migrate middlewares to entrypoint + refactor

nixos/viridian/services/traefik/middlewares.nix

@@ -1,12 +1,6 @@
 {...}: {
   # Attached to the routers, pieces of middleware are a means of tweaking the requests before they are sent to your service
   services.traefik.dynamicConfigOptions.http.middlewares = {
-    # Restrict access to internal networks
-    internal.ipwhitelist.sourcerange = [
-      "127.0.0.1/32" # localhost
-      "192.168.50.1/24" # lan
-    ];
-
     # Restrict access based on geo-location
     geoblock.plugin.geoblock = {
       silentStartUp = "false";
@@ -20,9 +14,37 @@
       apiTimeoutMs = "750";
       # Max size of least recently used cache
       cacheSize = "25";
-      # List of countries to block access
+      # OFAC (US) sanctions list
       countries = [
+        "AF" # Afghanistan
+        "AL" # Albania
+        "BA" # Bosnia and Herzegovina
+        "BY" # Belarus
+        "CF" # Central African Republic (the)
+        "CN" # China
+        "CD" # Congo (the Democratic Republic of the)
+        "CU" # Cuba
+        "ET" # Ethiopia
+        "HK" # Hong Kong
+        "IR" # Iran (Islamic Republic of)
+        "IQ" # Iraq
+        "KP" # Korea (the Democratic People's Republic of)
+        "LB" # Lebanon
+        "LY" # Libya
+        "ML" # Mali
+        "ME" # Montenegro
+        "MM" # Myanmar
+        "MK" # Republic of North Macedonia
+        "NI" # Nicaragua
         "RU" # Russian Federation (the)
+        "RS" # Serbia
+        "SO" # Somalia
+        "SS" # South Sudan
+        "SD" # Sudan (the)
+        "SY" # Syrian Arab Republic
+        "UA" # Ukraine
+        "VE" # Venezuela (Bolivarian Republic of)
+        "YE" # Yemen
       ];
       # Inverts filter logic
       blackListMode = "true";