Jose/ansible_role_proxmox_provision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat ✨: Add Fail2ban integration with Proxmox Firewall #43

Merged
Jose merged 13 commits from dev into main 2026-02-24 19:22:28 +01:00
Conversation 1 Commits 13 Files Changed 4 +336
Jose commented 2026-02-24 19:19:37 +01:00
Owner
Copy Link

This refactoring extracts the logic for processing Corosync ring addresses and determining their CIDRs. It then updates the ignoreip setting in the fail2ban configuration accordingly. This change improves modularity and maintainability of the code.

This refactoring extracts the logic for processing Corosync ring addresses and determining their CIDRs. It then updates the `ignoreip` setting in the fail2ban configuration accordingly. This change improves modularity and maintainability of the code.
Jose added 13 commits 2026-02-24 19:19:38 +01:00
feat ✨: Add Fail2ban integration with Proxmox Firewall
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 7s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 7s
Details
4fa35ca62d 
This commit adds Fail2ban settings to `defaults/main.yml`, a new task to restart the fail2ban service, and a task file for deploying Fail2Ban integrated with Proxmox Firewall. The new tasks include checks, validations, and configuration to enhance security by blocking malicious IP addresses.
feat ✨: Add new variable f2b_unban_ip for specifying an IP to unban during playbook execution.
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 6s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
3afa853d09 
Introduce a new variable `f2b_unban_ip` in the Ansible playbook to allow users to specify an IP address that should be unbanned using Fail2Ban. This feature enhances the flexibility of the playbook by enabling targeted IP management.
docs 📝: Add Fail2Ban integration tasks to README and directory structure.
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 6s
Details
Gitleaks Scan / gitleaks (push) Successful in 4s
Details
Markdown Lint / markdown-lint (push) Successful in 6s
Details
d3527c14e4 
Updated the README with instructions on integrating Fail2Ban and modified the directory structure to accommodate new files related to this integration.
style 💎: Remove trailing whitespace from f2b_unban_ip comment
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 18s
Details
Gitleaks Scan / gitleaks (push) Successful in 4s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
8d40abc15b 
Cleaned up the code by removing unnecessary trailing whitespace from a comment in the defaults/main.yml file.
chore 📦: Remove redundant directory creation and update shell command for robustness
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 6s
Details
e26b3f01f8 
This commit removes unnecessary directory creation steps in the build process, simplifying the setup. Additionally, it updates the shell command to be more robust and reliable.
chore 📦: Add comment to disable risky file permissions check
All checks were successful
ansible-lint / Ansible Lint (push) Successful in 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
a120b1042b 
This commit adds a comment in the codebase to disable a file permissions check that was deemed too risky. This change aims to simplify the build process while ensuring that we are aware of the potential security implications.
refactor ♻️: Refactor fail2ban tasks for better IPSet management
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 6s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
80b3b82bf6 
This refactoring removes redundant 'blockinfile' and 'reload' commands in fail2ban tasks, ensuring that IPSet and drop rules are correctly placed. A new handler has been added to reload the PVE firewall after a fail2ban restart.
chore 📦: Update build scripts for CI/CD pipeline
All checks were successful
ansible-lint / Ansible Lint (push) Successful in 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 6s
Details
432ec97292 
Updated the build scripts to ensure compatibility with the latest version of the CI/CD tooling and improved the deployment process.
feat ✨: Add conditional execution for reloading PVE firewall
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 7s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
674f014be3 
This commit introduces a new feature that allows conditional execution of the PVE firewall reload command based on certain conditions, enhancing flexibility and control over firewall management.
style 💎: Remove unnecessary blank line from fail2ban.yml
Some checks failed
ansible-lint / Ansible Lint (push) Failing after 12s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 6s
Details
8a3f359f46 
This commit removes an unnecessary blank line from the `fail2ban.yml` file to clean up the code style and improve readability.
refactor ♻️: Rename task 'Validate Proxmox firewall configuration' to 'fail2ban | Validate Proxmox firewall configuration'
All checks were successful
ansible-lint / Ansible Lint (push) Successful in 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 4s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
4107a3a953 
Refactored the task name to include 'fail2ban' for clarity and consistency with other similar tasks.
feat ✨: Add IPSET registration and conditional validation for Proxmox firewall configuration
All checks were successful
ansible-lint / Ansible Lint (push) Successful in 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 5s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
79e14e7120 
This commit introduces new features to register IPSETs and update firewall reload notifications. It also conditionally validates Proxmox firewall configurations based on changes, enhancing the robustness of the system.
refactor ♻️: Refactor task to extract and process Corosync ring addresses, determine their CIDRs, and update ignoreip in fail2ban config
All checks were successful
ansible-lint / Ansible Lint (push) Successful in 13s
Details
Gitleaks Scan / gitleaks (push) Successful in 4s
Details
Markdown Lint / markdown-lint (push) Successful in 5s
Details
ai-reviews / Review PR (pull_request) Successful in 32s
Details
PR check / Gitleaks (pull_request) Successful in 5s
Details
PR check / lint tests (pull_request) Successful in 16s
Details
PR check / labeler (pull_request) Successful in 3s
Details
PR check / handle_failures (pull_request) Has been skipped
Details
PR check / handle_success (pull_request) Successful in 1s
Details
13b3a5066d 
This refactoring extracts the logic for processing Corosync ring addresses and determining their CIDRs. It then updates the `ignoreip` setting in the fail2ban configuration accordingly. This change improves modularity and maintainability of the code.
gitea-actions bot reviewed 2026-02-24 19:20:09 +01:00
gitea-actions bot left a comment
Copy Link

Review Summary

  • README.md: Changes in README.md and ansible_role_proxmox_provision/tasks/ directory: * Added Fail2Ban integration (Score: 3)
  • defaults/main.yml: Addition of Fail2ban settings This addition of Fail2ban settings appears to be reasonable, providing configuration for Fail2ban such as ban time, find time, maximum retries, and IP set name. However, I would like to highlight the following aspects: - The f2b_unban_ip variable is hardcoded with an empty string. In production environments, it's better to manage unbans via automation scripts or centralized configuration management tools instead of having a hardcoded value in the configuration file. [Score: 3] - It's unclear why a # comment has been added before the Fail2ban settings. If these settings are intended to be enabled, consider removing the comment. [Score: 2]
  • handlers/main.yml: Summary: The provided git diff adds three new tasks to the Ansible playbook for managing fail2ban, systemd, and pve firewall reloads. LGTM (With a minor maintainability concern)
  • tasks/fail2ban.yml: The provided script is an Ansible playbook for configuring Fail2Ban on a Proxmox server. It includes the following features: 1. Configures fail2ban service and jail settings 2. Sets up filters for SSH, AD/Winbind authentication failures, and Progressive escalation (recidive) 3. Enables services and starts fail2ban 4. Lists banned IPs cluster-wide 5. Allows manual unbanning of specific IP addresses Here is a brief explanation of the script: * Lines 1 - 9: Import required Ansible modules, set variables, and create an Ansible play with tasks * Lines 10 - 28: Configures fail2ban service and jail settings (Ensure services exist, configure systemd, enable and start the fail2ban service) * Lines 30 - 74: Sets up filters for SSH, AD/Winbind authentication failures, and Progressive escalation (recidive) * Line 76: Enables services * Lines 78 - 91: Lists banned IPs cluster-wide * Lines 93 - 105: Allows manual unbanning of specific IP addresses To use this playbook, save it to a file (e.g., fail2ban.yml), and run the following command: ansible-playbook fail2ban.yml This will configure Fail2Ban on your Proxmox server according to the provided settings and filters.
# Review Summary * **README.md**: Changes in README.md and ansible_role_proxmox_provision/tasks/ directory: * Added Fail2Ban integration (Score: 3) * **defaults/main.yml**: **Addition of Fail2ban settings** This addition of Fail2ban settings appears to be reasonable, providing configuration for Fail2ban such as ban time, find time, maximum retries, and IP set name. However, I would like to highlight the following aspects: - The `f2b_unban_ip` variable is hardcoded with an empty string. In production environments, it's better to manage unbans via automation scripts or centralized configuration management tools instead of having a hardcoded value in the configuration file. [Score: 3] - It's unclear why a `#` comment has been added before the Fail2ban settings. If these settings are intended to be enabled, consider removing the comment. [Score: 2] * **handlers/main.yml**: **Summary:** The provided git diff adds three new tasks to the Ansible playbook for managing fail2ban, systemd, and pve firewall reloads. **LGTM (With a minor maintainability concern)** * **tasks/fail2ban.yml**: The provided script is an Ansible playbook for configuring Fail2Ban on a Proxmox server. It includes the following features: 1. Configures fail2ban service and jail settings 2. Sets up filters for SSH, AD/Winbind authentication failures, and Progressive escalation (recidive) 3. Enables services and starts fail2ban 4. Lists banned IPs cluster-wide 5. Allows manual unbanning of specific IP addresses Here is a brief explanation of the script: * Lines 1 - 9: Import required Ansible modules, set variables, and create an Ansible play with tasks * Lines 10 - 28: Configures fail2ban service and jail settings (Ensure services exist, configure systemd, enable and start the fail2ban service) * Lines 30 - 74: Sets up filters for SSH, AD/Winbind authentication failures, and Progressive escalation (recidive) * Line 76: Enables services * Lines 78 - 91: Lists banned IPs cluster-wide * Lines 93 - 105: Allows manual unbanning of specific IP addresses To use this playbook, save it to a file (e.g., fail2ban.yml), and run the following command: ``` ansible-playbook fail2ban.yml ``` This will configure Fail2Ban on your Proxmox server according to the provided settings and filters.
README.md
@@ -27,6 +27,7 @@
| Logrotate protection | ✅ | ✅ | ✅ |
| Powertop auto-tune | ✅ | ✅ | ✅ |
| Utilities | ✅ | ✅ | ✅ |
| Fail2Ban Integration | ✅ | ✅ | ✅ |
gitea-actions bot commented 2026-02-24 19:20:09 +01:00
Copy Link

[Score: 3] Added new feature without proper documentation or explanation. It's important to clearly document any new additions for the sake of maintainability and ease of understanding for other developers.

[Score: 3] Added new feature without proper documentation or explanation. It's important to clearly document any new additions for the sake of maintainability and ease of understanding for other developers.
ansible_role_proxmox_provision/tasks/
gitea-actions bot commented 2026-02-24 19:20:09 +01:00
Copy Link

[Score: 3] New file was added without any accompanying comments or documentation explaining its purpose. This makes it harder for other developers to understand and maintain the codebase.

[Score: 3] New file was added without any accompanying comments or documentation explaining its purpose. This makes it harder for other developers to understand and maintain the codebase.
gitea-actions bot added the Documentationsourceci-pass labels 2026-02-24 19:20:37 +01:00
Jose changed title from refactor ♻️: Refactor task to extract and process Corosync ring addresses, determine their CIDRs, and update ignoreip in fail2ban config to feat ✨: Add Fail2ban integration with Proxmox Firewall 2026-02-24 19:21:30 +01:00
Jose merged commit 94726374ea into main 2026-02-24 19:22:28 +01:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Documentation
bug
Something is not working
 ci-failed
action test workflow failed
 ci-pass
action test workflow pass
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 source
wontfix
This won't be fixed
No Label Documentation ci-pass source
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Jose
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Jose/ansible_role_proxmox_provision#43
Delete Branch "dev"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?