From 2235a00f3b92bd2a7fba1c8149932cba645ec723 Mon Sep 17 00:00:00 2001
From: Ian Fijolek <ian@iamthefij.com>
Date: Mon, 24 Jun 2024 17:04:03 -0700
Subject: [PATCH] Refactor blocky lists to a new nomad var space to make them
 easier to manage

---
 core/blocky/blocky.nomad           | 42 +++++++++++++++++++++++++++---
 core/blocky/blocky.tf              | 28 ++++++++++++++++++++
 core/blocky/config.yml             | 25 ++----------------
 core/blocky/list-smarttv-regex.txt | 13 +++++++++
 core/blocky/list-wemo.txt          |  8 ++++++
 5 files changed, 89 insertions(+), 27 deletions(-)
 create mode 100644 core/blocky/list-smarttv-regex.txt
 create mode 100644 core/blocky/list-wemo.txt

diff --git a/core/blocky/blocky.nomad b/core/blocky/blocky.nomad
index d968b29..4e9b903 100644
--- a/core/blocky/blocky.nomad
+++ b/core/blocky/blocky.nomad
@@ -124,8 +124,8 @@ job "blocky" {
 
       template {
         data = <<EOF
-{{ if nomadVarExists "nomad/jobs/blocky" }}
-{{ with nomadVar "nomad/jobs/blocky" -}}
+{{ if nomadVarExists "blocky_lists/user" }}
+{{ with nomadVar "blocky_lists/user" -}}
 {{ .block_list.Value }}
 {{- end }}
 {{- end }}
@@ -141,8 +141,8 @@ job "blocky" {
 
       template {
         data = <<EOF
-{{ if nomadVarExists "nomad/jobs/blocky" }}
-{{ with nomadVar "nomad/jobs/blocky" -}}
+{{ if nomadVarExists "blocky_lists/user" }}
+{{ with nomadVar "blocky_lists/user" -}}
 {{ .allow_list.Value }}
 {{- end }}
 {{- end }}
@@ -155,6 +155,40 @@ job "blocky" {
           max = "20s"
         }
       }
+
+      template {
+        data = <<EOF
+{{ if nomadVarExists "blocky_lists/terraform" }}
+{{ with nomadVar "blocky_lists/terraform" -}}
+{{ .smarttv_regex.Value }}
+{{- end }}
+{{- end }}
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/smarttv-regex.txt"
+        change_mode = "noop"
+
+        wait {
+          min = "10s"
+          max = "20s"
+        }
+      }
+
+      template {
+        data = <<EOF
+{{ if nomadVarExists "blocky_lists/terraform" }}
+{{ with nomadVar "blocky_lists/terraform" -}}
+{{ .wemo.Value }}
+{{- end }}
+{{- end }}
+        EOF
+        destination = "$${NOMAD_TASK_DIR}/wemo.txt"
+        change_mode = "noop"
+
+        wait {
+          min = "10s"
+          max = "20s"
+        }
+      }
     }
 
     task "stunnel" {
diff --git a/core/blocky/blocky.tf b/core/blocky/blocky.tf
index 94348aa..206bd25 100644
--- a/core/blocky/blocky.tf
+++ b/core/blocky/blocky.tf
@@ -66,3 +66,31 @@ EOH
     task   = "stunnel"
   }
 }
+
+resource "nomad_variable" "blocky_lists_terraform" {
+  path = "blocky_lists/terraform"
+  items = {
+    smarttv_regex = file("${path.module}/list-smarttv-regex.txt")
+    wemo          = file("${path.module}/list-wemo.txt")
+  }
+}
+
+resource "nomad_acl_policy" "blocky_lists" {
+  name        = "blocky-lists"
+  description = "Give access Blocky lists"
+  rules_hcl   = <<EOH
+namespace "default" {
+  variables {
+    path "blocky_lists/*" {
+      capabilities = ["read"]
+    }
+  }
+}
+EOH
+
+  job_acl {
+    job_id = "blocky"
+    group  = "blocky"
+    task   = "blocky"
+  }
+}
diff --git a/core/blocky/config.yml b/core/blocky/config.yml
index c2f814d..98f7ee9 100644
--- a/core/blocky/config.yml
+++ b/core/blocky/config.yml
@@ -77,30 +77,9 @@ blocking:
       # - https://hosts-file.net/ad_servers.txt
     smarttv:
       - https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt
-      # - https://perflyst.github.io/PiHoleBlocklist/regex.list
-      - |
-        # Title: Perflyst's SmartTV Blocklist for Pi-hole - RegEx extension
-        # Version: 13July2023v1
-        # Samsung
-        /(^|\.)giraffic\.com$/
-        /(^|\.)internetat\.tv$/
-        /(^|\.)pavv\.co\.kr$/
-        # /(^|\.)samsungcloudcdn\.com$/ # prevents updates
-        # /(^|\.)samsungcloudsolution\.com$/ # prevents internet connection
-        /(^|\.)samsungcloudsolution\.net$/
-        /(^|\.)samsungelectronics\.com$/
-        # /(^|\.)samsungotn\.net$/ # prevents updates
-        /(^|\.)samsungrm\.net$/
+      - {{ env "NOMAD_TASK_DIR" }}/smartv-regex.txt
     wemo:
-      - |
-        # Remote commands
-        api.xbcs.net
-        # Firmware updates
-        fw.xbcs.net
-        # TURN service
-        nat.wemo2.com
-        # Connectivity checks
-        heartbeat.xwemo.com
+      - {{ env "NOMAD_TASK_DIR" }}/wemo.txt
     antisocial:
       - |
         facebook.com
diff --git a/core/blocky/list-smarttv-regex.txt b/core/blocky/list-smarttv-regex.txt
new file mode 100644
index 0000000..1cd850c
--- /dev/null
+++ b/core/blocky/list-smarttv-regex.txt
@@ -0,0 +1,13 @@
+# From: https://perflyst.github.io/PiHoleBlocklist/regex.list
+# Title: Perflyst's SmartTV Blocklist for Pi-hole - RegEx extension
+# Version: 13July2023v1
+# Samsung
+/(^|\.)giraffic\.com$/
+/(^|\.)internetat\.tv$/
+/(^|\.)pavv\.co\.kr$/
+/(^|\.)samsungcloudsolution\.net$/
+/(^|\.)samsungelectronics\.com$/
+/(^|\.)samsungrm\.net$/
+# /(^|\.)samsungotn\.net$/ # prevents updates
+# /(^|\.)samsungcloudcdn\.com$/ # prevents updates
+# /(^|\.)samsungcloudsolution\.com$/ # prevents internet connection
diff --git a/core/blocky/list-wemo.txt b/core/blocky/list-wemo.txt
new file mode 100644
index 0000000..7075322
--- /dev/null
+++ b/core/blocky/list-wemo.txt
@@ -0,0 +1,8 @@
+# Remote commands
+api.xbcs.net
+# Firmware updates
+fw.xbcs.net
+# TURN service
+nat.wemo2.com
+# Connectivity checks
+heartbeat.xwemo.com