← Retour
#!/bin/bash
# ═══════════════════════════════════════════════════════════════════════════
# sync-allowed-ips.sh - Synchronise les IPs autorisées vers O2switch
# ═══════════════════════════════════════════════════════════════════════════
#
# Usage: ./sync-allowed-ips.sh
#
# Ce script génère les .htaccess sur O2switch depuis allowed-ips.conf nginx
# ═══════════════════════════════════════════════════════════════════════════
set -euo pipefail
# Configuration
NGINX_SNIPPET="/etc/nginx/snippets/allowed-ips.conf"
O2SWITCH_DIRS=(
"public_html/dashboard"
"public_html/claude"
"public_html/status"
)
# Couleurs
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
# Récupérer le snippet depuis nginx
log_info "Récupération du snippet nginx..."
SNIPPET=$(ssh gouroubleu@nginx.local "cat $NGINX_SNIPPET" 2>/dev/null)
if [[ -z "$SNIPPET" ]]; then
log_error "Impossible de lire $NGINX_SNIPPET"
exit 1
fi
# Extraire les IPs (format nginx -> format Apache)
log_info "Conversion nginx -> Apache .htaccess..."
HTACCESS_CONTENT="# ═══════════════════════════════════════════════════════════════════════════
# .htaccess - IPs autorisées (généré automatiquement)
# Source : /etc/nginx/snippets/allowed-ips.conf
# Généré : $(date '+%Y-%m-%d %H:%M:%S')
# ═══════════════════════════════════════════════════════════════════════════
Order deny,allow
Deny from all
"
# Parser les lignes "allow" du snippet
while IFS= read -r line; do
# Ignorer les commentaires et lignes vides
[[ "$line" =~ ^[[:space:]]*# ]] && continue
[[ -z "$line" ]] && continue
# Extraire les IP des lignes "allow"
if [[ "$line" =~ allow[[:space:]]+([^;]+) ]]; then
IP="${BASH_REMATCH[1]}"
# Nettoyer les espaces
IP=$(echo "$IP" | xargs)
# Ajouter le commentaire si présent
if [[ "$line" =~ \#[[:space:]]*(.+)$ ]]; then
COMMENT="${BASH_REMATCH[1]}"
HTACCESS_CONTENT+="# $COMMENT
"
fi
HTACCESS_CONTENT+="Allow from $IP
"
fi
done <<< "$SNIPPET"
# Ajouter les IPs publiques de 33800 (nécessaires pour O2switch car les requêtes
# depuis le LAN sortent par l'IP publique de la Freebox)
HTACCESS_CONTENT+="
# ═══════════════════════════════════════════════════════════════════════════
# IPs publiques 33800 (Bordeaux) - requis pour accès O2switch depuis le LAN
# ═══════════════════════════════════════════════════════════════════════════
# IPv4 publique Freebox 33800
Allow from 82.65.119.221
# Préfixe IPv6 33800
Allow from 2a01:e0a:2c:a320::/64
"
echo "$HTACCESS_CONTENT"
# Déployer sur O2switch
log_info "Déploiement sur O2switch..."
for dir in "${O2SWITCH_DIRS[@]}"; do
log_info " -> ~/$dir/.htaccess"
echo "$HTACCESS_CONTENT" | ssh o2switch "cat > ~/$dir/.htaccess"
done
log_info "Synchronisation terminée."
log_info "IPs autorisées synchronisées sur O2switch."