···

       
100
       
100
       
 
       
    "fail2ban/action.d/abuseipdb-agenix.conf".text = ''

     

       
101
       
101
       
 
       
      [Definition]

     

       
102
       
102
       
 
       
      # Report IP to AbuseIPDB, reading API key from Agenix secret file

     

       
103
       
103
       
-
       
      # Simple version without <matches> to avoid parameter substitution issues

     

       
104
       
103
       
 
       
      # Uses double quotes to allow shell expansion of $(cat /run/agenix/abuseipdb)

     

       
105
       
105
       
-
       
      actionban = sleep 1; curl --fail 'https://api.abuseipdb.com/api/v2/report' -H 'Accept: application/json' -H "Key: $(cat /run/agenix/abuseipdb)" --data-urlencode 'ip=<ip>' --data 'categories=<abuseipdb_category>'

     

       
104
       
104
       
+
       
      # Sleep 12 seconds to respect AbuseIPDB rate limit (~5 requests per minute)

     

       
105
       
105
       
+
       
      actionban = sleep 12; curl --fail 'https://api.abuseipdb.com/api/v2/report' -H 'Accept: application/json' -H "Key: $(cat /run/agenix/abuseipdb)" --data-urlencode 'ip=<ip>' --data-urlencode 'comment=<matches>' --data 'categories=<abuseipdb_category>'

     

       
106
       
106
       
 
       


     

       
107
       
107
       
 
       
      actionstart =

     

       
108
       
108
       
 
       
      actionstop =