diff --git a/manifests/monitoring/fail2ban.pp b/manifests/monitoring/fail2ban.pp index 40b4c0b..0300e0b 100644 --- a/manifests/monitoring/fail2ban.pp +++ b/manifests/monitoring/fail2ban.pp @@ -22,7 +22,20 @@ class cd_haproxy::monitoring::fail2ban ( seltype => etc_t, seluser => system_u, content => template('cd_haproxy/fail2ban/f2b_haproxy.conf.erb'), - notify => Service[$fn_service], + notify => Service['fail2ban'], + } + + file { '/etc/fail2ban/jail.d/010-haproxy.conf': + ensure => file, + owner => 'root', + group => 'root', + mode => '0644', + selrange => s0, + selrole => object_r, + seltype => etc_t, + seluser => system_u, + content => template('cd_haproxy/fail2ban/010_jaild_haproxy.conf.erb'), + notify => Service['fail2ban'], } } } diff --git a/templates/fail2ban/010_jail.d_haproxy.conf.erb b/templates/fail2ban/010_jail.d_haproxy.conf.erb new file mode 100644 index 0000000..804359d --- /dev/null +++ b/templates/fail2ban/010_jail.d_haproxy.conf.erb @@ -0,0 +1,12 @@ +################################################################################ +##### fail2ban jail for haproxy.conf created by Puppet ##### +################################################################################ + +[haproxy-http-auth] +enabled = true +filter = haproxy +action = iptables[name=haproxy, port="http,https", protocol=tcp] +logpath = /var/log/haproxy.log +maxretry = 5 +findtime = 600 +bantime = 3600