From 533bc95c751337d5f2952252b0378848cf078357 Mon Sep 17 00:00:00 2001
From: Jan Tuomi <jan@jantuomi.fi>
Date: Mon, 29 Dec 2025 23:16:22 +0200
Subject: Add crawler tarpit

---
 templates/ingress/nginx_snippet_ban.inc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 templates/ingress/nginx_snippet_ban.inc

(limited to 'templates/ingress/nginx_snippet_ban.inc')

diff --git a/templates/ingress/nginx_snippet_ban.inc b/templates/ingress/nginx_snippet_ban.inc
new file mode 100644
index 0000000..029b965
--- /dev/null
+++ b/templates/ingress/nginx_snippet_ban.inc
@@ -0,0 +1,17 @@
+# Trap route
+location ^~ /wp-admin/ {
+    proxy_set_header X-IP $remote_addr;
+    proxy_method POST;
+    proxy_pass http://unix:/var/run/pfban/ban.sock:/ban;
+
+    proxy_connect_timeout 50ms;
+    proxy_send_timeout    50ms;
+    proxy_read_timeout    50ms;
+
+    # If the socket isn't up yet, still return something
+    error_page 500 502 503 504 = @ban_fallback;
+}
+
+location @ban_fallback {
+    return 204;
+}
-- 
cgit v1.3