Add country-based IP blocking for Caddy via Ansible

- Introduce generate_country_blocks.py to fetch IP ranges by country
- Update group_vars/servers.yml with country blocking settings
- Add country_block snippet to Caddyfile and apply to all sites
- Create Ansible tasks for automated IP range generation and integration
- Add documentation for configuring and managing country blocking

config/ansible/tasks/servers/services/caddy/Caddyfile.j2

@@ -1,43 +1,74 @@
+# Global configuration for country blocking
+{
+    # Block specific countries (add ISO country codes as needed)
+    # Examples: CN (China), RU (Russia), KP (North Korea), IR (Iran)
+    servers {
+        protocols h1 h2 h3
+    }
+}
+
+# Country blocking snippet - reusable across all sites
+{% if enable_country_blocking | default(false) and blocked_countries | default([]) | length > 0 %}
+(country_block) {
+    @blocked_countries {
+        remote_ip {{ blocked_countries | join(' ') }}
+    }
+    respond @blocked_countries "Access denied from your country" 403
+}
+{% else %}
+(country_block) {
+    # Country blocking disabled
+}
+{% endif %}
+
 photos.mvl.sh {
+    import country_block
     reverse_proxy immich:2283
     tls {{ caddy_email }}
 }
 
 photos.vleeuwen.me {
+    import country_block
     redir https://photos.mvl.sh{uri}
     tls {{ caddy_email }}
 }
 
 karakeep.mvl.sh {
+    import country_block
     reverse_proxy karakeep:3000
     tls {{ caddy_email }}
 }
 
 hoarder.mvl.sh {
+    import country_block
     redir https://karakeep.mvl.sh{uri}
 }
 
 git.vleeuwen.me git.mvl.sh {
+    import country_block
     reverse_proxy gitea:3000
     tls {{ caddy_email }}
 }
 
 status.vleeuwen.me status.mvl.sh {
+    import country_block
     reverse_proxy uptime-kuma:3001
     tls {{ caddy_email }}
 }
 
 sf.mvl.sh {
+    import country_block
     reverse_proxy seafile:80
 
     handle /seafdav* {
         reverse_proxy seafile:8080
     }
-    
+
     tls {{ caddy_email }}
 }
 
 of.mvl.sh {
+    import country_block
     reverse_proxy onlyoffice:80 {
         header_up Host {host}
         header_up X-Real-IP {remote}
@@ -48,31 +79,37 @@ of.mvl.sh {
 }
 
 fsm.mvl.sh {
+    import country_block
     reverse_proxy factorio-server-manager:80
     tls {{ caddy_email }}
 }
 
 df.mvl.sh {
+    import country_block
     redir / https://git.mvl.sh/vleeuwenmenno/dotfiles/raw/branch/master/setup.sh
     tls {{ caddy_email }}
 }
 
 overseerr.mvl.sh jellyseerr.mvl.sh overseerr.vleeuwen.me jellyseerr.vleeuwen.me {
+    import country_block
     reverse_proxy mennos-server:5555
     tls {{ caddy_email }}
 }
 
 jellyfin.mvl.sh jellyfin.vleeuwen.me {
+    import country_block
     reverse_proxy jellyfin:8096
     tls {{ caddy_email }}
 }
 
 fladder.mvl.sh {
+    import country_block
     reverse_proxy fladder:80
     tls {{ caddy_email }}
 }
 
 ip.mvl.sh {
+    import country_block
     reverse_proxy echoip:8080 {
         header_up X-Real-IP {http.request.remote.host}
         header_up X-Forwarded-For {http.request.remote.host}
@@ -84,6 +121,7 @@ ip.mvl.sh {
 }
 
 http://ip.mvl.sh {
+    import country_block
     reverse_proxy echoip:8080 {
         header_up X-Real-IP {http.request.remote.host}
         header_up X-Forwarded-For {http.request.remote.host}