From 400e8f00feb1be733524d2d74db87c9241741b01 Mon Sep 17 00:00:00 2001 From: pierre Date: Thu, 5 Mar 2026 21:07:28 +0000 Subject: [PATCH] adding all missed external_manifests --- .../bitwarden.backup_db.cronjob.yaml | 46 +++++++ .../django/django-db.secret.yaml | 1 - external_manifests/django/django-db.svc.yaml | 17 +++ .../django/kubeconfig.secret.yaml | 3 +- external_manifests/fail2ban/command.txt | 1 + ...il2ban-nginx-http-auth-jail.configmap.yaml | 23 ++++ ...n-nginx-unauthorized-filter.configmap.yaml | 30 +++++ .../fail2ban/fail2ban.Role.yaml | 19 +++ .../fail2ban/fail2ban.RoleBinding.yaml | 15 +++ .../fail2ban/fail2ban.ServiceAccount.yaml | 6 + .../nginx-block-map-action.configmap.yaml | 58 ++++++++ .../fail2ban/nginx-block-map.local | 124 ++++++++++++++++++ .../immich/immich-db.secret.yaml | 7 +- .../paperless/Paperless.secret.yaml | 4 +- .../paperless/emailproxy.config | 5 + .../paperless/emailproxyconfig.configmap.yml | 13 ++ .../paperless_backup_db.cronjob.yaml | 45 +++++++ .../servarr/prowlarr.secret.yaml | 1 - .../servarr/servarr-db.secret.yaml | 1 - .../stash/download.sh_curl_error_20250808.sh | 85 ++++++++++++ external_manifests/tdarr/tdarr.svc.yaml | 15 +++ .../wikijs/wikijs-db.secret.yaml | 1 - 22 files changed, 508 insertions(+), 12 deletions(-) create mode 100644 external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml create mode 100644 external_manifests/django/django-db.svc.yaml create mode 100644 external_manifests/fail2ban/command.txt create mode 100644 external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml create mode 100644 external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml create mode 100644 external_manifests/fail2ban/fail2ban.Role.yaml create mode 100644 external_manifests/fail2ban/fail2ban.RoleBinding.yaml create mode 100644 external_manifests/fail2ban/fail2ban.ServiceAccount.yaml create mode 100644 external_manifests/fail2ban/nginx-block-map-action.configmap.yaml create mode 100644 external_manifests/fail2ban/nginx-block-map.local create mode 100644 external_manifests/paperless/emailproxy.config create mode 100644 external_manifests/paperless/emailproxyconfig.configmap.yml create mode 100644 external_manifests/paperless/paperless_backup_db.cronjob.yaml create mode 100644 external_manifests/stash/download.sh_curl_error_20250808.sh create mode 100644 external_manifests/tdarr/tdarr.svc.yaml diff --git a/external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml b/external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml new file mode 100644 index 0000000..9112196 --- /dev/null +++ b/external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml @@ -0,0 +1,46 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: bitwarden-calendar-backup + namespace: bitwarden +spec: + schedule: "0 0 * * *" + jobTemplate: + spec: + backoffLimit: 4 + ttlSecondsAfterFinished: 100 + template: + spec: + containers: + - name: bitwarden-database-backup + image: mcr.microsoft.com/mssql-tools + envFrom: + - secretRef: + name: bitwarden-mssql-db-terraform + optional: false + command: ["/bin/sh","-c"] + #args: ["mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "] + args: ["sleep 3600"] + volumeMounts: + - name: backup + mountPath: /backup + volumes: + - name: backup + persistentVolumeClaim: + claimName: bitwarden-database-backup + restartPolicy: Never +--- +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: bitwarden-database-backup + namespace: bitwarden + annotations: + fileType: Backup +spec: + storageClassName: nfs-storage-fastaccess + accessModes: + - ReadWriteMany + resources: + requests: + storage: 2Gi diff --git a/external_manifests/django/django-db.secret.yaml b/external_manifests/django/django-db.secret.yaml index 785bce0..bd6111a 100644 --- a/external_manifests/django/django-db.secret.yaml +++ b/external_manifests/django/django-db.secret.yaml @@ -6,6 +6,5 @@ data: DB_USERNAME: ZGphbmdvX3VzZXJuYW1l kind: Secret metadata: - creationTimestamp: null name: django-db-credentials namespace: django diff --git a/external_manifests/django/django-db.svc.yaml b/external_manifests/django/django-db.svc.yaml new file mode 100644 index 0000000..e1a21f4 --- /dev/null +++ b/external_manifests/django/django-db.svc.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: django-db-nodeport + namespace: django +spec: + ports: + - name: http + nodePort: 32345 + port: 5432 + protocol: TCP + targetPort: 5432 + selector: + app: django-db + type: NodePort + diff --git a/external_manifests/django/kubeconfig.secret.yaml b/external_manifests/django/kubeconfig.secret.yaml index f035905..5e3b6f2 100644 --- a/external_manifests/django/kubeconfig.secret.yaml +++ b/external_manifests/django/kubeconfig.secret.yaml @@ -1,8 +1,7 @@ apiVersion: v1 data: - config: YXBpVmVyc2lvbjogdjEKY2x1c3RlcnM6Ci0gY2x1c3RlcjoKICAgIGNlcnRpZmljYXRlLWF1dGhvcml0eS1kYXRhOiBMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VSQ1ZFTkRRV1V5WjBGM1NVSkJaMGxKU1V0RFJtWm1UMHRLUWtsM1JGRlpTa3R2V2tsb2RtTk9RVkZGVEVKUlFYZEdWRVZVVFVKRlIwRXhWVVVLUVhoTlMyRXpWbWxhV0VwMVdsaFNiR042UVdWR2R6QjVUa1JCZUUxVVVYaFBWRUY1VFdwYVlVWjNNSHBPUkVGNFRWUkZlRTlVUVROTmFscGhUVUpWZUFwRmVrRlNRbWRPVmtKQlRWUkRiWFF4V1cxV2VXSnRWakJhV0UxM1oyZEZhVTFCTUVkRFUzRkhVMGxpTTBSUlJVSkJVVlZCUVRSSlFrUjNRWGRuWjBWTENrRnZTVUpCVVVSalV6ZGhObVJyV1doUFoyczJTRTV3Vm1sSVdXcG1iMHg1S3pWQ1JERlpTa1ExWTNkaWJXOWtWRWRxY21nNWQyeFBSWHBqTkVoME1Ga0thMUJqUVU1TVREQlVla2h3Tmxsb1lta3lSRTVRZVc1cVVucFZhMEpFT1ZOcGFsSTFNa0p3VlM5NlNFOUZlRk40TUhSNlRqTnRSVzFWZVVwUU1qWTVjd28wYmxWMmFqUnRRVWx5TjNCUWNrRnhURU5MVFZoRmQzZFhORkJYTlRrNWFsQkhVRlV2V2tFNFVGUnRaakI0ZWxjNWExVkNUbEo0YVZGMWVrbHBXWE5UQ2pkbWJuQnJVakpZVXpSS1EwVkNjMnRJYXpaSVVFTmpPVFJWVmxGSWRWTm5lWGhTYm1neE1VeFNhVk51WkdKUU9UWkRZbWhpYTNaRGJUVnlPSGsyUW0wS1puWnRWVTlhZURaVVIyUllUekF6Ulc1alUyNVlOMk0zUkV0Sk0zTmhZVnBzV21jelZtTlFTWFYzU2t0blNrZE9kVE01ZDJwelEzZDJXa0psVW1GeFNBcFZRa0ZhV0hKWWFUbE1PRTExVWk5ck1HaFRaakpOYUVGeEsweFlRV2ROUWtGQlIycFhWRUpZVFVFMFIwRXhWV1JFZDBWQ0wzZFJSVUYzU1VOd1JFRlFDa0puVGxaSVVrMUNRV1k0UlVKVVFVUkJVVWd2VFVJd1IwRXhWV1JFWjFGWFFrSlJNREk0ZVROQmVrSXdTMGhyY0RCMVVqaFRWVGhoZUd4ak0xWlVRVllLUW1kT1ZraFNSVVZFYWtGTloyZHdjbVJYU214amJUVnNaRWRXZWsxQk1FZERVM0ZIVTBsaU0wUlJSVUpEZDFWQlFUUkpRa0ZSUWxKb1JVUkhhekJsYmdwak1FMU1UekoxY2xReFNUVk9XRk55UTNobVlTOHlhbUpWWVZNNUwzTk5RamsxU1ZoWU9UbFhWMFJxVUVGdUsyUjVkemRyTW5kbVRYZG9XRGhNSzJoTkNtcDNOVzV2TTNGNldISnJZemR4VXpJNWFsRnBRekU1VDBKQmNsVlhhWGxUT1cxcGVpdFNWbmxGVVZwNVNXMHpWVlJ4U1ZSdFpVeEROM2RHT0VSQmVqVUtkbVl2VkZWSWFreHdPV05XV0VsR0t5czFTWFpUTWt3Mk0zQkZkaXREYzFOVk1IZHVTVlZIWnpneVJqSm5ZM2N2UjJSR05XSnJTRlE0ZVVGSFpGaEdiUW95TTFkWFpWRnhZVTR3VEdwclUzSXZRelJoWWtWME9FeHhSV3A1WVdKMllrMWlRMlpDZUd0U2VYWXJSRVp5YkhRNVJuRmhkRTFQTVcxa1dUZEJaMjFTQ2tOUmNGUk1hRUl5UVd0NmMxRlVUSHByUjFNeFYzUTBUamgzVjFoRWEzbE9WRFEyVlhBdlRXNW5kM0pqTDBWcmFsb3JkbTVXVWtWQmR6VXZNVXA2VkhnS1JGSlZkSHBEWlZsS1dITnZDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsKICAgIHNlcnZlcjogaHR0cHM6Ly8xOTIuMTY4Ljg4LjUyOjY0NDMKICBuYW1lOiBrdWJlcm5ldGVzCmNvbnRleHRzOgotIGNvbnRleHQ6CiAgICBjbHVzdGVyOiBrdWJlcm5ldGVzCiAgICBuYW1lc3BhY2U6IHBpbmNoZmxhdAogICAgdXNlcjoga3ViZXJuZXRlcy1hZG1pbgogIG5hbWU6IGt1YmVybmV0ZXMtYWRtaW5Aa3ViZXJuZXRlcwpjdXJyZW50LWNvbnRleHQ6IGt1YmVybmV0ZXMtYWRtaW5Aa3ViZXJuZXRlcwpraW5kOiBDb25maWcKcHJlZmVyZW5jZXM6IHt9CnVzZXJzOgotIG5hbWU6IGt1YmVybmV0ZXMtYWRtaW4KICB1c2VyOgogICAgY2xpZW50LWNlcnRpZmljYXRlLWRhdGE6IExTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVVJKVkVORFFXZHRaMEYzU1VKQlowbEpUblJ4VjBwdFZqbHdOVzkzUkZGWlNrdHZXa2xvZG1OT1FWRkZURUpSUVhkR1ZFVlVUVUpGUjBFeFZVVUtRWGhOUzJFelZtbGFXRXAxV2xoU2JHTjZRV1ZHZHpCNVRrUkJlRTFVVVhoUFZFRjVUV3BhWVVaM01IbE9ha0Y0VFZSTmVFOVVVWGxPVkZKaFRVUlJlQXBHZWtGV1FtZE9Wa0pCYjFSRWJrNDFZek5TYkdKVWNIUlpXRTR3V2xoS2VrMVNhM2RHZDFsRVZsRlJSRVY0UW5Ka1YwcHNZMjAxYkdSSFZucE1WMFpyQ21KWGJIVk5TVWxDU1dwQlRrSm5hM0ZvYTJsSE9YY3dRa0ZSUlVaQlFVOURRVkU0UVUxSlNVSkRaMHREUVZGRlFUZFhZVXRoY0V4Q1pHWlBaVEEzSzNrS1ZHNVJaRVZITTA1NWJGQnRhMnRpYTI5YWMyaDRSR3hXZHl0c01WQTNRamxSTkN0S1UwZ3ZZWFlyY1ZGaFlXSTJjakEzUlhsRUsydEdVaTl4Ym5wcFJRcG9SMmxJVGxoblVsVXhNR1ZqVDBaR1RGRXphemxDVkRaSVZVdHBaamM0WVhONFNFZ3ljbmwzV1U5eFoyUjFTRlk1TjBNeFVISXZaSGxtYXl0cVJWTm5DbGsxUXpkdkt5czVlREJ0U2xjeFNWTm1lV2RGTDJSTWRucHVXRWcxZEc1VVFTOTNlVnB5UVdSWmIxSllVRGhFTlRjeFREbGFMMUJUU1RkSGJYSlBPRFFLVTNoM2JuQjRaWFJZVjBjekwwZEtZVmhuWjBGYWMzZHhOVEUzTXpsSlYzRktWWFl4YTFaNVlsTkpVbnBWYjJSWmJGWTBZeklyT0c5VFVsZFVaV1JYTVFwcFNuQmlZMlJXTW0wNEwxUmlPV0pNWVdWWVZsaHJXa052UldkdldXdzJVRU5TU2sxT01EUjZhaXRZT1U5eFMzSldTVVYxU1ROallqSmpjRTk2TDFRckNuTmpWbVJJZDBsRVFWRkJRbTh4V1hkV1JFRlBRbWRPVmtoUk9FSkJaamhGUWtGTlEwSmhRWGRGZDFsRVZsSXdiRUpCZDNkRFoxbEpTM2RaUWtKUlZVZ0tRWGRKZDBSQldVUldVakJVUVZGSUwwSkJTWGRCUkVGbVFtZE9Wa2hUVFVWSFJFRlhaMEpSTURJNGVUTkJla0l3UzBocmNEQjFVamhUVlRoaGVHeGpNd3BXVkVGT1FtZHJjV2hyYVVjNWR6QkNRVkZ6UmtGQlQwTkJVVVZCUTBJdk5HWm5UUzl2UlRScFRUTlVWSFkxUVVsNlNtRmhlVWRsTWpoaUwwUnZLMFJPQ2sxVlRFeDBVSEkyT0c1U1oyTjVhREJPWWs1WGRtdENVVVEwU0VaamJVUmlSMUkzVlhsQ1NXWjJUWGhIYlN0SlJqbFJSREF6Y0d0UVpVRk9iM05yVFZvS1ZXaG9UV1ZSZDBGSFVYQXhhVnBrUWtwT1FUVlJSbWxVYW1KU1lVRk1WbVk0VDIweFJWRkhOV1VyUnpSQlVXOXVSREZFT0VaVVFsRjZiRmRFYmk5d1ZBbzJNRVp2Y3pKR1ZHdGpSV3RxVWtSNFNtUjRNWEZHVTFaTk5YWTVjeTlCY3pOVVRUVjZWVXMyWm1WVlExTmFVekZQVlVndlVrWnFSMjFTVm1SU2JWQXZDa2Q2Wkc5QmVGWnpSbTFqUW1kNU5tNUpTSEJFUm5vclptbHNVVEpoTUVodVlXbFBjMUJ6Tm1sUVFuQlNXR2RzTm14MWFHMVJiMHBtT0U1QlIzbElUVzBLUlVoSWQyc3hXRWxEUTFrNEwycHJUR2szWkc5clJEWjRNRk41VGxnM1JuWXZXbGhrVmtsTVJXWktlRk5vV0ZGdFdFRTlQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09CiAgICBjbGllbnQta2V5LWRhdGE6IExTMHRMUzFDUlVkSlRpQlNVMEVnVUZKSlZrRlVSU0JMUlZrdExTMHRMUXBOU1VsRmNFRkpRa0ZCUzBOQlVVVkJOMWRoUzJGd1RFSmtaazlsTURjcmVWUnVVV1JGUnpOT2VXeFFiV3RyWW10dlduTm9lRVJzVm5jcmJERlFOMEk1Q2xFMEswcFRTQzloZGl0eFVXRmhZalp5TURkRmVVUXJhMFpTTDNGdWVtbEZhRWRwU0U1WVoxSlZNVEJsWTA5R1JreFJNMnM1UWxRMlNGVkxhV1kzT0dFS2MzaElTREp5ZVhkWlQzRm5aSFZJVmprM1F6RlFjaTlrZVdacksycEZVMmRaTlVNM2J5c3JPWGd3YlVwWE1VbFRabmxuUlM5a1RIWjZibGhJTlhSdVZBcEJMM2Q1V25KQlpGbHZVbGhRT0VRMU56Rk1PVm92VUZOSk4wZHRjazg0TkZONGQyNXdlR1YwV0ZkSE15OUhTbUZZWjJkQlduTjNjVFV4TnpNNVNWZHhDa3BWZGpGclZubGlVMGxTZWxWdlpGbHNWalJqTWlzNGIxTlNWMVJsWkZjeGFVcHdZbU5rVmpKdE9DOVVZamxpVEdGbFdGWllhMXBEYjBWbmIxbHNObEFLUTFKS1RVNHdOSHBxSzFnNVQzRkxjbFpKUlhWSk0yTmlNbU53VDNvdlZDdHpZMVprU0hkSlJFRlJRVUpCYjBsQ1FVRndjRXB6VkVweWMxa3pZWE15Y1FwaFJ6RmpWbXBJTUZCelVWTnlaR1paVjBGd2JWQlVURmgxVGxWbmJHTXlNMDVoWTFNd2JHaHNhM1puTjJ4NE1uRXZkVGxXUzNablJrbHVUSGwwVmpGTENrbDZWMVJTSzNGdFZ6QjNiV3d3Ulc0dk9YRmlPREpDYnpCNFkxcGFkbkp1VEVseFVubDNkbWx1YmtkQ2JVbDJaVVl6TkVoT09IVkxjVzVXUkVGMVZYWUtNVlZFU1dob1NVbFlNMEYyTXpKQmNqRjZabEZVTTJVMlIydzBXbGx2TUVWMFpHcEZMekZrYVRablMybGpTMDlJTVVaUmJHRlRaa1owWkc1TGMwZFVTUXBhVm1sMGVsQkZPR0pOV0RNeE5VWlBWelZXTml0amMzUXphVVpSU3pGWVFscHNWVXgwU25FMloxSTRPU3RvTVVrMFIzZFpVRWhoV2k5VVZuRjRLMWxYQ2pWNGJtbFNWMnBhTm1nMFlUbG5OMlIzTjNaUmMwNVpTME4yUzJ3elJYTnVObkptTlZsSU5YQnRSMk5aUkRsa1FsSnlLMHRJT0dnNVkxaG5OalExVFZRS1oyNXJlVFpUUlVObldVVkJLMmRrVlZkMlVFUnpVVTlhWm5CTVdVSnJZMUJpYXpONE4yNVNXa0pVUjJWUmN5dEhNVUpQV2pWT1NWUnFZVWxUVVhoTVZBcGpNa2xoTlc1cVRtOTNRMVExYm5aTllrRlNUSEpOYnpCVWVtOW1UM0F5VUhGTWVIaFNVVFpUVHpKM1FtZHdjek0wYlZaNFFuTmFOVmxtV21jNE0yaHRDa2xCVjNWcWFHSXJORFJMVXk5dFEyNDBXR2g0V2tKMU56SjRlRGQzT0RCV1prNDVOVWh2VGpaaE5TODFiM1E0ZW5CclNWVTJZbXREWjFsRlFUaDRTVUVLTWxkRlIySTBiVFZWZGxoQ2QydGlZamxTYWtSSGFqbHlVa3hUSzJ0NE9GUkRLeTgwUkZJemRtUlVWa3B1YmpneGRqWkRjVUZRYldGd2NESTFkWFZZWkFwRGRsaHBkbWxQZVUxd2NVRk1aV1pWWTBsVFlVbGtXbTlvV21OU1IxTndRMHB1UkdvMmJWTkZVVmx0TlZVMWJTODFSeTlDTHpWcU5HbHlUakZsZVdKMENtcDRlRE5wVGtWWk9VSmtlVE56SzJOeWFEUkZXVlpqZUdKSk4zZFBTelZxU2xKRU5FTmFZME5uV1VKNmRWRkxPVWRuWjJkSVVHUnNWWGhtZWxJNU5rZ0taMnRKVVhsUU9FOHpWbXhRZFZCbVFtNTBWR2w1UzNwUFMwRTFiSGgzWm1oYWNUTnRjMFpGVms5aldUWnliQzhyVDNKeEx6TmtURFpRU0N0S2VFeFdhUXBPZERSRFVsY3dMMWhaTUZKWk1FRndXa05ST1VzME1uY3pjbFZsTWpCSlFsaHFMMlJsYURBNVRtZHNUUzlZVjFkalVWZHBabEZsYTNOWWJFUk9aQzlXQ2t4VFdFWkVjblZTY0hKcFNGQjFSMHdyVW1aMU1sRkxRbWRSUkhWV1dWUkliMHc0ZVhSd1VXdHhRbmR2V214d1pWcE1NVXBETURSbGRrTnllRVIwVFdFS1RGWXpTRmh6WW1jMGFrMW9WMmhLVm5CNUswdGlWRkZoYTNsVUswRlZNVkExWmtaRFFuSlpMM05CV20wdlNqTjBRbVJuY25aYVVWaERVakJYTURkNWR3b3ZTbWM1ZUM5c01sZGFhVU5TU1hSSVltUXlSM2hZVGs5aVRrTlJlRWxpUTJkSFRXdHZRVWxpZEV4S1NtcHpRazloWkdoYWNXRnJiMnBMT0RKd1MyUkxDbEJQTURSWFVVdENaMUZETW1adlpVcFJObVZEYzA4ekwzWldkVE5TWWpaT1Jpc3lSRXhvY2psamJuSldZVkJQYm5kcFYyaElVa3BUWWtnMmNpdEJWemdLWkd3MGVYTldSakpqTVcxaFoxZG5WM2R0U3pkVFowUlNhbEV5Vnk4d2RUUlJaMVppVVRaQ1kzRjROVlJuZURkdVkzZzRiMjFtT1ZwUmNVUlBUM3B4VFFwc1YyNHZUR3RTWmtkeVREZzJjV1ZLVG1rMGRYVkpUVUkyVW13d1ZuUXdhSHB1SzFsR05XczJlREJUVmt4M1pTdENRbEZKVVZFOVBRb3RMUzB0TFVWT1JDQlNVMEVnVUZKSlZrRlVSU0JMUlZrdExTMHRMUW89Cg== + config: YXBpVmVyc2lvbjogdjEKY2x1c3RlcnM6Ci0gY2x1c3RlcjoKICAgIGNlcnRpZmljYXRlLWF1dGhvcml0eS1kYXRhOiBMUzB0TFMxQ1JVZEpUaUJEUlZKVVNVWkpRMEZVUlMwdExTMHRDazFKU1VSQ1ZFTkRRV1V5WjBGM1NVSkJaMGxKU1V0RFJtWm1UMHRLUWtsM1JGRlpTa3R2V2tsb2RtTk9RVkZGVEVKUlFYZEdWRVZVVFVKRlIwRXhWVVVLUVhoTlMyRXpWbWxhV0VwMVdsaFNiR042UVdWR2R6QjVUa1JCZUUxVVVYaFBWRUY1VFdwYVlVWjNNSHBPUkVGNFRWUkZlRTlVUVROTmFscGhUVUpWZUFwRmVrRlNRbWRPVmtKQlRWUkRiWFF4V1cxV2VXSnRWakJhV0UxM1oyZEZhVTFCTUVkRFUzRkhVMGxpTTBSUlJVSkJVVlZCUVRSSlFrUjNRWGRuWjBWTENrRnZTVUpCVVVSalV6ZGhObVJyV1doUFoyczJTRTV3Vm1sSVdXcG1iMHg1S3pWQ1JERlpTa1ExWTNkaWJXOWtWRWRxY21nNWQyeFBSWHBqTkVoME1Ga0thMUJqUVU1TVREQlVla2h3Tmxsb1lta3lSRTVRZVc1cVVucFZhMEpFT1ZOcGFsSTFNa0p3VlM5NlNFOUZlRk40TUhSNlRqTnRSVzFWZVVwUU1qWTVjd28wYmxWMmFqUnRRVWx5TjNCUWNrRnhURU5MVFZoRmQzZFhORkJYTlRrNWFsQkhVRlV2V2tFNFVGUnRaakI0ZWxjNWExVkNUbEo0YVZGMWVrbHBXWE5UQ2pkbWJuQnJVakpZVXpSS1EwVkNjMnRJYXpaSVVFTmpPVFJWVmxGSWRWTm5lWGhTYm1neE1VeFNhVk51WkdKUU9UWkRZbWhpYTNaRGJUVnlPSGsyUW0wS1puWnRWVTlhZURaVVIyUllUekF6Ulc1alUyNVlOMk0zUkV0Sk0zTmhZVnBzV21jelZtTlFTWFYzU2t0blNrZE9kVE01ZDJwelEzZDJXa0psVW1GeFNBcFZRa0ZhV0hKWWFUbE1PRTExVWk5ck1HaFRaakpOYUVGeEsweFlRV2ROUWtGQlIycFhWRUpZVFVFMFIwRXhWV1JFZDBWQ0wzZFJSVUYzU1VOd1JFRlFDa0puVGxaSVVrMUNRV1k0UlVKVVFVUkJVVWd2VFVJd1IwRXhWV1JFWjFGWFFrSlJNREk0ZVROQmVrSXdTMGhyY0RCMVVqaFRWVGhoZUd4ak0xWlVRVllLUW1kT1ZraFNSVVZFYWtGTloyZHdjbVJYU214amJUVnNaRWRXZWsxQk1FZERVM0ZIVTBsaU0wUlJSVUpEZDFWQlFUUkpRa0ZSUWxKb1JVUkhhekJsYmdwak1FMU1UekoxY2xReFNUVk9XRk55UTNobVlTOHlhbUpWWVZNNUwzTk5RamsxU1ZoWU9UbFhWMFJxVUVGdUsyUjVkemRyTW5kbVRYZG9XRGhNSzJoTkNtcDNOVzV2TTNGNldISnJZemR4VXpJNWFsRnBRekU1VDBKQmNsVlhhWGxUT1cxcGVpdFNWbmxGVVZwNVNXMHpWVlJ4U1ZSdFpVeEROM2RHT0VSQmVqVUtkbVl2VkZWSWFreHdPV05XV0VsR0t5czFTWFpUTWt3Mk0zQkZkaXREYzFOVk1IZHVTVlZIWnpneVJqSm5ZM2N2UjJSR05XSnJTRlE0ZVVGSFpGaEdiUW95TTFkWFpWRnhZVTR3VEdwclUzSXZRelJoWWtWME9FeHhSV3A1WVdKMllrMWlRMlpDZUd0U2VYWXJSRVp5YkhRNVJuRmhkRTFQTVcxa1dUZEJaMjFTQ2tOUmNGUk1hRUl5UVd0NmMxRlVUSHByUjFNeFYzUTBUamgzVjFoRWEzbE9WRFEyVlhBdlRXNW5kM0pqTDBWcmFsb3JkbTVXVWtWQmR6VXZNVXA2VkhnS1JGSlZkSHBEWlZsS1dITnZDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsKICAgIHNlcnZlcjogaHR0cHM6Ly8xOTIuMTY4Ljg4LjUyOjY0NDMKICBuYW1lOiBrdWJlcm5ldGVzCmNvbnRleHRzOgotIGNvbnRleHQ6CiAgICBjbHVzdGVyOiBrdWJlcm5ldGVzCiAgICBuYW1lc3BhY2U6IGRqYW5nbwogICAgdXNlcjoga3ViZXJuZXRlcy1hZG1pbgogIG5hbWU6IGt1YmVybmV0ZXMtYWRtaW5Aa3ViZXJuZXRlcwpjdXJyZW50LWNvbnRleHQ6IGt1YmVybmV0ZXMtYWRtaW5Aa3ViZXJuZXRlcwpraW5kOiBDb25maWcKcHJlZmVyZW5jZXM6IHt9CnVzZXJzOgotIG5hbWU6IGt1YmVybmV0ZXMtYWRtaW4KICB1c2VyOgogICAgY2xpZW50LWNlcnRpZmljYXRlLWRhdGE6IExTMHRMUzFDUlVkSlRpQkRSVkpVU1VaSlEwRlVSUzB0TFMwdENrMUpTVVJKVkVORFFXZHRaMEYzU1VKQlowbEpRMjQzVUd4VWMwaHVabFYzUkZGWlNrdHZXa2xvZG1OT1FWRkZURUpSUVhkR1ZFVlVUVUpGUjBFeFZVVUtRWGhOUzJFelZtbGFXRXAxV2xoU2JHTjZRV1ZHZHpCNVRrUkJlRTFVVVhoUFZFRjVUV3BhWVVaM01IbE9la0Y0VFZSUmVVMVVUVEpPVkd4aFRVUlJlQXBHZWtGV1FtZE9Wa0pCYjFSRWJrNDFZek5TYkdKVWNIUlpXRTR3V2xoS2VrMVNhM2RHZDFsRVZsRlJSRVY0UW5Ka1YwcHNZMjAxYkdSSFZucE1WMFpyQ21KWGJIVk5TVWxDU1dwQlRrSm5hM0ZvYTJsSE9YY3dRa0ZSUlVaQlFVOURRVkU0UVUxSlNVSkRaMHREUVZGRlFXdzJkMVZ6VTNScldFeFZiek55TWlzS1VWZHpVREZGSzBGTVFWSXdkbVkwVms1Rk5XbHdRVWQzYW0xbmQyMVRValpLVWs1UFdsQkVRblZZZVVkYVdtVlFaa2hzUjJ4SWJGWmxabk5xY2xndlpBcHBjbUZKTUVKT1NqYzJWRkYyVFhSNk5XZ3JValppZUZkVFZFUkpTMk5FVEVZeldUWTNiM2xVVTFOTWMybzVWek5uV0VKVllqRlJPVzFxZVdka1ZESTRDalJJWmtwaE0wdDJiSEZGUW1odlQyaEdVR3BoUkRKUmFXNXFVbHBRZDFFdlFWUTBObmRCYW1GRlYySXhkR2xDVmtzekswTXpTbkpQTlUxWll6bDBlWFFLUzFkd1NUTjRXa2hDUms5UmNUWnliVWw1YlhjMFIybHpPV2RuWXpaRFZuaGlja0ZvUzJaQlFVdzBhMnd6VGxCS2JsRkphR0pHT0U1V1VXUjFaVlpzWndwNFZGVkhNMVJqZUVKdFdrNTRWbWhFVTFGdFFXc3lSSE00TUd4Q1EwTlJOakJRV1dwUlJXdG9kM1pZWkU0MFMzVjVOM0o2SzBjeWF6bEZiMlpuYzA1dUNrUTFjVkZZZDBsRVFWRkJRbTh4V1hkV1JFRlBRbWRPVmtoUk9FSkJaamhGUWtGTlEwSmhRWGRGZDFsRVZsSXdiRUpCZDNkRFoxbEpTM2RaUWtKUlZVZ0tRWGRKZDBSQldVUldVakJVUVZGSUwwSkJTWGRCUkVGbVFtZE9Wa2hUVFVWSFJFRlhaMEpSTURJNGVUTkJla0l3UzBocmNEQjFVamhUVlRoaGVHeGpNd3BXVkVGT1FtZHJjV2hyYVVjNWR6QkNRVkZ6UmtGQlQwTkJVVVZCUkdKSVUwOXNSRE5MWW5JM2EyOWFOV0ppWTB0MU16RktTM3BPYW1WVVZrRTNSV3RHQ2xSUVZuTndiRFpXY0N0MllsaFNTa1U1VkVSRFoxRkpZVVJqZWpOdlZHdENOWFJ4ZFRZemIwRkxjVEpXZUdSa0wzQmlLelJVZFRselRIaE5kMWt5U1ZFS2MweGpObFpDS3pVdlRuSlZRVVJJS3pOb1IzSm9iVWR5TTNGU1REbE9UMWRFYm5wMmRIRmFaekJ5Ym1WU2NHZFdVVU53ZDNCV05Hd3hTWE42YmpjeGFBcHpNREF2WkRKM2JUQndjbWs1UVdsS1VXTjFWbTk0UzBkNU1WSnVLMmh5WjIxNlpDdDJWazV0TjFSVFRrSmxTM1owVjA1MVUwbzJXREpMWkdKSFEwdHdDbEpNYW5aVlMxWlZTV1pvWmxsTmJYWmllakZZVGl0dFkySndhVWxUZWxsaVlXSmFlakZhZGxCWFVGQXJlVlIyVjFNelZEUlBjMnhFYjFkMlZrNDRhV0VLZG1KaVYwWnpaVmhUUVZsb1NrMVZOMlJ3V2xwSVdXWlpUMEpYVFdFM1kxbHVlVTB6S3pKSlFsQTRjazFLYW1ONFdtYzlQUW90TFMwdExVVk9SQ0JEUlZKVVNVWkpRMEZVUlMwdExTMHRDZz09CiAgICBjbGllbnQta2V5LWRhdGE6IExTMHRMUzFDUlVkSlRpQlNVMEVnVUZKSlZrRlVSU0JMUlZrdExTMHRMUXBOU1VsRmNGRkpRa0ZCUzBOQlVVVkJiRFozVlhOVGRHdFlURlZ2TTNJeUsxRlhjMUF4UlN0QlRFRlNNSFptTkZaT1JUVnBjRUZIZDJwdFozZHRVMUkyQ2twU1RrOWFVRVJDZFZoNVIxcGFaVkJtU0d4SGJFaHNWbVZtYzJweVdDOWthWEpoU1RCQ1RrbzNObFJSZGsxMGVqVm9LMUkyWW5oWFUxUkVTVXRqUkV3S1JqTlpOamR2ZVZSVFUweHphamxYTTJkWVFsVmlNVkU1YldwNVoyUlVNamcwU0daS1lUTkxkbXh4UlVKb2IwOW9SbEJxWVVReVVXbHVhbEphVUhkUkx3cEJWRFEyZDBGcVlVVlhZakYwYVVKV1N6TXJRek5LY2s4MVRWbGpPWFI1ZEV0WGNFa3plRnBJUWtaUFVYRTJjbTFKZVcxM05FZHBjemxuWjJNMlExWjRDbUp5UVdoTFprRkJURFJyYkROT1VFcHVVVWxvWWtZNFRsWlJaSFZsVm14bmVGUlZSek5VWTNoQ2JWcE9lRlpvUkZOUmJVRnJNa1J6T0RCc1FrTkRVVFlLTUZCWmFsRkZhMmgzZGxoa1RqUkxkWGszY25vclJ6SnJPVVZ2Wm1kelRtNUVOWEZSV0hkSlJFRlJRVUpCYjBsQ1FWRkRURVJYVkdKSFYwVnNOMkZFVHdwMFZEWmpWWG81Y2podlkySXdLMjlFTVdSSmVUVnFjR2hEYm5WSU1EbFlZVlZUY2padGNubG5jRzF0TVZkSmEwOHdkV3BzZDFodlNETlZWMVZWTnpka0NqZG5RalpxSzJKWFpsSnBiamhJTmlzeEwyZHNNMjlQZW5WemRWRjRibmc0WVhocVNFcGpibHB6YkM5SFExcE1RVTgzZGtadEszRk9Ubkp3Vkd0WmJUWUtZM2xQWVRFM1pDdElkVTFGVVdoQ1dEbHZNMVEwUjBweVFXVTRURUZ4U1ZCNWJUTmlaSEpYVDNweGNtMVlVMXB3UTFGblVXeDNiVTlVUm5sMk4yWlZkd293TUVWalNEQXhXamxXTmt0UVIxaFdOMUZQTUVJMWQxZEtibXBKY1ZFNU1uQnlkRGxNWW14Uk5UaFhTSHB3TDBKSU1WcEJOMEo2VHpCTlYzRm5jWGgxQ21KS1VFNU1ZMWxZWnl0UWVpdEpaMFJ2VldkdWFuWm9WMjVJVlhCdFVVWXhNRnBFYmtkM1MxcG5OV1ZoWml0V1J6ZGliRzFETWtoaFQzaGpSWEFyV0RVS1JWTTNhSGQ0Y0VKQmIwZENRVTFUYzJkMFUyWnpZMnhYUVdoQ1V5dFVWREJzZGpSS1UxZ3hORGQxVkVGcWFVOWpSRUZJWkZKQ1JVMXZkRGhUU2k5T1RncHRWaXQyY0ZOdFJqSkJiR05ZWXpCWWR5OTFOMlZDY3pablNUTnFPRFpwTm1jM1RXcGxTRzlEWWtWWlUzbDFjR3REWm1ZdlFqUjFVRzlrYms5SVNTOUhDbFZ5T0dSemNrVTFPVzFPVFdOMWJURjRhbUZoVkUxcGExWmtWMWhETW5NMWFESXhXRXgyVG5SVVpXZE5kMUpzV0VKWVpsRndjbEUxUVc5SFFrRk5Wbk1LWkhOSE9FRnRhWGsxYnpKSEswdEhjRWhrVW10TlFVNUthMmxKV0dac1NuTTVjbmRLVVZOblRsWjBTelJwVkRscFRHdERabFp1U0VwblRGWnNhV3c1S3dwdVpsQmxWRVZLYjNSU1MzWXlTbko0V2pKT1VqRmlOR2s0VUdoRGFHeEVXa1F3UVhKelpXaEtWRUpPZHpsQk1FOXVSRmQxTHpVMlVUVXpXbWxqT0d4akNrNUpSbmM0YzFKbU5XcFJlbFZKVUN0cVJrdGFOek56SzNGdWNHcE1NMmhTZVZCd0wzQTViRmhCYjBkQlJEQTNVMGhDVTFZNVVFeFNNVVV4ZUVGcVRYSUtZMWhvZEd4UGRVNTRTbHBOVDJVNVUyRXJOalU1YnpORFR6VlRhRTFYYmxCNk1HWlFiR2w2U25oUGFrRnJSVGhUVUZGNU5XRXpNR2hPYlc5UmRFRm9XUXBoWlVGUU5UUmpObmRFVjBWUU4zZHlibTVpYlUxdVIzRnBiRnBzYlV4ak5rSTFRV0pOV0c5MVpVVnZhVUUxYWxoYVltRmhNVlk0WkVsNlVGQmxjbWRQQ213eU9HRjNNakl4YVRaTk5tZEhkSEZxU1c1aUx6bHJRMmRaUlVGcVNGUkpXVXhyUkRsaU1HZzNhSEpUYkZORlpXbGtZbXh0WkVWcU1rbEdhV0V2TXprS05VaFhjRVl6WlRKQ05rVnRaRU5RUkhsR1NWVlVSWGRTT1M5NFVETXZWRlJLTkdSSFRtaEZUV3RyYW5SRUx6aHFhMVJRVG00NFNqUk5aMmRUVTNvM1F3cGlUMDF3V2xwMVVVNXNlWE5LVVZnMUswOHJVME5TZDB0elRqQkhhRFJJUlVWVWRITllSek5zT1Roc2VWSlNXVFpsZVVoMGExZzVZVUpyZVN0dWVHMUJDbkJWWkdoQlZ6QkRaMWxGUVdod1ZrbHBkVkV2ZFc5RlZFWlBTR1ZoYmpSNlJWTlBOa2MwV0d4clRHdDBkbkJJWlZKU1REaHFhVWhDVURJdlRsTnNaazBLZGs4eWVpdEhkMlJFUjBOcWRVTTVSRnBRZURad1RYcFJabVkzYXk5UlJFMVhRM3BpTkhkNlNHSnNNRGd4WTBOTFZFOUZkMGxQVDNZckwyMXdhWEZtYWdwVEswSjBUWGw0UTNOclQweFFiVEYwVG01eFoyYzRVVWxEYzJkb1MyUklhemhXVGpCclJGSlliM0o1VlhSd1ptVXpiVWxoU0RKelBRb3RMUzB0TFVWT1JDQlNVMEVnVUZKSlZrRlVSU0JMUlZrdExTMHRMUW89Cg== kind: Secret metadata: - creationTimestamp: null name: kubeconfig namespace: django diff --git a/external_manifests/fail2ban/command.txt b/external_manifests/fail2ban/command.txt new file mode 100644 index 0000000..fac1c09 --- /dev/null +++ b/external_manifests/fail2ban/command.txt @@ -0,0 +1 @@ +kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload diff --git a/external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml b/external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml new file mode 100644 index 0000000..d82c762 --- /dev/null +++ b/external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +data: + nginx-http-auth.local: | + ## Version 2022/08/06 + # Fail2Ban jail configuration for nginx-http-auth + + # To use more aggressive http-auth modes set filter parameter "mode" in jail.local: + # normal (default), aggressive (combines all), auth or fallback + # See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details. + + [nginx-http-auth] + + enabled = false + port = http,https + filter = nginx-unauthorized + action = nginx-block-map + logpath = /var/log/nginx/backend_debug.log + maxretry = 5 +kind: ConfigMap +metadata: + creationTimestamp: null + name: fail2ban-nginx-http-auth-jail + namespace: fail2ban diff --git a/external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml b/external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml new file mode 100644 index 0000000..09500e7 --- /dev/null +++ b/external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +data: + nginx-unauthorized.local: | + ## Version 2022/08/06 + # Fail2Ban filter configuration for nginx unauthorized + + [INCLUDES] + before = common.conf + + [Definition] + + #original + #failregex = ^.*"(GET|POST|HEAD).*" (401) .*$ + + + #try this one + failregex = ^ - .* "(?:GET|POST|HEAD) [^"]+" 401 + ^ - .* upstream_status=401 + #for servarr + ^ -.*"GET /login\?returnUrl=/&loginFailed=true HTTP/.*" 200 + ^ -.*"POST /login\?returnUrl=/&loginFailed=true HTTP/.*" 200 + #for bitwarden + ^ -.*"POST /identity/accounts/prelogin *HTTP/.*" 200 + #actionban = touch /tmp/.ban + #actionunban = touch /tmp/.unban +kind: ConfigMap +metadata: + creationTimestamp: null + name: fail2ban-nginx-unauthorized-filter + namespace: fail2ban diff --git a/external_manifests/fail2ban/fail2ban.Role.yaml b/external_manifests/fail2ban/fail2ban.Role.yaml new file mode 100644 index 0000000..5c353ac --- /dev/null +++ b/external_manifests/fail2ban/fail2ban.Role.yaml @@ -0,0 +1,19 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: role:service-acc + namespace: reverse-proxy + +rules: + - apiGroups: [""] + resources: + - pods + - pods/exec + verbs: + - create + - list + - apiGroups: ["apps"] + resources: + - deployments + verbs: + - get diff --git a/external_manifests/fail2ban/fail2ban.RoleBinding.yaml b/external_manifests/fail2ban/fail2ban.RoleBinding.yaml new file mode 100644 index 0000000..773b5a2 --- /dev/null +++ b/external_manifests/fail2ban/fail2ban.RoleBinding.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: rolebinding:service-acc + namespace: reverse-proxy + +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: role:service-acc +subjects: + - kind: ServiceAccount + name: kubectl-service-account + namespace: fail2ban diff --git a/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml b/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml new file mode 100644 index 0000000..721091d --- /dev/null +++ b/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: kubectl-service-account + namespace: fail2ban diff --git a/external_manifests/fail2ban/nginx-block-map-action.configmap.yaml b/external_manifests/fail2ban/nginx-block-map-action.configmap.yaml new file mode 100644 index 0000000..0097ea9 --- /dev/null +++ b/external_manifests/fail2ban/nginx-block-map-action.configmap.yaml @@ -0,0 +1,58 @@ +apiVersion: v1 +data: + nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for + black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use + 'nginx-block-map' action you should define some special blocks in your nginx configuration,\n# + and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx + by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used + here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to + check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok + { include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses + { include blacklisted-sessions.map; }\n# ...\n# # special log-format to + notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure + \"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\" + $status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n# + \ # location checking blacklisted values:\n# location ... {\n# # + check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files + \"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure + inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n# + \ ...\n# # location for return with \"403 Forbidden\" if banned:\n# location + @f2b-banned {\n# default_type text/html;\n# return 403 \"
\n# + \ \n# + \ You are banned!
\";\n# }\n# ...\n# # location + to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n# + \ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n# + \ }\n# ...\n#\n# Note that quote-character (and possibly other special characters) + are not allowed currently as session-id.\n# Thus please add any session-id validation + rule in your locations (or in the corresponding backend-service), \n# like in + example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\") + {\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The + parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n# + \ filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"[^\"]+\" + - \n# usedns = no\n#\n# The same log-file can be used for IP-related jail + (additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n# + \ maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure + \"[^\"]+\" - \n# usedns = no\n#\n\n[Definition]\n\n# path to configuration + of nginx (used to target nginx-instance in multi-instance system,\n# and as path + for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n# + cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd + = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n# + command used to check whether nginx is running and configuration is valid:\nsrv_is_running + = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n# + first test nginx is running and configuration is correct, hereafter send reload + signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s + -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file + = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep + 20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action + = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n# + Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush + = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck + = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"\"\n\nactionban = echo + | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s'; + %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g'); + sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n" +kind: ConfigMap +metadata: + creationTimestamp: null + name: nginx-block-map-action + namespace: fail2ban diff --git a/external_manifests/fail2ban/nginx-block-map.local b/external_manifests/fail2ban/nginx-block-map.local new file mode 100644 index 0000000..0e1abaf --- /dev/null +++ b/external_manifests/fail2ban/nginx-block-map.local @@ -0,0 +1,124 @@ +## Version 2022/08/06 +# Fail2Ban configuration file for black-listing via nginx +# +# Author: Serg G. Brester (aka sebres) +# +# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration, +# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban). +# +# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user): +# +# http { +# ... +# # maps to check user is blacklisted (banned in f2b): +# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; } +# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; } +# ... +# # special log-format to notify fail2ban about failures: +# log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user ' +# ;# '"$request" $status $bytes_sent ' +# # '"$http_referer" "$http_user_agent"'; +# +# # location checking blacklisted values: +# location ... { +# # check banned sessionid: +# if ($blck_lst_ses != "") { +# try_files "" @f2b-banned; +# } +# ... +# # notify fail2ban about a failure inside nginx: +# error_page 401 = @notify-f2b; +# ... +# } +# ... +# # location for return with "403 Forbidden" if banned: +# location @f2b-banned { +# default_type text/html; +# return 403 "
+# +# You are banned!
"; +# } +# ... +# # location to notify fail2ban about a failure inside nginx: +# location @notify-f2b { +# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors; +# } +# } +# ... +# +# Note that quote-character (and possibly other special characters) are not allowed currently as session-id. +# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), +# like in example below: +# +# location ... { +# if ($cookie_session_id !~ "^[\w\-]+$") { +# return 403 "Wrong session-id" +# } +# ... +# } +# +# The parameters for jail corresponding log-format (f2b_session_errors): +# +# [nginx-blck-lst] +# filter = +# datepattern = ^Epoch +# failregex = ^ failure "[^"]+" - +# usedns = no +# +# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs): +# +# [nginx-blck-ip] +# maxretry = 100 +# filter = +# datepattern = ^Epoch +# failregex = ^ failure "[^"]+" - +# usedns = no +# + +[Definition] + +# path to configuration of nginx (used to target nginx-instance in multi-instance system, +# and as path for the blacklisted map): +#srv_cfg_path = /etc/nginx/ + +srv_cfg_path = /blacklisted.d/ + +# cmd-line arguments to supply to test/reload nginx: +#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf +srv_cmd = nginx + +# pid file (used to check nginx is running): +srv_pid = /run/nginx.pid + +# command used to check whether nginx is running and configuration is valid: +srv_is_running = [ -f "%(srv_pid)s" ] +srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt + +# first test nginx is running and configuration is correct, hereafter send reload signal: +#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then +# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi; +# fi; + +restart_file = /restart-signal/restart.txt + +blck_lst_reload = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload + +# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`: +blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf + +# Action definition: + +actionstart_on_demand = false +actionstart = touch '%(blck_lst_file)s' + +actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s + +actionstop = %(actionflush)s + +actioncheck = + +_echo_blck_row = printf '\%%s 1;\n' "" + +actionban = kubectl exec -it -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- sh -c "echo 'deny ;' > /etc/nginx/blacklisted.d/blacklisted-sessions.conf"; %(blck_lst_reload)s + +actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s diff --git a/external_manifests/immich/immich-db.secret.yaml b/external_manifests/immich/immich-db.secret.yaml index 298925f..ac07265 100644 --- a/external_manifests/immich/immich-db.secret.yaml +++ b/external_manifests/immich/immich-db.secret.yaml @@ -1,11 +1,10 @@ apiVersion: v1 data: DB_DATABASE_NAME: aW1taWNo - DB_HOST: aW1taWNodC1kYi1zdmM= + DB_HOST: aW1taWNoLWRiLXN2Yw== DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg= - DB_USERNAME: aW1taWNoX3VzZXJuYW1l + DB_USERNAME: aW1taWNo kind: Secret metadata: - creationTimestamp: null name: immich-db-credentials - namespace: immicht + namespace: immich diff --git a/external_manifests/paperless/Paperless.secret.yaml b/external_manifests/paperless/Paperless.secret.yaml index 3f8d60a..11af8c0 100644 --- a/external_manifests/paperless/Paperless.secret.yaml +++ b/external_manifests/paperless/Paperless.secret.yaml @@ -5,9 +5,9 @@ data: POSTGRES_PASSWORD: cGFwZXJsZXNz PAPERLESS_ADMIN_USER: YWRtaW4= PAPERLESS_ADMIN_PASSWORD: YWRtaW4= - POSTGRES_HOST: cGFwZXItZGItc3Zj + POSTGRES_HOST: cGFwZXJsZXNzLWRiLXN2Yw== kind: Secret metadata: name: paperless-credentials - namespace: paper + namespace: paperless type: Opaque diff --git a/external_manifests/paperless/emailproxy.config b/external_manifests/paperless/emailproxy.config new file mode 100644 index 0000000..1a8eab9 --- /dev/null +++ b/external_manifests/paperless/emailproxy.config @@ -0,0 +1,5 @@ +[IMAP-1993] +documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts *** +server_address = outlook.office365.com +server_port = 993 +local_address = 127.0.0.1 diff --git a/external_manifests/paperless/emailproxyconfig.configmap.yml b/external_manifests/paperless/emailproxyconfig.configmap.yml new file mode 100644 index 0000000..d644c46 --- /dev/null +++ b/external_manifests/paperless/emailproxyconfig.configmap.yml @@ -0,0 +1,13 @@ +apiVersion: v1 +data: + emailproxy.config: | + [IMAP-1993] + documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts *** + server_address = outlook.office365.com + server_port = 993 + local_address = 127.0.0.1 +kind: ConfigMap +metadata: + creationTimestamp: null + name: emailproxyconfig + namespace: paperless diff --git a/external_manifests/paperless/paperless_backup_db.cronjob.yaml b/external_manifests/paperless/paperless_backup_db.cronjob.yaml new file mode 100644 index 0000000..c6d77d4 --- /dev/null +++ b/external_manifests/paperless/paperless_backup_db.cronjob.yaml @@ -0,0 +1,45 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: paperless-calendar-backup + namespace: paperless +spec: + schedule: "0 0 * * *" + jobTemplate: + spec: + backoffLimit: 4 + ttlSecondsAfterFinished: 100 + template: + spec: + containers: + - name: paperless-database-backup + image: alpine/psql + envFrom: + - secretRef: + name: paperless-db-terraform + optional: false + command: ["/bin/sh","-c"] + args: ["pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "] + volumeMounts: + - name: backup + mountPath: /backup + volumes: + - name: backup + persistentVolumeClaim: + claimName: paperless-database-backup + restartPolicy: Never +--- +kind: PersistentVolumeClaim +apiVersion: v1 +metadata: + name: paperless-database-backup + namespace: paperless + annotations: + fileType: Backup +spec: + storageClassName: nfs-storage-fastaccess + accessModes: + - ReadWriteMany + resources: + requests: + storage: 2Gi diff --git a/external_manifests/servarr/prowlarr.secret.yaml b/external_manifests/servarr/prowlarr.secret.yaml index 8504123..6177293 100644 --- a/external_manifests/servarr/prowlarr.secret.yaml +++ b/external_manifests/servarr/prowlarr.secret.yaml @@ -6,6 +6,5 @@ data: DB_USER: cHJvd2xhcnJfdXNlcm5hbWU= kind: Secret metadata: - creationTimestamp: null name: prowlarr-credentials namespace: bookstack diff --git a/external_manifests/servarr/servarr-db.secret.yaml b/external_manifests/servarr/servarr-db.secret.yaml index 6adb663..bdb42ef 100644 --- a/external_manifests/servarr/servarr-db.secret.yaml +++ b/external_manifests/servarr/servarr-db.secret.yaml @@ -6,6 +6,5 @@ data: DB_USER: c2VydmFycl91c2VybmFtZQ== kind: Secret metadata: - creationTimestamp: null name: servarr-db-credentials namespace: servarr diff --git a/external_manifests/stash/download.sh_curl_error_20250808.sh b/external_manifests/stash/download.sh_curl_error_20250808.sh new file mode 100644 index 0000000..8038126 --- /dev/null +++ b/external_manifests/stash/download.sh_curl_error_20250808.sh @@ -0,0 +1,85 @@ +#!/bin/bash + +#install required packages +apk add curl wget + +#named argument generation +skip_searching_gallery="${skip_searching_gallery:-false}" + + +while [ $# -gt 0 ]; do + if [[ $1 == "--"* ]]; then + v="${1/--/}" + declare "$v"="$2" + shift + fi + shift +done + +#check if we will use a HTTP proxy or not + +if [[ -z $http_proxy ]]; then + echo "not using proxy" + curl_command="curl" +else + echo "using proxy" + echo $http_proxy + curl_command="curl -x $http_proxy" + +fi + + +#dowload from https://www.pornpics.com/pornstars/eiby-shine/ +DESTINATION_FOLDER="/data" +PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888" + +#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/" +#pornstars="eiby-shine" + +#BASE_URL="https://www.pornpics.com/?q=shy+imp" +#pornstars="shy-imp" + +#BASE_URL="https://www.pornpics.com/pornstars/gloria-sol/" +#pornstars="gloria-sol" + + +#BASE_URL="https://www.pornpics.com/pornstars/becky-summer" +#pornstars="becky-summer" + + +#clear files beforehand + +echo "Pornstar: "$pornstars +echo "URL: "$BASE_URL + +mkdir -p $DESTINATION_FOLDER/$pornstars + +if [[ $skip_searching_gallery == true ]]; then + echo "not looping through galleries" + echo "using existing file instead" + #because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition, + #no deletion of this file +else + echo "looping through galleries" + #because we will re-generate this file, can be emptied + echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt + $curl_command -s $BASE_URL | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt +fi + +echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt + + +for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do + echo "$curl_command $f" + $curl_command "$f" + $curl_command "$f" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt + echo $f +done + + +for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do + $curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars "$g" +# wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars + echo $g +done +exit 0 diff --git a/external_manifests/tdarr/tdarr.svc.yaml b/external_manifests/tdarr/tdarr.svc.yaml new file mode 100644 index 0000000..1aa2778 --- /dev/null +++ b/external_manifests/tdarr/tdarr.svc.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: tdarr-svc-ext + namespace: servarr +spec: + ports: + - name: tdarr + nodePort: 30266 + port: 8266 + protocol: TCP + targetPort: 8266 + selector: + app: tdarr + type: NodePort diff --git a/external_manifests/wikijs/wikijs-db.secret.yaml b/external_manifests/wikijs/wikijs-db.secret.yaml index 2f55b61..d398ca0 100644 --- a/external_manifests/wikijs/wikijs-db.secret.yaml +++ b/external_manifests/wikijs/wikijs-db.secret.yaml @@ -6,6 +6,5 @@ data: DB_USER: d2lraWpzX3VzZXJuYW1l kind: Secret metadata: - creationTimestamp: null name: wikijs-db-credentials namespace: wikijs