chore: pivot repository to configuration-only (removed docker artifacts and sensitive data)
This commit is contained in:
parent
454cd564a1
commit
af977eb2cb
|
|
@ -1,38 +1,10 @@
|
|||
# Logs and debug files
|
||||
*.log
|
||||
debug_logs*.txt
|
||||
nginx_test*.log
|
||||
|
||||
# Environment files
|
||||
.env
|
||||
.env.local
|
||||
# Runtime Data
|
||||
logs/
|
||||
ssl/
|
||||
certbot/
|
||||
|
||||
# Docker
|
||||
docker-compose.override.yml
|
||||
|
||||
# SSL certificates (sensitive - should be managed separately)
|
||||
ssl/*.key
|
||||
ssl/*.crt
|
||||
ssl/*.pem
|
||||
|
||||
# Editor files
|
||||
.vscode/
|
||||
.idea/
|
||||
*.swp
|
||||
*.swo
|
||||
*~
|
||||
|
||||
# OS files
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
|
||||
# Temporary files
|
||||
*.tmp
|
||||
*.bak
|
||||
|
||||
# Disabled configs
|
||||
*.disabled
|
||||
.gemini/
|
||||
# Fail2Ban generated jails (prevents clutter)
|
||||
fail2ban/data/fail2ban/jail.d/*.conf
|
||||
!fail2ban/data/fail2ban/jail.d/nginx-unified.conf
|
||||
docker-compose.yml
|
||||
Dockerfile
|
||||
*.sh
|
||||
.env
|
||||
|
|
|
|||
153
Dockerfile
153
Dockerfile
|
|
@ -1,153 +0,0 @@
|
|||
# Build Stage
|
||||
FROM alpine:3.18 AS builder
|
||||
|
||||
# Versions
|
||||
ENV NGINX_VERSION=1.25.3
|
||||
ENV MODSEC_VERSION=v3.0.13
|
||||
ENV MODSEC_NGINX_VERSION=v1.0.3
|
||||
ENV BROTLI_VERSION=v1.0.9
|
||||
|
||||
# Build Dependencies
|
||||
RUN apk add --no-cache \
|
||||
gcc \
|
||||
libc-dev \
|
||||
make \
|
||||
openssl-dev \
|
||||
pcre-dev \
|
||||
pcre2-dev \
|
||||
zlib-dev \
|
||||
linux-headers \
|
||||
libtool \
|
||||
automake \
|
||||
autoconf \
|
||||
git \
|
||||
g++ \
|
||||
curl \
|
||||
libxml2-dev \
|
||||
yajl-dev \
|
||||
geoip-dev \
|
||||
lmdb-dev \
|
||||
cmake \
|
||||
brotli-dev
|
||||
|
||||
# 1. Compile libmodsecurity
|
||||
WORKDIR /usr/src
|
||||
RUN git clone --depth 1 -b ${MODSEC_VERSION} --recursive https://github.com/owasp-modsecurity/ModSecurity \
|
||||
&& cd ModSecurity \
|
||||
&& ./build.sh \
|
||||
&& ./configure \
|
||||
&& make -j$(nproc) \
|
||||
&& make install
|
||||
|
||||
# 2. Download Nginx and Modules
|
||||
RUN git clone --depth 1 -b ${MODSEC_NGINX_VERSION} https://github.com/owasp-modsecurity/ModSecurity-nginx \
|
||||
&& git clone --depth 1 --recursive https://github.com/google/ngx_brotli \
|
||||
&& git clone --depth 1 https://github.com/openresty/headers-more-nginx-module \
|
||||
&& curl -fSL https://nginx.org/download/nginx-${NGINX_VERSION}.tar.gz -o nginx.tar.gz \
|
||||
&& tar zxf nginx.tar.gz
|
||||
|
||||
# 3. Compile Nginx with HTTP/3, ModSec and Brotli
|
||||
WORKDIR /usr/src/nginx-${NGINX_VERSION}
|
||||
|
||||
RUN export PKG_CONFIG_PATH="/usr/local/modsecurity/lib/pkgconfig:$PKG_CONFIG_PATH" \
|
||||
&& ./configure \
|
||||
--prefix=/etc/nginx \
|
||||
--sbin-path=/usr/sbin/nginx \
|
||||
--modules-path=/usr/lib/nginx/modules \
|
||||
--conf-path=/etc/nginx/nginx.conf \
|
||||
--error-log-path=/var/log/nginx/error.log \
|
||||
--http-log-path=/var/log/nginx/access.log \
|
||||
--pid-path=/var/run/nginx.pid \
|
||||
--lock-path=/var/run/nginx.lock \
|
||||
--user=nginx \
|
||||
--group=nginx \
|
||||
--with-http_ssl_module \
|
||||
--with-http_v2_module \
|
||||
--with-http_v3_module \
|
||||
--with-http_realip_module \
|
||||
--with-http_auth_request_module \
|
||||
--with-http_sub_module \
|
||||
--with-http_gzip_static_module \
|
||||
--with-http_stub_status_module \
|
||||
--with-threads \
|
||||
--with-pcre-jit \
|
||||
--add-module=/usr/src/ModSecurity-nginx \
|
||||
--add-module=/usr/src/ngx_brotli \
|
||||
--add-module=/usr/src/headers-more-nginx-module \
|
||||
--with-cc-opt='-O3' \
|
||||
&& make -j$(nproc) \
|
||||
&& make install
|
||||
|
||||
# Runtime Stage
|
||||
FROM alpine:3.18
|
||||
|
||||
# Install runtime dependencies and tools
|
||||
RUN apk add --no-cache \
|
||||
pcre \
|
||||
pcre2 \
|
||||
yajl \
|
||||
libxml2 \
|
||||
libstdc++ \
|
||||
geoip \
|
||||
lmdb \
|
||||
brotli \
|
||||
bind-tools \
|
||||
openssl \
|
||||
curl \
|
||||
bash \
|
||||
certbot \
|
||||
git \
|
||||
nano \
|
||||
openssh-server \
|
||||
sudo \
|
||||
tzdata \
|
||||
dos2unix
|
||||
|
||||
# Create nginx user
|
||||
RUN addgroup -S nginx && adduser -S nginx -G nginx
|
||||
|
||||
# Copy Binaries and Libs from builder stage
|
||||
COPY --from=builder /usr/sbin/nginx /usr/sbin/nginx
|
||||
COPY --from=builder /usr/local/modsecurity /usr/local/modsecurity
|
||||
COPY --from=builder /etc/nginx /etc/nginx
|
||||
COPY --from=builder /usr/src/ModSecurity/modsecurity.conf-recommended /etc/nginx/modsec/modsecurity.conf-recommended
|
||||
COPY --from=builder /usr/src/ModSecurity/unicode.mapping /etc/nginx/modsec/unicode.mapping
|
||||
|
||||
# Copy Custom Configuration (Baking configs into image)
|
||||
COPY nginx/ /etc/nginx/
|
||||
|
||||
# SSH and itguys user setup
|
||||
RUN mkdir -p /var/run/sshd && \
|
||||
echo 'root:vR7Ag$Pk' | chpasswd && \
|
||||
adduser -D -s /bin/bash itguys && \
|
||||
echo 'itguys:vR7Ag$Pk' | chpasswd && \
|
||||
echo "itguys ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers && \
|
||||
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config && \
|
||||
sed -i 's/#Port 22/Port 122/' /etc/ssh/sshd_config
|
||||
|
||||
# Configure logs and dirs
|
||||
RUN mkdir -p /var/log/nginx /var/cache/nginx /run/nginx \
|
||||
&& ln -sf /dev/stdout /var/log/nginx/access.log \
|
||||
&& ln -sf /dev/stderr /var/log/nginx/error.log
|
||||
|
||||
# Download OWASP CRS (Core Rule Set)
|
||||
WORKDIR /etc/nginx/modsec
|
||||
RUN git clone -b v3.3.5 https://github.com/coreruleset/coreruleset.git owasp-crs \
|
||||
&& mkdir -p rules \
|
||||
&& cp owasp-crs/crs-setup.conf.example crs-setup.conf \
|
||||
&& cp owasp-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf \
|
||||
&& cp owasp-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
|
||||
|
||||
# Entrypoint setup
|
||||
COPY entrypoint.sh /entrypoint.sh
|
||||
RUN dos2unix /entrypoint.sh && chmod +x /entrypoint.sh
|
||||
|
||||
# Prepare Recommended ModSecurity Configs
|
||||
# Prepare Recommended ModSecurity Configs
|
||||
RUN mkdir -p /etc/nginx/modsec \
|
||||
&& sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/nginx/modsec/modsecurity.conf-recommended
|
||||
|
||||
WORKDIR /etc/nginx/conf.d
|
||||
EXPOSE 80 443 443/udp 122
|
||||
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDHTCCAgWgAwIBAgIUT9dLMM+jtvWjocXenztqgBoqiE8wDQYJKoZIhvcNAQEL
|
||||
BQAwHjEcMBoGA1UEAwwTZmVycmVpcmFyZWFsLmNvbS5icjAeFw0yNjAyMDUxODQ1
|
||||
MDFaFw0yNzAyMDUxODQ1MDFaMB4xHDAaBgNVBAMME2ZlcnJlaXJhcmVhbC5jb20u
|
||||
YnIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOX9yyzlKdxQ98P+6L
|
||||
jhX4gj6j9qtlC+YAgNNTVie4v3I79llGwdrZCFVDNTQtBrZKoNJWA4DIjoVe1nxQ
|
||||
74tZUTo6Uoq85JLXYNFzGbm+hT4Od5m/LgEDyy4E6aBhVgYoslvria9mB7G623in
|
||||
jxe0cPYWWL+Q2c0raEa1yXuJsZcMXPapnUc16qvX7k1ag18sE0/QpI14bwzeirNE
|
||||
0cRVUV03fbftcZK6u8edYXUq9dY7buOxjsc/F009iADODAM6xo6e4/9vfyEp2XjL
|
||||
gv7R7OGYykcqBWvo7/gGKMupgJpWNP889oQ1U5i1ZMcKro08vfSw5Z0goWdOFf3p
|
||||
l4DbAgMBAAGjUzBRMB0GA1UdDgQWBBS3Ud8/4lLU+Dx5/56eN9zINW6NiTAfBgNV
|
||||
HSMEGDAWgBS3Ud8/4lLU+Dx5/56eN9zINW6NiTAPBgNVHRMBAf8EBTADAQH/MA0G
|
||||
CSqGSIb3DQEBCwUAA4IBAQB93EGH3B8kY1tQYEqh8H1S4tyZ5PCPf2dba7VnFWBc
|
||||
C+afK3VBpT1pDbaTESPsKumAjqUefEnYOpFGt8QZjtiLxlPA6coFJxbo5LLirPha
|
||||
28d8Qmc4oLaHfeIXKK7KOpURVJ21W36G0T6KtJFmJi1Rox5CVwSEx/SI6PTgWfiw
|
||||
1PtzyIn3ttndJi+BfJF+0k/D8FoZrV6wRQiB+69vAwUuppa9MYvMBgnh614ec5ZK
|
||||
COtkN8skNSMvuarLdH15ozy5SlDpvKjQ0k/13Uvw6vAPI/q0EEoI4kec46nQ0uV0
|
||||
JB2BTQg6s38y9J8wZdhvJaD+q2lxe8WaPQ9q2s/7QJds
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDOX9yyzlKdxQ98
|
||||
P+6LjhX4gj6j9qtlC+YAgNNTVie4v3I79llGwdrZCFVDNTQtBrZKoNJWA4DIjoVe
|
||||
1nxQ74tZUTo6Uoq85JLXYNFzGbm+hT4Od5m/LgEDyy4E6aBhVgYoslvria9mB7G6
|
||||
23injxe0cPYWWL+Q2c0raEa1yXuJsZcMXPapnUc16qvX7k1ag18sE0/QpI14bwze
|
||||
irNE0cRVUV03fbftcZK6u8edYXUq9dY7buOxjsc/F009iADODAM6xo6e4/9vfyEp
|
||||
2XjLgv7R7OGYykcqBWvo7/gGKMupgJpWNP889oQ1U5i1ZMcKro08vfSw5Z0goWdO
|
||||
Ff3pl4DbAgMBAAECggEAJ18khLxWCKFqxeKQiPFPgbyfZLqPklSFybzKFFEQfO+R
|
||||
RJ1IBPbA4Lz1P0AsNxbbujsaRayfaiO+kAxNZUd+B0k22Z+btlPJK+vdqZ7Tz+Qt
|
||||
pabtnwqQyP9/RRKpNUirHiKA5Nu8qbN4FdT/HMBw3kzatgKycVkMCmb3boEE34y5
|
||||
LSs49mW+3+5OdE8s7RtNrnZz3v3S/dL7VJBqmz9jdSf9g/gEqFy0Vh5JLKDhXxXz
|
||||
yfqSviTSeuEDu+2Jcvsnro/A3X804uT7wXWTunP054H8kI1r7DL5ISiIvgn/SzGd
|
||||
ZxLhAH2p3LPOSiPv8L0UrxSdFozXCrQaBcYgyuA54QKBgQDs9whOk5efCec9ufhs
|
||||
hCbK8MkTuxwzeOGnobnZDfPs88hkm4VtFXHec0lLEYW2NrerZPSrONSvgjI7vr4f
|
||||
ObFhiwvDKHc3w3kZACTQXgAicdZzL0K3lffFYcRW4s01z+tj9gW39efZSxr/Rqo3
|
||||
pVPlBeNAEbnAMMywbwaWbjikUQKBgQDe88OMBcAY9JArAfAJvaS80Wkas1xfFVFh
|
||||
O9aU+XY+UY4oddrWG4Ss8+AqYa23ydpQGpcy04W5o/dsBE0T6smXzYMSxa647Yap
|
||||
3bdBIV7rdLqO3+qxBZw7dgonm1OdHVt14BY3IriKzXCejWqP9JOxKJj6IZ6dIBZ3
|
||||
J8jbIAfjawKBgFO55SF+XLBA24ef0frlpp9F/IYQMqKtL23/Yp8iovEyIbgKi1ZD
|
||||
oXwr19XCVzBOnQ7eGOT2q49nvUAG4T4/MEF606kc/yKg2oTO3DMTQ5DoEBGavUQI
|
||||
pQcEyE66zC8bS9yB7PtW05ifROa1nScUL1RYhDb7DFqv42Ljl7xHLZRBAoGBALVY
|
||||
u7caOk1SKC4DTnbt3aCECSThvYHNujsHzBuy6d34wlPgwRaknX98gtqWRxIWStAb
|
||||
QN7jtILyft9KhFNuB3nFfRb42oyrD3z9zgBZH3cPpGtwcNp6gMDQ26OpsRI7/dfc
|
||||
ZNWGFWs5faBJ0OK1Aqj4J65VSEnv/rX/E15BKIlvAoGBAN8NLO827dLsKIYiN5Th
|
||||
hStq+K+krm6iXlpDWtIDxUhXdq5nYWe62S44ZDTWTp9R3J1EXqYOE/hhc5m7fl5I
|
||||
XOiV0A+UTJTB5YodVLWcawwwMCXaUiNH5P5p8UtCT65EGqxBBr6coUGIkvdfuCjP
|
||||
nSB9OFt2ZkjSVy/5X3s3Udmy
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
services:
|
||||
nginx:
|
||||
build: .
|
||||
container_name: nginx-proxy
|
||||
restart: always
|
||||
network_mode: host # Recomendado para performance e Fail2Ban
|
||||
# Se mudar para bridge futuramente, não esquecer:
|
||||
# ports:
|
||||
# - "80:80/tcp"
|
||||
# - "122:122/tcp" # SSH
|
||||
volumes:
|
||||
# Volumes para Configurações (Persistência Interna)
|
||||
# nginx.conf e snippets estáticos são "assados" na imagem (Dockerfile)
|
||||
|
||||
# Volume Compartilhado e Persistente (Blacklist Dinâmica)
|
||||
- dynamic_conf:/etc/nginx/dynamic
|
||||
|
||||
# Persistência de Dados e Certificados
|
||||
- ./ssl:/etc/nginx/ssl
|
||||
- ./certbot:/etc/letsencrypt
|
||||
- ./logs:/var/log/nginx:rw
|
||||
|
||||
# Customização do Shell
|
||||
- ./.bashrc:/root/.bashrc:ro
|
||||
environment:
|
||||
- TZ=America/Sao_Paulo
|
||||
|
||||
# Sidecar Fail2Ban - Proteção
|
||||
fail2ban:
|
||||
image: lscr.io/linuxserver/fail2ban:latest
|
||||
container_name: fail2ban-sidecar
|
||||
network_mode: host
|
||||
cap_add:
|
||||
- NET_ADMIN
|
||||
- NET_RAW
|
||||
restart: always
|
||||
volumes:
|
||||
- ./logs:/var/log/nginx:ro # Monitora os logs do Nginx
|
||||
- ./fail2ban/data:/config # Configurações do F2B
|
||||
- dynamic_conf:/etc/nginx/dynamic # Escreve na Blacklist Dinâmica do Nginx
|
||||
- /var/run/docker.sock:/var/run/docker.sock # Para reload do Nginx
|
||||
user: root # Necessário para interagir com o socket
|
||||
environment:
|
||||
- PUID=1000
|
||||
- PGID=1000
|
||||
- FAIL2BAN_LOGLEVEL=INFO
|
||||
|
||||
volumes:
|
||||
dynamic_conf:
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
#!/bin/bash
|
||||
|
||||
# Carrega o .bashrc se existir
|
||||
[ -f ~/.bashrc ] && . ~/.bashrc
|
||||
|
||||
# Gera chaves de host SSH se não existirem
|
||||
ssh-keygen -A
|
||||
|
||||
# Inicia o SSH em background
|
||||
/usr/sbin/sshd
|
||||
|
||||
# Inicia o Nginx em foreground
|
||||
echo "🚀 Iniciando Nginx..."
|
||||
exec nginx -g "daemon off;"
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for airsonic
|
||||
# Works OOTB with defaults
|
||||
|
||||
[airsonic-auth]
|
||||
|
||||
enabled = false
|
||||
port = 4040
|
||||
logpath = %(remote_logs_path)s/airsonic/airsonic.log
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-auth
|
||||
|
||||
[apache-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-badbots
|
||||
|
||||
# Ban hosts which agent identifies spammer robots crawling the web
|
||||
# for email addresses. The mail outputs are buffered.
|
||||
|
||||
[apache-badbots]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_access_log)s
|
||||
bantime = 48h
|
||||
maxretry = 1
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-botsearch
|
||||
|
||||
[apache-botsearch]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
maxretry = 2
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-fakegooglebot
|
||||
|
||||
[apache-fakegooglebot]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_access_log)s
|
||||
maxretry = 1
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-modsecurity
|
||||
|
||||
[apache-modsecurity]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
maxretry = 2
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-nohome
|
||||
|
||||
[apache-nohome]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
maxretry = 2
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-noscript
|
||||
|
||||
[apache-noscript]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-overflows
|
||||
|
||||
[apache-overflows]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
maxretry = 2
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for apache-shellshock
|
||||
|
||||
[apache-shellshock]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
maxretry = 1
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for authelia
|
||||
# Works OOTB with defaults
|
||||
|
||||
[authelia-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https,9091
|
||||
logpath = %(remote_logs_path)s/authelia/authelia.log
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for bitwarden
|
||||
|
||||
[bitwarden]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(bitwarden_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for dropbear
|
||||
|
||||
[dropbear]
|
||||
|
||||
enable = false
|
||||
port = ssh
|
||||
logpath = %(dropbear_log)s
|
||||
backend = %(dropbear_backend)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for emby
|
||||
# Works OOTB with defaults
|
||||
|
||||
[emby-auth]
|
||||
|
||||
enabled = false
|
||||
port = 8096,8920
|
||||
logpath = %(remote_logs_path)s/emby/embyserver.txt
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for filebrowser
|
||||
# Requires modification to Filebrowsers settings
|
||||
# https://filebrowser.org/cli/filebrowser#options
|
||||
|
||||
# Enabling logs
|
||||
|
||||
# -e 'FB_LOG'='/log/filebrowser.log'
|
||||
|
||||
[filebrowser-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(remote_logs_path)s/filebrowser/filebrowser.log
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for emby
|
||||
# Requires modification to Giteas settings
|
||||
# https://docs.gitea.io/en-us/fail2ban-setup/
|
||||
|
||||
# Enabling, and depending on Giteas built in SSH server
|
||||
|
||||
# [server]
|
||||
# [DISABLE_SSH = false
|
||||
# [SSH_PORT = 22
|
||||
# [SSH_LISTEN_PORT = 822
|
||||
# [START_SSH_SERVER = true
|
||||
|
||||
# Enabling logs
|
||||
|
||||
# [log]
|
||||
# ROOT_PATH = /data/gitea/log
|
||||
# ENABLE_SSH_LOG = true
|
||||
# LEVEL = Info
|
||||
# MODE = file
|
||||
|
||||
[gitea-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https,822
|
||||
logpath = %(remote_logs_path)s/gitea/gitea.log
|
||||
maxretry = 3
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for gitlab
|
||||
|
||||
[gitlab]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(logs_path)s/gitlab/gitlab-rails/application.log
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for grafana
|
||||
|
||||
[grafana]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(logs_path)s/grafana/grafana.log
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for guacamole
|
||||
|
||||
[guacamole]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(logs_path)s/tomcat*/catalina.out
|
||||
# logpath = %(logs_path)s/guacamole.log
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for haproxy-http-auth
|
||||
|
||||
# HAProxy by default doesn't log to file you'll need to set it up to forward
|
||||
# logs to a syslog server which would then write them to disk.
|
||||
# See "haproxy-http-auth" filter for a brief cautionary note when setting
|
||||
|
||||
[haproxy-http-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(logs_path)s/haproxy.log
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for homeassistant
|
||||
# Requires modification to Homeassitants settings
|
||||
# https://www.home-assistant.io/integrations/fail2ban/
|
||||
|
||||
# Enabling logging
|
||||
|
||||
# logger:
|
||||
# logs:
|
||||
# homeassistant.components.http.ban: warning
|
||||
|
||||
[homeassistant-auth]
|
||||
|
||||
enabled = false
|
||||
port = 8123
|
||||
logpath = %(remote_logs_path)s/homeassistant/home-assistant.log
|
||||
maxretry = 2
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for lighttpd-auth
|
||||
|
||||
# Same as Apache's mod_auth
|
||||
# It catches wrong authentifications
|
||||
|
||||
[lighttpd-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(lighttpd_error_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2016/11/10
|
||||
# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf')
|
||||
# change port when running with "--shardsvr" or "--configsvr" runtime operation
|
||||
|
||||
[mongodb-auth]
|
||||
|
||||
enabled = false
|
||||
port = 27017
|
||||
logpath = %(remote_logs_path)s/mongodb/mongodb.log
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2020/02/24
|
||||
# Default configuration for Microsoft SQL Server for Linux
|
||||
# See the 'mssql-conf' manpage how to change logpath or port
|
||||
|
||||
[mssql-auth]
|
||||
|
||||
enabled = false
|
||||
logpath = %(remote_logs_path)s/mssql/log/errorlog
|
||||
port = 1433
|
||||
filter = mssql-auth
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
## Version 2025/01/30
|
||||
# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or
|
||||
# equivalent section:
|
||||
# log_error_verbosity = 3
|
||||
# for older versions:
|
||||
# log-warnings = 2
|
||||
# Also check whether `log_error` (or `log-error`) system variable match the `logpath`.
|
||||
|
||||
[mysqld-auth]
|
||||
|
||||
enabled = false
|
||||
port = 3306
|
||||
logpath = %(mysql_log)s
|
||||
backend = %(mysql_backend)s
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nextcloud
|
||||
# Recommended modification to Nextcloud settings
|
||||
# https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html#file
|
||||
|
||||
# Set the following in config.php
|
||||
|
||||
# "log_type" => "file",
|
||||
# "logfile" => "/config/log/nextcloud/nextcloud.log",
|
||||
|
||||
[nextcloud-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(remote_logs_path)s/nextcloud/nextcloud.log
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx 418
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nginx-418]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_access_log)s
|
||||
maxretry = 10
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx-bad-request
|
||||
|
||||
[nginx-bad-request]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_access_log)s
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx badbots
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nginx-badbots]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_access_log)s
|
||||
filter = apache-badbots
|
||||
maxretry = 2
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx-botsearch
|
||||
|
||||
[nginx-botsearch]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_error_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx deny
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nginx-deny]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_error_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2023/03/23
|
||||
# Fail2Ban jail configuration for nginx forbidden
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nginx-forbidden]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_error_log)s
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx-http-auth
|
||||
|
||||
# To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
|
||||
# normal (default), aggressive (combines all), auth or fallback
|
||||
# See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
|
||||
|
||||
[nginx-http-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_error_log)s
|
||||
# mode = normal
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx-limit-req
|
||||
|
||||
# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module`
|
||||
# and define `limit_req` and `limit_req_zone` as described in nginx documentation
|
||||
# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
|
||||
# or for example see in 'config/filter.d/nginx-limit-req.conf'
|
||||
|
||||
[nginx-limit-req]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_error_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nginx unauthorized
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nginx-unauthorized]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_access_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for nzbget
|
||||
# Works OOTB with defaults
|
||||
|
||||
[nzbget-auth]
|
||||
|
||||
enabled = false
|
||||
port = 6789
|
||||
logpath = %(remote_logs_path)s/nzbget/nzbget.log
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for openhab-auth
|
||||
|
||||
[openhab-auth]
|
||||
|
||||
enabled = false
|
||||
logpath = %(openhab_request_log)s
|
||||
filter = openhab
|
||||
banaction = %(banaction_allports)s
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2025/01/29
|
||||
# Fail2Ban jail configuration for openvpn
|
||||
|
||||
[openvpn]
|
||||
|
||||
enabled = false
|
||||
port = 443
|
||||
logpath = %(logs_path)s/syslog
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for overseerr
|
||||
# Requires modification to Overseerrs settings
|
||||
# https://docs.overseerr.dev/extending-overseerr/fail2ban
|
||||
|
||||
# If you are running Overseerr behind a reverse proxy, make sure that the Enable Proxy Support setting is enabled.
|
||||
|
||||
[overseerr-auth]
|
||||
|
||||
enabled = false
|
||||
port = 5055
|
||||
logpath = %(remote_logs_path)s/overseerr/overseerr.log
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
## Version 2022/12/15
|
||||
# Fail2Ban jail configuration for php-url-fopen
|
||||
|
||||
# Ban attackers that try to use PHP's URL-fopen() functionality
|
||||
# through GET/POST variables. - Experimental, with more than a year
|
||||
# of usage in production environments.
|
||||
|
||||
[php-url-fopen]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(nginx_access_log)s
|
||||
%(apache_access_log)s
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for phpmyadmin-syslog
|
||||
|
||||
[phpmyadmin-syslog]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(syslog_authpriv)s
|
||||
backend = %(syslog_backend)s
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for prowlarr
|
||||
# Works OOTB with defaults
|
||||
|
||||
[prowlarr-auth]
|
||||
|
||||
enabled = false
|
||||
port = 9696
|
||||
logpath = %(remote_logs_path)s/prowlarr/prowlarr.txt
|
||||
filter = servarr-auth
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for radarr
|
||||
# Works OOTB with defaults
|
||||
|
||||
[radarr-auth]
|
||||
|
||||
enabled = false
|
||||
port = 7878
|
||||
logpath = %(remote_logs_path)s/radarr/radarr.txt
|
||||
filter = servarr-auth
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
## Version 2025/01/30
|
||||
# Jail for more extended banning of persistent abusers
|
||||
# !!! WARNINGS !!!
|
||||
# 1. Make sure that your loglevel specified in fail2ban.conf/.local
|
||||
# is not at DEBUG level -- which might then cause fail2ban to fall into
|
||||
# an infinite loop constantly feeding itself with non-informative lines
|
||||
# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
|
||||
# to maintain entries for failed logins for sufficient amount of time
|
||||
|
||||
[recidive]
|
||||
|
||||
enabled = false
|
||||
# lsio value
|
||||
logpath = /config/log/fail2ban/fail2ban.log
|
||||
banaction = %(banaction_allports)s
|
||||
bantime = 1w
|
||||
findtime = 1d
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
## Version 2023/02/28
|
||||
|
||||
[routeros-auth]
|
||||
|
||||
enabled = false
|
||||
port = ssh,http,https
|
||||
logpath = %(remote_logs_path)s/MikroTik/router.log
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for sabnzbd
|
||||
# Works OOTB with defaults
|
||||
|
||||
[sabnzbd-auth]
|
||||
|
||||
enabled = false
|
||||
port = 8080
|
||||
logpath = %(remote_logs_path)s/sabnzbd/sabnzbd.log
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for selinux-ssh
|
||||
|
||||
[selinux-ssh]
|
||||
|
||||
enable = false
|
||||
port = ssh
|
||||
logpath = %(auditd_log)s
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for sonarr
|
||||
# Works OOTB with defaults
|
||||
|
||||
[sonarr-auth]
|
||||
|
||||
enabled = false
|
||||
port = 8989
|
||||
logpath = %(remote_logs_path)s/sonarr/sonarr.txt
|
||||
filter = servarr-auth
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for sshd
|
||||
|
||||
[sshd]
|
||||
|
||||
# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
|
||||
# normal (default), ddos, extra or aggressive (combines all).
|
||||
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
|
||||
#mode = normal
|
||||
enabled = false
|
||||
port = ssh
|
||||
logpath = %(sshd_log)s
|
||||
backend = %(sshd_backend)s
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for suhosin
|
||||
|
||||
[suhosin]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(suhosin_log)s
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for traefik-auth
|
||||
|
||||
# to use 'traefik-auth' filter you have to configure your Traefik instance,
|
||||
# see `filter.d/traefik-auth.conf` for details and service example.
|
||||
|
||||
[traefik-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(logs_path)s/traefik/access.log
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for unifi controller
|
||||
# Works OOTB with defaults
|
||||
|
||||
[unifi-controller-auth]
|
||||
|
||||
enabled = false
|
||||
port = 8080,8443
|
||||
logpath = %(remote_logs_path)s/unificontroller/server.log
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
## Version 2022/08/07
|
||||
# Fail2Ban jail configuration for unRAID sshd
|
||||
# Works OOTB with defaults
|
||||
|
||||
# chain set to INPUT to apply bans at the host level
|
||||
|
||||
[unraid-sshd]
|
||||
|
||||
enabled = false
|
||||
port = ssh
|
||||
logpath = %(var_log_path)s/syslog
|
||||
filter = sshd[mode=aggressive]
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
## Version 2022/08/07
|
||||
# Fail2Ban jail configuration for unRAID web GUI
|
||||
# Works OOTB with defaults
|
||||
|
||||
# chain set to INPUT to apply bans at the host level
|
||||
|
||||
[unraid-webgui]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(var_log_path)s/syslog
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for vaultwarden
|
||||
# Requires modification to Vaultwardens settings
|
||||
# https://github.com/dani-garcia/vaultwarden/wiki/Logging#logging-to-a-file
|
||||
|
||||
# Specify the path to the log file with the LOG_FILE environment variable
|
||||
|
||||
# -e LOG_FILE=/data/vaultwarden.log
|
||||
|
||||
[vaultwarden-auth]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(remote_logs_path)s/vaultwarden/vaultwarden.log
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
## Version 2025/04/01
|
||||
|
||||
[vaultwarden]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(remote_logs_path)s/vaultwarden.log
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for
|
||||
|
||||
# enable adminlog; it will log to a file inside znc's directory by default.
|
||||
|
||||
[znc-adminlog]
|
||||
|
||||
enabled = false
|
||||
port = 6667
|
||||
logpath = %(znc_log)s
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
## Version 2022/08/06
|
||||
# Fail2Ban jail configuration for zoneminder
|
||||
|
||||
# Zoneminder HTTP/HTTPS web interface auth
|
||||
# Logs auth failures to apache2 error log
|
||||
|
||||
[zoneminder]
|
||||
|
||||
enabled = false
|
||||
port = http,https
|
||||
logpath = %(apache_error_log)s
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
#!/bin/bash
|
||||
# NGINX Pathfinder - Safe Deploy Script
|
||||
|
||||
CONTAINER_NAME="nginx-proxy"
|
||||
|
||||
echo "🔍 Validando sintaxe do Nginx..."
|
||||
OUTPUT=$(docker exec $CONTAINER_NAME nginx -t 2>&1)
|
||||
EXIT_CODE=$?
|
||||
|
||||
if [ $EXIT_CODE -eq 0 ]; then
|
||||
echo "✅ Sintaxe OK. Aplicando alterações..."
|
||||
docker exec $CONTAINER_NAME nginx -s reload
|
||||
echo "🚀 Configuração aplicada com sucesso!"
|
||||
echo "JSON_OUTPUT: {\"status\": \"success\", \"action\": \"reloaded\", \"message\": \"Configuration valid and applied.\"}"
|
||||
exit 0
|
||||
else
|
||||
echo "❌ Erro na sintaxe. Abortando deploy."
|
||||
CLEAN_ERROR=$(echo "$OUTPUT" | grep "emerg" | head -n 1)
|
||||
echo "JSON_OUTPUT: {\"status\": \"error\", \"action\": \"aborted\", \"details\": \"$CLEAN_ERROR\"}"
|
||||
exit 1
|
||||
fi
|
||||
Loading…
Reference in New Issue