Init

config/bad-ip-blocker.php

@@ -0,0 +1,90 @@
+<?php
+
+return [
+
+    /*
+    | Turn the blocker on or off without removing the middleware.
+    */
+    'enabled' => env('BAD_IP_BLOCKER_ENABLED', true),
+
+    /*
+    | Register the middleware globally automatically. Disable this if you
+    | prefer to add CheckBadIps yourself in bootstrap/app.php.
+    */
+    'auto_register' => env('BAD_IP_BLOCKER_AUTO_REGISTER', true),
+
+    /*
+    | Schedule `bad-ip-blocker:prune` daily to remove expired blocks.
+    | Requires the Laravel scheduler (`schedule:run`) to be running.
+    */
+    'schedule_prune' => env('BAD_IP_BLOCKER_SCHEDULE_PRUNE', true),
+
+    /*
+    | Where the local JSON list of blocked IPs is stored.
+    */
+    'storage_path' => env('BAD_IP_BLOCKER_STORAGE_PATH', storage_path('app/bad-ip-blocker.json')),
+
+    /*
+    | Response returned to blocked clients.
+    */
+    'response' => [
+        'status' => 418,
+        'message' => 'Blocked.',
+    ],
+
+    /*
+    | IPs or CIDR ranges that are never blocked. Private and loopback ranges
+    | are included by default so that a misconfigured proxy setup (where
+    | $request->ip() returns the load balancer's address) never blocks
+    | every visitor. Configure TrustProxies so the real client IP is used.
+    */
+    'whitelist' => [
+        '127.0.0.0/8',
+        '::1',
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '192.168.0.0/16',
+        'fc00::/7',
+    ],
+
+    /*
+    | Automatically block clients that request paths no normal visitor asks
+    | for. A hit only counts when the response is a 404, so routes that
+    | actually exist in your app (e.g. a published security.txt) are never
+    | affected. Patterns use Request::is() syntax.
+    */
+    'auto_block' => [
+        'enabled' => env('BAD_IP_BLOCKER_AUTO_BLOCK', true),
+
+        'paths' => [
+            '.well-known/security.txt',
+            'security.txt',
+            '.env*',
+            '*/.env*',
+            '.git/*',
+            '.aws/*',
+            'wp-login.php',
+            'wp-admin*',
+            'wp-content/*',
+            'wp-includes/*',
+            'xmlrpc.php',
+            'phpmyadmin*',
+            'pma*',
+            'vendor/phpunit/*',
+            'cgi-bin/*',
+            '*.php',
+        ],
+
+        // Number of matching 404 hits before the IP is blocked.
+        'max_hits' => 1,
+
+        // Seconds a hit counter is kept.
+        'decay' => 3600,
+
+        // Seconds an automatic block lasts (default 7 days). null = permanent.
+        // Scanners rotate IPs, so permanent blocks mostly grow the list and
+        // risk locking out shared addresses (mobile carriers, NAT) forever.
+        'ttl' => env('BAD_IP_BLOCKER_AUTO_BLOCK_TTL', 60 * 60 * 24 * 7),
+    ],
+
+];