Damien/infra-scripts
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(proxy): couvrir les deux ordres de champs dans l'ignoreregex git

Browse Source 
L'ignoreregex n'excluait que l'ordre RequestPath puis DownstreamStatus,
alors que le failregex juste au-dessus gère explicitement les deux
ordres possibles de sérialisation JSON de Traefik. Si Traefik
sérialise dans l'autre ordre, l'exclusion ne matchait pas et le ban
sur git fetch revenait silencieusement.

Ajoute la seconde ligne (DownstreamStatus puis RequestPath), symétrique
au failregex.
This commit is contained in:
Damien
2026-08-01 10:58:51 +02:00
parent fe284d8a38
commit 25bd5f2ac9
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/install.sh
+2
View File
@@ -162,7 +162,9 @@ failregex = ^.*"ClientHost":"<HOST>".*"DownstreamStatus":(401|403|429|5[0-9]{2})
# WWW-Authenticate challenge, then retries with credentials. That first 401 # WWW-Authenticate challenge, then retries with credentials. That first 401
# is protocol, not abuse — without this exclusion a handful of git # is protocol, not abuse — without this exclusion a handful of git
# clone/fetch/push in a few minutes bans the client on a private repo. # clone/fetch/push in a few minutes bans the client on a private repo.
# Same two-orderings caveat as failregex above.
ignoreregex = ^.*"RequestPath":"[^"]*/(info/refs|git-upload-pack|git-receive-pack)[^"]*".*"DownstreamStatus":401 ignoreregex = ^.*"RequestPath":"[^"]*/(info/refs|git-upload-pack|git-receive-pack)[^"]*".*"DownstreamStatus":401
^.*"DownstreamStatus":401.*"RequestPath":"[^"]*/(info/refs|git-upload-pack|git-receive-pack)[^"]*"
EOF EOF
sudo tee /etc/fail2ban/jail.d/traefik.conf > /dev/null << 'EOF' sudo tee /etc/fail2ban/jail.d/traefik.conf > /dev/null << 'EOF'