From 5b79002894c20601b9cf80d0aa525051dded4564 Mon Sep 17 00:00:00 2001
From: Andrew Kostka <andrew.kostka@wikimedia.de>
Date: Mon, 30 Oct 2023 10:19:06 +0000
Subject: [PATCH] feat(nginx): allow blocking certain user-agents on production

---
 k8s/helmfile/env/production/platform-nginx.nginx.conf | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/k8s/helmfile/env/production/platform-nginx.nginx.conf b/k8s/helmfile/env/production/platform-nginx.nginx.conf
index dbf9c2e85..b28ff3d1f 100644
--- a/k8s/helmfile/env/production/platform-nginx.nginx.conf
+++ b/k8s/helmfile/env/production/platform-nginx.nginx.conf
@@ -18,6 +18,11 @@ map $request_uri $mwgroup {
         default "web";
 }
 
+map $http_user_agent $blocked_agent {
+        ~Bytespider 1;
+        default 0;
+}
+
 server {
         listen 8080;
         server_name _; # This is just an invalid value which will never trigger on a real hostname.
@@ -65,6 +70,10 @@ server {
 
         proxy_max_temp_file_size                1024m;
 
+        if ($blocked_agent) {
+                return 444;
+        }
+
         # Allowoverriding the group decision using the magic header
         if ($http_x_wbstack_alpha) {
                 set $mwgroup "alpha";