Add country-based IP blocking for Caddy via Ansible

- Introduce generate_country_blocks.py to fetch IP ranges by country
- Update group_vars/servers.yml with country blocking settings
- Add country_block snippet to Caddyfile and apply to all sites
- Create Ansible tasks for automated IP range generation and integration
- Add documentation for configuring and managing country blocking

config/ansible/tasks/servers/services/caddy/country-blocking.yml

@@ -0,0 +1,52 @@
+---
+- name: Country blocking setup for Caddy
+  block:
+    - name: Ensure Python requests module is installed
+      ansible.builtin.pip:
+        name: requests
+        state: present
+      when: enable_country_blocking | default(false)
+
+    - name: Copy country blocking script
+      ansible.builtin.copy:
+        src: generate_country_blocks.py
+        dest: "{{ caddy_service_dir }}/generate_country_blocks.py"
+        mode: '0755'
+      when: enable_country_blocking | default(false)
+
+    - name: Generate country IP ranges
+      ansible.builtin.command:
+        cmd: "python3 {{ caddy_service_dir }}/generate_country_blocks.py {{ blocked_countries_codes | join(' ') }} --format=list"
+      register: country_ranges_result
+      when:
+        - enable_country_blocking | default(false)
+        - blocked_countries_codes | default([]) | length > 0
+      changed_when: false
+
+    - name: Set country IP ranges fact
+      ansible.builtin.set_fact:
+        blocked_countries: "{{ country_ranges_result.stdout.split('\n') | select('match', '^[0-9]') | list }}"
+      when:
+        - enable_country_blocking | default(false)
+        - country_ranges_result is defined
+        - country_ranges_result.stdout is defined
+
+    - name: Display blocked countries info
+      ansible.builtin.debug:
+        msg:
+          - "Country blocking enabled: {{ enable_country_blocking | default(false) }}"
+          - "Countries to block: {{ blocked_countries_codes | default([]) | join(', ') }}"
+          - "IP ranges found: {{ blocked_countries | default([]) | length }}"
+      when: enable_country_blocking | default(false)
+
+    - name: Fallback to empty list if no ranges generated
+      ansible.builtin.set_fact:
+        blocked_countries: []
+      when:
+        - enable_country_blocking | default(false)
+        - blocked_countries is not defined
+
+  tags:
+    - caddy
+    - security
+    - country-blocking