From b8bc3d6759ef4d80a8f4662b6399a4535c0b6f32 Mon Sep 17 00:00:00 2001
From: LOR <louis.rossignol@mediactivegroup.com>
Date: Thu, 25 Jun 2026 11:05:47 +0200
Subject: [PATCH] Create blocklist for attacker

---
 infrastructure/traefik/helm-release.yaml | 61 ++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml
index c8d3d3f..97285b3 100644
--- a/infrastructure/traefik/helm-release.yaml
+++ b/infrastructure/traefik/helm-release.yaml
@@ -393,3 +393,64 @@ spec:
               port: 54322
               targetPort: 54322
               protocol: TCP
+
+      - apiVersion: v1
+        kind: Service
+        metadata:
+          name: blackhole
+          namespace: common-services
+        spec:
+          # Placeholder : jamais contacté, le middleware renvoie 403 avant.
+          type: ClusterIP
+          ports:
+            - name: http
+              port: 80
+              targetPort: 80
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: Middleware
+        metadata:
+          name: deny-ip-blocklist
+          namespace: common-services
+        spec:
+          # ipAllowList rejette en 403
+          ipAllowList:
+            sourceRange:
+              - 192.0.2.1/32 # TEST-NET-1 (RFC 5737) : ne matche aucun client réel => deny
+
+      - apiVersion: traefik.io/v1alpha1
+        kind: IngressRoute
+        metadata:
+          name: security-ip-blocklist
+          namespace: common-services
+        spec:
+          entryPoints:
+            - websecure
+          routes:
+            - match: >-
+                ClientIP(`45.88.138.45/32`)
+              priority: 100000
+              middlewares:
+                - name: deny-ip-blocklist
+                  namespace: common-services
+              services:
+                - name: blackhole
+                  port: 80
+
+      - apiVersion: discovery.k8s.io/v1
+        kind: EndpointSlice
+        metadata:
+          name: blackhole
+          namespace: common-services
+          labels:
+            kubernetes.io/service-name: blackhole
+        addressType: IPv4
+        endpoints:
+          - addresses:
+              - 192.0.2.1 # TEST-NET-1 : non-routable, jamais contacté
+            conditions:
+              ready: true
+        ports:
+          - name: http
+            port: 80
+            protocol: TCP