hydra: block various user-agents
These are used by a botnet, that spoofs various outdated OS and User-Agent versions.
Martin Weinelt committed
Jan 12, 2025 at 04:15 UTC
c7a93adf21b76de9d3d1e721b4aa4d39fa99f4d9
1 file changed
+33
build/hydra-proxy.nix
+33
@@ -1,9 +1,27 @@
1
{
2
config,
3
+ lib,
4
pkgs,
5
...
6
}:
7
8
+let
9
+ bannedUserAgentPatterns = [
10
+ "Trident/"
11
+ "Android\\s[123456789]\\."
12
+ "iPod"
13
+ "iPad\\sOS\\s"
14
+ "iPhone\\sOS\\s[23456789]"
15
+ "Opera/[89]"
16
+ "(Chrome|CriOS)/(\\d\\d?\\.|1[01]|12[4])"
17
+ "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]\\.)"
18
+ "PPC\\sMac\\sOS"
19
+ "Windows\\sCE"
20
+ "Windows\\s95"
21
+ "Windows\\s98"
22
+ "Windows\\sNT\\s[12345]\\."
23
+ ];
24
+in
25
{
26
networking.firewall.allowedTCPPorts = [
27
80
@@ -31,6 +49,15 @@
49
worker_connections 1024;
50
'';
51
52
+ appendHttpConfig = ''
53
+ map $http_user_agent $badagent {
54
+ default 0;
55
+ ${lib.concatMapStringsSep "\n" (pattern: ''
56
+ ~${pattern} 1;
57
+ '') bannedUserAgentPatterns}
58
+ }
59
+ '';
60
+
61
virtualHosts."hydra.nixos.org" = {
62
forceSSL = true;
63
enableACME = true;
@@ -53,6 +80,12 @@
80
81
locations."/" = {
82
proxyPass = "http://127.0.0.1:3000";
83
+ extraConfig = ''
84
+ if ($badagent) {
85
+ access_log /var/log/nginx/abuse.log;
86
+ return 403;
87
+ }
88
+ '';
89
};
90
91
locations."/static/" = {