mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-11-07 22:38:46 +01:00
Christian Heusel
9f9e4f4379
Behind the HAProxy ADN every packet arrives from an allowlisted ADN IP, so an L3/L4 ban issued by fail2ban that targets the real client IP never matches. Add an opt-in L4 stream front-proxy (nginx_stream_deny) that terminates the PROXY protocol, denies banned clients by their real IP before TLS is terminated, then re-emits the PROXY protocol to loopback http listeners so the real client IP is preserved. Related-to: https://gitlab.archlinux.org/archlinux/infrastructure/-/work_items/766 Assisted-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>
10 lines
217 B
SYSTEMD
10 lines
217 B
SYSTEMD
[Unit]
|
|
Description=Reload nginx to apply fail2ban stream deny list changes
|
|
StartLimitIntervalSec=10s
|
|
StartLimitBurst=30
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStartPre=/usr/bin/nginx -t
|
|
ExecStart=/usr/bin/systemctl reload nginx
|