From 7c333b323a4e3bdc4e7d5cfe1e3585c427b311ac Mon Sep 17 00:00:00 2001 From: pierre Date: Wed, 11 Feb 2026 21:43:36 +0000 Subject: [PATCH] doing some cleanup --- module.tf | 31 ----------- nginx_config.tftpl | 45 ++++++++++++++++ terraform.tfstate | 111 +++------------------------------------ terraform.tfstate.backup | 42 +++++++-------- 4 files changed, 73 insertions(+), 156 deletions(-) create mode 100644 nginx_config.tftpl diff --git a/module.tf b/module.tf index e26a447..2196def 100644 --- a/module.tf +++ b/module.tf @@ -856,37 +856,6 @@ for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : k } -data "bitwarden-secrets_secret" "secret" { - id = "fee7431a-9f6d-478e-8ee0-b3e800c394b5" -} - -output "example" { - value = { - id = data.bitwarden-secrets_secret.secret.id - key = data.bitwarden-secrets_secret.secret.key - value = data.bitwarden-secrets_secret.secret.value #The actual secret value is marked sensitive and will not be printed to stdout - note = data.bitwarden-secrets_secret.secret.note - project_id = data.bitwarden-secrets_secret.secret.project_id - organization_id = data.bitwarden-secrets_secret.secret.organization_id - creation_date = data.bitwarden-secrets_secret.secret.creation_date - revision_date = data.bitwarden-secrets_secret.secret.revision_date - } - sensitive = true -} - - - -resource "kubernetes_config_map_v1_data" "tf-bw-configmap" { - metadata { - name = "bitwarden-terraform" - namespace = "echo-server" - } - - data = yamldecode(data.bitwarden-secrets_secret.secret.value) - #data = data.bitwarden-secrets_secret.secret.value - -} - resource "kubernetes_secret_v1" "automatic-database-secret" { for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true } metadata { diff --git a/nginx_config.tftpl b/nginx_config.tftpl new file mode 100644 index 0000000..8e11070 --- /dev/null +++ b/nginx_config.tftpl @@ -0,0 +1,45 @@ +############################################ +# config file for ${name_site} +############################################ + +upstream ${name_site}_backend { + server ${name_service}; + server 1.1.1.1 backup; + } + +server { + server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu; + location / { + proxy_pass http://${name_site}_backend; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Host $host; + } + location /.well-known/acme-challenge/ { + root /var/www/certbot; + } + + access_log /var/log/nginx/access.log my_custom_format; + access_log /var/log/nginx/ip_audit.log ip_audit; + + listen 443 ssl; + + ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem; + ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem; + +} + +server { + if ($host = www.${name_site}.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } + + + if ($host = ${name_site}.tryton.geeraert.eu) { + return 301 https://$host$request_uri; + } + + server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu; + listen 80; + return 404; + +} diff --git a/terraform.tfstate b/terraform.tfstate index 27d1097..8a5feba 100644 --- a/terraform.tfstate +++ b/terraform.tfstate @@ -1,35 +1,9 @@ { "version": 4, "terraform_version": "1.14.4", - "serial": 5397, + "serial": 5403, "lineage": "9de68ad6-060f-6b41-b115-a689f60c73a2", "outputs": { - "example": { - "value": { - "creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC", - "id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5", - "key": "servarr__db__credentials", - "note": "", - "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d", - "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd", - "revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC", - "value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ==" - }, - "type": [ - "object", - { - "creation_date": "string", - "id": "string", - "key": "string", - "note": "string", - "organization_id": "string", - "project_id": "string", - "revision_date": "string", - "value": "string" - } - ], - "sensitive": true - }, "fromressource": { "value": { "key": { @@ -1320,36 +1294,6 @@ } ] }, - { - "mode": "data", - "type": "bitwarden-secrets_secret", - "name": "secret", - "provider": "provider[\"registry.terraform.io/bitwarden/bitwarden-secrets\"]", - "instances": [ - { - "schema_version": 0, - "attributes": { - "creation_date": "2026-02-05 11:52:05.2843411 +0000 UTC", - "id": "fee7431a-9f6d-478e-8ee0-b3e800c394b5", - "key": "servarr__db__credentials", - "note": "", - "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d", - "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd", - "revision_date": "2026-02-09 13:01:31.4122943 +0000 UTC", - "value": "DB_DATABASE: cHJvd2xhcnItbWFpbg==testing\nDB_HOST: cHJvd2xhcnItZGItc3Zj\nDB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3\nDB_USER: c2VydmFycl91c2VybmFtZQ==" - }, - "sensitive_attributes": [ - [ - { - "type": "get_attr", - "value": "value" - } - ] - ], - "identity_schema_version": 0 - } - ] - }, { "mode": "data", "type": "bitwarden-secrets_secret", @@ -2521,7 +2465,7 @@ "index_key": "fail2ban-50814edb-d190-41cb-8950-b3ee01622dcf", "schema_version": 0, "attributes": { - "binary_data": null, + "binary_data": {}, "data": { "nginx-block-map.local": "## Version 2022/08/06\n# Fail2Ban configuration file for black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,\n# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }\n# ...\n# # special log-format to notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure \"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\" $status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n# # location checking blacklisted values:\n# location ... {\n# # check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files \"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n# ...\n# # location for return with \"403 Forbidden\" if banned:\n# location @f2b-banned {\n# default_type text/html;\n# return 403 \"\u003cbr/\u003e\u003ccenter\u003e\n# \u003cb style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\"\u003e\n# You are banned!\u003c/b\u003e\u003c/center\u003e\";\n# }\n# ...\n# # location to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n# }\n# ...\n#\n# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.\n# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), \n# like in example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\") {\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"\u003cF-ID\u003e[^\"]+\u003c/F-ID\u003e\" - \u003cADDR\u003e\n# usedns = no\n#\n# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n# maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"[^\"]+\" - \u003cADDR\u003e\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration of nginx (used to target nginx-instance in multi-instance system,\n# and as path for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n# cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n# command used to check whether nginx is running and configuration is valid:\nsrv_is_running = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s \u0026\u0026 %(srv_cmd)s -qt\n\n# first test nginx is running and configuration is correct, hereafter send reload signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep 20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n# Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"\u003cfid\u003e\"\n\nactionban = echo \u003cip\u003e | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' \u003e\u003e '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\\u0026/g'); sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n" }, @@ -2529,10 +2473,10 @@ "immutable": false, "metadata": [ { - "annotations": null, + "annotations": {}, "generate_name": "", "generation": 0, - "labels": null, + "labels": {}, "name": "nginx-block-map-action", "namespace": "fail2ban", "resource_version": "218713306", @@ -2607,7 +2551,7 @@ "index_key": "fail2ban-fb11452e-fec1-489f-9144-b3ee0162ccda", "schema_version": 0, "attributes": { - "binary_data": null, + "binary_data": {}, "data": { "nginx-unauthorized.local": "## Version 2022/08/06\n# Fail2Ban filter configuration for nginx unauthorized\n\n[INCLUDES]\nbefore = common.conf\n\n[Definition]\n\n#original\n#failregex = ^\u003cHOST\u003e.*\"(GET|POST|HEAD).*\" (401) .*$\n\n\n#try this one\nfailregex = ^\u003cHOST\u003e - .* \"(?:GET|POST|HEAD) [^\"]+\" 401\n ^\u003cHOST\u003e - .* upstream_status=401\n #for servarr\n ^\u003cHOST\u003e -.*\"GET /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n ^\u003cHOST\u003e -.*\"POST /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n #for bitwarden\n ^\u003cHOST\u003e -.*\"POST /identity/accounts/prelogin *HTTP/.*\" 200\n#actionban = touch /tmp/\u003cname\u003e.ban\n#actionunban = touch /tmp/\u003cname\u003e.unban\n" }, @@ -2615,10 +2559,10 @@ "immutable": false, "metadata": [ { - "annotations": null, + "annotations": {}, "generate_name": "", "generation": 0, - "labels": null, + "labels": {}, "name": "fail2ban-nginx-unauthorized-filter", "namespace": "fail2ban", "resource_version": "218713307", @@ -2648,47 +2592,6 @@ } ] }, - { - "mode": "managed", - "type": "kubernetes_config_map_v1_data", - "name": "tf-bw-configmap", - "provider": "provider[\"registry.terraform.io/hashicorp/kubernetes\"]", - "instances": [ - { - "schema_version": 0, - "attributes": { - "data": { - "DB_DATABASE": "cHJvd2xhcnItbWFpbg==testing", - "DB_HOST": "cHJvd2xhcnItZGItc3Zj", - "DB_PASS": "R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3", - "DB_USER": "c2VydmFycl91c2VybmFtZQ==" - }, - "field_manager": "Terraform", - "force": null, - "id": "echo-server/bitwarden-terraform", - "metadata": [ - { - "name": "bitwarden-terraform", - "namespace": "echo-server" - } - ] - }, - "sensitive_attributes": [ - [ - { - "type": "get_attr", - "value": "data" - } - ] - ], - "identity_schema_version": 0, - "private": "bnVsbA==", - "dependencies": [ - "data.bitwarden-secrets_secret.secret" - ] - } - ] - }, { "mode": "managed", "type": "kubernetes_deployment_v1", diff --git a/terraform.tfstate.backup b/terraform.tfstate.backup index b349a6b..27d1097 100644 --- a/terraform.tfstate.backup +++ b/terraform.tfstate.backup @@ -1,7 +1,7 @@ { "version": 4, "terraform_version": "1.14.4", - "serial": 5388, + "serial": 5397, "lineage": "9de68ad6-060f-6b41-b115-a689f60c73a2", "outputs": { "example": { @@ -1256,10 +1256,10 @@ "creation_date": "2026-02-11 21:29:31.5585848 +0000 UTC", "id": "50814edb-d190-41cb-8950-b3ee01622dcf", "key": "fail2ban__configmap__nginx-block-map-action", - "note": "nginx-block-map-action-tf", + "note": "nginx-block-map-action", "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d", "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd", - "revision_date": "2026-02-11 21:29:31.5585853 +0000 UTC", + "revision_date": "2026-02-11 21:33:46.2095808 +0000 UTC", "value": " nginx-block-map.local: \"## Version 2022/08/06\\n# Fail2Ban configuration file for\n black-listing via nginx\\n#\\n# Author: Serg G. Brester (aka sebres)\\n#\\n# To use\n 'nginx-block-map' action you should define some special blocks in your nginx configuration,\\n#\n and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx\n by ban).\\n#\\n# Example (argument \\\"token_id\\\" resp. cookie \\\"session_id\\\" used\n here as unique identifier for user):\\n#\\n# http {\\n# ...\\n# # maps to\n check user is blacklisted (banned in f2b):\\n# #map $arg_token_id $blck_lst_tok\n { include blacklisted-tokens.map; }\\n# map $cookie_session_id $blck_lst_ses\n { include blacklisted-sessions.map; }\\n# ...\\n# # special log-format to\n notify fail2ban about failures:\\n# log_format f2b_session_errors '$msec failure\n \\\"$cookie_session_id\\\" - $remote_addr - $remote_user '\\n# ;# '\\\"$request\\\"\n $status $bytes_sent '\\n# # '\\\"$http_referer\\\" \\\"$http_user_agent\\\"';\\n#\\n#\n \\ # location checking blacklisted values:\\n# location ... {\\n# #\n check banned sessionid:\\n# if ($blck_lst_ses != \\\"\\\") {\\n# try_files\n \\\"\\\" @f2b-banned;\\n# }\\n# ...\\n# # notify fail2ban about a failure\n inside nginx:\\n# error_page 401 = @notify-f2b;\\n# ...\\n# }\\n#\n \\ ...\\n# # location for return with \\\"403 Forbidden\\\" if banned:\\n# location\n @f2b-banned {\\n# default_type text/html;\\n# return 403 \\\"\u003cbr/\u003e\u003ccenter\u003e\\n#\n \\ \u003cb style=\\\\\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\\\\\"\u003e\\n#\n \\ You are banned!\u003c/b\u003e\u003c/center\u003e\\\";\\n# }\\n# ...\\n# # location\n to notify fail2ban about a failure inside nginx:\\n# location @notify-f2b {\\n#\n \\ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\\n# }\\n#\n \\ }\\n# ...\\n#\\n# Note that quote-character (and possibly other special characters)\n are not allowed currently as session-id.\\n# Thus please add any session-id validation\n rule in your locations (or in the corresponding backend-service), \\n# like in\n example below:\\n#\\n# location ... {\\n# if ($cookie_session_id !~ \\\"^[\\\\w\\\\-]+$\\\")\n {\\n# return 403 \\\"Wrong session-id\\\"\\n# }\\n# ...\\n# }\\n#\\n# The\n parameters for jail corresponding log-format (f2b_session_errors):\\n#\\n# [nginx-blck-lst]\\n#\n \\ filter =\\n# datepattern = ^Epoch\\n# failregex = ^ failure \\\"\u003cF-ID\u003e[^\\\"]+\u003c/F-ID\u003e\\\"\n - \u003cADDR\u003e\\n# usedns = no\\n#\\n# The same log-file can be used for IP-related jail\n (additionally to session-related, to ban very bad IPs):\\n#\\n# [nginx-blck-ip]\\n#\n \\ maxretry = 100\\n# filter =\\n# datepattern = ^Epoch\\n# failregex = ^ failure\n \\\"[^\\\"]+\\\" - \u003cADDR\u003e\\n# usedns = no\\n#\\n\\n[Definition]\\n\\n# path to configuration\n of nginx (used to target nginx-instance in multi-instance system,\\n# and as path\n for the blacklisted map):\\n#srv_cfg_path = /etc/nginx/\\n\\nsrv_cfg_path = /blacklisted.d/\\n\\n#\n cmd-line arguments to supply to test/reload nginx:\\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\\nsrv_cmd\n = nginx\\n\\n# pid file (used to check nginx is running):\\nsrv_pid = /run/nginx.pid\\n\\n#\n command used to check whether nginx is running and configuration is valid:\\nsrv_is_running\n = [ -f \\\"%(srv_pid)s\\\" ]\\nsrv_check_cmd = %(srv_is_running)s \u0026\u0026 %(srv_cmd)s -qt\\n\\n#\n first test nginx is running and configuration is correct, hereafter send reload\n signal:\\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\\n# %(srv_cmd)s\n -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\\n# fi;\\n\\nrestart_file\n = /restart-signal/restart.txt\\n\\nblck_lst_reload = touch %(restart_file)s;sleep\n 20; rm %(restart_file)s;\\n\\n# map-file for nginx, can be redefined using `action\n = nginx-block-map[blck_lst_file=\\\"/path/file.map\\\"]`:\\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\\n\\n#\n Action definition:\\n\\nactionstart_on_demand = false\\nactionstart = touch '%(blck_lst_file)s'\\n\\nactionflush\n = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\\n\\nactionstop = %(actionflush)s\\n\\nactioncheck\n = \\n\\n_echo_blck_row = printf '\\\\%%s 1;\\\\n' \\\"\u003cfid\u003e\\\"\\n\\nactionban = echo \u003cip\u003e\n | awk -F. '{print \\\"deny \\\"$1\\\".\\\"$2\\\".\\\"$3\\\".\\\"$4\\\";\\\"}' \u003e\u003e '%(blck_lst_file)s';\n %(blck_lst_reload)s\\n\\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\\\/$*.^|[]/\\\\\\\\\u0026/g');\n sed -i \\\"/^$id$/d\\\" %(blck_lst_file)s; %(blck_lst_reload)s\\n\"\n" }, "sensitive_attributes": [ @@ -1302,10 +1302,10 @@ "creation_date": "2026-02-11 21:31:47.2717663 +0000 UTC", "id": "fb11452e-fec1-489f-9144-b3ee0162ccda", "key": "fail2ban__configmap__fail2ban-nginx-unauthorized-filter", - "note": "fail2ban-nginx-unauthorized-filter-tf", + "note": "fail2ban-nginx-unauthorized-filter", "organization_id": "a6361589-badd-4bde-9cb4-af8901161c0d", "project_id": "b5fc4c48-e951-442f-97ca-b3e800c143cd", - "revision_date": "2026-02-11 21:31:47.2717667 +0000 UTC", + "revision_date": "2026-02-11 21:33:55.7856419 +0000 UTC", "value": " nginx-unauthorized.local: |\n ## Version 2022/08/06\n # Fail2Ban filter configuration for nginx unauthorized\n\n [INCLUDES]\n before = common.conf\n\n [Definition]\n\n #original\n #failregex = ^\u003cHOST\u003e.*\"(GET|POST|HEAD).*\" (401) .*$\n\n\n #try this one\n failregex = ^\u003cHOST\u003e - .* \"(?:GET|POST|HEAD) [^\"]+\" 401\n ^\u003cHOST\u003e - .* upstream_status=401\n #for servarr\n ^\u003cHOST\u003e -.*\"GET /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n ^\u003cHOST\u003e -.*\"POST /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n #for bitwarden\n ^\u003cHOST\u003e -.*\"POST /identity/accounts/prelogin *HTTP/.*\" 200\n #actionban = touch /tmp/\u003cname\u003e.ban\n #actionunban = touch /tmp/\u003cname\u003e.unban\n" }, "sensitive_attributes": [ @@ -2521,22 +2521,22 @@ "index_key": "fail2ban-50814edb-d190-41cb-8950-b3ee01622dcf", "schema_version": 0, "attributes": { - "binary_data": {}, + "binary_data": null, "data": { "nginx-block-map.local": "## Version 2022/08/06\n# Fail2Ban configuration file for black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,\n# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok { include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }\n# ...\n# # special log-format to notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure \"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\" $status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n# # location checking blacklisted values:\n# location ... {\n# # check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files \"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n# ...\n# # location for return with \"403 Forbidden\" if banned:\n# location @f2b-banned {\n# default_type text/html;\n# return 403 \"\u003cbr/\u003e\u003ccenter\u003e\n# \u003cb style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\"\u003e\n# You are banned!\u003c/b\u003e\u003c/center\u003e\";\n# }\n# ...\n# # location to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n# access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n# }\n# ...\n#\n# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.\n# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), \n# like in example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\") {\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"\u003cF-ID\u003e[^\"]+\u003c/F-ID\u003e\" - \u003cADDR\u003e\n# usedns = no\n#\n# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n# maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"[^\"]+\" - \u003cADDR\u003e\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration of nginx (used to target nginx-instance in multi-instance system,\n# and as path for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n# cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n# command used to check whether nginx is running and configuration is valid:\nsrv_is_running = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s \u0026\u0026 %(srv_cmd)s -qt\n\n# first test nginx is running and configuration is correct, hereafter send reload signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep 20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n# Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"\u003cfid\u003e\"\n\nactionban = echo \u003cip\u003e | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' \u003e\u003e '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\\u0026/g'); sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n" }, - "id": "fail2ban/nginx-block-map-action-tf", + "id": "fail2ban/nginx-block-map-action", "immutable": false, "metadata": [ { - "annotations": {}, + "annotations": null, "generate_name": "", "generation": 0, - "labels": {}, - "name": "nginx-block-map-action-tf", + "labels": null, + "name": "nginx-block-map-action", "namespace": "fail2ban", - "resource_version": "218712271", - "uid": "3236592a-fbb9-41e2-a8bf-8bcb7e077361" + "resource_version": "218713306", + "uid": "becd578a-4dd2-4be6-a3fe-d8a277659218" } ] }, @@ -2552,7 +2552,7 @@ "identity": { "api_version": "v1", "kind": "ConfigMap", - "name": "nginx-block-map-action-tf", + "name": "nginx-block-map-action", "namespace": "fail2ban" }, "private": "bnVsbA==", @@ -2607,22 +2607,22 @@ "index_key": "fail2ban-fb11452e-fec1-489f-9144-b3ee0162ccda", "schema_version": 0, "attributes": { - "binary_data": {}, + "binary_data": null, "data": { "nginx-unauthorized.local": "## Version 2022/08/06\n# Fail2Ban filter configuration for nginx unauthorized\n\n[INCLUDES]\nbefore = common.conf\n\n[Definition]\n\n#original\n#failregex = ^\u003cHOST\u003e.*\"(GET|POST|HEAD).*\" (401) .*$\n\n\n#try this one\nfailregex = ^\u003cHOST\u003e - .* \"(?:GET|POST|HEAD) [^\"]+\" 401\n ^\u003cHOST\u003e - .* upstream_status=401\n #for servarr\n ^\u003cHOST\u003e -.*\"GET /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n ^\u003cHOST\u003e -.*\"POST /login\\?returnUrl=/\u0026loginFailed=true HTTP/.*\" 200\n #for bitwarden\n ^\u003cHOST\u003e -.*\"POST /identity/accounts/prelogin *HTTP/.*\" 200\n#actionban = touch /tmp/\u003cname\u003e.ban\n#actionunban = touch /tmp/\u003cname\u003e.unban\n" }, - "id": "fail2ban/fail2ban-nginx-unauthorized-filter-tf", + "id": "fail2ban/fail2ban-nginx-unauthorized-filter", "immutable": false, "metadata": [ { - "annotations": {}, + "annotations": null, "generate_name": "", "generation": 0, - "labels": {}, - "name": "fail2ban-nginx-unauthorized-filter-tf", + "labels": null, + "name": "fail2ban-nginx-unauthorized-filter", "namespace": "fail2ban", - "resource_version": "218712966", - "uid": "a662b957-7166-4b50-af2b-e0ce6ad5861f" + "resource_version": "218713307", + "uid": "4852876c-7ac4-4833-a5ab-496a9fb30987" } ] }, @@ -2638,7 +2638,7 @@ "identity": { "api_version": "v1", "kind": "ConfigMap", - "name": "fail2ban-nginx-unauthorized-filter-tf", + "name": "fail2ban-nginx-unauthorized-filter", "namespace": "fail2ban" }, "private": "bnVsbA==",