From 311138ef7b3314a140d8385e6f4549e1454fa97c Mon Sep 17 00:00:00 2001 From: binwiederhier Date: Mon, 20 Jul 2026 23:23:42 +0200 Subject: [PATCH] Derp --- docs/config.md | 7 +++---- server/config.go | 8 ++------ 2 files changed, 5 insertions(+), 10 deletions(-) diff --git a/docs/config.md b/docs/config.md index 948ffcbc..889c4c4e 100644 --- a/docs/config.md +++ b/docs/config.md @@ -2145,8 +2145,8 @@ every line is already a confirmed offender, the fail2ban jail can ban on first s `ban-file`. Each prefix has one shared budget, so it cannot be gamed by mixing error codes. - `ban-weights` assigns a strike weight per matcher key, formatted as `KEY:WEIGHT`. A key is an exact ntfy error code (`42909`), a code family (`429*`, `403*`, `4*`), a bare HTTP status (`403`, short for - `403*`), or `*`. The longest matching key wins. A weight of `0` exempts a code, which is useful to - spare legit plan/quota `429`s from a `*` catch-all. Heavier weights ban faster. If you do not + `403*`), or `*`. The longest matching key wins. A weight of `0` exempts a code entirely (it never + counts toward a ban), useful to spare a specific code from a `*` catch-all. Heavier weights ban faster. If you do not include a `*` rule, any code that matches nothing defaults to weight `1` (i.e. it can be banned); set `*:0` to exempt everything that is not explicitly weighted. @@ -2172,7 +2172,6 @@ applies the prefix): ban-threshold: 100 ban-weights: - "42909:10" # too many auth failures -> brute force, ban fast - - "42908:0" # daily message quota reached -> legit, never counts # everything else 4xx/5xx defaults to weight 1 ``` @@ -2398,7 +2397,7 @@ variable before running the `ntfy` command (e.g. `export NTFY_LISTEN_HTTP=:80`). | `ban-file` | `NTFY_BAN_FILE` | *filename* | - | Abuse ban-feed: file confirmed abusive visitor IPs are appended to, for fail2ban to tail. Empty disables the feature. See [Banning bad actors](#banning-bad-actors-fail2ban) | | `ban-window` | `NTFY_BAN_WINDOW` | *duration* | 10m | Abuse ban-feed: rolling window over which weighted strikes are counted, per IP prefix | | `ban-threshold` | `NTFY_BAN_THRESHOLD` | *number* | 100 | Abuse ban-feed: weighted strikes per `ban-window` before a prefix is written to `ban-file` | -| `ban-weights` | `NTFY_BAN_WEIGHTS` | *list of KEY:WEIGHT* | `42909:10 ... *:1`| Abuse ban-feed: per-code strike weights (exact code, family `429*`, or `*`; longest match wins; `0` exempts). See [Banning bad actors](#banning-bad-actors-fail2ban) | +| `ban-weights` | `NTFY_BAN_WEIGHTS` | *list of KEY:WEIGHT* | `42909:10`| Abuse ban-feed: per-code strike weights (exact code, family `429*`, or `*`; longest match wins; `0` exempts). See [Banning bad actors](#banning-bad-actors-fail2ban) | | `web-root` | `NTFY_WEB_ROOT` | *path*, e.g. `/` or `/app`, or `disable` | `/` | Sets root of the web app (e.g. /, or /app), or disables it entirely (disable) | | `enable-signup` | `NTFY_ENABLE_SIGNUP` | *boolean* (`true` or `false`) | `false` | Allows users to sign up via the web app, or API | | `enable-login` | `NTFY_ENABLE_LOGIN` | *boolean* (`true` or `false`) | `false` | Allows users to log in via the web app, or API | diff --git a/server/config.go b/server/config.go index 460ef42b..e3397e2d 100644 --- a/server/config.go +++ b/server/config.go @@ -50,13 +50,9 @@ const ( ) // DefaultBanWeights is the ban-feed's default per-code strike weights: the auth-failure flood bans fast, -// legit quota codes are exempt (weight 0), and everything else defaults to weight 1 (no "*"; see WeightFor). +// and everything else defaults to weight 1 (no "*" rule needed; see BanWeights.WeightFor). var DefaultBanWeights = []string{ - banWeight(errHTTPTooManyRequestsLimitAuthFailure, 10), // brute-force auth flood -> ban fast - banWeight(errHTTPTooManyRequestsLimitMessages, 0), // daily message quota -> legit, exempt - banWeight(errHTTPTooManyRequestsLimitSubscriptions, 0), // too many subscriptions -> legit, exempt - banWeight(errHTTPTooManyRequestsLimitAttachmentBandwidth, 0), // daily attachment bandwidth -> legit, exempt - banWeight(errHTTPTooManyRequestsLimitCalls, 0), // daily phone-call quota -> legit, exempt + banWeight(errHTTPTooManyRequestsLimitAuthFailure, 10), // brute-force auth flood -> ban fast } // banWeight formats a "CODE:WEIGHT" ban-feed default from an ntfy error, so the codes stay in sync with