Remotely connect to fail2ban to do ports

Traefik can affect the edge, so blocks work there and prevent traffic hitting home network.

ansible/roles/gateway/files/haproxy-fail2ban-jail.conf

@@ -1,10 +1,16 @@
 [haproxy]
 enabled  = true
 bantime  = 600
-findtime = 60
+findtime = 10
-maxretry = 15
+maxretry = 100
 filter   = haproxy-basic
 backend  = systemd
 journalmatch = _COMM=haproxy
 port     = http,https
 ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }}
+
+[traefik]
+enabled = true
+filter = haproxy-basic  # Not actually used
+port     = http,https
+ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }}

ansible/roles/traefik/files/fail2ban/remote-action.conf

@@ -0,0 +1,6 @@
+[Definition]
+actionban   = ssh -p 7743 f2b@{{ nebula.clients.casey.ip }} -i /root/.ssh/f2b/id_ed25519 set traefik banip <ip>
+actionunban = ssh -p 7743 f2b@{{ nebula.clients.casey.ip }} -i /root/.ssh/f2b/id_ed25519 set traefik unbanip <ip>
+actioncheck =
+actionstart =
+actionstop =

ansible/roles/traefik/files/fail2ban/traefik-jail.conf

@@ -1,9 +1,10 @@
 [traefik]
 enabled  = true
 bantime  = 6000
-findtime = 600
+findtime = 300
 maxretry = 5
 filter   = traefik
 logpath = /tmp/traefik-logs/access.log
 port     = http,https
 ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }}
+action = gateway

ansible/roles/traefik/tasks/fail2ban.yml

@@ -13,3 +13,11 @@
     mode: 0644
   become: true
   notify: restart fail2ban
+
+- name: Create action
+  template:
+    src: files/fail2ban/remote-action.conf
+    dest: /etc/fail2ban/action.d/gateway.conf
+    mode: 0644
+  become: true
+  notify: restart fail2ban