feat(security): fail2ban для HAProxy JSON reject и Zabbix 403.

scripts/security/haproxy-ufw-apply.sh

@@ -38,6 +38,7 @@ source "$ENV_FILE"
 
 SSH_ALLOWED=${SSH_ALLOWED:-}
 INBOUND_TCP=${INBOUND_TCP:-80 443}
+LAN_BACKENDS_CIDR=${LAN_BACKENDS_CIDR:-192.168.160.0/24}
 STATS_TCP=${STATS_TCP:-8404}
 UFW_IPV6=${UFW_IPV6:-no}
 
@@ -73,6 +74,10 @@ for port in $INBOUND_TCP; do
     run ufw allow "$port/tcp" comment "haproxy service $port"
 done
 
+if [[ -n ${LAN_BACKENDS_CIDR:-} ]]; then
+    run ufw allow from "$LAN_BACKENDS_CIDR" comment 'LAN backends return'
+fi
+
 if [[ $APPLY -eq 1 ]]; then
     ufw --force enable
     ufw status verbose