From b0785c211b96197dcd5a31d6322bace41498b7e2 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Mon, 7 Sep 2026 09:09:37 -0500 Subject: [PATCH] nuisance: 24 new blocks 09-07 (backlog of missed runs) + path/env fixes Sweep checkout path moved to ~/projects/KNEL/KNELPFVCluster; creds now accepted from env (vault/sm-ready) since ~/.creds textfiles retired. Redmine: https://projects.knownelement.com/issues/796#note-134 --- perf/nuisance/blocklist.txt | 32 ++++++++++++++++++++++++++------ perf/nuisance/nuisance-sweep.sh | 18 +++++++++++------- 2 files changed, 37 insertions(+), 13 deletions(-) diff --git a/perf/nuisance/blocklist.txt b/perf/nuisance/blocklist.txt index 6c8a706..2ff035b 100644 --- a/perf/nuisance/blocklist.txt +++ b/perf/nuisance/blocklist.txt @@ -3,14 +3,11 @@ # GET/POST https://my.knownelement.com/api/v1/network/blocklist (admin token) # panel: Network > IP block list; enforced via ipset cloudron_blocklist on # INPUT(CLOUDRON) + FORWARD(DOCKER-USER); Cloudron re-applies at boot. -# This file mirrors the live setting (last sync 2026-09-04 12:15 CDT, #796). +# This file mirrors the live setting (last sync 2026-09-07 09:09 CDT, #796). # Full-line comments allowed in both. - -# founder-directed 2026-09-04 (#796, #787 root cause): hostile SMTP ranges +# sweep-added 2026-09-07 (#796 auto: spamhaus-DENY sources, hits>=3) — 24 sources, backlog of missed 09-05..09-06 runs 92.118.39.0/24 80.94.92.0/24 - -# sweep-added 2026-09-04 (#796 auto: spamhaus-DENY sources, hits>=MIN_HITS) 213.176.24.83 193.32.162.9 193.32.162.71 @@ -64,4 +61,27 @@ 45.164.115.86 46.44.0.185 61.37.150.6 - +141.98.10.16 +213.177.179.12 +213.177.179.126 +157.66.225.224 +71.6.167.142 +147.185.132.74 +189.188.15.8 +147.185.132.83 +162.216.150.47 +207.175.57.177 +173.207.70.42 +185.93.89.118 +45.172.139.167 +68.183.177.121 +103.62.238.130 +124.160.45.26 +158.94.210.8 +179.184.85.167 +187.8.120.90 +211.58.176.42 +27.115.113.138 +31.173.29.136 +77.90.185.238 +95.105.52.153 diff --git a/perf/nuisance/nuisance-sweep.sh b/perf/nuisance/nuisance-sweep.sh index 23cde1e..4cb87ff 100644 --- a/perf/nuisance/nuisance-sweep.sh +++ b/perf/nuisance/nuisance-sweep.sh @@ -20,12 +20,12 @@ # are untouched in practice. # # Run (workstation; needs tests/remote.sh chokepoint + ~/.creds/cloudron.env): -# cd ~/projects/PFVCluster && timeout 300 env VM_IP=my.knownelement.com VM_USER=root \ +# cd ~/projects/KNEL/KNELPFVCluster && timeout 300 env VM_IP=my.knownelement.com VM_USER=root \ # bash ~/projects/cloudron/perf/nuisance/nuisance-sweep.sh [--dry] set -u -PFV_DIR=${PFV_CLUSTER_DIR:-/home/reachableceo/projects/PFVCluster} +PFV_DIR=${PFV_CLUSTER_DIR:-/home/reachableceo/projects/KNEL/KNELPFVCluster} NUIS_DIR=${NUISANCE_DIR:-/home/reachableceo/projects/cloudron/perf/nuisance} ALLOWLIST="$NUIS_DIR/allowlist.txt" HOST_NAME=my.knownelement.com @@ -47,11 +47,15 @@ timeout 120 env VM_IP="$HOST_NAME" VM_USER=root bash tests/remote.sh vm \ deny_lines=$(wc -l < "$TMP/scan") # --- 2. current blocklist from the Cloudron API --- -[ -f "$HOME/.creds/cloudron.env" ] || fail "$HOME/.creds/cloudron.env missing" -set -a -# shellcheck disable=SC1091 # creds file path built above -. "$HOME/.creds/cloudron.env" -set +a +# Creds: pre-exported env (e.g. `sm env cloudron`) wins; ~/.creds fallback is +# legacy (the textfile pattern was RETIRED 2026-09-06 — vault via sm is the way). +if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then + [ -f "$HOME/.creds/cloudron.env" ] || fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN in env and $HOME/.creds/cloudron.env missing" + set -a + # shellcheck disable=SC1091 # creds file path built above + . "$HOME/.creds/cloudron.env" + set +a +fi [ -n "${CLOUDRON_URL:-}" ] && [ -n "${CLOUDRON_API_TOKEN:-}" ] || fail "creds file lacks CLOUDRON_URL/CLOUDRON_API_TOKEN" curl -sf --max-time 15 "$CLOUDRON_URL/api/v1/network/blocklist" \ -H "Authorization: Bearer $CLOUDRON_API_TOKEN" \