Christian Heusel 735a38b8c2 fail2ban: add nginx-stream-deny ban action ...

Add a ban action that writes `deny <ip>;` lines into the nginx stream
deny snippet, so bans actually match real
client traffic behind the proxies.

The action does not reload nginx itself, there instead is a separate
systemd path unit does that with a cooldown period.

The `nginx-limit-req` jail switches to this banaction when
`nginx_stream_deny` is set on the host.

Related-to: https://gitlab.archlinux.org/archlinux/infrastructure/-/work_items/766
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Christian Heusel <christian@heusel.eu>

2026-10-07 16:08:34 +02:00

..

main.yml

fail2ban: add nginx-stream-deny ban action

2026-10-07 16:08:34 +02:00