developer/scrabble-game
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(gateway): temporary IP ban (fail2ban) + honeypot/honeytoken (PRERELEASE AG) #97

Merged
developer merged 3 commits from feature/abuse-ip-ban-honeypot into development 2026-06-21 07:28:31 +00:00
Conversation 1 Commits 3 Files Changed 28
+6 -5
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit cf9fa75d62 - Show all commits
deploy/caddy/Caddyfile
+6 -5
View File
@@ -49,14 +49,15 @@
} }
# Honeypot decoy paths: classic vulnerability-scanner bait no real client ever # Honeypot decoy paths: classic vulnerability-scanner bait no real client ever
# requests. Route them to the gateway tagged with X-Scrabble-Honeypot so it logs # requests. Route them to the gateway tagged with X-Scrabble-Honeypot — the set
# the scanner hit and (in prod) bans the source IP. The inbound header is # replaces any client-supplied value — so it logs the scanner hit and (in prod)
# stripped first so a client cannot pre-set it — and even if it did, it would # bans the source IP. (A delete + set in one block would not work: Caddy applies
# only ban itself. Keep this list in sync with no legitimate landing/app path. # header_up deletions after sets, which would strip the tag we just set; the real
# endpoints instead strip the header in the @gateway block above.) Keep this list
# disjoint from every legitimate landing/app path.
@honeypot path /.env /.git /.git/* /.aws/* /wp-login.php /wp-admin /wp-admin/* /phpmyadmin /phpmyadmin/* @honeypot path /.env /.git /.git/* /.aws/* /wp-login.php /wp-admin /wp-admin/* /phpmyadmin /phpmyadmin/*
handle @honeypot { handle @honeypot {
reverse_proxy gateway:8081 { reverse_proxy gateway:8081 {
header_up -X-Scrabble-Honeypot
header_up X-Scrabble-Honeypot 1 header_up X-Scrabble-Honeypot 1
} }
} }