Infinidoge/universe
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Infini-OPTIPLEX: add nginx url probe jail

Browse source
This commit is contained in:
Infinidoge 2024-04-26 05:23:15 -04:00
parent 75c4e4294b
commit 6fc8b69fff
Signed by: Infinidoge
SSH key fingerprint: SHA256:VEv3zmkBzcYYle6/37h+BbOyNDbGy/o8SHh7fcs9RbQ
2 changed files with 20 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
hosts/Infini-OPTIPLEX/default.nix
View file

@ -60,6 +60,21 @@
services.fail2ban.enable = true;
environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
'');
services.fail2ban.jails.nginx-url-probe.settings = {
enabled = true;
filter = "nginx-url-probe";
logpath = "/var/log/nginx/access.log";
action = "%(action_)s[blocktype=DROP]";
backend = "auto";
maxretry = 5;
findtime = 600;
};
services.nginx.enable = true;
security.acme.certs."inx.moe" = {

14
hosts/Infini-OPTIPLEX/web.nix
View file

@ -23,18 +23,14 @@ in
root = "/srv/web/inx.moe";
tryFiles = "$uri $uri.html $uri/ =404";
extraConfig = ''
deny all;
error_page 403 /403.html;
error_page 404 /404.html;
error_page 403 404 /404.html;
location ^~ /.well-known { allow all; }
location = /template.html { deny all; }
location /.git { deny all; }
location = /404.html { allow all; internal; }
location ~* "\.(html|css|txt)$" { allow all; }
location ~ "/[^.]+" { allow all; }
location ~ "/$" { allow all; }
location ~* "\.(nix|lock)" { deny all; }
location ~ "/\..+" { deny all; }
'';
};
};