91 lines
2.6 KiB
PHP
91 lines
2.6 KiB
PHP
<?php
|
|
|
|
return [
|
|
|
|
/*
|
|
| Turn the blocker on or off without removing the middleware.
|
|
*/
|
|
'enabled' => env('BAD_IP_BLOCKER_ENABLED', true),
|
|
|
|
/*
|
|
| Register the middleware globally automatically. Disable this if you
|
|
| prefer to add CheckBadIps yourself in bootstrap/app.php.
|
|
*/
|
|
'auto_register' => env('BAD_IP_BLOCKER_AUTO_REGISTER', true),
|
|
|
|
/*
|
|
| Schedule `bad-ip-blocker:prune` daily to remove expired blocks.
|
|
| Requires the Laravel scheduler (`schedule:run`) to be running.
|
|
*/
|
|
'schedule_prune' => env('BAD_IP_BLOCKER_SCHEDULE_PRUNE', true),
|
|
|
|
/*
|
|
| Where the local JSON list of blocked IPs is stored.
|
|
*/
|
|
'storage_path' => env('BAD_IP_BLOCKER_STORAGE_PATH', storage_path('app/bad-ip-blocker.json')),
|
|
|
|
/*
|
|
| Response returned to blocked clients.
|
|
*/
|
|
'response' => [
|
|
'status' => 418,
|
|
'message' => 'Blocked.',
|
|
],
|
|
|
|
/*
|
|
| IPs or CIDR ranges that are never blocked. Private and loopback ranges
|
|
| are included by default so that a misconfigured proxy setup (where
|
|
| $request->ip() returns the load balancer's address) never blocks
|
|
| every visitor. Configure TrustProxies so the real client IP is used.
|
|
*/
|
|
'whitelist' => [
|
|
'127.0.0.0/8',
|
|
'::1',
|
|
'10.0.0.0/8',
|
|
'172.16.0.0/12',
|
|
'192.168.0.0/16',
|
|
'fc00::/7',
|
|
],
|
|
|
|
/*
|
|
| Automatically block clients that request paths no normal visitor asks
|
|
| for. A hit only counts when the response is a 404, so routes that
|
|
| actually exist in your app (e.g. a published security.txt) are never
|
|
| affected. Patterns use Request::is() syntax.
|
|
*/
|
|
'auto_block' => [
|
|
'enabled' => env('BAD_IP_BLOCKER_AUTO_BLOCK', true),
|
|
|
|
'paths' => [
|
|
'.well-known/security.txt',
|
|
'security.txt',
|
|
'.env*',
|
|
'*/.env*',
|
|
'.git/*',
|
|
'.aws/*',
|
|
'wp-login.php',
|
|
'wp-admin*',
|
|
'wp-content/*',
|
|
'wp-includes/*',
|
|
'xmlrpc.php',
|
|
'phpmyadmin*',
|
|
'pma*',
|
|
'vendor/phpunit/*',
|
|
'cgi-bin/*',
|
|
'*.php',
|
|
],
|
|
|
|
// Number of matching 404 hits before the IP is blocked.
|
|
'max_hits' => 1,
|
|
|
|
// Seconds a hit counter is kept.
|
|
'decay' => 3600,
|
|
|
|
// Seconds an automatic block lasts (default 7 days). null = permanent.
|
|
// Scanners rotate IPs, so permanent blocks mostly grow the list and
|
|
// risk locking out shared addresses (mobile carriers, NAT) forever.
|
|
'ttl' => env('BAD_IP_BLOCKER_AUTO_BLOCK_TTL', 60 * 60 * 24 * 7),
|
|
],
|
|
|
|
];
|