From 92b88c0e22e783140949b8cf12ba4930b58a6da6 Mon Sep 17 00:00:00 2001
From: Joe Banks <joe@jb3.dev>
Date: Sun, 2 Jun 2024 14:56:16 +0100
Subject: Filter CNs of client certificates for Prometheus

---
 ansible/host_vars/lovelace/nginx.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'ansible')

diff --git a/ansible/host_vars/lovelace/nginx.yml b/ansible/host_vars/lovelace/nginx.yml
index be10ebc..2179c2c 100644
--- a/ansible/host_vars/lovelace/nginx.yml
+++ b/ansible/host_vars/lovelace/nginx.yml
@@ -13,6 +13,14 @@ nginx_configs:
       ssl_verify_client       on;
 
       location / {
+        if ($reject) { return 403; }
+
         proxy_pass http://localhost:9090;
       }
     }
+
+    map $ssl_client_s_dn $reject {
+      default 1;
+      CN=sudo.access.tls.pydis.wtf 0;
+      CN=prometheus.access.tls.pydis.wtf 0;
+    }
-- 
cgit v1.2.3