Christian Heusel 9f9e4f4379 nginx: add stream deny front-proxy for fail2ban behind HAProxy ...

Behind the HAProxy ADN every packet arrives from an allowlisted ADN IP,
so an L3/L4 ban issued by fail2ban that targets the real client IP never
matches.

Add an opt-in L4 stream front-proxy (nginx_stream_deny) that terminates
the PROXY protocol, denies banned clients by their real IP before TLS is
terminated, then re-emits the PROXY protocol to loopback http listeners
so the real client IP is preserved.

Related-to: https://gitlab.archlinux.org/archlinux/infrastructure/-/work_items/766
Assisted-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Christian Heusel <christian@heusel.eu>

2026-10-07 16:08:33 +02:00

..

main.yml

nginx: add stream deny front-proxy for fail2ban behind HAProxy

2026-10-07 16:08:33 +02:00