mirror of
https://github.com/MeshCore-Beacon/beacon-docs.git
synced 2026-10-25 02:42:39 +00:00
46 lines
1.5 KiB
Plaintext
46 lines
1.5 KiB
Plaintext
# Beacon API jails for a host-Apache deployment (analyzer.meshmapper.net shape).
|
|
# Same conventions as meshmapper-http.conf on that box: no [DEFAULT], backend = polling per jail,
|
|
# ignoreip = loopback, Tailscale, the Subscriber.
|
|
# banaction = dummy is observe mode (would-be bans land in /var/run/fail2ban/fail2ban.dummy).
|
|
# To enforce, delete those lines: the inherited default (nftables, input hook) works as-is because
|
|
# Apache listens on the host. bantime is a flat 10m to start: a banned CGNAT address hurts every
|
|
# user behind it.
|
|
|
|
[beacon-api-flood]
|
|
enabled = true
|
|
backend = polling
|
|
filter = beacon-api-flood
|
|
port = http,https
|
|
banaction = dummy
|
|
logpath = /var/log/apache2/analyzer-ssl-access.log
|
|
maxretry = 900
|
|
findtime = 60
|
|
bantime = 10m
|
|
ignoreip = 127.0.0.1/8 ::1 100.64.0.0/10 192.99.151.15
|
|
|
|
[beacon-api-429]
|
|
enabled = true
|
|
backend = polling
|
|
filter = beacon-api-429
|
|
port = http,https
|
|
banaction = dummy
|
|
logpath = /var/log/apache2/analyzer-ssl-access.log
|
|
maxretry = 300
|
|
findtime = 600
|
|
bantime = 10m
|
|
ignoreip = 127.0.0.1/8 ::1 100.64.0.0/10 192.99.151.15
|
|
|
|
# A paced scraper stays under the per-minute flood rule; this counts the hour instead.
|
|
# Real sessions peak around 300/h (2026-09-03 observation); a scraper pacing at 2/s does ~7,000.
|
|
[beacon-api-sustained]
|
|
enabled = true
|
|
backend = polling
|
|
filter = beacon-api-flood
|
|
port = http,https
|
|
logpath = /var/log/apache2/analyzer-ssl-access.log
|
|
banaction = dummy
|
|
maxretry = 1000
|
|
findtime = 1h
|
|
bantime = 10m
|
|
ignoreip = 127.0.0.1/8 ::1 100.64.0.0/10 192.99.151.15
|