Geoip-Shell Container

[kiwilad-nz]

Hey, so I am no programmer or developer by all means and am pretty new to the whole publish things on github, but I was having issues wanting to install this locally on TrueNAS and thought it would be better suited as a container to work around that.

Hopefully you don't mind but you can find it here: and hopefully it will get more exposure to your awesome tool!
https://github.com/kiwilad-nz/geoip-shell-container

It essentially curls from your repot directly upon starrup to get the latest version and looks for config already otherwise have to do a manual configuration.

If there's actually errors in what I've done I would appreciate as much feedback as possible.

[friendly-bits]

Hi @kiwilad-nz , thank you for the heads-up. I have a very limited acquaintance with Docker containers, so I don't really understand what would be the point of having a dedicated container for geoip-shell. I imagine that any rules geoip-shell creates would only apply inside that container? Or do you have another app in the container and you want to geoblock access to it?

Also I would be interested to hear specifics of what issues you were having with geoip-shell in TrueNAS. If that's a compatibility issue then perhaps I could look into fixing it.

If this can't be fixed inside geoip-shell but you have a workaround then other users might benefit from having this documented. If you would like to write a short text describing the issue and the workaround, I could add it to the docs and link to it from the FAQ section of the README. Alternatively, you could send me a pull request with the documentation update. As a reference, take a look at the excellent documentation update PR sent by another user.

As to your code, I'll look into it when I have time. I'm pretty busy these days, so it may take a while.

[kiwilad-nz]

I discovered that this can be propagated to the host from containers through setting up a crowdsec bouncer as also a container.
So long as the containers network mode is set to host and has the following capabilities added: (- NET_ADMIN / - NET_RAW)

The issue with TrueNAS is it's locked down like an appliance.
I decided to not really bother with hacking it so gave the containerisation of it a crack and it works without any issues from what I can see.

Here's the output from running this on the TrueNAS host though:

sh geoip-shell-install.sh
Checking files... OK
Preparing to install geoip-shell for firewall backends: all...
install: Cleaning up previous installation (if any)...

Killing any running geoip-shell processes...
Creating directories... mkdir: cannot create directory '/usr/lib/geoip-shell': Read-only file system
Failed to create directory '/usr/lib/geoip-shell'.

Installation failed.

As for the code for the contrainer- there's not much to review. It's pretty short and sweet.

[friendly-bits]

I discovered that this can be propagated to the host from containers through setting up a crowdsec bouncer as also a container.

Could you elaborate on how geoip-shell in one container interacts with crowdsec in another container?

So long as the containers network mode is set to host and has the following capabilities added: (- NET_ADMIN / - NET_RAW)

You set this globally or individually for both of the above containers?

[kiwilad-nz]

Sorry, crowdsec is in an independent container doing a similar function to the host operation mode allowing the blocklists to propogate to the host. It was just mentioned as it was a reference point of me getting geoip-shell to work in the same manner:

root@TrueNAS[/home/admin]# nft list ruleset 2>/dev/null | grep CROWD
                counter packets 301149743 bytes 249022944425 jump CROWDSEC_CHAIN
                counter packets 5216536 bytes 3283111849 jump CROWDSEC_CHAIN
        chain CROWDSEC_CHAIN {
                xt match set  counter packets 16 bytes 960 jump CROWDSEC_LOG
                xt match set  counter packets 10765 bytes 578011 jump CROWDSEC_LOG
                xt match set  counter packets 2551 bytes 236169 jump CROWDSEC_LOG
        chain CROWDSEC_LOG {

root@TrueNAS[/home/admin]# nft list ruleset 2>/dev/null | grep GEO
                 counter packets 16056770 bytes 11063814453 jump GEOIP-SHELL_IN
        chain GEOIP-SHELL_IN {
                 counter packets 16494 bytes 6942517 jump GEOIP-SHELL_IN
        chain GEOIP-SHELL_IN {

Both containers are using host as it's network mode.

[latimeria68]

@kiwilad-nz
Hello. I'm interested too in interaction with crowdsec. I use NPMPLUS as a reverse proxy but the nginx geoip module apparently acts after crowdsec so I have a lot of request to my docker apps passing before being blocked by geoip. Are you saying your geoip-shell container can pass geoip info to crowdsec?
Thank you

[friendly-bits]

Are you saying your geoip-shell container can pass geoip info to crowdsec?

I believe that @kiwilad-nz configured the docker container which geoip-shell runs in in a way that allows geoip-shell to configure nftables on the host from inside the container. crowdsec runs in a separate container with similar privileges.