External Dynamic Lists for
AI Domain Blocking

# /etc/nginx/sites-available/edl.conf
# nginx virtual host for serving the AI-tool EDL

server {
    listen       443 ssl http2;
    server_name  edl.internal.example.com;

    ssl_certificate      /etc/ssl/certs/edl.pem;
    ssl_certificate_key  /etc/ssl/private/edl.key;
    ssl_protocols        TLSv1.2 TLSv1.3;
    ssl_ciphers          HIGH:!aNULL:!MD5;

    root  /var/www/edl;
    index index.txt;

    # Serve the EDL file with correct headers
    location /ai-tools.txt {
        default_type  text/plain;
        charset       utf-8;

        # Cache-Control: firewall gets fresh content every 5 minutes
        add_header  Cache-Control "public, max-age=300, must-revalidate";
        add_header  X-EDL-Generated $date_gmt;
        add_header  X-EDL-Source "aitoolsblocklist.com";

        # ETag for conditional requests (If-None-Match)
        etag on;

        # Restrict access to firewall management IPs
        allow  10.0.0.0/8;
        allow  172.16.0.0/12;
        allow  192.168.0.0/16;
        deny   all;
    }

    # Health check endpoint for monitoring
    location /health {
        return 200 "OK\n";
        add_header Content-Type text/plain;
    }

    access_log  /var/log/nginx/edl-access.log;
    error_log   /var/log/nginx/edl-error.log;
}

#!/usr/bin/env python3
# edl_update.py — Fetch AI-tool domains from API and write EDL file
# Run via cron: 0 2 * * * /usr/local/bin/edl_update.py

import requests, tempfile, os, sys
from datetime import datetime, timezone

API_URL   = "https://api.aitoolsblocklist.com/v1/domains"
API_KEY   = os.environ["BLOCKLIST_API_KEY"]
EDL_PATH  = "/var/www/edl/ai-tools.txt"
EDL_DIR   = os.path.dirname(EDL_PATH)

def fetch_domains():
    resp = requests.get(API_URL, headers={
        "Authorization": f"Bearer {API_KEY}",
        "Accept": "text/plain"
    }, params={
        "format": "plain",
        "status": "active",
        "min_confidence": "0.8"
    }, timeout=60)
    resp.raise_for_status()
    return resp.text.strip().splitlines()

def write_edl(domains):
    now = datetime.now(timezone.utc).isoformat()
    header = f"""# AI Tools Blocklist — External Dynamic List
# Generated: {now}
# Entries: {len(domains)}
# Source: https://aitoolsblocklist.com
# Update frequency: daily
"""
    # Atomic write: temp file + rename
    fd, tmp = tempfile.mkstemp(dir=EDL_DIR, suffix=".tmp")
    try:
        with os.fdopen(fd, "w") as f:
            f.write(header)
            for d in domains:
                f.write(d.strip() + "\n")
        os.chmod(tmp, 0o644)
        os.rename(tmp, EDL_PATH)  # atomic on same filesystem
    except:
        os.unlink(tmp)
        raise

if __name__ == "__main__":
    domains = fetch_domains()
    if len(domains) < 1000:
        print(f"Sanity check failed: only {len(domains)} domains", file=sys.stderr)
        sys.exit(1)
    write_edl(domains)
    print(f"EDL updated: {len(domains)} domains written to {EDL_PATH}")

# PAN-OS CLI — Configure an External Dynamic List for AI-tool domains

# Step 1: Create the EDL object
set external-list ai-tools-blocklist type domain recurring hourly \
  url "https://feeds.aitoolsblocklist.com/v1/edl?key=YOUR_API_KEY&format=plain" \
  description "AI Tools Blocklist — 16,024+ domains, 18 categories, updated daily"

# Step 2: Create a URL filtering profile that references the EDL
set profiles url-filtering ai-block-profile \
  block-list ai-tools-blocklist \
  action block

# Step 3: Create a security policy rule
set rulebase security rules Block-AI-Tools \
  from trust \
  to untrust \
  source any \
  destination any \
  application any \
  service application-default \
  action deny \
  profile-setting profiles url-filtering ai-block-profile \
  log-start yes \
  log-end yes

# Step 4: Commit the configuration
commit

# Verify the EDL is loaded and the entry count is correct
request system external-list show name ai-tools-blocklist