statuscode "400,401,403-499" counted almost every client error as a
brute-force strike, so normal 404s/400s from routine app behavior could
rack up 5 hits in 10 minutes and trip a 3h ban (returned as 429) for real
users. Narrow to 401/403 (actual auth failures) and raise maxretry to 15
so it still catches real brute-forcing without false-positiving on noise.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
74.7.243.196 was crawling valknar/home SVG icon tree at 1.8 req/s.
- Denylist the IP in fail2ban dynamic config
- Add rate-limit@file middleware to Gitea's Traefik router to throttle
future scrapers on public repos
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
v0.7.1 caused 403 on all routes. v0.9.0 renamed whitelist→allowlist,
changed ip to a comma-separated string, and added enabled/statuscode fields.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Registers tomMoulard/fail2ban v0.7.1 as an experimental plugin and
applies it globally on the web-secure entrypoint alongside security-headers.
Bans IPs after 5 failures within 10 minutes for 3 hours; whitelists
RFC1918 ranges to protect internal/Docker traffic.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
valknarandClaude Sonnet 5