infrastructure/ansible/roles/gateway/files/nginx-fail2ban-jail.conf

[nginx]
enabled  = true
bantime  = 600
findtime = 10
maxretry = 100
filter   = nginx-tcp
logpath  = /var/log/nginx/ips.log
port     = http,https,8448
ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }},{{ vps_hosts.values()|sort|join(",") }},{{ tailscale_cidr }}

[traefik]
enabled = true
port     = http,https,8448
ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }},{{ vps_hosts.values()|sort|join(",") }},{{ tailscale_cidr }}
Replace edge proxy with nginx The config makes more sense, and it has more of the features I need, which will come later. 2021-08-22 22:34:27 +01:00			`[nginx]`
Revert "Remove fail2ban" This reverts commit 1f0e33acc8f93bcf793bff5a90ee2d0bca780150. 2020-10-16 19:08:49 +01:00			`enabled = true`
			`bantime = 600`
Remotely connect to fail2ban to do ports Traefik can affect the edge, so blocks work there and prevent traffic hitting home network. 2021-03-28 16:06:36 +01:00			`findtime = 10`
			`maxretry = 100`
Replace edge proxy with nginx The config makes more sense, and it has more of the features I need, which will come later. 2021-08-22 22:34:27 +01:00			`filter = nginx-tcp`
			`logpath = /var/log/nginx/ips.log`
Fix matrix federation Apparently this has been broken since like March... It seems communication over port 8448 is required for server-to-server comms, even if the client doesn't use it. 2021-06-12 16:47:51 +01:00			`port = http,https,8448`
Allow tailscale IP in more places 2024-02-07 18:21:16 +00:00			`ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }},{{ vps_hosts.values()\|sort\|join(",") }},{{ tailscale_cidr }}`
Remotely connect to fail2ban to do ports Traefik can affect the edge, so blocks work there and prevent traffic hitting home network. 2021-03-28 16:06:36 +01:00
			`[traefik]`
			`enabled = true`
Fix matrix federation Apparently this has been broken since like March... It seems communication over port 8448 is required for server-to-server comms, even if the client doesn't use it. 2021-06-12 16:47:51 +01:00			`port = http,https,8448`
Allow tailscale IP in more places 2024-02-07 18:21:16 +00:00			`ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }},{{ vps_hosts.values()\|sort\|join(",") }},{{ tailscale_cidr }}`