mrcharles
9959f86295
Cloudron-native enforcement (ipset cloudron_blocklist via panel setting). https://projects.knownelement.com/issues/796
44 lines
1.5 KiB
Bash
44 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
# perf/nuisance/nuisance-detect.sh — HOST-side nuisance candidate detection [#796]
|
|
#
|
|
# Runs on the Cloudron host (systemd timer, 07:15 CDT daily + at boot).
|
|
# No secrets, no API: scans the mail container's Haraka log for sources
|
|
# DENIED via zen.spamhaus.org in the last 24h and writes a ranked
|
|
# candidates file the daily automation cross-checks. Detection is
|
|
# independent of the LLM automation; enforcement stays in
|
|
# nuisance-sweep.sh (Cloudron blocklist API).
|
|
#
|
|
# Output: /home/yellowtent/platformdata/nuisance/candidates.txt
|
|
# lines: <hits24h> <ip> <BLOCKED|seen> (BLOCKED = already in ipset)
|
|
|
|
set -u
|
|
|
|
OUT_DIR=/home/yellowtent/platformdata/nuisance
|
|
OUT="$OUT_DIR/candidates.txt"
|
|
SET_NAME=cloudron_blocklist
|
|
|
|
mkdir -p "$OUT_DIR"
|
|
TMP=$(mktemp) || exit 1
|
|
trap 'rm -f "$TMP"' EXIT
|
|
|
|
docker logs mail --since 24h 2>&1 \
|
|
| grep -a "plugin=dns-list" \
|
|
| grep -a "retval=DENY" \
|
|
| grep -aoE "host \[[0-9.]+\]" \
|
|
| sed "s/^host \[//; s/\]$//" | sort | uniq -c | sort -rn > "$TMP"
|
|
|
|
{
|
|
printf '# nuisance candidates — Haraka spamhaus-DENY sources, 24h, generated %s\n' \
|
|
"$(date '+%F %T %Z')"
|
|
printf '# format: <hits24h> <ip> <BLOCKED|seen> (BLOCKED = covered by %s)\n' "$SET_NAME"
|
|
while read -r hits ip; do
|
|
[ -n "$ip" ] || continue
|
|
if ipset test "$SET_NAME" "$ip" > /dev/null 2>&1; then
|
|
state=BLOCKED
|
|
else
|
|
state=seen
|
|
fi
|
|
printf '%s %s %s\n' "$hits" "$ip" "$state"
|
|
done < "$TMP"
|
|
} > "$OUT"
|