Réorganiser les guides et ajouter architecture filesystem
- Nouvelle structure : linux-essentials/ et forgejo/ - Nouveau guide : architecture-filesystem.md (comprendre /etc, /var, etc.) - Déplacement et renommage des guides existants - README pour chaque dossier - Suppression des sections auteurs Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
isUnknown
parent
4e99c5025c
commit
e33395dc35
10 changed files with 2811 additions and 17 deletions
134
serveur/forgejo/QUICK-START.md
Normal file
134
serveur/forgejo/QUICK-START.md
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
# Quick Start : Sécuriser Forgejo contre les bots (15 min)
|
||||
|
||||
## Problème
|
||||
Bots qui téléchargent massivement des archives → Disque saturé (47G en 24-48h)
|
||||
|
||||
## Solution en 3 étapes
|
||||
|
||||
### 1️⃣ Fail2ban : Ban plus rapide (3 min)
|
||||
|
||||
```bash
|
||||
sudo nano /etc/fail2ban/jail.d/forgejo.conf
|
||||
```
|
||||
|
||||
**Changez ces valeurs :**
|
||||
```ini
|
||||
maxretry = 8 # Au lieu de 20
|
||||
bantime = 21600 # Au lieu de 3600
|
||||
```
|
||||
|
||||
**Ajoutez (si absent) :**
|
||||
```ini
|
||||
bantime.increment = true
|
||||
bantime.factor = 2
|
||||
bantime.maxtime = 604800
|
||||
```
|
||||
|
||||
```bash
|
||||
sudo systemctl restart fail2ban
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2️⃣ Forgejo : Rate limit + Expiration (3 min)
|
||||
|
||||
```bash
|
||||
nano /home/debian/forgejo/data/gitea/conf/app.ini
|
||||
```
|
||||
|
||||
**Changez ces valeurs :**
|
||||
```ini
|
||||
[api]
|
||||
RATE_LIMIT_BURST = 20 # Au lieu de 100
|
||||
|
||||
[repository.local]
|
||||
ARCHIVE_EXPIRY = 3600 # Au lieu de 604800
|
||||
```
|
||||
|
||||
```bash
|
||||
docker restart forgejo
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 3️⃣ Cron : Nettoyage plus fréquent (2 min)
|
||||
|
||||
```bash
|
||||
sudo crontab -e
|
||||
```
|
||||
|
||||
**Remplacez la ligne existante par :**
|
||||
```bash
|
||||
0 */6 * * * find /home/debian/forgejo/data/gitea/repo-archive -type f -mmin +360 -delete
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Nettoyage initial
|
||||
|
||||
```bash
|
||||
# Voir la taille
|
||||
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
||||
|
||||
# Nettoyer maintenant
|
||||
find /home/debian/forgejo/data/gitea/repo-archive -type f -delete
|
||||
|
||||
# Vérifier
|
||||
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Vérification quotidienne
|
||||
|
||||
```bash
|
||||
# Taille du cache (objectif : < 5G)
|
||||
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
||||
|
||||
# IP bannies (doit augmenter)
|
||||
sudo fail2ban-client status forgejo-archive
|
||||
|
||||
# Top 5 IP actives
|
||||
docker logs forgejo --since 24h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn | head -5
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Résultat attendu
|
||||
|
||||
| Avant | Après |
|
||||
|-------|-------|
|
||||
| 47G de cache | 2-3G max |
|
||||
| 20 archives avant ban | 8 archives avant ban |
|
||||
| Ban 1h | Ban 6h (puis 12h, 24h...) |
|
||||
| 100 requêtes/min | 20 requêtes/min |
|
||||
| Archives gardées 7j | Archives supprimées après 1h |
|
||||
|
||||
---
|
||||
|
||||
## Dépannage
|
||||
|
||||
**Le cache se remplit encore ?**
|
||||
```bash
|
||||
# Voir qui télécharge
|
||||
docker logs forgejo --since 1h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn
|
||||
|
||||
# Bannir manuellement
|
||||
sudo fail2ban-client set forgejo-archive banip IP_SUSPECTE
|
||||
|
||||
# Vérifier Fail2ban
|
||||
sudo fail2ban-client status forgejo-archive
|
||||
```
|
||||
|
||||
**Fail2ban ne bannit pas ?**
|
||||
```bash
|
||||
# Tester la regex
|
||||
sudo fail2ban-regex /var/lib/docker/containers/.../...json.log /etc/fail2ban/filter.d/forgejo-archive.conf
|
||||
|
||||
# Logs Fail2ban
|
||||
sudo tail -f /var/log/fail2ban.log
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
Pour plus de détails, voir le guide complet : [bloquer-telechargements-abusifs.md](bloquer-telechargements-abusifs.md)
|
||||
144
serveur/forgejo/README.md
Normal file
144
serveur/forgejo/README.md
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
# Guides Forgejo
|
||||
|
||||
Guides spécifiques pour administrer et sécuriser une instance Forgejo (forge Git auto-hébergée).
|
||||
|
||||
## 📚 Guides disponibles
|
||||
|
||||
### 🚀 Démarrage rapide
|
||||
|
||||
**[QUICK-START.md](QUICK-START.md)**
|
||||
- **Objectif :** Sécuriser Forgejo contre les bots en 15 minutes
|
||||
- **Contenu :** Configuration Fail2ban, rate limiting, cron de nettoyage
|
||||
- **Niveau :** Intermédiaire
|
||||
- **Temps :** 15 min
|
||||
|
||||
### 🛡️ Guide complet
|
||||
|
||||
**[bloquer-telechargements-abusifs.md](bloquer-telechargements-abusifs.md)**
|
||||
- **Objectif :** Empêcher les bots de saturer le disque avec des téléchargements massifs d'archives
|
||||
- **Contenu :** Fail2ban détaillé, rate limiting, expiration des archives, monitoring, 5 solutions
|
||||
- **Niveau :** Intermédiaire
|
||||
- **Temps :** 30-60 min
|
||||
|
||||
---
|
||||
|
||||
## 🎯 Par situation
|
||||
|
||||
### Disque saturé par repo-archive
|
||||
**Symptôme :** `/var/lib/docker/.../repo-archive` fait 40-50G
|
||||
|
||||
**Action rapide :**
|
||||
1. Appliquer : [QUICK-START.md](QUICK-START.md)
|
||||
2. Nettoyage : `find /path/repo-archive -type f -delete`
|
||||
|
||||
**Solution complète :**
|
||||
1. Lire : [bloquer-telechargements-abusifs.md](bloquer-telechargements-abusifs.md)
|
||||
2. Appliquer la configuration recommandée
|
||||
3. Monitorer pendant 48h
|
||||
|
||||
### Configuration préventive
|
||||
**Vous installez Forgejo ou voulez sécuriser préventivement :**
|
||||
1. Lire la section "Configuration complète" de [bloquer-telechargements-abusifs.md](bloquer-telechargements-abusifs.md)
|
||||
2. Appliquer avant de rendre public
|
||||
|
||||
---
|
||||
|
||||
## ⚙️ Configuration type recommandée
|
||||
|
||||
### Fail2ban (`/etc/fail2ban/jail.d/forgejo.conf`)
|
||||
```ini
|
||||
[forgejo-archive]
|
||||
enabled = true
|
||||
filter = forgejo-archive
|
||||
logpath = /var/lib/docker/containers/CONTAINER_ID/CONTAINER_ID-json.log
|
||||
maxretry = 8
|
||||
findtime = 600
|
||||
bantime = 21600
|
||||
bantime.increment = true
|
||||
bantime.factor = 2
|
||||
bantime.maxtime = 604800
|
||||
```
|
||||
|
||||
### Forgejo (`app.ini`)
|
||||
```ini
|
||||
[api]
|
||||
ENABLE_RATE_LIMIT = true
|
||||
RATE_LIMIT_BURST = 20
|
||||
RATE_LIMIT_PERIOD = 60s
|
||||
|
||||
[repository.local]
|
||||
ARCHIVE_EXPIRY = 3600
|
||||
```
|
||||
|
||||
### Cron
|
||||
```bash
|
||||
# Nettoyage toutes les 6h (fichiers de +6h)
|
||||
0 */6 * * * find /path/repo-archive -type f -mmin +360 -delete
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 🔍 Monitoring quotidien
|
||||
|
||||
```bash
|
||||
# Taille du cache (objectif : < 5G)
|
||||
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
||||
|
||||
# Fail2ban status
|
||||
sudo fail2ban-client status forgejo-archive
|
||||
|
||||
# Top 5 IP actives (24h)
|
||||
docker logs forgejo --since 24h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn | head -5
|
||||
|
||||
# Nombre d'archives téléchargées (24h)
|
||||
docker logs forgejo --since 24h | grep "archive" | wc -l
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 📊 Métriques de santé
|
||||
|
||||
| Métrique | Valeur saine | Alerte |
|
||||
|----------|--------------|--------|
|
||||
| Taille cache `repo-archive` | < 5 GB | > 10 GB |
|
||||
| Nombre de fichiers | < 300 | > 500 |
|
||||
| IP bannies/jour | 1-5 | > 10 |
|
||||
| Archives téléchargées/jour | < 100 | > 500 |
|
||||
|
||||
---
|
||||
|
||||
## 🆘 Dépannage rapide
|
||||
|
||||
### Le cache se remplit encore
|
||||
|
||||
```bash
|
||||
# 1. Vérifier la config Forgejo
|
||||
cat /path/to/app.ini | grep -A3 "\[api\]"
|
||||
docker restart forgejo
|
||||
|
||||
# 2. Vérifier Fail2ban
|
||||
sudo fail2ban-client status forgejo-archive
|
||||
|
||||
# 3. Identifier les IP actives
|
||||
docker logs forgejo --since 1h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn
|
||||
|
||||
# 4. Bannir manuellement si besoin
|
||||
sudo fail2ban-client set forgejo-archive banip IP_SUSPECTE
|
||||
```
|
||||
|
||||
### Fail2ban ne bannit pas
|
||||
|
||||
```bash
|
||||
# Tester le filtre
|
||||
sudo fail2ban-regex /var/lib/docker/containers/.../...json.log /etc/fail2ban/filter.d/forgejo-archive.conf
|
||||
|
||||
# Vérifier les logs
|
||||
sudo journalctl -u fail2ban -n 50
|
||||
|
||||
# Redémarrer
|
||||
sudo systemctl restart fail2ban
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
[← Retour à l'index principal](../README.md)
|
||||
1070
serveur/forgejo/bloquer-telechargements-abusifs.md
Normal file
1070
serveur/forgejo/bloquer-telechargements-abusifs.md
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Add table
Add a link
Reference in a new issue