chore: add new routes for addresses

2026-02-25 09:55:18 +01:00
parent 03cb05f3a5
commit 1376ce3583
8 changed files with 292 additions and 4 deletions
@@ -0,0 +1,142 @@
+---
+# ============================================
+# Fail2Ban Installation et configuration
+# ============================================
+- name: Installation et configuration de Fail2Ban
+  hosts: uber-stup
+  become: true
+  gather_facts: true
+
+  vars:
+    fail2ban_bantime: "1h"
+    fail2ban_findtime: "10m"
+    fail2ban_maxretry: 5
+    fail2ban_ignoreip: "127.0.0.1/8 ::1"
+
+  tasks:
+      # ============================================================
+      # Installation
+      # ============================================================
+      - name: Installer Fail2Ban
+        ansible.builtin.apt:
+            name: fail2ban
+            state: present
+            update_cache: yes
+
+      # ============================================================
+      # Configuration globale (jail.local)
+      # ============================================================
+      - name: Créer jail.local avec la configuration globale
+        ansible.builtin.copy:
+            dest: /etc/fail2ban/jail.local
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+                [DEFAULT]
+                ignoreip    = {{ fail2ban_ignoreip }}
+                bantime     = {{ fail2ban_bantime }}
+                findtime    = {{ fail2ban_findtime }}
+                maxretry    = {{ fail2ban_maxretry }}
+                banaction   = iptables-multiport
+                backend     = systemd
+                loglevel    = INFO
+
+                # ============================================================
+                # SSH
+                # ============================================================
+                [sshd]
+                enabled   = true
+                port      = ssh
+                filter    = sshd
+                logpath   = %(sshd_log)s
+                maxretry  = 3
+                bantime   = 24h
+
+                # ============================================================
+                # Nginx - requêtes trop fréquentes (rate limit)
+                # ============================================================
+                [nginx-limit-req]
+                enabled   = true
+                port      = http,https
+                filter    = nginx-limit-req
+                logpath   = /var/log/nginx/error.log
+                maxretry  = 10
+                bantime   = 1h
+
+                # ============================================================
+                # Nginx - 4xx répétés (scan, bot)
+                # ============================================================
+                [nginx-http-auth]
+                enabled   = true
+                port      = http,https
+                filter    = nginx-http-auth
+                logpath   = /var/log/nginx/error.log
+                maxretry  = 5
+                bantime   = 1h
+
+                # ============================================================
+                # Nginx - bad bots / scans (404 répétés)
+                # ============================================================
+                [nginx-botsearch]
+                enabled   = true
+                port      = http,https
+                filter    = nginx-botsearch
+                logpath   = /var/log/nginx/access.log
+                maxretry  = 10
+                bantime   = 2h
+
+                # ============================================================
+                # API Backend - brute force login (POST /api/v2/login)
+                # ============================================================
+                [backend-login]
+                enabled   = true
+                port      = http,https
+                filter    = backend-login
+                logpath   = /var/log/nginx/access.log
+                maxretry  = 10
+                findtime  = 5m
+                bantime   = 2h
+        notify: Restart fail2ban
+
+      # ============================================================
+      # Filtre personnalisé - brute force login API
+      # ============================================================
+      - name: Créer le filtre fail2ban pour le login API
+        ansible.builtin.copy:
+            dest: /etc/fail2ban/filter.d/backend-login.conf
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+                [Definition]
+                failregex = ^<HOST> .* "POST /api/v2/login HTTP/.*" (401|403) .*$
+                ignoreregex =
+        notify: Restart fail2ban
+
+      # ============================================================
+      # Démarrage et activation
+      # ============================================================
+      - name: Démarrer et activer Fail2Ban
+        ansible.builtin.systemd:
+            name: fail2ban
+            state: started
+            enabled: yes
+
+      # ============================================================
+      # Vérification
+      # ============================================================
+      - name: Vérifier le statut de Fail2Ban
+        ansible.builtin.command: fail2ban-client status
+        register: fail2ban_status
+        changed_when: false
+
+      - name: Afficher le statut des jails
+        ansible.builtin.debug:
+            msg: "{{ fail2ban_status.stdout_lines }}"
+
+  handlers:
+      - name: Restart fail2ban
+        ansible.builtin.systemd:
+            name: fail2ban
+            state: restarted