X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/2c9527844e884db26c83395ac4068d76507c7999..0027d0084da35d700e08b77d42a6e2e7e61655d1:/cookbooks/apache/recipes/default.rb?ds=inline diff --git a/cookbooks/apache/recipes/default.rb b/cookbooks/apache/recipes/default.rb index aee5dfcc8..d1a0aac1d 100644 --- a/cookbooks/apache/recipes/default.rb +++ b/cookbooks/apache/recipes/default.rb @@ -17,7 +17,7 @@ # limitations under the License. # -include_recipe "munin" +include_recipe "fail2ban" include_recipe "prometheus" include_recipe "ssl" @@ -61,13 +61,6 @@ systemd_service "apache2" do notifies :restart, "service[apache2]" end -service "apache2" do - action [:enable, :start] - retries 2 - retry_delay 10 - supports :status => true, :restart => true, :reload => true -end - apache_module "info" do conf "info.conf.erb" variables :hosts => admins["hosts"] @@ -78,9 +71,14 @@ apache_module "status" do variables :hosts => admins["hosts"] end -apache_module "evasive" do - conf "evasive.conf.erb" - only_if { node[:apache][:evasive] } +if node[:apache][:evasive][:enable] + apache_module "evasive" do + conf "evasive.conf.erb" + end +else + apache_module "evasive" do + action :disable + end end apache_module "brotli" do @@ -98,9 +96,34 @@ apache_conf "ssl" do template "ssl.erb" end -munin_plugin "apache_accesses" -munin_plugin "apache_processes" -munin_plugin "apache_volume" +# Apache should only be started after modules enabled +service "apache2" do + action [:enable, :start] + retries 2 + retry_delay 10 + supports :status => true, :restart => true, :reload => true +end + +fail2ban_filter "apache-forbidden" do + action :delete +end + +fail2ban_jail "apache-forbidden" do + action :delete +end + +fail2ban_filter "apache-evasive" do + failregex ": Blacklisting address : possible DoS attack\.$" +end + +fail2ban_jail "apache-evasive" do + filter "apache-evasive" + backend "systemd" + journalmatch "_SYSTEMD_UNIT=apache2.service SYSLOG_IDENTIFIER=mod_evasive" + ports [80, 443] + findtime "10m" + maxretry 3 +end template "/var/lib/prometheus/node-exporter/apache.prom" do source "apache.prom.erb"