mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-07 21:18:57 +01:00
Christian Heusel
9f9e4f4379
Behind the HAProxy ADN every packet arrives from an allowlisted ADN IP, so an L3/L4 ban issued by fail2ban that targets the real client IP never matches. Add an opt-in L4 stream front-proxy (nginx_stream_deny) that terminates the PROXY protocol, denies banned clients by their real IP before TLS is terminated, then re-emits the PROXY protocol to loopback http listeners so the real client IP is preserved. Related-to: https://gitlab.archlinux.org/archlinux/infrastructure/-/work_items/766 Assisted-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>
13 lines
350 B
SYSTEMD
13 lines
350 B
SYSTEMD
[Unit]
|
|
Description=Watch the fail2ban nginx stream deny list for changes
|
|
|
|
[Path]
|
|
PathChanged=/etc/nginx/snippets/stream-fail2ban-deny.conf
|
|
# Setting a limit here could lead to the unit failing, which means that no
|
|
# further reloads are applied and banned IPs can continue to access our
|
|
# service.
|
|
TriggerLimitBurst=0
|
|
|
|
[Install]
|
|
WantedBy=paths.target
|