grepular/geoveto repository overview

⁠geoveto

Geographic access control for reverse proxies: may this client's country reach the site? Your proxy asks geoveto about each request (Traefik forwardAuth, Caddy forward_auth, Envoy ext_authz, nginx auth_request). A 200 allows it; anything else denies it, and geoveto's response body is passed back to the visitor, so you can serve a custom explanation page.

A single static Go binary in a scratch image (amd64 and arm64): no shell, no libc, no package manager. It is sandboxed with Landlock and seccomp, and in serve mode it cannot open an outbound connection at all. Releases are signed and attested with cosign. Read the source README before deploying, in particular the section on X-Forwarded-For ordering.

• Source: https://gitlab.com/grepular/geoveto⁠
• License: GNU AGPL V3, or a commercial licence on request
• Author: Mike Cardwell - https://www.grepular.com⁠

Hire me⁠ · Blog⁠ · RSS feed⁠

⁠Support/Appreciate my work

• Bitcoin⁠: 1PQLtWnjUi1itHLG6QCQeHM3Nxua8pRsq1
• Paypal⁠
• Buy me a Coffee⁠