selfhostedops/selfhostedops-stack
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Episode 15: offboarding waits out the Vaultwarden admin rate limit, fail2ban exception only on the provider host

Browse source 
Measured clean run: Pocket ID disable alone left 12 of 14 ways open, the
script (0.9 s, 9 of 9 steps) left 1 of 14.
This commit is contained in:
Maximilian Grimm 2026-09-23 12:08:08 +02:00
parent 12542ecb19
commit 54ab43dac7
3 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

7
HARDENING.md
View file

@ -587,11 +587,12 @@ before the eth0 lines:
**fail2ban locked out people logging in.** The `caddy-probes` jail counts
401/403/404. Pocket ID's login page asks `/api/users/me` (401 without a session)
and the logo (404) on every load. Ten page loads in a minute and the employee is
banned for an hour. Narrow exception in `filter.d/caddy-probes.conf`:
banned for an hour. Narrow exception in `filter.d/caddy-probes.conf`, only for
the provider's own host, so the same paths elsewhere still count:
```
ignoreregex = "uri":"/api/users/me"
"uri":"/api/application-images/
ignoreregex = "host":"id\.[^"]*","uri":"/api/users/me"
"host":"id\.[^"]*","uri":"/api/application-images/
```
**Pocket ID's `/setup` belongs to whoever opens it first.** A scanner fetched