apiVersion: v1
data:
  nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
    black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
    'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
    and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
    by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
    here as unique identifier for user):\n#\n#   http {\n#     ...\n#     # maps to
    check user is blacklisted (banned in f2b):\n#     #map $arg_token_id      $blck_lst_tok
    { include blacklisted-tokens.map; }\n#     map  $cookie_session_id $blck_lst_ses
    { include blacklisted-sessions.map; }\n#     ...\n#     # special log-format to
    notify fail2ban about failures:\n#     log_format f2b_session_errors '$msec failure
    \"$cookie_session_id\" - $remote_addr - $remote_user '\n#      ;#                  '\"$request\"
    $status $bytes_sent '\n#       #                  '\"$http_referer\" \"$http_user_agent\"';\n#\n#
    \    # location checking blacklisted values:\n#     location ... {\n#       #
    check banned sessionid:\n#       if ($blck_lst_ses != \"\") {\n#         try_files
    \"\" @f2b-banned;\n#       }\n#       ...\n#       # notify fail2ban about a failure
    inside nginx:\n#       error_page 401 = @notify-f2b;\n#       ...\n#     }\n#
    \    ...\n#     # location for return with \"403 Forbidden\" if banned:\n#     location
    @f2b-banned {\n#       default_type text/html;\n#       return 403 \"<br/><center>\n#
    \        <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
    \        You are banned!</b></center>\";\n#     }\n#     ...\n#     # location
    to notify fail2ban about a failure inside nginx:\n#     location @notify-f2b {\n#
    \      access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n#     }\n#
    \  }\n#   ...\n#\n# Note that quote-character (and possibly other special characters)
    are not allowed currently as session-id.\n# Thus please add any session-id validation
    rule in your locations (or in the corresponding backend-service), \n# like in
    example below:\n#\n#   location ... {\n#     if ($cookie_session_id !~ \"^[\\w\\-]+$\")
    {\n#       return  403 \"Wrong session-id\"\n#     }\n#     ...\n#   }\n#\n# The
    parameters for jail corresponding log-format (f2b_session_errors):\n#\n#   [nginx-blck-lst]\n#
    \  filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
    - <ADDR>\n#   usedns = no\n#\n# The same log-file can be used for IP-related jail
    (additionally to session-related, to ban very bad IPs):\n#\n#   [nginx-blck-ip]\n#
    \  maxretry = 100\n#   filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure
    \"[^\"]+\" - <ADDR>\n#   usedns = no\n#\n\n[Definition]\n\n# path to configuration
    of nginx (used to target nginx-instance in multi-instance system,\n# and as path
    for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
    cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
    = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
    command used to check whether nginx is running and configuration is valid:\nsrv_is_running
    = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
    first test nginx is running and configuration is correct, hereafter send reload
    signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n#                    %(srv_cmd)s
    -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n#                  fi;\n\nrestart_file
    = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
    20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
    = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
    Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
    = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
    = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
    | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
    %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
    sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
kind: ConfigMap
metadata:
  creationTimestamp: null
  name: nginx-block-map-action
  namespace: fail2ban