update_cf.sh

#!/bin/bash

set -e

cf_ips() {
  echo "# https://www.cloudflare.com/ips"
  echo 'geo $realip_remote_addr $cf {'
  echo -e "\tdefault 0;"
  for type in v4 v6; do
    echo -e "\t# IP$type"
    curl -s "https://www.cloudflare.com/ips-$type" | sed "s|^|\t|g" | sed "s|\$| 1;|g"
  done
  echo "}"
}

cf_ips > /etc/nginx/conf_extra.d/allow-cloudflare-only.conf
nginx -t && systemctl restart nginx