bastian/deploy_home
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GitHub linguist .yml, fail2ban config fixes

Browse Source
This commit is contained in:
Bastian de Byl
2020-09-25 11:41:15 -04:00
parent 770be0ef4b
commit 3b4ad7c45c
4 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
.gitattributes vendored
View File

@@ -1,2 +1,3 @@
.pass.sh filter=git-crypt diff=git-crypt .pass.sh filter=git-crypt diff=git-crypt
ansible/vars/vault.yml filter=git-crypt diff=git-crypt ansible/vars/vault.yml filter=git-crypt diff=git-crypt
*.yml linguist-detectable

6
ansible/roles/common/files/fail2ban/jails/nginx.local
View File

@@ -1,9 +1,11 @@
[nginx-limit-req] [nginx-limit-req]
enabled = true enabled = true
port = http,https port = http,https
logpath = %(nginx_error_log)s
findtime = 600 findtime = 600
bantime = 1w bantime = 1w
maxretry = 8 maxretry = 8
ignoreip = 127.0.0.1/32 192.168.1.0/24
[nginx-http-auth] [nginx-http-auth]
enabled = true enabled = true
@@ -11,10 +13,12 @@ port = http,https
logpath = %(nginx_error_log)s logpath = %(nginx_error_log)s
bantime = 2w bantime = 2w
maxretry = 5 maxretry = 5
ignoreip = 127.0.0.1/32 192.168.1.0/24
[nginx-botsearch] [nginx-botsearch]
enabled = true enabled = true
port = http,https port = http,https
logpath = %(nginx_error_log)s logpath = %(nginx_access_log)s
bantime = 1w bantime = 1w
maxretry = 5 maxretry = 5
ignoreip = 127.0.0.1/32 192.168.1.0/24

2
ansible/roles/common/files/fail2ban/jails/sshd.local
View File

@@ -6,5 +6,5 @@ backend = systemd
maxretry = 5 maxretry = 5
findtime = 1d findtime = 1d
bantime = 2w bantime = 2w
ignoreip = 127.0.0.1/8 192.168.1.0/24 ignoreip = 127.0.0.1/32 192.168.1.0/24
logpath = %(sshd_log)s logpath = %(sshd_log)s

3
ansible/roles/http/templates/nginx/sites/ci.bdebyl.net.https.conf.j2
View File

@@ -8,6 +8,9 @@ server {
server_name {{ ci_server_name }}; server_name {{ ci_server_name }};
add_header Strict-Transport-Security max-age=6307200; add_header Strict-Transport-Security max-age=6307200;
add_header Allow "GET, POST, HEAD" always;
limit_except GET POST { deny all; }
ssl_certificate /etc/letsencrypt/live/{{ ci_server_name }}/fullchain.pem; ssl_certificate /etc/letsencrypt/live/{{ ci_server_name }}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/{{ ci_server_name }}/privkey.pem; ssl_certificate_key /etc/letsencrypt/live/{{ ci_server_name }}/privkey.pem;