Skip to content

Commit 7a90cc2

Browse files
karteekiitgkarteekiitg
committed
feat: Cloudflare DNS ad-blocking
Signed-off-by: Karteek <[email protected]>
1 parent 1fbe9fb commit 7a90cc2

12 files changed

+1256
-0
lines changed

‎.github/workflows/cf_adblock.yaml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
name: Monthly Cloudflare Adblock Update
2+
3+
on:
4+
workflow_dispatch: # Allows manual triggering
5+
schedule:
6+
- cron: "0 0 1 * *" # Runs at 00:00 UTC on the 1st day of every month
7+
8+
env:
9+
TF_VAR_gcs_env: prod
10+
11+
permissions:
12+
contents: read
13+
id-token: write
14+
15+
jobs:
16+
update_cf_adblock:
17+
runs-on: ubuntu-latest
18+
container:
19+
image: ghcr.io/karteekiitg/k8s_setup:latest
20+
21+
steps:
22+
- name: Checkout repository
23+
id: checkout
24+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
25+
26+
- name: Load .env file to environment
27+
shell: bash
28+
run: |
29+
if [ -f "./.env" ]; then
30+
echo "Sourcing .env file..."
31+
grep -v '^[[:space:]]*#' ./.env | grep -v '^[[:space:]]*$' | grep '=' >> $GITHUB_ENV
32+
echo "Finished processing .env file for GITHUB_ENV."
33+
else
34+
echo -e "\033[31mError: .env file not found at ./.\033[0m"
35+
exit 1
36+
fi
37+
38+
- name: Load secrets to environment
39+
shell: bash
40+
env: # Environment variables specific to THIS step
41+
TF_VAR_infisical_client_secret: ${{ secrets.INFISICAL_CLIENT_SECRET }}
42+
run: |
43+
echo "Making setup_infisical.sh executable..."
44+
chmod +x ./.devcontainer/setup_infisical.sh
45+
echo "Running setup_infisical.sh..."
46+
./.devcontainer/setup_infisical.sh
47+
if [ $? -ne 0 ]; then
48+
echo -e "\033[31mError: setup_infisical.sh failed. See script output above for details.\033[0m"
49+
exit 1
50+
fi
51+
52+
EXPORT_FILE="$HOME/.infisical_exports.env"
53+
54+
if [ -f "$EXPORT_FILE" ]; then
55+
echo "Sourcing secrets from $EXPORT_FILE to GITHUB_ENV (filtering, handling 'export' prefix, and stripping quotes)..."
56+
57+
# Pre-filter with grep to remove comments and truly empty lines, ensure '=' exists
58+
# Then pipe into the while loop for further processing
59+
grep -v '^[[:space:]]*#' "$EXPORT_FILE" | grep -v '^[[:space:]]*$' | grep '=' | \
60+
while IFS= read -r line || [ -n "$line" ]; do # Read whole line
61+
# Remove "export " prefix if it exists from the already filtered line
62+
line_no_export="${line#export }"
63+
64+
# At this point, 'line_no_export' should be in KEY=VALUE format
65+
# (possibly with quotes around VALUE) because of the preceding grep filters.
66+
# We still split to handle the value quoting.
67+
68+
key="${line_no_export%%=*}"
69+
value_with_potential_quotes="${line_no_export#*=}"
70+
71+
# Remove leading/trailing single quotes from value_with_potential_quotes
72+
value_cleaned="${value_with_potential_quotes#\'}"
73+
value_cleaned="${value_cleaned%\'}"
74+
# Remove leading/trailing double quotes from value_with_potential_quotes
75+
value_cleaned="${value_cleaned#\"}"
76+
value_cleaned="${value_cleaned%\"}"
77+
78+
echo "$key=$value_cleaned" >> $GITHUB_ENV
79+
done
80+
81+
echo "Finished processing $EXPORT_FILE for GITHUB_ENV."
82+
echo "Removing $EXPORT_FILE..."
83+
rm -f "$EXPORT_FILE"
84+
else
85+
echo -e "\033[31mError: Secrets export file ($EXPORT_FILE) was not found after running setup_infisical.sh.\033[0m"
86+
exit 1
87+
fi
88+
echo "Secrets loaded and temporary file removed."
89+
90+
- name: Authenticate to Google Cloud
91+
id: google-auth
92+
uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193
93+
with:
94+
workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }} # Now from Infisical via env
95+
service_account: ${{ env.GCP_SERVICE_ACCOUNT_EMAIL }} # Now from Infisical via env
96+
97+
- name: Run Adblock List Chunking Script
98+
run: bash chunk_adblock_lists.sh 1000 90
99+
working-directory: ./tofu/cf-adblock # Ensures script is run in the correct context
100+
101+
- name: OpenTofu Init for cf-adblock
102+
run: tofu init
103+
working-directory: ./tofu/cf-adblock
104+
105+
- name: OpenTofu Apply for cf-adblock
106+
id: apply_cf_adblock
107+
shell: bash
108+
run: tofu apply -auto-approve
109+
working-directory: ./tofu/cf-adblock
110+
111+
- name: Install Python dependencies
112+
shell: bash
113+
run: |
114+
echo "Installing cloudflare Python library..."
115+
pip3 install cloudflare
116+
117+
- name: Run Cloudflare Adblock Management Script
118+
shell: bash
119+
run: |
120+
echo "Running Python script manage_cloudflare_adblock.py..."
121+
python3 manage_cloudflare_adblock.py 1000 90
122+
working-directory: ./tofu/cf-adblock # Runs Python script from the same dir as chunker & TF

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,5 @@ override.tf.json
3131

3232
*.pem
3333
*.crt
34+
35+
processed_adblock_chunks

0 commit comments

Comments
 (0)