PTah
088eec369f
Исправлен синтаксис !(host_ext path_autodiscover) и порядок http-request/use_backend. Скрипт deploy сохраняет stats auth с сервера.
66 lines
2.0 KiB
Bash
66 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# Deploy fe_http + fail2ban fix on HAProxy host. Preserves stats auth from live config.
|
|
set -euo pipefail
|
|
|
|
NEW_CFG="${1:-/tmp/haproxy.cfg.new}"
|
|
F2B_FILTER="${2:-/tmp/haproxy-zabbix-403.conf}"
|
|
LIVE_CFG="/etc/haproxy/haproxy.cfg"
|
|
TS="$(date +%Y%m%d-%H%M%S)"
|
|
|
|
if [[ ! -f "$NEW_CFG" ]]; then
|
|
echo "Missing $NEW_CFG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
STATS_AUTH="$(grep -E '^[[:space:]]+stats auth ' "$LIVE_CFG" | head -1 | sed 's/^[[:space:]]*//')"
|
|
if [[ -z "$STATS_AUTH" ]]; then
|
|
echo "Could not read stats auth from $LIVE_CFG" >&2
|
|
exit 1
|
|
fi
|
|
|
|
MERGED="/tmp/haproxy.cfg.merged-${TS}"
|
|
cp "$NEW_CFG" "$MERGED"
|
|
# Replace placeholder; stats line has no spaces in password
|
|
sed -i "s|stats auth admin:CHANGEME|${STATS_AUTH}|" "$MERGED"
|
|
|
|
echo "Backup: ${LIVE_CFG}.bak-${TS}"
|
|
cp "$LIVE_CFG" "${LIVE_CFG}.bak-${TS}"
|
|
|
|
echo "=== merged checks ==="
|
|
grep 'Config version' "$MERGED"
|
|
grep -E 'frontend fe_http|fe_http_zabbix|be_exchange_http' "$MERGED"
|
|
grep -E '^[[:space:]]+stats auth ' "$MERGED"
|
|
|
|
haproxy -c -f "$MERGED"
|
|
cp "$MERGED" "$LIVE_CFG"
|
|
systemctl reload haproxy
|
|
echo "HAProxy reloaded OK"
|
|
|
|
if [[ -f "$F2B_FILTER" ]]; then
|
|
cp "$F2B_FILTER" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
|
|
systemctl reload fail2ban || fail2ban-client reload
|
|
echo "fail2ban filter updated"
|
|
fi
|
|
|
|
for jail in haproxy-zabbix-403 haproxy-reject sshd; do
|
|
if fail2ban-client status "$jail" >/dev/null 2>&1; then
|
|
banned="$(fail2ban-client status "$jail" | sed -n 's/.*Banned IP list:[[:space:]]*//p')"
|
|
if [[ -n "${banned// }" ]]; then
|
|
for ip in $banned; do
|
|
fail2ban-client set "$jail" unbanip "$ip"
|
|
echo "unbanned $ip from $jail"
|
|
done
|
|
fi
|
|
fi
|
|
done
|
|
|
|
if fail2ban-client unban --all >/dev/null 2>&1; then
|
|
fail2ban-client unban --all
|
|
echo "fail2ban-client unban --all done"
|
|
fi
|
|
|
|
echo "=== final ==="
|
|
grep 'Config version' "$LIVE_CFG"
|
|
fail2ban-client status haproxy-zabbix-403 | grep -E 'Currently banned|Banned IP'
|
|
fail2ban-client status haproxy-reject | grep -E 'Currently banned|Banned IP'
|