 @@ metadata:
   name: hubble-ui
   namespace: kube-system
 spec:
+  mergeType: StrategicMerge
   targetRefs:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/envoy-gateway/config/clienttrafficpolicy.yaml b/kubernetes/gabernetes/apps/envoy-gateway/config/clienttrafficpolicy.yaml
@@ -10,9 +10,7 @@ spec:
       name: public
       sectionName: https
   clientIPDetection:
-    xForwardedFor:
-      trustedCIDRs:
-        - 10.42.0.0/16
+    directSourceIP: {}
   headers:
     earlyRequestHeaders:
       set:
diff --git a/kubernetes/gabernetes/apps/esphome/app/helmrelease.yaml b/kubernetes/gabernetes/apps/esphome/app/helmrelease.yaml
@@ -100,6 +100,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/hammond/app/helmrelease.yaml b/kubernetes/gabernetes/apps/hammond/app/helmrelease.yaml
@@ -67,6 +67,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/headscale/resources/app/helmrelease.yaml b/kubernetes/gabernetes/apps/headscale/resources/app/helmrelease.yaml
@@ -150,6 +150,18 @@ spec:
               body:
                 type: Inline
                 inline: Access Denied
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
 
     secrets:
       config:
diff --git a/kubernetes/gabernetes/apps/headscale/resources/headplane/helmrelease.yaml b/kubernetes/gabernetes/apps/headscale/resources/headplane/helmrelease.yaml
@@ -88,3 +88,17 @@ spec:
                   value: /admin
             backendRefs:
               - identifier: headplane
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/healthchecks/app/helmrelease.yaml b/kubernetes/gabernetes/apps/healthchecks/app/helmrelease.yaml
@@ -146,6 +146,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/homepage/app/helmrelease.yaml b/kubernetes/gabernetes/apps/homepage/app/helmrelease.yaml
@@ -126,6 +126,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/lidarr/app/helmrelease.yaml b/kubernetes/gabernetes/apps/lidarr/app/helmrelease.yaml
@@ -103,6 +103,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/linx/app/helmrelease.yaml b/kubernetes/gabernetes/apps/linx/app/helmrelease.yaml
@@ -110,3 +110,17 @@ spec:
             timeouts:
               request: 5m
               backendRequest: 5m
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/longhorn/app/httproute.yaml b/kubernetes/gabernetes/apps/longhorn/app/httproute.yaml
@@ -23,6 +23,7 @@ metadata:
   name: auth
   namespace: longhorn-system
 spec:
+  mergeType: StrategicMerge
   targetRefs:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/miniflux/app/helmrelease.yaml b/kubernetes/gabernetes/apps/miniflux/app/helmrelease.yaml
@@ -118,6 +118,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/minio/app/helmrelease.yaml b/kubernetes/gabernetes/apps/minio/app/helmrelease.yaml
@@ -164,6 +164,21 @@ spec:
               body:
                 type: Inline
                 inline: Access Denied
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}-s3"
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}-admin"
+            authorization:
+              defaultAction: Allow
 
     serviceMonitor:
       main:
diff --git a/kubernetes/gabernetes/apps/monica/app/helmrelease.yaml b/kubernetes/gabernetes/apps/monica/app/helmrelease.yaml
@@ -158,6 +158,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/nightscout/resources/app/helmrelease.yaml b/kubernetes/gabernetes/apps/nightscout/resources/app/helmrelease.yaml
@@ -137,6 +137,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/paperless-ngx/app/helmrelease.yaml b/kubernetes/gabernetes/apps/paperless-ngx/app/helmrelease.yaml
@@ -126,6 +126,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/plausible/app/helmrelease.yaml b/kubernetes/gabernetes/apps/plausible/app/helmrelease.yaml
@@ -121,3 +121,17 @@ spec:
             name: public
         hostnames:
           - ${app_host}
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/prometheus/app/securitypolicy.yaml b/kubernetes/gabernetes/apps/prometheus/app/securitypolicy.yaml
@@ -4,6 +4,7 @@ metadata:
   name: prometheus-auth
   namespace: prometheus
 spec:
+  mergeType: StrategicMerge
   targetRefs:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/prometheus/kromgo/helmrelease.yaml b/kubernetes/gabernetes/apps/prometheus/kromgo/helmrelease.yaml
@@ -83,3 +83,17 @@ spec:
             name: public
         hostnames:
           - kromgo.gabe565.com
+
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
diff --git a/kubernetes/gabernetes/apps/prowlarr/app/helmrelease.yaml b/kubernetes/gabernetes/apps/prowlarr/app/helmrelease.yaml
@@ -93,6 +93,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/qbittorrent/app/helmrelease.yaml b/kubernetes/gabernetes/apps/qbittorrent/app/helmrelease.yaml
@@ -222,6 +222,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/radarr/app/helmrelease.yaml b/kubernetes/gabernetes/apps/radarr/app/helmrelease.yaml
@@ -103,6 +103,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/relax-sounds/app/helmrelease.yaml b/kubernetes/gabernetes/apps/relax-sounds/app/helmrelease.yaml
@@ -77,6 +77,20 @@ spec:
         hostnames:
           - ${app_url}
 
+    rawResources:
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}"
+            authorization:
+              defaultAction: Allow
+
     serviceMonitor:
       relax-sounds:
         enabled: true
diff --git a/kubernetes/gabernetes/apps/scanservjs/app/helmrelease.yaml b/kubernetes/gabernetes/apps/scanservjs/app/helmrelease.yaml
@@ -107,6 +107,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/searxng/app/helmrelease.yaml b/kubernetes/gabernetes/apps/searxng/app/helmrelease.yaml
@@ -111,6 +111,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/shlink/app/helmrelease.yaml b/kubernetes/gabernetes/apps/shlink/app/helmrelease.yaml
@@ -167,6 +167,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
@@ -195,6 +196,18 @@ spec:
                   claimToHeaders:
                     - claim: shlink_token
                       header: X-Shlink-Token
+      no-geoblock:
+        suffix: no-geoblock
+        manifest:
+          apiVersion: gateway.envoyproxy.io/v1alpha1
+          kind: SecurityPolicy
+          spec:
+            targetRefs:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+                name: "{{ .Release.Name }}-api"
+            authorization:
+              defaultAction: Allow
       servers-json:
         manifest:
           apiVersion: gateway.envoyproxy.io/v1alpha1
diff --git a/kubernetes/gabernetes/apps/sonarr/app/helmrelease.yaml b/kubernetes/gabernetes/apps/sonarr/app/helmrelease.yaml
@@ -103,6 +103,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/stable-diffusion/app/helmrelease.yaml b/kubernetes/gabernetes/apps/stable-diffusion/app/helmrelease.yaml
@@ -102,6 +102,7 @@ spec:
           apiVersion: gateway.envoyproxy.io/v1alpha1
           kind: SecurityPolicy
           spec:
+            mergeType: StrategicMerge
             targetRefs:
               - group: gateway.networking.k8s.io
                 kind: HTTPRoute
diff --git a/kubernetes/gabernetes/apps/tautulli/app/helmrelease.yaml b/kubernetes/gabernetes/apps/tautulli/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/uptime-kuma/app/helmrelease.yaml b/kubernetes/gabernetes/apps/uptime-kuma/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/vaultwarden/app/helmrelease.yaml b/kubernetes/gabernetes/apps/vaultwarden/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/watch-your-lan/app/helmrelease.yaml b/kubernetes/gabernetes/apps/watch-your-lan/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/your-spotify/app/helmrelease.yaml b/kubernetes/gabernetes/apps/your-spotify/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/zigbee2mqtt/app/helmrelease.yaml b/kubernetes/gabernetes/apps/zigbee2mqtt/app/helmrelease.yaml
diff --git a/kubernetes/gabernetes/apps/zwave-js-ui/app/helmrelease.yaml b/kubernetes/gabernetes/apps/zwave-js-ui/app/helmrelease.yaml
