KNEL/KNELCloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nuisance: 24 new blocks 09-07 (backlog of missed runs) + path/env fixes

Browse Source 
Sweep checkout path moved to ~/projects/KNEL/KNELPFVCluster; creds now
accepted from env (vault/sm-ready) since ~/.creds textfiles retired.

Redmine: https://projects.knownelement.com/issues/796#note-134
This commit is contained in:
mrcharles
2026-09-07 09:09:37 -05:00
parent 9959f86295
commit b0785c211b
2 changed files with 37 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
perf/nuisance/blocklist.txt
+26 -6
View File
@@ -3,14 +3,11 @@
# GET/POST https://my.knownelement.com/api/v1/network/blocklist (admin token) # GET/POST https://my.knownelement.com/api/v1/network/blocklist (admin token)
# panel: Network > IP block list; enforced via ipset cloudron_blocklist on # panel: Network > IP block list; enforced via ipset cloudron_blocklist on
# INPUT(CLOUDRON) + FORWARD(DOCKER-USER); Cloudron re-applies at boot. # INPUT(CLOUDRON) + FORWARD(DOCKER-USER); Cloudron re-applies at boot.
# This file mirrors the live setting (last sync 2026-09-04 12:15 CDT, #796). # This file mirrors the live setting (last sync 2026-09-07 09:09 CDT, #796).
# Full-line comments allowed in both. # Full-line comments allowed in both.
# sweep-added 2026-09-07 (#796 auto: spamhaus-DENY sources, hits>=3) — 24 sources, backlog of missed 09-05..09-06 runs
# founder-directed 2026-09-04 (#796, #787 root cause): hostile SMTP ranges
92.118.39.0/24 92.118.39.0/24
80.94.92.0/24 80.94.92.0/24
# sweep-added 2026-09-04 (#796 auto: spamhaus-DENY sources, hits>=MIN_HITS)
213.176.24.83 213.176.24.83
193.32.162.9 193.32.162.9
193.32.162.71 193.32.162.71
@@ -64,4 +61,27 @@
45.164.115.86 45.164.115.86
46.44.0.185 46.44.0.185
61.37.150.6 61.37.150.6
141.98.10.16
213.177.179.12
213.177.179.126
157.66.225.224
71.6.167.142
147.185.132.74
189.188.15.8
147.185.132.83
162.216.150.47
207.175.57.177
173.207.70.42
185.93.89.118
45.172.139.167
68.183.177.121
103.62.238.130
124.160.45.26
158.94.210.8
179.184.85.167
187.8.120.90
211.58.176.42
27.115.113.138
31.173.29.136
77.90.185.238
95.105.52.153
perf/nuisance/nuisance-sweep.sh
+7 -3
View File
@@ -20,12 +20,12 @@
# are untouched in practice. # are untouched in practice.
# #
# Run (workstation; needs tests/remote.sh chokepoint + ~/.creds/cloudron.env): # Run (workstation; needs tests/remote.sh chokepoint + ~/.creds/cloudron.env):
# cd ~/projects/PFVCluster && timeout 300 env VM_IP=my.knownelement.com VM_USER=root \ # cd ~/projects/KNEL/KNELPFVCluster && timeout 300 env VM_IP=my.knownelement.com VM_USER=root \
# bash ~/projects/cloudron/perf/nuisance/nuisance-sweep.sh [--dry] # bash ~/projects/cloudron/perf/nuisance/nuisance-sweep.sh [--dry]
set -u set -u
PFV_DIR=${PFV_CLUSTER_DIR:-/home/reachableceo/projects/PFVCluster} PFV_DIR=${PFV_CLUSTER_DIR:-/home/reachableceo/projects/KNEL/KNELPFVCluster}
NUIS_DIR=${NUISANCE_DIR:-/home/reachableceo/projects/cloudron/perf/nuisance} NUIS_DIR=${NUISANCE_DIR:-/home/reachableceo/projects/cloudron/perf/nuisance}
ALLOWLIST="$NUIS_DIR/allowlist.txt" ALLOWLIST="$NUIS_DIR/allowlist.txt"
HOST_NAME=my.knownelement.com HOST_NAME=my.knownelement.com
@@ -47,11 +47,15 @@ timeout 120 env VM_IP="$HOST_NAME" VM_USER=root bash tests/remote.sh vm \
deny_lines=$(wc -l < "$TMP/scan") deny_lines=$(wc -l < "$TMP/scan")
# --- 2. current blocklist from the Cloudron API --- # --- 2. current blocklist from the Cloudron API ---
[ -f "$HOME/.creds/cloudron.env" ] || fail "$HOME/.creds/cloudron.env missing" # Creds: pre-exported env (e.g. `sm env cloudron`) wins; ~/.creds fallback is
# legacy (the textfile pattern was RETIRED 2026-09-06 — vault via sm is the way).
if [ -z "${CLOUDRON_URL:-}" ] || [ -z "${CLOUDRON_API_TOKEN:-}" ]; then
[ -f "$HOME/.creds/cloudron.env" ] || fail "no CLOUDRON_URL/CLOUDRON_API_TOKEN in env and $HOME/.creds/cloudron.env missing"
set -a set -a
# shellcheck disable=SC1091 # creds file path built above # shellcheck disable=SC1091 # creds file path built above
. "$HOME/.creds/cloudron.env" . "$HOME/.creds/cloudron.env"
set +a set +a
fi
[ -n "${CLOUDRON_URL:-}" ] && [ -n "${CLOUDRON_API_TOKEN:-}" ] || fail "creds file lacks CLOUDRON_URL/CLOUDRON_API_TOKEN" [ -n "${CLOUDRON_URL:-}" ] && [ -n "${CLOUDRON_API_TOKEN:-}" ] || fail "creds file lacks CLOUDRON_URL/CLOUDRON_API_TOKEN"
curl -sf --max-time 15 "$CLOUDRON_URL/api/v1/network/blocklist" \ curl -sf --max-time 15 "$CLOUDRON_URL/api/v1/network/blocklist" \
-H "Authorization: Bearer $CLOUDRON_API_TOKEN" \ -H "Authorization: Bearer $CLOUDRON_API_TOKEN" \