lbailly/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

chore(modules/firewall): Rewrite to simplify

Browse source 
Also disable the ai filter for nodes that don't have nginx enabled
This commit is contained in:
Tom Hubrecht 2025-01-06 00:28:13 +01:00
parent e0cfd1ceb0
commit 3c9c38fb03
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
2 changed files with 55 additions and 59 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
modules/nixos/dgn-firewall/default.nix
View file

@ -3,9 +3,9 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
pkgs, config,
lib, lib,
name, pkgs,
... ...
}: }:
@ -13,6 +13,7 @@ let
inherit (lib) inherit (lib)
concatStringsSep concatStringsSep
length length
optionalAttrs
replicate replicate
splitString splitString
; ;
@ -85,7 +86,9 @@ in
stop = [ (nft "delete table inet reaction") ]; stop = [ (nft "delete table inet reaction") ];
streams = streams'.default // (streams'.${name} or { }); streams = {
inherit (streams') ssh;
} // (optionalAttrs config.services.nginx.enable { inherit (streams') ai-crawlers; });
}; };
}; };
} }

105
modules/nixos/dgn-firewall/streams.nix
View file

@ -23,68 +23,61 @@ let
cmd = act "delete"; cmd = act "delete";
}; };
}; };
in
available = { {
ai-crawlers = { ai-crawlers = {
cmd = [ cmd = [
"tail" "tail"
"-n0" "-n0"
"-f" "-f"
"/var/log/nginx/access.log" "/var/log/nginx/access.log"
];
filters.bots = {
regex = builtins.map (name: ''^<ip>.*"[^"]*${name}[^"]*"$'') [
"AI2Bot"
"Amazonbot"
"Applebot"
"Applebot-Extended"
"Bytespider"
"CCBot"
"ChatGPT-User"
"ClaudeBot"
"Diffbot"
"DuckAssistBot"
"FacebookBot"
"GPTBot"
"Google-Extended"
"Kangaroo Bot"
"Meta-ExternalAgent"
"Meta-ExternalFetcher"
"OAI-SearchBot"
"PerplexityBot"
"Timpibot"
"Webzio-Extended"
"YouBot"
"omgili"
]; ];
actions = ban "720h";
filters.bots = {
regex = builtins.map (name: ''^<ip>.*"[^"]*${name}[^"]*"$'') [
"AI2Bot"
"Amazonbot"
"Applebot"
"Applebot-Extended"
"Bytespider"
"CCBot"
"ChatGPT-User"
"ClaudeBot"
"Diffbot"
"DuckAssistBot"
"FacebookBot"
"GPTBot"
"Google-Extended"
"Kangaroo Bot"
"Meta-ExternalAgent"
"Meta-ExternalFetcher"
"OAI-SearchBot"
"PerplexityBot"
"Timpibot"
"Webzio-Extended"
"YouBot"
"omgili"
];
actions = ban "720h";
};
}; };
};
ssh = { ssh = {
cmd = journalctl "sshd"; cmd = journalctl "sshd";
filters = { filters = {
failedlogin = { failedlogin = {
regex = [ regex = [
"authentication failure;.*rhost=<ip>" "authentication failure;.*rhost=<ip>"
"Connection reset by authenticating user .* <ip>" "Connection reset by authenticating user .* <ip>"
"Connection closed by invalid user .* <ip> port .*" "Connection closed by invalid user .* <ip> port .*"
"Failed password for .* from <ip>" "Failed password for .* from <ip>"
"Invalid user .* from <ip> port .*" "Invalid user .* from <ip> port .*"
"Unable to negotiate with <ip> port .*" "Unable to negotiate with <ip> port .*"
]; ];
actions = ban "48h"; actions = ban "48h";
};
}; };
}; };
}; };
in
builtins.mapAttrs (_: builtins.foldl' (a: s: a // { ${s} = available.${s}; }) { }) {
default = [
"ai-crawlers"
"ssh"
];
} }