# Fail2Ban jail: fake-Googlebot User-Agent, vhost-log variant.
#
# Install as: /etc/fail2ban/jail.d/apache-vhost-fakegooglebot.local
#
# Why jail.d/*.local and not jail.d/*.conf: on a panel-managed host (e.g.
# ISPConfig3), the panel owns /etc/fail2ban/jail.local and rewrites it on
# update.  Files in jail.d/ are left alone, and the .local suffix is read
# last, so nothing in that file's [DEFAULT] can silently override the
# values set here.  On a hand-managed host with no such panel, jail.d/*.local
# still works the same way and costs nothing.
#
# IMPORTANT: `ignorecommand` below is required, not optional. The failregex
# matches any UA containing "Googlebot/", including real Googlebot - the
# ignorecommand is what does the reverse-DNS check against *.google(bot).com
# and tells fail2ban to skip the ban when the IP is genuinely Google's.
# Without it, this jail bans real Googlebot too. The script it points at
# ships with the fail2ban package itself, not this project.

[apache-vhost-fakegooglebot]
enabled  = true

# MUST equal the filter's filename without .conf, i.e.
# /etc/fail2ban/filter.d/apache-vhost-fakegooglebot.conf
filter   = apache-vhost-fakegooglebot

logpath  = /var/log/apache2/other_vhosts_access.log

ignorecommand = %(fail2ban_confpath)s/filter.d/ignorecommands/apache-fakegooglebot <ip>

# This host is SysV, not systemd - never let this become "systemd".
backend  = auto

port     = http,https
protocol = tcp

# maxretry = 1, matching the stock apache-fakegooglebot jail: the
# ignorecommand above is what actually decides real-vs-fake, so there is no
# benefit to waiting for a second occurrence.
maxretry = 1
findtime = 1d
bantime  = 48h

# Requires fail2ban >= 0.11 - delete these three lines on 0.9/0.10.
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 1w

# Add your own office/VPN addresses here if you want to be exempt outright.
#ignoreip = 127.0.0.1/8 ::1

# banaction is deliberately not set, so this jail uses whatever
# jail.local's [DEFAULT] already configures on this host - panel-managed
# or not - and stays consistent with the existing firewall (iptables/
# nftables/ufw).