#1124 - [CT] - migrate to nftables and re-deploy fail2ban - Disroot/Disroot-Project - Disroot Forgejo: Brace yourself, merge conflicts ahead.

muppeth commented

2025-02-13 15:59:49 +01:00

Owner

Copy link

Current default on containers is iptables. We should migrate to nftables and automate it unlike current iptables setup on containers.

Development:

Write quick role similar to host setup
Create needed Host_vars for staging
Create needed vars for production
Create procedure for manually blocking IPs (in case of abuse of all sort, which currently is done manually with iptables)
- Procedure should be automated (script+ansible)
- Every added rule should have a reason documented
Document procedure, and entire setup

Implementation:

Create nft playbook
Update fail2ban playbook
Test and prepare procedure for migrating log directory into external mountpoint
Implement migration of log files
Mount gathered log dirs on containers requiring external logfiles from other containers in order to provide paring data for fail2ban
Run nft/fail2ban playbook
Test blocking
Test custom IP block procedure

Current default on containers is iptables. We should migrate to nftables and automate it unlike current iptables setup on containers. ### Development: - [x] Write quick role similar to host setup - [x] Create needed Host_vars for staging - [x] Create needed vars for production - [x] Create procedure for manually blocking IPs (in case of abuse of all sort, which currently is done manually with iptables) - [x] Procedure should be automated (script+ansible) - [x] Every added rule should have a reason documented - [x] Document procedure, and entire setup ### Implementation: - [x] Create nft playbook - [x] Update fail2ban playbook - [x] Test and prepare procedure for migrating log directory into external mountpoint - [ ] Implement migration of log files - [x] Mount gathered log dirs on containers requiring external logfiles from other containers in order to provide paring data for fail2ban - [x] Run nft/fail2ban playbook - [x] Test blocking - [x] Test custom IP block procedure

muppeth added the

Documentation

sysadmin

housekeeping

labels 2025-02-13 15:59:49 +01:00

muppeth added this to the Currently working on milestone 2025-02-24 10:08:08 +01:00

muppeth self-assigned this 2025-02-24 10:08:12 +01:00

muppeth referenced this issue

2025-02-24 10:11:53 +01:00

Update fail2ban role and migrate to nftables #677

meaz commented

2025-03-01 08:16:00 +01:00

Owner

Copy link

I added a comment in the Documentation that you already provided to ask also for documentation on how you mount needed stuff for logfile parsing

👍 1

muppeth referenced this issue

2025-03-02 16:27:20 +01:00

Update fail2ban role and migrate to nftables #677

muppeth changed title from ~~[CT] - migrate to nftables~~ to [CT] - migrate to nftables and re-deploy fail2ban

2025-03-02 16:27:51 +01:00

muppeth added the

🦾 6

label 2025-03-14 14:37:34 +01:00

muppeth commented

2025-04-18 09:31:05 +02:00

Author

Owner

Copy link

Pretty much done but need to do logdir mount and remounts and that will disturb services and since its middle of the day I will not do it now. I will either do it during morning session or perhaps sunday as it's usually quiet. I will see what I will be more comfortable with.