multipleof4/ntfy
1
0
Fork 0
mirror of https://github.com/multipleof4/ntfy.git synced 2026-10-08 21:05:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Derp

Browse Source
This commit is contained in:
binwiederhier
2026-07-20 23:23:42 +02:00
parent f6b03b44dd
commit 311138ef7b
2 changed files with 5 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/config.md
+3 -4
View File
@@ -2145,8 +2145,8 @@ every line is already a confirmed offender, the fail2ban jail can ban on first s
`ban-file`. Each prefix has one shared budget, so it cannot be gamed by mixing error codes.
- `ban-weights` assigns a strike weight per matcher key, formatted as `KEY:WEIGHT`. A key is an exact
ntfy error code (`42909`), a code family (`429*`, `403*`, `4*`), a bare HTTP status (`403`, short for
`403*`), or `*`. The longest matching key wins. A weight of `0` exempts a code, which is useful to
spare legit plan/quota `429`s from a `*` catch-all. Heavier weights ban faster. If you do not
`403*`), or `*`. The longest matching key wins. A weight of `0` exempts a code entirely (it never
counts toward a ban), useful to spare a specific code from a `*` catch-all. Heavier weights ban faster. If you do not
include a `*` rule, any code that matches nothing defaults to weight `1` (i.e. it can be banned);
set `*:0` to exempt everything that is not explicitly weighted.
@@ -2172,7 +2172,6 @@ applies the prefix):
ban-threshold: 100
ban-weights:
- "42909:10" # too many auth failures -> brute force, ban fast
- "42908:0" # daily message quota reached -> legit, never counts
# everything else 4xx/5xx defaults to weight 1
```
@@ -2398,7 +2397,7 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`).
| `ban-file` | `NTFY_BAN_FILE` | *filename* | - | Abuse ban-feed: file confirmed abusive visitor IPs are appended to, for fail2ban to tail. Empty disables the feature. See [Banning bad actors](#banning-bad-actors-fail2ban) |
| `ban-window` | `NTFY_BAN_WINDOW` | *duration* | 10m | Abuse ban-feed: rolling window over which weighted strikes are counted, per IP prefix |
| `ban-threshold` | `NTFY_BAN_THRESHOLD` | *number* | 100 | Abuse ban-feed: weighted strikes per `ban-window` before a prefix is written to `ban-file` |
| `ban-weights` | `NTFY_BAN_WEIGHTS` | *list of KEY:WEIGHT* | `42909:10 ... *:1`| Abuse ban-feed: per-code strike weights (exact code, family `429*`, or `*`; longest match wins; `0` exempts). See [Banning bad actors](#banning-bad-actors-fail2ban) |
| `ban-weights` | `NTFY_BAN_WEIGHTS` | *list of KEY:WEIGHT* | `42909:10`| Abuse ban-feed: per-code strike weights (exact code, family `429*`, or `*`; longest match wins; `0` exempts). See [Banning bad actors](#banning-bad-actors-fail2ban) |
| `web-root` | `NTFY_WEB_ROOT` | *path*, e.g. `/` or `/app`, or `disable` | `/` | Sets root of the web app (e.g. /, or /app), or disables it entirely (disable) |
| `enable-signup` | `NTFY_ENABLE_SIGNUP` | *boolean* (`true` or `false`) | `false` | Allows users to sign up via the web app, or API |
| `enable-login` | `NTFY_ENABLE_LOGIN` | *boolean* (`true` or `false`) | `false` | Allows users to log in via the web app, or API |
server/config.go
+2 -6
View File
@@ -50,13 +50,9 @@ const (
)
// DefaultBanWeights is the ban-feed's default per-code strike weights: the auth-failure flood bans fast,
// legit quota codes are exempt (weight 0), and everything else defaults to weight 1 (no "*"; see WeightFor).
// and everything else defaults to weight 1 (no "*" rule needed; see BanWeights.WeightFor).
var DefaultBanWeights = []string{
banWeight(errHTTPTooManyRequestsLimitAuthFailure, 10), // brute-force auth flood -> ban fast
banWeight(errHTTPTooManyRequestsLimitMessages, 0), // daily message quota -> legit, exempt
banWeight(errHTTPTooManyRequestsLimitSubscriptions, 0), // too many subscriptions -> legit, exempt
banWeight(errHTTPTooManyRequestsLimitAttachmentBandwidth, 0), // daily attachment bandwidth -> legit, exempt
banWeight(errHTTPTooManyRequestsLimitCalls, 0), // daily phone-call quota -> legit, exempt
banWeight(errHTTPTooManyRequestsLimitAuthFailure, 10), // brute-force auth flood -> ban fast
}
// banWeight formats a "CODE:WEIGHT" ban-feed default from an ntfy error, so the codes stay in sync with