Configure NGINX rate limiting and DDoS protection with advanced security rules

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
NGINX_CONFIG=""
NGINX_USER=""
BLOCKED_COUNTRIES="${BLOCKED_COUNTRIES:-CN,RU,KP}"

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Configure NGINX rate limiting and DDoS protection"
    echo ""
    echo "Options:"
    echo "  -c COUNTRIES    Comma-separated list of country codes to block (default: CN,RU,KP)"
    echo "  -h             Show this help message"
    echo ""
    echo "Example:"
    echo "  $0 -c CN,RU,KP,IR"
}

# Parse command line arguments
while getopts "c:h" opt; do
    case ${opt} in
        c )
            BLOCKED_COUNTRIES="$OPTARG"
            ;;
        h )
            usage
            exit 0
            ;;
        \? )
            usage
            exit 1
            ;;
    esac
done

# Cleanup function for rollback
cleanup() {
    if [[ $? -ne 0 ]]; then
        echo -e "${RED}[ERROR] Script failed. Cleaning up...${NC}"
        systemctl stop nginx 2>/dev/null || true
        if [[ -f "${NGINX_CONFIG}.backup" ]]; then
            mv "${NGINX_CONFIG}.backup" "${NGINX_CONFIG}"
            echo -e "${YELLOW}[CLEANUP] Restored original nginx.conf${NC}"
        fi
        systemctl start nginx 2>/dev/null || true
    fi
}
trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        echo -e "${RED}[ERROR] This script must be run as root or with sudo${NC}"
        exit 1
    fi
}

# Auto-detect distribution
detect_distro() {
    if [[ ! -f /etc/os-release ]]; then
        echo -e "${RED}[ERROR] Cannot detect distribution - /etc/os-release not found${NC}"
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            NGINX_CONFIG="/etc/nginx/nginx.conf"
            NGINX_USER="www-data"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            NGINX_CONFIG="/etc/nginx/nginx.conf"
            NGINX_USER="nginx"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            NGINX_CONFIG="/etc/nginx/nginx.conf"
            NGINX_USER="nginx"
            ;;
        *)
            echo -e "${RED}[ERROR] Unsupported distribution: $ID${NC}"
            exit 1
            ;;
    esac
    
    echo -e "${GREEN}[INFO] Detected distribution: $PRETTY_NAME${NC}"
}

# Install NGINX and required modules
install_nginx() {
    echo -e "${BLUE}[1/6] Installing NGINX and required modules...${NC}"
    
    $PKG_UPDATE
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        $PKG_INSTALL nginx nginx-module-geoip2
    else
        # For RHEL-based systems
        if ! rpm -q epel-release >/dev/null 2>&1; then
            $PKG_INSTALL epel-release
        fi
        $PKG_INSTALL nginx nginx-mod-http-geoip2
    fi
    
    systemctl enable nginx
    systemctl start nginx
}

# Verify NGINX modules
verify_modules() {
    echo -e "${BLUE}[2/6] Verifying NGINX modules...${NC}"
    
    if ! nginx -V 2>&1 | grep -q "http_limit_req_module"; then
        echo -e "${RED}[ERROR] Rate limiting module not found${NC}"
        exit 1
    fi
    
    if ! nginx -V 2>&1 | grep -q "http_limit_conn_module"; then
        echo -e "${RED}[ERROR] Connection limiting module not found${NC}"
        exit 1
    fi
    
    echo -e "${GREEN}[SUCCESS] Required modules verified${NC}"
}

# Download GeoIP database
setup_geoip() {
    echo -e "${BLUE}[3/6] Setting up GeoIP database...${NC}"
    
    mkdir -p /etc/nginx/geoip
    cd /etc/nginx/geoip
    
    if [[ ! -f "GeoLite2-Country.mmdb" ]]; then
        wget -q https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-Country.mmdb
    fi
    
    chown "${NGINX_USER}:${NGINX_USER}" GeoLite2-Country.mmdb
    chmod 644 GeoLite2-Country.mmdb
}

# Configure NGINX with security settings
configure_nginx() {
    echo -e "${BLUE}[4/6] Configuring NGINX security settings...${NC}"
    
    # Backup original configuration
    cp "${NGINX_CONFIG}" "${NGINX_CONFIG}.backup"
    
    # Create security configuration
    cat > /etc/nginx/conf.d/security.conf << 'EOF'
# Rate limiting zones
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=general:10m rate=1r/s;

# Connection limiting zones
limit_conn_zone $binary_remote_addr zone=perip:10m;
limit_conn_zone $server_name zone=perserver:10m;

# Load GeoIP module and database
geoip2 /etc/nginx/geoip/GeoLite2-Country.mmdb {
    auto_reload 5m;
    $geoip2_metadata_country_build metadata build_epoch;
    $geoip2_data_country_code country iso_code;
    $geoip2_data_country_name country names en;
}

# Map blocked user agents
map $http_user_agent $blocked_agent {
    default 0;
    ~*bot 1;
    ~*crawler 1;
    ~*spider 1;
    ~*scanner 1;
    "" 1;
}

# Define rate limiting log format
log_format rate_limit '$remote_addr - $remote_user [$time_local] '
                     '"$request" $status $bytes_sent '
                     '"$http_referer" "$http_user_agent" '
                     'rt=$request_time '
                     'country=$geoip2_data_country_code';
EOF

    # Create blocked countries map
    cat > /etc/nginx/conf.d/geo-blocking.conf << EOF
# Map blocked countries
map \$geoip2_data_country_code \$blocked_country {
    default 0;
EOF

    IFS=',' read -ra COUNTRIES <<< "$BLOCKED_COUNTRIES"
    for country in "${COUNTRIES[@]}"; do
        echo "    $country 1;" >> /etc/nginx/conf.d/geo-blocking.conf
    done
    
    echo "}" >> /etc/nginx/conf.d/geo-blocking.conf
    
    # Set proper permissions
    chown root:root /etc/nginx/conf.d/security.conf /etc/nginx/conf.d/geo-blocking.conf
    chmod 644 /etc/nginx/conf.d/security.conf /etc/nginx/conf.d/geo-blocking.conf
}

# Create example server configuration
create_example_config() {
    echo -e "${BLUE}[5/6] Creating example server configuration...${NC}"
    
    cat > /etc/nginx/conf.d/ddos-protection-example.conf << 'EOF'
server {
    listen 80;
    server_name example.com;
    
    # Enable rate limiting logs
    access_log /var/log/nginx/rate_limit.log rate_limit;
    
    # Block based on geography
    if ($blocked_country) {
        return 444;
    }
    
    # Block suspicious user agents
    if ($blocked_agent) {
        return 444;
    }
    
    # Apply connection limits
    limit_conn perip 10;
    limit_conn perserver 100;
    
    # General rate limiting
    limit_req zone=general burst=5 nodelay;
    
    # Login endpoint with stricter limits
    location /login {
        limit_req zone=login burst=2 nodelay;
        # Your login handler here
        return 200 "Login endpoint\n";
    }
    
    # API endpoints
    location /api/ {
        limit_req zone=api burst=20 nodelay;
        # Your API handler here
        return 200 "API endpoint\n";
    }
    
    # Default location
    location / {
        return 200 "Protected server\n";
    }
}
EOF
    
    chown root:root /etc/nginx/conf.d/ddos-protection-example.conf
    chmod 644 /etc/nginx/conf.d/ddos-protection-example.conf
}

# Test and reload NGINX
test_and_reload() {
    echo -e "${BLUE}[6/6] Testing configuration and reloading NGINX...${NC}"
    
    # Test configuration
    if ! nginx -t; then
        echo -e "${RED}[ERROR] NGINX configuration test failed${NC}"
        exit 1
    fi
    
    # Reload NGINX
    systemctl reload nginx
    
    echo -e "${GREEN}[SUCCESS] NGINX configuration reloaded${NC}"
}

# Verify installation
verify_installation() {
    echo -e "${BLUE}[VERIFICATION] Checking installation...${NC}"
    
    # Check if NGINX is running
    if systemctl is-active --quiet nginx; then
        echo -e "${GREEN}✓ NGINX is running${NC}"
    else
        echo -e "${RED}✗ NGINX is not running${NC}"
        exit 1
    fi
    
    # Check if GeoIP database exists
    if [[ -f /etc/nginx/geoip/GeoLite2-Country.mmdb ]]; then
        echo -e "${GREEN}✓ GeoIP database installed${NC}"
    else
        echo -e "${RED}✗ GeoIP database missing${NC}"
    fi
    
    # Check configuration files
    if [[ -f /etc/nginx/conf.d/security.conf ]]; then
        echo -e "${GREEN}✓ Security configuration created${NC}"
    else
        echo -e "${RED}✗ Security configuration missing${NC}"
    fi
    
    echo -e "${GREEN}[SUCCESS] Installation completed successfully!${NC}"
    echo -e "${YELLOW}[INFO] Example configuration created at: /etc/nginx/conf.d/ddos-protection-example.conf${NC}"
    echo -e "${YELLOW}[INFO] Rate limit logs will be written to: /var/log/nginx/rate_limit.log${NC}"
    echo -e "${YELLOW}[INFO] Blocked countries: $BLOCKED_COUNTRIES${NC}"
}

# Main function
main() {
    check_privileges
    detect_distro
    install_nginx
    verify_modules
    setup_geoip
    configure_nginx
    create_example_config
    test_and_reload
    verify_installation
}

main "$@"