gitea
1be79cbd3e
- Remove telegram_notif.sh and all Telegram references - Remove webhook.conf fail2ban action (dashboard webhook stays) - docker-npm.conf: iptables ban/unban only, no lifecycle hooks - Merge docker-compose.cloudflare.yml into docker-compose.yml CF_EMAIL/CF_APIKEY always present — fill in to enable WAF banning - Remove TELEGRAM_BOT_TOKEN/TELEGRAM_CHAT_ID from compose - Drop .env.example dependency — all config inline in compose file Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
66 lines
3.3 KiB
Bash
66 lines
3.3 KiB
Bash
#!/bin/bash
|
|
# ── F2B Control Center — container entrypoint ────────────────────────────────
|
|
# Handles first-run initialisation, then hands off to supervisord.
|
|
# ─────────────────────────────────────────────────────────────────────────────
|
|
set -e
|
|
|
|
echo "[f2b-cc] Starting F2B Control Center..."
|
|
|
|
# ── Kernel module: xt_string (required for X-Forwarded-For matching) ──────────
|
|
if modprobe xt_string 2>/dev/null; then
|
|
echo "[f2b-cc] xt_string kernel module loaded OK"
|
|
else
|
|
echo "[f2b-cc] WARNING: xt_string module unavailable — X-Forwarded-For iptables rules will NOT work"
|
|
echo "[f2b-cc] Run 'modprobe xt_string' on the Docker host to fix this."
|
|
fi
|
|
|
|
# ── DOCKER-USER chain (must exist for the ban action to insert rules) ─────────
|
|
if iptables -L DOCKER-USER -n > /dev/null 2>&1; then
|
|
echo "[f2b-cc] DOCKER-USER iptables chain found OK"
|
|
else
|
|
echo "[f2b-cc] DOCKER-USER chain missing — creating it"
|
|
iptables -N DOCKER-USER 2>/dev/null || true
|
|
fi
|
|
|
|
# ── First-run: install default fail2ban config if none exists ─────────────────
|
|
if [ ! -f /etc/fail2ban/jail.local ]; then
|
|
echo "[f2b-cc] First run — installing default fail2ban configuration..."
|
|
cp -r /etc/f2b-defaults/. /etc/fail2ban/
|
|
|
|
# Cloudflare credentials present → use the CF-enabled jail config
|
|
if [ -n "${CF_EMAIL}" ] && [ -n "${CF_APIKEY}" ]; then
|
|
echo "[f2b-cc] CF_EMAIL + CF_APIKEY detected — enabling Cloudflare jail config"
|
|
cp /etc/f2b-defaults/jail.cloudflare.local /etc/fail2ban/jail.local
|
|
fi
|
|
|
|
# Apply SUBNETS_TO_IGNORE from environment into jail.local's ignoreip line
|
|
if [ -n "${SUBNETS_TO_IGNORE}" ]; then
|
|
IGNORE_LINE="ignoreip = 127.0.0.1/8 ::1 ${SUBNETS_TO_IGNORE}"
|
|
sed -i "s|^ignoreip = .*|${IGNORE_LINE}|" /etc/fail2ban/jail.local
|
|
echo "[f2b-cc] ignoreip set to: 127.0.0.1/8 ::1 ${SUBNETS_TO_IGNORE}"
|
|
fi
|
|
|
|
echo "[f2b-cc] Default configuration installed at /etc/fail2ban/"
|
|
echo "[f2b-cc] Edit /etc/fail2ban/jail.local to customise jails."
|
|
else
|
|
echo "[f2b-cc] Using existing fail2ban configuration."
|
|
fi
|
|
|
|
# ── Ensure required directories and files exist ───────────────────────────────
|
|
mkdir -p /data /var/log /var/run/fail2ban
|
|
|
|
# Create fail2ban log file if it doesn't exist (prevents startup errors)
|
|
touch /var/log/fail2ban.log
|
|
|
|
# Ensure nginx-logs directory exists (warn if empty/unmounted)
|
|
if [ ! -d /nginx-logs ] || [ -z "$(ls -A /nginx-logs 2>/dev/null)" ]; then
|
|
echo "[f2b-cc] WARNING: /nginx-logs appears empty or unmounted."
|
|
echo "[f2b-cc] Set DATA_DIR in .env so NPM logs are bind-mounted here."
|
|
echo "[f2b-cc] Log scanning will not return results until logs are available."
|
|
mkdir -p /nginx-logs
|
|
fi
|
|
|
|
# ── Start supervisord (manages fail2ban + dashboard) ─────────────────────────
|
|
echo "[f2b-cc] Starting supervisord (fail2ban + dashboard)..."
|
|
exec /usr/bin/supervisord -n -c /etc/supervisor/supervisord.conf
|