Nginx whitelist update script (403 for not whitelisted)

update-cloudflare-nginx.sh

#!/bin/bash

set -e

#
# Whitelist config file.
#
# Make sure 
#   include /etc/nginx/conf.d/*.conf;
# is present inside the http {} block of
# /etc/nginx/nginx.conf
#
FIREWALL_FILE="/etc/nginx/conf.d/cloudflare.conf"

if [ "$EUID" -ne 0 ]
  then echo "Please run as root"
  exit 1
fi

cf_ips() {
  echo "# https://www.cloudflare.com/ips"

  for type in v4 v6; do
    echo "# IP$type"
    curl -sL "https://www.cloudflare.com/ips-$type/" | sed "s|^|allow |g" | sed "s|\$|;|g"
    echo
  done

  echo "# Generated at $(LC_ALL=C date)"
  echo "deny all; # deny all remaining ips"
}

cf_ips | tee "$FIREWALL_FILE"
systemctl restart nginx