# Fail2Ban jail: DokuWiki media-manager crawling.
#
# Install as: /etc/fail2ban/jail.d/apache-vhost-dokuwiki-crawl.local
#
# Enable this AFTER the Apache rule in dokuwiki-block.md is live and
# verified.  Before that rule, the attack traffic is HTTP 200 and this jail
# will match nothing (by design - see apache-vhost-dokuwiki-crawl.conf).
#
# HONEST LIMITATION: this jail is a backstop, not the defence.  The observed
# burst used 9 source IPs for 10 requests - 8 of them appeared exactly once.
# No per-IP threshold can catch a swarm shaped like that, so maxretry is set
# to the lowest value that still tolerates one forgetful editor.  The Apache
# 403 is what actually neutralises the attack; this jail just stops the
# repeat offenders from holding connections open at all.

[apache-vhost-dokuwiki-crawl]
enabled  = true

filter   = apache-vhost-dokuwiki-crawl

logpath  = /var/log/apache2/other_vhosts_access.log

# SysV host, not systemd.
backend  = auto

port     = http,https
protocol = tcp

# 2 strikes, counted over a long window: a swarm IP that comes back at all
# gets caught, while an editor who hits the media manager once or twice
# before logging in does not.  Long findtime matters more than a low
# maxretry here, because these IPs return over hours, not seconds.
maxretry = 2
findtime = 6h
bantime  = 1w

# Requires fail2ban >= 0.11 - delete on 0.9/0.10.
bantime.increment = true
bantime.factor    = 4
bantime.maxtime   = 30d

#ignoreip = 127.0.0.1/8 ::1

# banaction unset on purpose: inherits jail.local's [DEFAULT] on this host -
# panel-managed or not - so this stays consistent with the existing
# firewall.