gitea
ec97c06d07
- entrypoint: create proxy-host-placeholder_access.log if no NPM logs exist so fail2ban can start before any proxy hosts are configured - docker-compose: remove :ro from nginx-logs mount (needed for placeholder) - Dockerfile: add jq (required by cloudflare.conf actionunban) - cloudflare.conf: replace python3 JSON parsing with jq; clean stale comments - jail.local + jail.cloudflare.local: add allowipv6 = auto to suppress warning - jail.cloudflare.local: remove stale .env and docker-compose.cloudflare.yml refs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
34 lines
1.5 KiB
Plaintext
34 lines
1.5 KiB
Plaintext
[Definition]
|
|
|
|
# Blocks/unblocks IPs at the Cloudflare account level via the Access Rules API.
|
|
# Bans are enforced by Cloudflare before traffic reaches your server.
|
|
# Enable by setting CF_EMAIL + CF_APIKEY in docker-compose.yml.
|
|
#
|
|
# NOTE: Uses the user-level API — applies across all zones on your account.
|
|
# For zone-scoped rules replace the URL with:
|
|
# https://api.cloudflare.com/client/v4/zones/<ZONE_ID>/firewall/access_rules/rules
|
|
|
|
actionban = curl -s -X POST \
|
|
-H "X-Auth-Email: %(cf_email)s" \
|
|
-H "X-Auth-Key: %(cf_apikey)s" \
|
|
-H "Content-Type: application/json" \
|
|
-d "{\"mode\":\"block\",\"configuration\":{\"target\":\"ip\",\"value\":\"<ip>\"},\"notes\":\"f2b-cc: <name>\"}" \
|
|
"https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules" \
|
|
> /dev/null 2>&1 || true
|
|
|
|
actionunban = RULE_ID=$(curl -s \
|
|
-H "X-Auth-Email: %(cf_email)s" \
|
|
-H "X-Auth-Key: %(cf_apikey)s" \
|
|
"https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules?configuration_target=ip&configuration_value=<ip>&mode=block&page=1&per_page=1" | \
|
|
jq -r '.result[0].id // empty' 2>/dev/null) ; \
|
|
[ -n "$RULE_ID" ] && \
|
|
curl -s -X DELETE \
|
|
-H "X-Auth-Email: %(cf_email)s" \
|
|
-H "X-Auth-Key: %(cf_apikey)s" \
|
|
"https://api.cloudflare.com/client/v4/user/firewall/access_rules/rules/$RULE_ID" \
|
|
> /dev/null 2>&1 || true
|
|
|
|
[Init]
|
|
cf_email =
|
|
cf_apikey =
|