v0.3.0 - Initial Release
This commit is contained in:
5
.vscode/settings.json
vendored
Normal file
5
.vscode/settings.json
vendored
Normal file
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"chat.tools.terminal.autoApprove": {
|
||||
"Rename-Item": true
|
||||
}
|
||||
}
|
||||
73
README.md
73
README.md
@@ -38,67 +38,80 @@ Wenn ein Client eine bestimmte Domain zu oft anfragt (z.B. >30x pro Minute), wir
|
||||
## Voraussetzungen
|
||||
|
||||
- Linux Server mit AdGuard Home (bare metal)
|
||||
- `curl`, `jq`, `iptables` / `ip6tables`
|
||||
- Root-Zugriff
|
||||
- Root-Zugriff (`sudo`)
|
||||
- AdGuard Home Web-API erreichbar (Standard: Port 3000)
|
||||
- Pakete: `curl`, `jq`, `iptables`, `gawk`, `systemd` — werden bei der Installation **automatisch** installiert
|
||||
|
||||
## Schnellstart
|
||||
|
||||
```bash
|
||||
# 1. Repository klonen
|
||||
git clone <repo-url> /tmp/adguard-security
|
||||
cd /tmp/adguard-security
|
||||
git clone https://git.techniverse.net/scriptos/adguard-shield.git /tmp/adguard-shield
|
||||
cd /tmp/adguard-shield
|
||||
|
||||
# 2. Installer ausführen (fragt interaktiv nach Zugangsdaten & Einstellungen)
|
||||
# 2. Installer aufrufen (interaktives Menü)
|
||||
sudo bash install.sh
|
||||
|
||||
# Oder direkt installieren:
|
||||
sudo bash install.sh install
|
||||
|
||||
# 3. Erst im Dry-Run testen (loggt nur, sperrt nichts)
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh dry-run
|
||||
sudo /opt/adguard-shield/adguard-shield.sh dry-run
|
||||
|
||||
# 4. Wenn alles passt — Service starten
|
||||
sudo systemctl start adguard-ratelimit
|
||||
sudo systemctl status adguard-ratelimit
|
||||
sudo systemctl start adguard-shield
|
||||
sudo systemctl status adguard-shield
|
||||
```
|
||||
|
||||
> **Hinweis:** Bei der Installation werden alle benötigten Abhängigkeiten automatisch installiert und der Service wird für den Autostart beim Booten registriert.
|
||||
|
||||
## Wichtigste Befehle
|
||||
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh status # Aktive Sperren anzeigen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history # Ban-History anzeigen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh unban IP # Einzelne IP entsperren
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh flush # Alle Sperren aufheben
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh test # API-Verbindung testen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh blocklist-status # Externe Blocklisten Status
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh blocklist-sync # Blocklisten manuell synchronisieren
|
||||
sudo journalctl -u adguard-ratelimit -f # Logs live verfolgen
|
||||
# Installer-Menü
|
||||
sudo bash install.sh # Interaktives Menü (Install/Update/Uninstall/Status)
|
||||
sudo bash install.sh --help # Hilfe anzeigen
|
||||
sudo bash install.sh update # Update mit automatischer Konfigurations-Migration
|
||||
sudo bash install.sh status # Installationsstatus prüfen
|
||||
|
||||
# Monitor
|
||||
sudo /opt/adguard-shield/adguard-shield.sh status # Aktive Sperren anzeigen
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history # Ban-History anzeigen
|
||||
sudo /opt/adguard-shield/adguard-shield.sh unban IP # Einzelne IP entsperren
|
||||
sudo /opt/adguard-shield/adguard-shield.sh flush # Alle Sperren aufheben
|
||||
sudo /opt/adguard-shield/adguard-shield.sh test # API-Verbindung testen
|
||||
sudo /opt/adguard-shield/adguard-shield.sh blocklist-status # Externe Blocklisten Status
|
||||
sudo /opt/adguard-shield/adguard-shield.sh blocklist-sync # Blocklisten manuell synchronisieren
|
||||
sudo journalctl -u adguard-shield -f # Logs live verfolgen
|
||||
```
|
||||
|
||||
## Projektstruktur
|
||||
|
||||
```
|
||||
├── adguard-ratelimit.sh # Haupt-Monitor-Script
|
||||
├── adguard-ratelimit.conf # Konfiguration
|
||||
├── adguard-ratelimit.service # systemd Unit
|
||||
├── external-blocklist-worker.sh # Externer Blocklist-Worker
|
||||
├── iptables-helper.sh # Manuelle iptables-Verwaltung
|
||||
├── unban-expired.sh # Cron-basiertes Entsperren
|
||||
├── install.sh # Installer / Uninstaller
|
||||
├── adguard-shield.sh # Haupt-Monitor-Script
|
||||
├── adguard-shield.conf # Konfiguration
|
||||
├── adguard-shield.service # systemd Unit
|
||||
├── external-blocklist-worker.sh # Externer Blocklist-Worker
|
||||
├── iptables-helper.sh # Manuelle iptables-Verwaltung
|
||||
├── unban-expired.sh # Cron-basiertes Entsperren
|
||||
├── install.sh # Installer / Updater / Uninstaller
|
||||
├── README.md
|
||||
└── doc/
|
||||
├── architektur.md # Architektur & Funktionsweise
|
||||
├── konfiguration.md # Alle Parameter erklärt
|
||||
├── befehle.md # Vollständige Befehlsreferenz
|
||||
├── benachrichtigungen.md # Webhook-Setup (Discord, Slack, Gotify)
|
||||
├── architektur.md # Architektur & Funktionsweise
|
||||
├── konfiguration.md # Alle Parameter erklärt + Konfig-Migration
|
||||
├── befehle.md # Vollständige Befehlsreferenz inkl. Installer
|
||||
├── benachrichtigungen.md # Webhook-Setup (Discord, Slack, Gotify, Ntfy)
|
||||
└── tipps-und-troubleshooting.md
|
||||
```
|
||||
```
|
||||
|
||||
## Dokumentation
|
||||
|
||||
| Dokument | Inhalt |
|
||||
|----------|--------|
|
||||
| [Architektur](doc/architektur.md) | Wie das Tool funktioniert, iptables-Strategie, Ablauf einer Sperre |
|
||||
| [Konfiguration](doc/konfiguration.md) | Alle Parameter, Ports, Whitelist-Pflege, externe Blocklisten |
|
||||
| [Befehle](doc/befehle.md) | Vollständige Befehlsreferenz für Monitor, iptables-Helper und systemd |
|
||||
| [Architektur](doc/architektur.md) | Wie das Tool funktioniert, iptables-Strategie, Konfig-Migration |
|
||||
| [Konfiguration](doc/konfiguration.md) | Alle Parameter, Ports, Whitelist-Pflege, automatische Migration |
|
||||
| [Befehle](doc/befehle.md) | Vollständige Befehlsreferenz für Installer, Monitor, iptables-Helper und systemd |
|
||||
| [Benachrichtigungen](doc/benachrichtigungen.md) | Setup für Discord, Slack, Gotify, Ntfy |
|
||||
| [Tipps & Troubleshooting](doc/tipps-und-troubleshooting.md) | Best Practices, häufige Probleme, Deinstallation |
|
||||
|
||||
|
||||
@@ -1,36 +0,0 @@
|
||||
[Unit]
|
||||
Description=AdGuard Shield - DNS Rate-Limit Monitor
|
||||
Documentation=https://github.com/your-repo/adguard-security
|
||||
After=network.target AdGuardHome.service
|
||||
Wants=AdGuardHome.service
|
||||
StartLimitBurst=5
|
||||
StartLimitIntervalSec=60
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/opt/adguard-ratelimit/adguard-ratelimit.sh start
|
||||
ExecStop=/opt/adguard-ratelimit/adguard-ratelimit.sh stop
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
|
||||
# Neustart-Verhalten
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
|
||||
# Sicherheits-Hardening
|
||||
ProtectSystem=full
|
||||
ReadWritePaths=/var/log /var/lib/adguard-ratelimit /var/lib/adguard-ratelimit/external-blocklist /var/run
|
||||
ProtectHome=true
|
||||
NoNewPrivileges=false
|
||||
PrivateTmp=true
|
||||
|
||||
# iptables benötigt CAP_NET_ADMIN
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
||||
|
||||
# Logging
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=adguard-ratelimit
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -5,10 +5,10 @@
|
||||
|
||||
# --- AdGuard Home API Einstellungen ---
|
||||
# URL der AdGuard Home Web-Oberfläche (ohne trailing slash)
|
||||
ADGUARD_URL="http://127.0.0.1:3000"
|
||||
ADGUARD_URL="https://dns1.techniverse.net"
|
||||
|
||||
# AdGuard Home Zugangsdaten (Web-UI Login)
|
||||
ADGUARD_USER="admin"
|
||||
ADGUARD_USER="adg-admin"
|
||||
ADGUARD_PASS='changeme'
|
||||
|
||||
# --- Rate-Limit Einstellungen ---
|
||||
@@ -26,7 +26,7 @@ CHECK_INTERVAL=10
|
||||
BAN_DURATION=3600
|
||||
|
||||
# iptables Chain-Name für die Sperren
|
||||
IPTABLES_CHAIN="ADGUARD_RATELIMIT"
|
||||
IPTABLES_CHAIN="ADGUARD_SHIELD"
|
||||
|
||||
# Welche Ports gesperrt werden sollen (DNS, DoT, DoH, DNSv5/QUIC)
|
||||
# Port 53 = DNS (UDP + TCP)
|
||||
@@ -43,7 +43,7 @@ WHITELIST="127.0.0.1,::1"
|
||||
|
||||
# --- Logging ---
|
||||
# Log-Datei Pfad
|
||||
LOG_FILE="/var/log/adguard-ratelimit.log"
|
||||
LOG_FILE="/var/log/adguard-shield.log"
|
||||
|
||||
# Log-Level: DEBUG, INFO, WARN, ERROR
|
||||
LOG_LEVEL="INFO"
|
||||
@@ -52,7 +52,7 @@ LOG_LEVEL="INFO"
|
||||
LOG_MAX_SIZE_MB=50
|
||||
|
||||
# Ban-History Datei (protokolliert alle Sperren & Entsperrungen dauerhaft)
|
||||
BAN_HISTORY_FILE="/var/log/adguard-ratelimit-bans.log"
|
||||
BAN_HISTORY_FILE="/var/log/adguard-shield-bans.log"
|
||||
|
||||
# --- Benachrichtigungen (optional) ---
|
||||
# Aktiviert Benachrichtigungen bei Sperren
|
||||
@@ -98,14 +98,14 @@ EXTERNAL_BLOCKLIST_BAN_DURATION=0
|
||||
EXTERNAL_BLOCKLIST_AUTO_UNBAN=true
|
||||
|
||||
# Lokaler Cache-Pfad für die heruntergeladene Blocklist
|
||||
EXTERNAL_BLOCKLIST_CACHE_DIR="/var/lib/adguard-ratelimit/external-blocklist"
|
||||
EXTERNAL_BLOCKLIST_CACHE_DIR="/var/lib/adguard-shield/external-blocklist"
|
||||
|
||||
# --- Erweiterte Einstellungen ---
|
||||
# Pfad zur State-Datei (speichert aktive Sperren)
|
||||
STATE_DIR="/var/lib/adguard-ratelimit"
|
||||
STATE_DIR="/var/lib/adguard-shield"
|
||||
|
||||
# Pfad zum PID-File
|
||||
PID_FILE="/var/run/adguard-ratelimit.pid"
|
||||
PID_FILE="/var/run/adguard-shield.pid"
|
||||
|
||||
# Anzahl der API-Einträge die pro Abfrage geholt werden (max 5000)
|
||||
API_QUERY_LIMIT=500
|
||||
37
adguard-shield.service
Normal file
37
adguard-shield.service
Normal file
@@ -0,0 +1,37 @@
|
||||
[Unit]
|
||||
Description=AdGuard Shield - DNS Rate-Limit Monitor
|
||||
Documentation=https://git.techniverse.net/scriptos/adguard-shield
|
||||
After=network.target AdGuardHome.service
|
||||
Wants=AdGuardHome.service
|
||||
StartLimitBurst=5
|
||||
StartLimitIntervalSec=60
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
ExecStart=/opt/adguard-shield/adguard-shield.sh start
|
||||
ExecStop=/opt/adguard-shield/adguard-shield.sh stop
|
||||
ExecReload=/bin/kill -HUP $MAINPID
|
||||
|
||||
# Neustart-Verhalten
|
||||
Restart=on-failure
|
||||
RestartSec=10
|
||||
|
||||
# Sicherheits-Hardening
|
||||
ProtectSystem=full
|
||||
ReadWritePaths=/var/log /var/lib/adguard-shield /var/lib/adguard-shield/external-blocklist /var/run
|
||||
ProtectHome=true
|
||||
NoNewPrivileges=false
|
||||
PrivateTmp=true
|
||||
|
||||
# iptables benötigt CAP_NET_ADMIN + CAP_NET_RAW
|
||||
# Weitere Capabilities für Dateizugriff, Signale und Prozessverwaltung
|
||||
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
||||
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_KILL CAP_SETUID CAP_SETGID CAP_CHOWN
|
||||
|
||||
# Logging
|
||||
StandardOutput=journal
|
||||
StandardError=journal
|
||||
SyslogIdentifier=adguard-shield
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -9,19 +9,22 @@
|
||||
# Lizenz: MIT
|
||||
###############################################################################
|
||||
|
||||
VERSION="1.0.0"
|
||||
VERSION="0.3.0"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Fehler-Trap: Bei unerwartetem Abbruch Fehlerdetails ausgeben
|
||||
trap 'echo "[$(date "+%Y-%m-%d %H:%M:%S")] [ERROR] Unerwarteter Fehler in Zeile $LINENO (Exit-Code: $?)" >&2' ERR
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-ratelimit.conf"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-shield.conf"
|
||||
|
||||
# ─── Konfiguration laden ───────────────────────────────────────────────────────
|
||||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||
echo "FEHLER: Konfigurationsdatei nicht gefunden: $CONFIG_FILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck source=adguard-ratelimit.conf
|
||||
# shellcheck source=adguard-shield.conf
|
||||
source "$CONFIG_FILE"
|
||||
|
||||
# ─── Abhängigkeiten prüfen ────────────────────────────────────────────────────
|
||||
@@ -276,9 +279,9 @@ send_notification() {
|
||||
|
||||
local message
|
||||
if [[ "$action" == "ban" ]]; then
|
||||
message="🚫 DNS Rate-Limit: Client **$client_ip** gesperrt (${count}x $domain in ${RATE_LIMIT_WINDOW}s). Sperre für ${BAN_DURATION}s."
|
||||
message="🚫 AdGuard Shield: Client **$client_ip** gesperrt (${count}x $domain in ${RATE_LIMIT_WINDOW}s). Sperre für ${BAN_DURATION}s."
|
||||
else
|
||||
message="✅ DNS Rate-Limit: Client **$client_ip** wurde entsperrt."
|
||||
message="✅ AdGuard Shield: Client **$client_ip** wurde entsperrt."
|
||||
fi
|
||||
|
||||
case "$NOTIFY_TYPE" in
|
||||
@@ -294,7 +297,7 @@ send_notification() {
|
||||
;;
|
||||
gotify)
|
||||
curl -s -X POST "$NOTIFY_WEBHOOK_URL" \
|
||||
-F "title=AdGuard Rate-Limit" \
|
||||
-F "title=AdGuard Shield" \
|
||||
-F "message=$message" \
|
||||
-F "priority=5" &>/dev/null &
|
||||
;;
|
||||
@@ -321,7 +324,7 @@ send_ntfy_notification() {
|
||||
|
||||
local ntfy_url="${NTFY_SERVER_URL:-https://ntfy.sh}"
|
||||
local priority="${NTFY_PRIORITY:-4}"
|
||||
local title="AdGuard Rate-Limit"
|
||||
local title="AdGuard Shield"
|
||||
local tags
|
||||
|
||||
if [[ "$action" == "ban" ]]; then
|
||||
@@ -354,9 +357,8 @@ send_ntfy_notification() {
|
||||
|
||||
# ─── AdGuard Home API abfragen ──────────────────────────────────────────────
|
||||
query_adguard_log() {
|
||||
local time_from
|
||||
time_from=$(date -u -d "-${RATE_LIMIT_WINDOW} seconds" '+%Y-%m-%dT%H:%M:%S.000Z' 2>/dev/null \
|
||||
|| date -u -v "-${RATE_LIMIT_WINDOW}S" '+%Y-%m-%dT%H:%M:%S.000Z')
|
||||
# Hinweis: Zeitfilterung erfolgt client-seitig in analyze_queries(),
|
||||
# da die AdGuard API keinen "newer_than" Parameter unterstützt.
|
||||
|
||||
local response
|
||||
response=$(curl -s -u "${ADGUARD_USER}:${ADGUARD_PASS}" \
|
||||
@@ -385,17 +387,44 @@ analyze_queries() {
|
||||
now_epoch=$(date '+%s')
|
||||
local window_start=$((now_epoch - RATE_LIMIT_WINDOW))
|
||||
|
||||
# Anzahl der API-Einträge loggen
|
||||
local entry_count
|
||||
entry_count=$(echo "$api_response" | jq '.data // [] | length' 2>/dev/null || echo "0")
|
||||
log "INFO" "API-Abfrage: ${entry_count} Einträge erhalten, prüfe Zeitfenster ${RATE_LIMIT_WINDOW}s..."
|
||||
|
||||
# Extrahiere Client-IP + Domain Paare aus dem Zeitfenster
|
||||
# und zähle die Häufigkeit pro (client, domain) Kombination
|
||||
local violations
|
||||
# Unterstützt .question.name (alte API) und .question.host (neue API)
|
||||
# Unterstützt Timestamps mit UTC ("Z") und Zeitzonen-Offset ("+01:00")
|
||||
local violations=""
|
||||
violations=$(echo "$api_response" | jq -r --argjson window_start "$window_start" '
|
||||
# ISO 8601 Timestamp zu Unix-Epoch konvertieren
|
||||
# Unterstützt: "2026-03-03T20:01:48Z", "2026-03-03T20:01:48.123Z",
|
||||
# "2026-03-03T20:01:48+01:00", "2026-03-03T20:01:48.123+01:00"
|
||||
def to_epoch:
|
||||
sub("\\.[0-9]+(?=[+-Z])"; "") |
|
||||
if endswith("Z") then
|
||||
fromdateiso8601
|
||||
elif test("[+-][0-9]{2}:[0-9]{2}$") then
|
||||
# Zeitzonen-Offset per String-Slicing extrahieren (zuverlässiger als Regex)
|
||||
# Letzten 6 Zeichen = "+01:00" bzw. "-05:00"
|
||||
(.[:-6]) as $base |
|
||||
(.[-6:-5]) as $sign |
|
||||
(.[-5:-3] | tonumber) as $h |
|
||||
(.[-2:] | tonumber) as $m |
|
||||
($base + "Z" | fromdateiso8601) +
|
||||
(if $sign == "+" then -1 else 1 end * ($h * 3600 + $m * 60))
|
||||
else
|
||||
fromdateiso8601
|
||||
end;
|
||||
|
||||
.data // [] |
|
||||
[.[] |
|
||||
select(.time != null) |
|
||||
select((.time | to_epoch) >= $window_start) |
|
||||
{
|
||||
client: (.client // .client_info.ip // "unknown"),
|
||||
domain: (.question.name // "unknown" | rtrimstr(".")),
|
||||
time_epoch: (.time | split(".")[0] | sub("T"; " ") | sub("Z$"; "") )
|
||||
domain: ((.question.name // .question.host // "unknown") | rtrimstr("."))
|
||||
}
|
||||
] |
|
||||
group_by(.client + "|" + .domain) |
|
||||
@@ -407,10 +436,13 @@ analyze_queries() {
|
||||
.[] |
|
||||
select(.count > 0) |
|
||||
"\(.client)|\(.domain)|\(.count)"
|
||||
' 2>/dev/null)
|
||||
') || {
|
||||
log "ERROR" "jq Analyse fehlgeschlagen - API-Antwort-Format prüfen (ist AdGuard Home erreichbar?)"
|
||||
return
|
||||
}
|
||||
|
||||
if [[ -z "$violations" ]]; then
|
||||
log "DEBUG" "Keine Anfragen im Zeitfenster gefunden"
|
||||
log "INFO" "Keine Anfragen im Zeitfenster gefunden"
|
||||
return
|
||||
fi
|
||||
|
||||
@@ -418,7 +450,7 @@ analyze_queries() {
|
||||
while IFS='|' read -r client domain count; do
|
||||
[[ -z "$client" || -z "$domain" || -z "$count" ]] && continue
|
||||
|
||||
log "DEBUG" "Client: $client, Domain: $domain, Anfragen: $count"
|
||||
log "INFO" "Client: $client, Domain: $domain, Anfragen: $count/$RATE_LIMIT_MAX_REQUESTS"
|
||||
|
||||
if [[ "$count" -gt "$RATE_LIMIT_MAX_REQUESTS" ]]; then
|
||||
if is_whitelisted "$client"; then
|
||||
@@ -434,7 +466,7 @@ analyze_queries() {
|
||||
# ─── Status anzeigen ─────────────────────────────────────────────────────────
|
||||
show_status() {
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo " AdGuard Home Rate-Limit Monitor - Status"
|
||||
echo " AdGuard Shield - Status"
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo ""
|
||||
|
||||
@@ -476,7 +508,7 @@ show_status() {
|
||||
show_history() {
|
||||
local lines="${1:-50}"
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo " AdGuard Home Rate-Limit - Ban History (letzte $lines Einträge)"
|
||||
echo " AdGuard Shield - Ban History (letzte $lines Einträge)"
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo ""
|
||||
|
||||
@@ -593,6 +625,7 @@ trap cleanup SIGTERM SIGINT SIGHUP
|
||||
# ─── Kommandozeilen-Argumente ────────────────────────────────────────────────
|
||||
case "${1:-start}" in
|
||||
start)
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] [INFO] AdGuard Shield v${VERSION} wird gestartet..."
|
||||
check_dependencies
|
||||
check_already_running
|
||||
init_directories
|
||||
@@ -15,7 +15,7 @@
|
||||
└─────────────────────┘ │
|
||||
▼
|
||||
┌──────────────────────┐
|
||||
│ adguard-ratelimit.sh │
|
||||
│ adguard-shield.sh │
|
||||
│ (Monitor Script) │
|
||||
└──────────┬───────────┘
|
||||
│
|
||||
@@ -35,27 +35,27 @@
|
||||
4. Monitor erkennt: 45 > 30 (Limit überschritten)
|
||||
5. Prüfung: Ist der Client auf der Whitelist? → Nein
|
||||
6. iptables-Regel wird erstellt: `DROP` für `192.168.1.50` auf allen DNS-Ports
|
||||
7. State-Datei wird angelegt: `/var/lib/adguard-ratelimit/192.168.1.50.ban`
|
||||
8. Ban-History Eintrag wird in `/var/log/adguard-ratelimit-bans.log` geschrieben
|
||||
7. State-Datei wird angelegt: `/var/lib/adguard-shield/192.168.1.50.ban`
|
||||
8. Ban-History Eintrag wird in `/var/log/adguard-shield-bans.log` geschrieben
|
||||
9. Log-Eintrag + optionale Webhook-Benachrichtigung
|
||||
10. Nach 3600 Sekunden (1 Stunde): automatische Entsperrung + History-Eintrag
|
||||
|
||||
## iptables Strategie
|
||||
|
||||
Das Tool erstellt eine eigene Chain `ADGUARD_RATELIMIT`:
|
||||
Das Tool erstellt eine eigene Chain `ADGUARD_SHIELD`:
|
||||
|
||||
```
|
||||
INPUT Chain
|
||||
├── ... (bestehende Regeln bleiben unberührt)
|
||||
├── -p tcp --dport 53 → ADGUARD_RATELIMIT
|
||||
├── -p udp --dport 53 → ADGUARD_RATELIMIT
|
||||
├── -p tcp --dport 443 → ADGUARD_RATELIMIT
|
||||
├── -p udp --dport 443 → ADGUARD_RATELIMIT
|
||||
├── -p tcp --dport 853 → ADGUARD_RATELIMIT
|
||||
├── -p udp --dport 853 → ADGUARD_RATELIMIT
|
||||
├── -p tcp --dport 53 → ADGUARD_SHIELD
|
||||
├── -p udp --dport 53 → ADGUARD_SHIELD
|
||||
├── -p tcp --dport 443 → ADGUARD_SHIELD
|
||||
├── -p udp --dport 443 → ADGUARD_SHIELD
|
||||
├── -p tcp --dport 853 → ADGUARD_SHIELD
|
||||
├── -p udp --dport 853 → ADGUARD_SHIELD
|
||||
└── ...
|
||||
|
||||
ADGUARD_RATELIMIT Chain
|
||||
ADGUARD_SHIELD Chain
|
||||
├── -s 192.168.1.50 → DROP (gesperrter Client)
|
||||
├── -s 10.0.0.25 → DROP (gesperrter Client)
|
||||
└── RETURN (alle anderen passieren)
|
||||
@@ -64,14 +64,14 @@ ADGUARD_RATELIMIT Chain
|
||||
**Vorteile der eigenen Chain:**
|
||||
- Greift nicht in bestehende Firewall-Regeln ein
|
||||
- Kann komplett geflusht werden ohne andere Regeln zu beeinflussen
|
||||
- Einfaches Debugging per `iptables -L ADGUARD_RATELIMIT`
|
||||
- Einfaches Debugging per `iptables -L ADGUARD_SHIELD`
|
||||
|
||||
## State-Management
|
||||
|
||||
Jede aktive Sperre wird als Datei gespeichert:
|
||||
|
||||
```
|
||||
/var/lib/adguard-ratelimit/192.168.1.50.ban
|
||||
/var/lib/adguard-shield/192.168.1.50.ban
|
||||
```
|
||||
|
||||
Inhalt:
|
||||
@@ -92,26 +92,64 @@ Das ermöglicht:
|
||||
## Dateistruktur nach Installation
|
||||
|
||||
```
|
||||
/opt/adguard-ratelimit/
|
||||
├── adguard-ratelimit.sh # Haupt-Monitor-Script
|
||||
├── adguard-ratelimit.conf # Konfiguration (chmod 600)
|
||||
├── iptables-helper.sh # iptables Verwaltung
|
||||
└── unban-expired.sh # Cron-basiertes Entsperren
|
||||
/opt/adguard-shield/
|
||||
├── adguard-shield.sh # Haupt-Monitor-Script
|
||||
├── adguard-shield.conf # Konfiguration (chmod 600)
|
||||
├── adguard-shield.conf.old # Backup der Konfig nach Update
|
||||
├── iptables-helper.sh # iptables Verwaltung
|
||||
├── external-blocklist-worker.sh # Externer Blocklist-Worker
|
||||
└── unban-expired.sh # Cron-basiertes Entsperren
|
||||
|
||||
/etc/systemd/system/
|
||||
└── adguard-ratelimit.service
|
||||
└── adguard-shield.service # systemd Service (Autostart aktiv)
|
||||
|
||||
/var/lib/adguard-ratelimit/
|
||||
└── *.ban # State-Dateien aktiver Sperren
|
||||
/var/lib/adguard-shield/
|
||||
├── *.ban # State-Dateien aktiver Sperren
|
||||
└── external-blocklist/ # Cache für externe Blocklisten
|
||||
|
||||
/var/log/
|
||||
├── adguard-ratelimit.log # Laufzeit-Log
|
||||
└── adguard-ratelimit-bans.log # Ban-History (alle Sperren/Entsperrungen)
|
||||
├── adguard-shield.log # Laufzeit-Log
|
||||
└── adguard-shield-bans.log # Ban-History (alle Sperren/Entsperrungen)
|
||||
```
|
||||
|
||||
## Installer-Architektur
|
||||
|
||||
Der Installer (`install.sh`) bietet ein interaktives Menü und folgende Funktionen:
|
||||
|
||||
| Befehl | Beschreibung |
|
||||
|--------|--------------|
|
||||
| `install` | Vollständige Neuinstallation (Abhängigkeiten, Dateien, Konfiguration, Service) |
|
||||
| `update` | Update mit automatischer Konfigurations-Migration und Service-Neustart |
|
||||
| `uninstall` | Deinstallation mit optionalem Behalten der Konfiguration |
|
||||
| `status` | Installationsstatus, Version und Service-Status anzeigen |
|
||||
| `--help` | Hilfe und Befehlsübersicht |
|
||||
|
||||
### Konfigurations-Migration beim Update
|
||||
|
||||
```
|
||||
┌─────────────────────────┐ ┌─────────────────────────┐
|
||||
│ Bestehende Konfig │ │ Neue Konfig (Repo) │
|
||||
│ (Benutzer-Settings) │ │ (mit neuen Parametern) │
|
||||
└───────────┬─────────────┘ └───────────┬─────────────┘
|
||||
│ │
|
||||
▼ ▼
|
||||
┌──────────────────────────────────────────┐
|
||||
│ Konfigurations-Migration │
|
||||
│ 1. Backup als .conf.old erstellen │
|
||||
│ 2. Alle Schlüssel vergleichen │
|
||||
│ 3. Neue Schlüssel zur Konfig ergänzen │
|
||||
│ 4. Bestehende Werte NICHT ändern │
|
||||
└──────────────────────┬───────────────────┘
|
||||
▼
|
||||
┌──────────────────────────┐
|
||||
│ Aktualisierte Konfig │
|
||||
│ (alte Werte + neue Keys) │
|
||||
└──────────────────────────┘
|
||||
```
|
||||
|
||||
## Ban-History
|
||||
|
||||
Jede Sperre und Entsperrung wird dauerhaft in der Ban-History protokolliert (`/var/log/adguard-ratelimit-bans.log`). Das ermöglicht eine lückenlose Nachvollziehbarkeit, auch nachdem State-Dateien bereits gelöscht wurden.
|
||||
Jede Sperre und Entsperrung wird dauerhaft in der Ban-History protokolliert (`/var/log/adguard-shield-bans.log`). Das ermöglicht eine lückenlose Nachvollziehbarkeit, auch nachdem State-Dateien bereits gelöscht wurden.
|
||||
|
||||
**Format:**
|
||||
```
|
||||
@@ -133,6 +171,6 @@ ZEITSTEMPEL | AKTION | CLIENT-IP | DOMAIN
|
||||
|
||||
**History anzeigen:**
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history # letzte 50
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history 200 # letzte 200
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history # letzte 50
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history 200 # letzte 200
|
||||
```
|
||||
|
||||
128
doc/befehle.md
128
doc/befehle.md
@@ -1,43 +1,86 @@
|
||||
# Befehle & Nutzung
|
||||
|
||||
## Installer / Updater
|
||||
|
||||
Der Installer bietet ein interaktives Menü wenn er ohne Argumente aufgerufen wird:
|
||||
|
||||
```bash
|
||||
# Interaktives Menü anzeigen
|
||||
sudo bash install.sh
|
||||
|
||||
# Neuinstallation
|
||||
sudo bash install.sh install
|
||||
|
||||
# Update (mit automatischer Konfigurations-Migration)
|
||||
sudo bash install.sh update
|
||||
|
||||
# Deinstallation
|
||||
sudo bash install.sh uninstall
|
||||
|
||||
# Installationsstatus anzeigen
|
||||
sudo bash install.sh status
|
||||
|
||||
# Hilfe anzeigen
|
||||
sudo bash install.sh --help
|
||||
```
|
||||
|
||||
### Update-Verhalten
|
||||
|
||||
Beim Update passiert automatisch:
|
||||
1. Alle Scripts werden aktualisiert
|
||||
2. Die bestehende Konfiguration wird als `adguard-shield.conf.old` gesichert
|
||||
3. Neue Konfigurationsparameter werden automatisch zur bestehenden Konfig hinzugefügt
|
||||
4. Bestehende Einstellungen bleiben **immer** erhalten
|
||||
5. Der systemd Service wird per `daemon-reload` neu geladen
|
||||
6. Der Service wird automatisch neu gestartet (falls er lief)
|
||||
|
||||
### Voraussetzungen
|
||||
|
||||
Folgende Pakete werden bei der Installation automatisch installiert (via `apt`):
|
||||
- `curl` — API-Kommunikation mit AdGuard Home
|
||||
- `jq` — JSON-Verarbeitung der API-Antworten
|
||||
- `iptables` — Firewall-Regeln für IP-Sperren
|
||||
- `gawk` — Textverarbeitung
|
||||
- `systemd` — Service-Management
|
||||
|
||||
## Monitor (Hauptscript)
|
||||
|
||||
```bash
|
||||
# Starten
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh start
|
||||
sudo /opt/adguard-shield/adguard-shield.sh start
|
||||
|
||||
# Stoppen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh stop
|
||||
sudo /opt/adguard-shield/adguard-shield.sh stop
|
||||
|
||||
# Status + aktive Sperren anzeigen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh status
|
||||
sudo /opt/adguard-shield/adguard-shield.sh status
|
||||
|
||||
# Ban-History anzeigen (letzte 50 Einträge)
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history
|
||||
|
||||
# Ban-History anzeigen (letzte 100 Einträge)
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history 100
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history 100
|
||||
|
||||
# Alle Sperren aufheben
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh flush
|
||||
sudo /opt/adguard-shield/adguard-shield.sh flush
|
||||
|
||||
# Einzelne IP entsperren
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh unban 192.168.1.100
|
||||
sudo /opt/adguard-shield/adguard-shield.sh unban 192.168.1.100
|
||||
|
||||
# API-Verbindung testen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh test
|
||||
sudo /opt/adguard-shield/adguard-shield.sh test
|
||||
|
||||
# Dry-Run (nur loggen, nichts sperren)
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh dry-run
|
||||
sudo /opt/adguard-shield/adguard-shield.sh dry-run
|
||||
|
||||
# Externe Blocklist - Status anzeigen
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh blocklist-status
|
||||
sudo /opt/adguard-shield/adguard-shield.sh blocklist-status
|
||||
|
||||
# Externe Blocklist - Einmalige Synchronisation
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh blocklist-sync
|
||||
sudo /opt/adguard-shield/adguard-shield.sh blocklist-sync
|
||||
|
||||
# Externe Blocklist - Alle Sperren der externen Liste aufheben
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh blocklist-flush
|
||||
sudo /opt/adguard-shield/adguard-shield.sh blocklist-flush
|
||||
```
|
||||
|
||||
## iptables Helper
|
||||
@@ -46,26 +89,26 @@ Für die manuelle Verwaltung der Firewall-Regeln:
|
||||
|
||||
```bash
|
||||
# Chain erstellen
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh create
|
||||
sudo /opt/adguard-shield/iptables-helper.sh create
|
||||
|
||||
# Alle Regeln anzeigen
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh status
|
||||
sudo /opt/adguard-shield/iptables-helper.sh status
|
||||
|
||||
# IP manuell sperren
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh ban 192.168.1.100
|
||||
sudo /opt/adguard-shield/iptables-helper.sh ban 192.168.1.100
|
||||
|
||||
# IP entsperren
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh unban 192.168.1.100
|
||||
sudo /opt/adguard-shield/iptables-helper.sh unban 192.168.1.100
|
||||
|
||||
# Alle Regeln leeren
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh flush
|
||||
sudo /opt/adguard-shield/iptables-helper.sh flush
|
||||
|
||||
# Chain komplett entfernen
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh remove
|
||||
sudo /opt/adguard-shield/iptables-helper.sh remove
|
||||
|
||||
# Regeln speichern / wiederherstellen
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh save
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh restore
|
||||
sudo /opt/adguard-shield/iptables-helper.sh save
|
||||
sudo /opt/adguard-shield/iptables-helper.sh restore
|
||||
```
|
||||
|
||||
## Externer Blocklist-Worker
|
||||
@@ -74,51 +117,55 @@ Der Worker kann auch standalone gesteuert werden:
|
||||
|
||||
```bash
|
||||
# Worker manuell starten (normalerweise automatisch per Hauptscript)
|
||||
sudo /opt/adguard-ratelimit/external-blocklist-worker.sh start
|
||||
sudo /opt/adguard-shield/external-blocklist-worker.sh start
|
||||
|
||||
# Worker stoppen
|
||||
sudo /opt/adguard-ratelimit/external-blocklist-worker.sh stop
|
||||
sudo /opt/adguard-shield/external-blocklist-worker.sh stop
|
||||
|
||||
# Einmalige Synchronisation (z.B. nach Konfigurationsänderung)
|
||||
sudo /opt/adguard-ratelimit/external-blocklist-worker.sh sync
|
||||
sudo /opt/adguard-shield/external-blocklist-worker.sh sync
|
||||
|
||||
# Status anzeigen
|
||||
sudo /opt/adguard-ratelimit/external-blocklist-worker.sh status
|
||||
sudo /opt/adguard-shield/external-blocklist-worker.sh status
|
||||
|
||||
# Alle externen Sperren aufheben
|
||||
sudo /opt/adguard-ratelimit/external-blocklist-worker.sh flush
|
||||
sudo /opt/adguard-shield/external-blocklist-worker.sh flush
|
||||
```
|
||||
|
||||
## systemd Service
|
||||
|
||||
Der Service wird bei der Installation automatisch für den **Autostart beim Booten** aktiviert.
|
||||
|
||||
```bash
|
||||
# Start / Stop / Restart
|
||||
sudo systemctl start adguard-ratelimit
|
||||
sudo systemctl stop adguard-ratelimit
|
||||
sudo systemctl restart adguard-ratelimit
|
||||
sudo systemctl start adguard-shield
|
||||
sudo systemctl stop adguard-shield
|
||||
sudo systemctl restart adguard-shield
|
||||
|
||||
# Status
|
||||
sudo systemctl status adguard-ratelimit
|
||||
sudo systemctl status adguard-shield
|
||||
|
||||
# Autostart aktivieren / deaktivieren
|
||||
sudo systemctl enable adguard-ratelimit
|
||||
sudo systemctl disable adguard-ratelimit
|
||||
sudo systemctl enable adguard-shield
|
||||
sudo systemctl disable adguard-shield
|
||||
```
|
||||
|
||||
> **Hinweis:** Nach einem Update wird der Service automatisch neu gestartet. Ein manueller Neustart ist nicht nötig.
|
||||
|
||||
## Logs
|
||||
|
||||
```bash
|
||||
# systemd Journal
|
||||
sudo journalctl -u adguard-ratelimit -f
|
||||
sudo journalctl -u adguard-shield -f
|
||||
|
||||
# Log-Datei direkt
|
||||
sudo tail -f /var/log/adguard-ratelimit.log
|
||||
sudo tail -f /var/log/adguard-shield.log
|
||||
|
||||
# Nur Sperr-Einträge
|
||||
sudo grep "SPERRE" /var/log/adguard-ratelimit.log
|
||||
sudo grep "SPERRE" /var/log/adguard-shield.log
|
||||
|
||||
# Nur Entsperr-Einträge
|
||||
sudo grep "ENTSPERRE" /var/log/adguard-ratelimit.log
|
||||
sudo grep "ENTSPERRE" /var/log/adguard-shield.log
|
||||
```
|
||||
|
||||
## Cron-basiertes Entsperren
|
||||
@@ -130,5 +177,14 @@ Als Alternative oder Ergänzung zum Haupt-Monitor:
|
||||
sudo crontab -e
|
||||
|
||||
# Alle 5 Minuten abgelaufene Sperren prüfen
|
||||
*/5 * * * * /opt/adguard-ratelimit/unban-expired.sh
|
||||
*/5 * * * * /opt/adguard-shield/unban-expired.sh
|
||||
```
|
||||
|
||||
## Hilfe
|
||||
|
||||
Alle verfügbaren Befehle und Optionen des Installers anzeigen:
|
||||
|
||||
```bash
|
||||
sudo bash install.sh --help
|
||||
sudo bash install.sh -h
|
||||
```
|
||||
|
||||
@@ -4,7 +4,7 @@ Das Tool kann bei Sperren und Entsperrungen Benachrichtigungen an verschiedene D
|
||||
|
||||
## Aktivierung
|
||||
|
||||
In der Konfiguration (`adguard-ratelimit.conf`):
|
||||
In der Konfiguration (`adguard-shield.conf`):
|
||||
|
||||
```bash
|
||||
NOTIFY_ENABLED=true
|
||||
@@ -18,7 +18,7 @@ NOTIFY_WEBHOOK_URL="<url>"
|
||||
NOTIFY_ENABLED=true
|
||||
NOTIFY_TYPE="ntfy"
|
||||
NTFY_SERVER_URL="https://ntfy.sh"
|
||||
NTFY_TOPIC="adguard-ratelimit"
|
||||
NTFY_TOPIC="adguard-shield"
|
||||
NTFY_TOKEN=""
|
||||
NTFY_PRIORITY="4"
|
||||
```
|
||||
@@ -94,7 +94,7 @@ Sendet einen POST mit JSON-Body:
|
||||
|
||||
```json
|
||||
{
|
||||
"message": "🚫 DNS Rate-Limit: Client 192.168.1.50 gesperrt ...",
|
||||
"message": "🚫 AdGuard Shield: Client 192.168.1.50 gesperrt ...",
|
||||
"action": "ban",
|
||||
"client": "192.168.1.50",
|
||||
"domain": "microsoft.com"
|
||||
@@ -104,7 +104,7 @@ Sendet einen POST mit JSON-Body:
|
||||
## Beispiel-Nachrichten
|
||||
|
||||
**Sperre:**
|
||||
> 🚫 DNS Rate-Limit: Client **192.168.1.50** gesperrt (45x microsoft.com in 60s). Sperre für 3600s.
|
||||
> 🚫 AdGuard Shield: Client **192.168.1.50** gesperrt (45x microsoft.com in 60s). Sperre für 3600s.
|
||||
|
||||
**Entsperrung:**
|
||||
> ✅ DNS Rate-Limit: Client **192.168.1.50** wurde entsperrt.
|
||||
> ✅ AdGuard Shield: Client **192.168.1.50** wurde entsperrt.
|
||||
|
||||
@@ -3,9 +3,21 @@
|
||||
Die Konfigurationsdatei liegt nach der Installation unter:
|
||||
|
||||
```
|
||||
/opt/adguard-ratelimit/adguard-ratelimit.conf
|
||||
/opt/adguard-shield/adguard-shield.conf
|
||||
```
|
||||
|
||||
## Automatische Konfigurations-Migration
|
||||
|
||||
Bei einem **Update** (`sudo bash install.sh update`) wird die Konfiguration automatisch migriert:
|
||||
|
||||
1. Die aktuelle Konfiguration wird als **Backup** gespeichert: `adguard-shield.conf.old`
|
||||
2. Neue Parameter (die in der alten Konfig noch nicht existieren) werden **automatisch** zur bestehenden Konfiguration hinzugefügt
|
||||
3. Alle bestehenden Einstellungen bleiben **unverändert** erhalten
|
||||
|
||||
Dadurch muss der Benutzer bei Updates die Konfiguration nicht manuell austauschen oder vergleichen.
|
||||
|
||||
> **Hinweis:** Nach einem Update empfiehlt es sich, die eventuell neu hinzugefügten Parameter zu prüfen und bei Bedarf anzupassen.
|
||||
|
||||
## Alle Parameter
|
||||
|
||||
### AdGuard Home API
|
||||
@@ -30,7 +42,7 @@ Die Konfigurationsdatei liegt nach der Installation unter:
|
||||
| Parameter | Standard | Beschreibung |
|
||||
|-----------|----------|--------------|
|
||||
| `BAN_DURATION` | `3600` | Sperrdauer in Sekunden (3600 = 1 Stunde) |
|
||||
| `IPTABLES_CHAIN` | `ADGUARD_RATELIMIT` | Name der iptables Chain |
|
||||
| `IPTABLES_CHAIN` | `ADGUARD_SHIELD` | Name der iptables Chain |
|
||||
| `BLOCKED_PORTS` | `53 443 853 784 8853` | Ports die gesperrt werden |
|
||||
| `WHITELIST` | `127.0.0.1,::1` | IPs die nie gesperrt werden (kommagetrennt) |
|
||||
|
||||
@@ -38,10 +50,10 @@ Die Konfigurationsdatei liegt nach der Installation unter:
|
||||
|
||||
| Parameter | Standard | Beschreibung |
|
||||
|-----------|----------|--------------|
|
||||
| `LOG_FILE` | `/var/log/adguard-ratelimit.log` | Pfad zur Log-Datei |
|
||||
| `LOG_FILE` | `/var/log/adguard-shield.log` | Pfad zur Log-Datei |
|
||||
| `LOG_LEVEL` | `INFO` | Log-Level: `DEBUG`, `INFO`, `WARN`, `ERROR` |
|
||||
| `LOG_MAX_SIZE_MB` | `50` | Max. Log-Größe bevor rotiert wird |
|
||||
| `BAN_HISTORY_FILE` | `/var/log/adguard-ratelimit-bans.log` | Datei für die Ban-History (alle Sperren/Entsperrungen) |
|
||||
| `BAN_HISTORY_FILE` | `/var/log/adguard-shield-bans.log` | Datei für die Ban-History (alle Sperren/Entsperrungen) |
|
||||
|
||||
### Benachrichtigungen
|
||||
|
||||
@@ -55,8 +67,8 @@ Die Konfigurationsdatei liegt nach der Installation unter:
|
||||
|
||||
| Parameter | Standard | Beschreibung |
|
||||
|-----------|----------|--------------|
|
||||
| `STATE_DIR` | `/var/lib/adguard-ratelimit` | Verzeichnis für State-Dateien |
|
||||
| `PID_FILE` | `/var/run/adguard-ratelimit.pid` | PID-Datei |
|
||||
| `STATE_DIR` | `/var/lib/adguard-shield` | Verzeichnis für State-Dateien |
|
||||
| `PID_FILE` | `/var/run/adguard-shield.pid` | PID-Datei |
|
||||
| `DRY_RUN` | `false` | Testmodus — nur loggen, nicht sperren |
|
||||
### Externe Blocklist
|
||||
|
||||
@@ -69,7 +81,7 @@ Ermöglicht das Einbinden externer IP-Blocklisten (z.B. gehostete Textdateien mi
|
||||
| `EXTERNAL_BLOCKLIST_INTERVAL` | `300` | Prüfintervall in Sekunden (300 = 5 Min.) |
|
||||
| `EXTERNAL_BLOCKLIST_BAN_DURATION` | `0` | Sperrdauer in Sekunden (0 = permanent bis IP aus Liste entfernt) |
|
||||
| `EXTERNAL_BLOCKLIST_AUTO_UNBAN` | `true` | IPs automatisch entsperren wenn aus Liste entfernt |
|
||||
| `EXTERNAL_BLOCKLIST_CACHE_DIR` | `/var/lib/adguard-ratelimit/external-blocklist` | Lokaler Cache für heruntergeladene Listen |
|
||||
| `EXTERNAL_BLOCKLIST_CACHE_DIR` | `/var/lib/adguard-shield/external-blocklist` | Lokaler Cache für heruntergeladene Listen |
|
||||
|
||||
#### Externe Blocklist einrichten
|
||||
|
||||
@@ -99,7 +111,7 @@ EXTERNAL_BLOCKLIST_URLS="https://example.com/list1.txt,https://other.com/list2.t
|
||||
4. Service neustarten:
|
||||
|
||||
```bash
|
||||
sudo systemctl restart adguard-ratelimit
|
||||
sudo systemctl restart adguard-shield
|
||||
```
|
||||
## Gesperrte Ports im Detail
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
|
||||
- **Erst immer im Dry-Run testen**, bevor der scharfe Modus aktiviert wird
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh dry-run
|
||||
sudo /opt/adguard-shield/adguard-shield.sh dry-run
|
||||
```
|
||||
- **Whitelist großzügig pflegen**: Eigene IPs, Router, wichtige Server nicht vergessen
|
||||
- **Sperrdauer anpassen**: Für DDoS-artige Muster ggf. länger sperren
|
||||
@@ -17,7 +17,7 @@
|
||||
### API-Verbindung schlägt fehl
|
||||
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh test
|
||||
sudo /opt/adguard-shield/adguard-shield.sh test
|
||||
```
|
||||
|
||||
**Mögliche Ursachen:**
|
||||
@@ -36,23 +36,23 @@ curl -s -u admin:passwort http://127.0.0.1:3000/control/querylog?limit=1
|
||||
Das Script muss als **root** laufen, da iptables Root-Rechte benötigt.
|
||||
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh start
|
||||
sudo /opt/adguard-shield/adguard-shield.sh start
|
||||
```
|
||||
|
||||
### Client wird fälschlich gesperrt
|
||||
|
||||
1. Client sofort entsperren:
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh unban 192.168.1.100
|
||||
sudo /opt/adguard-shield/adguard-shield.sh unban 192.168.1.100
|
||||
```
|
||||
2. In der Ban-History prüfen, warum gesperrt wurde:
|
||||
```bash
|
||||
sudo /opt/adguard-ratelimit/adguard-ratelimit.sh history | grep 192.168.1.100
|
||||
sudo /opt/adguard-shield/adguard-shield.sh history | grep 192.168.1.100
|
||||
```
|
||||
3. IP zur Whitelist hinzufügen in `adguard-ratelimit.conf`
|
||||
3. IP zur Whitelist hinzufügen in `adguard-shield.conf`
|
||||
3. Service neustarten:
|
||||
```bash
|
||||
sudo systemctl restart adguard-ratelimit
|
||||
sudo systemctl restart adguard-shield
|
||||
```
|
||||
|
||||
### Sperren überleben Reboot nicht
|
||||
@@ -73,22 +73,55 @@ Das ist normal — iptables-Regeln sind flüchtig. Der **Service** erstellt die
|
||||
|
||||
```bash
|
||||
# Altes PID-File entfernen
|
||||
sudo rm -f /var/run/adguard-ratelimit.pid
|
||||
sudo systemctl start adguard-ratelimit
|
||||
sudo rm -f /var/run/adguard-shield.pid
|
||||
sudo systemctl start adguard-shield
|
||||
```
|
||||
|
||||
## Update durchführen
|
||||
|
||||
```bash
|
||||
# Repository aktualisieren
|
||||
cd /tmp/adguard-shield
|
||||
git pull
|
||||
|
||||
# Update ausführen (Konfig wird automatisch migriert, Service neu gestartet)
|
||||
sudo bash install.sh update
|
||||
```
|
||||
|
||||
**Was passiert beim Update:**
|
||||
- Alle Scripts werden aktualisiert
|
||||
- Konfiguration wird als `adguard-shield.conf.old` gesichert
|
||||
- Neue Konfigurationsparameter werden automatisch zur bestehenden Konfig ergänzt
|
||||
- Bestehende Einstellungen bleiben erhalten
|
||||
- Service wird per `daemon-reload` neu geladen und automatisch neu gestartet
|
||||
|
||||
## Deinstallation
|
||||
|
||||
```bash
|
||||
# Über den Installer (interaktiv mit Menü)
|
||||
sudo bash install.sh uninstall
|
||||
```
|
||||
|
||||
Oder manuell:
|
||||
```bash
|
||||
sudo systemctl stop adguard-ratelimit
|
||||
sudo systemctl disable adguard-ratelimit
|
||||
sudo /opt/adguard-ratelimit/iptables-helper.sh remove
|
||||
sudo rm -rf /opt/adguard-ratelimit
|
||||
sudo rm -f /etc/systemd/system/adguard-ratelimit.service
|
||||
sudo systemctl stop adguard-shield
|
||||
sudo systemctl disable adguard-shield
|
||||
sudo /opt/adguard-shield/iptables-helper.sh remove
|
||||
sudo rm -rf /opt/adguard-shield
|
||||
sudo rm -f /etc/systemd/system/adguard-shield.service
|
||||
sudo systemctl daemon-reload
|
||||
```
|
||||
|
||||
## Voraussetzungen
|
||||
|
||||
Folgende Pakete werden für den Betrieb benötigt und bei der Installation automatisch installiert:
|
||||
|
||||
| Paket | Zweck |
|
||||
|-------|-------|
|
||||
| `curl` | API-Kommunikation mit AdGuard Home |
|
||||
| `jq` | JSON-Verarbeitung der API-Antworten |
|
||||
| `iptables` | Firewall-Regeln (IPv4 + IPv6) |
|
||||
| `gawk` | Textverarbeitung in Scripts |
|
||||
| `systemd` | Service-Management und Autostart |
|
||||
|
||||
Diese werden bei `sudo bash install.sh install` automatisch geprüft und bei Bedarf über den Paketmanager (`apt`, `dnf`, `yum`, `pacman`) nachinstalliert.
|
||||
|
||||
@@ -13,14 +13,14 @@
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-ratelimit.conf"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-shield.conf"
|
||||
|
||||
# ─── Konfiguration laden ───────────────────────────────────────────────────────
|
||||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||
echo "FEHLER: Konfigurationsdatei nicht gefunden: $CONFIG_FILE" >&2
|
||||
exit 1
|
||||
fi
|
||||
# shellcheck source=adguard-ratelimit.conf
|
||||
# shellcheck source=adguard-shield.conf
|
||||
source "$CONFIG_FILE"
|
||||
|
||||
# ─── Worker PID-File ──────────────────────────────────────────────────────────
|
||||
|
||||
608
install.sh
608
install.sh
@@ -1,17 +1,17 @@
|
||||
#!/bin/bash
|
||||
###############################################################################
|
||||
# AdGuard Shield - Installer
|
||||
# AdGuard Shield - Installer / Updater / Uninstaller
|
||||
# Autor: Patrick Asmus
|
||||
# E-Mail: support@techniverse.net
|
||||
# Lizenz: MIT
|
||||
###############################################################################
|
||||
|
||||
VERSION="1.0.0"
|
||||
VERSION="0.3.0"
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
INSTALL_DIR="/opt/adguard-ratelimit"
|
||||
SERVICE_FILE="/etc/systemd/system/adguard-ratelimit.service"
|
||||
INSTALL_DIR="/opt/adguard-shield"
|
||||
SERVICE_FILE="/etc/systemd/system/adguard-shield.service"
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
# Farben
|
||||
@@ -19,6 +19,8 @@ RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
CYAN='\033[0;36m'
|
||||
BOLD='\033[1m'
|
||||
NC='\033[0m'
|
||||
|
||||
print_header() {
|
||||
@@ -43,6 +45,101 @@ print_header() {
|
||||
echo ""
|
||||
}
|
||||
|
||||
# ─── Hilfe-Menü ──────────────────────────────────────────────────────────────
|
||||
print_help() {
|
||||
echo -e "${BOLD}Nutzung:${NC} sudo bash $0 [BEFEHL]"
|
||||
echo ""
|
||||
echo -e "${BOLD}Verfügbare Befehle:${NC}"
|
||||
echo ""
|
||||
echo -e " ${GREEN}install${NC} Vollständige Neuinstallation durchführen"
|
||||
echo -e " Installiert alle Dateien, fragt die Konfiguration ab,"
|
||||
echo -e " richtet den systemd Service ein und aktiviert Autostart."
|
||||
echo ""
|
||||
echo -e " ${GREEN}update${NC} Update auf die neueste Version"
|
||||
echo -e " Aktualisiert alle Scripts, führt eine automatische"
|
||||
echo -e " Konfigurations-Migration durch (neue Parameter werden"
|
||||
echo -e " hinzugefügt, bestehende Einstellungen bleiben erhalten),"
|
||||
echo -e " und startet den Service automatisch neu."
|
||||
echo ""
|
||||
echo -e " ${GREEN}uninstall${NC} Vollständige Deinstallation"
|
||||
echo -e " Stoppt den Service, entfernt iptables-Regeln und"
|
||||
echo -e " löscht alle Dateien (optional Konfiguration behalten)."
|
||||
echo ""
|
||||
echo -e " ${GREEN}status${NC} Installationsstatus anzeigen"
|
||||
echo -e " Zeigt ob AdGuard Shield installiert ist, welche Version"
|
||||
echo -e " läuft und ob der Service aktiv ist."
|
||||
echo ""
|
||||
echo -e " ${GREEN}--help, -h${NC} Diese Hilfe anzeigen"
|
||||
echo ""
|
||||
echo -e "${BOLD}Beispiele:${NC}"
|
||||
echo -e " ${CYAN}sudo bash install.sh install${NC} # Neuinstallation"
|
||||
echo -e " ${CYAN}sudo bash install.sh update${NC} # Update durchführen"
|
||||
echo -e " ${CYAN}sudo bash install.sh uninstall${NC} # Deinstallation"
|
||||
echo -e " ${CYAN}sudo bash install.sh status${NC} # Status prüfen"
|
||||
echo ""
|
||||
echo -e "${BOLD}Monitor-Befehle (nach Installation):${NC}"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh start${NC} # Monitor starten"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh stop${NC} # Monitor stoppen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh status${NC} # Status & aktive Sperren"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh history${NC} # Ban-History anzeigen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh unban IP${NC} # Einzelne IP entsperren"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh flush${NC} # Alle Sperren aufheben"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh test${NC} # API-Verbindung testen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/adguard-shield.sh dry-run${NC} # Testmodus (nur loggen)"
|
||||
echo ""
|
||||
echo -e "${BOLD}iptables-Befehle:${NC}"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh status${NC} # Firewall-Regeln anzeigen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh ban IP${NC} # IP manuell sperren"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh unban IP${NC} # IP entsperren"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh flush${NC} # Alle Regeln leeren"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh create${NC} # Chain erstellen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh remove${NC} # Chain komplett entfernen"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh save${NC} # Regeln speichern"
|
||||
echo -e " ${CYAN}sudo /opt/adguard-shield/iptables-helper.sh restore${NC} # Regeln wiederherstellen"
|
||||
echo ""
|
||||
echo -e "${BOLD}Service-Befehle:${NC}"
|
||||
echo -e " ${CYAN}sudo systemctl start adguard-shield${NC} # Service starten"
|
||||
echo -e " ${CYAN}sudo systemctl stop adguard-shield${NC} # Service stoppen"
|
||||
echo -e " ${CYAN}sudo systemctl restart adguard-shield${NC} # Service neustarten"
|
||||
echo -e " ${CYAN}sudo systemctl status adguard-shield${NC} # Service-Status"
|
||||
echo -e " ${CYAN}sudo journalctl -u adguard-shield -f${NC} # Logs live verfolgen"
|
||||
echo ""
|
||||
echo -e "${BOLD}Voraussetzungen:${NC}"
|
||||
echo " - Linux Server (Debian/Ubuntu empfohlen)"
|
||||
echo " - Root-Zugriff (sudo)"
|
||||
echo " - AdGuard Home installiert und erreichbar"
|
||||
echo " - Pakete: curl, jq, iptables, gawk (werden bei Installation automatisch installiert)"
|
||||
echo ""
|
||||
echo -e "${BOLD}Dokumentation:${NC}"
|
||||
echo " https://git.techniverse.net/scriptos/adguard-shield"
|
||||
echo ""
|
||||
}
|
||||
|
||||
# ─── Interaktives Menü ───────────────────────────────────────────────────────
|
||||
show_menu() {
|
||||
echo -e "${BOLD}Was möchtest du tun?${NC}"
|
||||
echo ""
|
||||
echo -e " ${CYAN}1)${NC} Installation — AdGuard Shield neu installieren"
|
||||
echo -e " ${CYAN}2)${NC} Update — Auf die neueste Version aktualisieren"
|
||||
echo -e " ${CYAN}3)${NC} Deinstallation — AdGuard Shield vollständig entfernen"
|
||||
echo -e " ${CYAN}4)${NC} Status — Installationsstatus anzeigen"
|
||||
echo -e " ${CYAN}5)${NC} Hilfe — Hilfe & Befehlsübersicht anzeigen"
|
||||
echo -e " ${CYAN}0)${NC} Beenden"
|
||||
echo ""
|
||||
read -rp " Auswahl [0-5]: " choice
|
||||
echo ""
|
||||
|
||||
case "$choice" in
|
||||
1) do_install ;;
|
||||
2) do_update ;;
|
||||
3) do_uninstall ;;
|
||||
4) do_status ;;
|
||||
5) print_help ;;
|
||||
0) echo -e "${GREEN}Auf Wiedersehen!${NC}"; exit 0 ;;
|
||||
*) echo -e "${RED}Ungültige Auswahl.${NC}"; exit 1 ;;
|
||||
esac
|
||||
}
|
||||
|
||||
check_root() {
|
||||
if [[ $EUID -ne 0 ]]; then
|
||||
echo -e "${RED}Dieses Script muss als root ausgeführt werden!${NC}" >&2
|
||||
@@ -51,37 +148,68 @@ check_root() {
|
||||
fi
|
||||
}
|
||||
|
||||
# ─── Abhängigkeiten prüfen und installieren ──────────────────────────────────
|
||||
check_dependencies() {
|
||||
echo -e "${YELLOW}Prüfe Abhängigkeiten...${NC}"
|
||||
local missing=()
|
||||
local missing_cmds=()
|
||||
local missing_pkgs=()
|
||||
|
||||
for cmd in curl jq iptables ip6tables; do
|
||||
# Befehl → Paketname Zuordnung
|
||||
declare -A cmd_to_pkg=(
|
||||
[curl]="curl"
|
||||
[jq]="jq"
|
||||
[iptables]="iptables"
|
||||
[ip6tables]="iptables"
|
||||
[gawk]="gawk"
|
||||
[systemctl]="systemd"
|
||||
)
|
||||
|
||||
for cmd in curl jq iptables ip6tables gawk systemctl; do
|
||||
if command -v "$cmd" &>/dev/null; then
|
||||
echo -e " ✅ $cmd"
|
||||
else
|
||||
echo -e " ❌ $cmd"
|
||||
missing+=("$cmd")
|
||||
missing_cmds+=("$cmd")
|
||||
local pkg="${cmd_to_pkg[$cmd]}"
|
||||
# Duplikate vermeiden
|
||||
if [[ ! " ${missing_pkgs[*]:-} " =~ " ${pkg} " ]]; then
|
||||
missing_pkgs+=("$pkg")
|
||||
fi
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ ${#missing[@]} -gt 0 ]]; then
|
||||
if [[ ${#missing_cmds[@]} -gt 0 ]]; then
|
||||
echo ""
|
||||
echo -e "${YELLOW}Installiere fehlende Pakete...${NC}"
|
||||
echo -e "${YELLOW}Installiere fehlende Pakete: ${missing_pkgs[*]}${NC}"
|
||||
|
||||
if command -v apt &>/dev/null; then
|
||||
apt update -qq
|
||||
apt install -y -qq curl jq iptables
|
||||
apt install -y -qq "${missing_pkgs[@]}"
|
||||
elif command -v dnf &>/dev/null; then
|
||||
dnf install -y curl jq iptables
|
||||
dnf install -y "${missing_pkgs[@]}"
|
||||
elif command -v yum &>/dev/null; then
|
||||
yum install -y curl jq iptables
|
||||
yum install -y "${missing_pkgs[@]}"
|
||||
elif command -v pacman &>/dev/null; then
|
||||
pacman -S --noconfirm curl jq iptables
|
||||
pacman -S --noconfirm "${missing_pkgs[@]}"
|
||||
else
|
||||
echo -e "${RED}Konnte Paketmanager nicht erkennen. Bitte installiere manuell: ${missing[*]}${NC}"
|
||||
echo -e "${RED}Konnte Paketmanager nicht erkennen. Bitte installiere manuell: ${missing_pkgs[*]}${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}Prüfe erneut...${NC}"
|
||||
for cmd in "${missing_cmds[@]}"; do
|
||||
if command -v "$cmd" &>/dev/null; then
|
||||
echo -e " ✅ $cmd (installiert)"
|
||||
else
|
||||
echo -e " ❌ $cmd (Installation fehlgeschlagen!)"
|
||||
echo -e "${RED}FEHLER: $cmd konnte nicht installiert werden. Bitte manuell nachinstallieren.${NC}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo -e " ${GREEN}Alle Abhängigkeiten erfüllt.${NC}"
|
||||
echo ""
|
||||
}
|
||||
|
||||
@@ -89,43 +217,128 @@ install_files() {
|
||||
echo -e "${YELLOW}Installiere Dateien nach $INSTALL_DIR ...${NC}"
|
||||
|
||||
mkdir -p "$INSTALL_DIR"
|
||||
mkdir -p /var/lib/adguard-ratelimit
|
||||
mkdir -p /var/lib/adguard-shield
|
||||
mkdir -p /var/log
|
||||
|
||||
# Dateien kopieren
|
||||
cp "$SCRIPT_DIR/adguard-ratelimit.sh" "$INSTALL_DIR/"
|
||||
# Scripts kopieren
|
||||
cp "$SCRIPT_DIR/adguard-shield.sh" "$INSTALL_DIR/"
|
||||
cp "$SCRIPT_DIR/iptables-helper.sh" "$INSTALL_DIR/"
|
||||
cp "$SCRIPT_DIR/unban-expired.sh" "$INSTALL_DIR/"
|
||||
cp "$SCRIPT_DIR/external-blocklist-worker.sh" "$INSTALL_DIR/"
|
||||
|
||||
# Konfigurationsdatei nur kopieren wenn nicht vorhanden (Update-Sicher)
|
||||
if [[ ! -f "$INSTALL_DIR/adguard-ratelimit.conf" ]]; then
|
||||
cp "$SCRIPT_DIR/adguard-ratelimit.conf" "$INSTALL_DIR/"
|
||||
echo -e " ✅ Konfiguration kopiert (NEU)"
|
||||
else
|
||||
cp "$SCRIPT_DIR/adguard-ratelimit.conf" "$INSTALL_DIR/adguard-ratelimit.conf.new"
|
||||
echo -e " ℹ️ Konfiguration existiert bereits - neue Version als .conf.new gespeichert"
|
||||
fi
|
||||
|
||||
# Ausführbar machen
|
||||
chmod +x "$INSTALL_DIR/adguard-ratelimit.sh"
|
||||
chmod +x "$INSTALL_DIR/adguard-shield.sh"
|
||||
chmod +x "$INSTALL_DIR/iptables-helper.sh"
|
||||
chmod +x "$INSTALL_DIR/unban-expired.sh"
|
||||
chmod +x "$INSTALL_DIR/external-blocklist-worker.sh"
|
||||
chmod 600 "$INSTALL_DIR/adguard-ratelimit.conf"
|
||||
|
||||
echo -e " ✅ Dateien installiert"
|
||||
echo ""
|
||||
}
|
||||
|
||||
# ─── Konfigurations-Migration ────────────────────────────────────────────────
|
||||
# Vergleicht die bestehende Konfiguration mit der neuen Version.
|
||||
# - Bestehende Einstellungen des Benutzers bleiben IMMER erhalten
|
||||
# - Neue Parameter (die in der alten Konfig fehlen) werden automatisch ergänzt
|
||||
# - Die alte Konfiguration wird als .conf.old gesichert
|
||||
migrate_config() {
|
||||
local existing_conf="$INSTALL_DIR/adguard-shield.conf"
|
||||
local new_conf="$SCRIPT_DIR/adguard-shield.conf"
|
||||
local backup_conf="$INSTALL_DIR/adguard-shield.conf.old"
|
||||
|
||||
if [[ ! -f "$existing_conf" ]]; then
|
||||
# Keine bestehende Konfig → einfach kopieren
|
||||
cp "$new_conf" "$existing_conf"
|
||||
chmod 600 "$existing_conf"
|
||||
echo -e " ✅ Konfiguration kopiert (Neuinstallation)"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo -e "${YELLOW}Führe Konfigurations-Migration durch...${NC}"
|
||||
|
||||
# Backup der aktuellen Konfiguration erstellen
|
||||
cp "$existing_conf" "$backup_conf"
|
||||
echo -e " 📦 Backup erstellt: adguard-shield.conf.old"
|
||||
|
||||
# Alle Schlüssel aus der bestehenden Konfig extrahieren (nur KEY=... Zeilen)
|
||||
local existing_keys=()
|
||||
while IFS= read -r line; do
|
||||
# Zeilen mit KEY=VALUE extrahieren (keine Kommentare, keine leeren Zeilen)
|
||||
if [[ "$line" =~ ^[A-Z_][A-Z0-9_]*= ]]; then
|
||||
local key="${line%%=*}"
|
||||
existing_keys+=("$key")
|
||||
fi
|
||||
done < "$existing_conf"
|
||||
|
||||
# Neue Schlüssel finden die in der bestehenden Konfig fehlen
|
||||
local new_keys_added=0
|
||||
local current_comment_block=""
|
||||
|
||||
while IFS= read -r line; do
|
||||
# Kommentarblock sammeln (für Kontext bei neuen Keys)
|
||||
if [[ "$line" =~ ^#.* ]] || [[ -z "$line" ]]; then
|
||||
current_comment_block+="$line"$'\n'
|
||||
continue
|
||||
fi
|
||||
|
||||
# KEY=VALUE Zeile prüfen
|
||||
if [[ "$line" =~ ^[A-Z_][A-Z0-9_]*= ]]; then
|
||||
local key="${line%%=*}"
|
||||
local found=false
|
||||
for existing_key in "${existing_keys[@]}"; do
|
||||
if [[ "$key" == "$existing_key" ]]; then
|
||||
found=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ "$found" == "false" ]]; then
|
||||
# Neuer Parameter gefunden → mit Kommentarblock an bestehende Konfig anhängen
|
||||
if [[ $new_keys_added -eq 0 ]]; then
|
||||
echo "" >> "$existing_conf"
|
||||
echo "# ─── Neue Parameter (automatisch bei Update hinzugefügt) ───" >> "$existing_conf"
|
||||
fi
|
||||
echo -n "$current_comment_block" >> "$existing_conf"
|
||||
echo "$line" >> "$existing_conf"
|
||||
echo -e " ➕ Neuer Parameter hinzugefügt: ${GREEN}$key${NC}"
|
||||
((new_keys_added++))
|
||||
fi
|
||||
fi
|
||||
|
||||
current_comment_block=""
|
||||
done < "$new_conf"
|
||||
|
||||
chmod 600 "$existing_conf"
|
||||
|
||||
if [[ $new_keys_added -eq 0 ]]; then
|
||||
echo -e " ✅ Konfiguration ist aktuell — keine neuen Parameter"
|
||||
else
|
||||
echo -e " ✅ ${new_keys_added} neue Parameter zur Konfiguration hinzugefügt"
|
||||
echo -e " ${YELLOW}ℹ️ Backup der alten Konfig: $backup_conf${NC}"
|
||||
echo -e " ${YELLOW}ℹ️ Bitte prüfe die neuen Parameter in: $existing_conf${NC}"
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
install_service() {
|
||||
echo -e "${YELLOW}Installiere systemd Service...${NC}"
|
||||
|
||||
cp "$SCRIPT_DIR/adguard-ratelimit.service" "$SERVICE_FILE"
|
||||
cp "$SCRIPT_DIR/adguard-shield.service" "$SERVICE_FILE"
|
||||
systemctl daemon-reload
|
||||
systemctl enable adguard-ratelimit.service
|
||||
|
||||
echo -e " ✅ Service installiert und aktiviert"
|
||||
echo -e " ✅ Service-Datei installiert"
|
||||
echo ""
|
||||
|
||||
# Interaktiv: Autostart beim Booten?
|
||||
read -rp " Soll AdGuard Shield beim Booten automatisch starten? [J/n]: " autostart
|
||||
if [[ "${autostart,,}" != "n" ]]; then
|
||||
systemctl enable adguard-shield.service
|
||||
echo -e " ✅ Autostart aktiviert"
|
||||
else
|
||||
systemctl disable adguard-shield.service 2>/dev/null || true
|
||||
echo -e " ℹ️ Autostart nicht aktiviert"
|
||||
echo -e " ${YELLOW}Später aktivieren mit: sudo systemctl enable adguard-shield${NC}"
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
@@ -133,7 +346,7 @@ configure() {
|
||||
echo -e "${YELLOW}Konfiguration:${NC}"
|
||||
echo ""
|
||||
|
||||
local conf="$INSTALL_DIR/adguard-ratelimit.conf"
|
||||
local conf="$INSTALL_DIR/adguard-shield.conf"
|
||||
|
||||
# AdGuard URL
|
||||
read -rp " AdGuard Home URL [http://127.0.0.1:3000]: " adguard_url
|
||||
@@ -176,7 +389,7 @@ configure() {
|
||||
test_connection() {
|
||||
echo -e "${YELLOW}Teste Verbindung zur AdGuard Home API...${NC}"
|
||||
|
||||
source "$INSTALL_DIR/adguard-ratelimit.conf"
|
||||
source "$INSTALL_DIR/adguard-shield.conf"
|
||||
|
||||
local response
|
||||
response=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||
@@ -188,59 +401,260 @@ test_connection() {
|
||||
echo -e " ✅ Verbindung erfolgreich! (HTTP $response)"
|
||||
else
|
||||
echo -e " ❌ Verbindung fehlgeschlagen (HTTP $response)"
|
||||
echo -e " ${YELLOW}Bitte prüfe URL und Zugangsdaten in: $INSTALL_DIR/adguard-ratelimit.conf${NC}"
|
||||
echo -e " ${YELLOW}Bitte prüfe URL und Zugangsdaten in: $INSTALL_DIR/adguard-shield.conf${NC}"
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
print_summary() {
|
||||
# Service-Status dynamisch ermitteln
|
||||
local svc_status="gestoppt"
|
||||
local autostart_status="deaktiviert"
|
||||
if systemctl is-active adguard-shield &>/dev/null 2>&1; then
|
||||
svc_status="läuft ✅"
|
||||
fi
|
||||
if systemctl is-enabled adguard-shield &>/dev/null 2>&1; then
|
||||
autostart_status="aktiviert ✅"
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "${GREEN} AdGuard Shield - Installation abgeschlossen!${NC}"
|
||||
echo -e "${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
echo " Installationspfad: $INSTALL_DIR"
|
||||
echo " Konfiguration: $INSTALL_DIR/adguard-ratelimit.conf"
|
||||
echo " Service: adguard-ratelimit.service"
|
||||
echo " Log-Datei: /var/log/adguard-ratelimit.log"
|
||||
echo " Konfiguration: $INSTALL_DIR/adguard-shield.conf"
|
||||
echo " Service: adguard-shield.service ($svc_status)"
|
||||
echo " Autostart: $autostart_status"
|
||||
echo " Log-Datei: /var/log/adguard-shield.log"
|
||||
echo ""
|
||||
echo " Nächste Schritte:"
|
||||
echo " ─────────────────"
|
||||
echo " 1. Konfiguration prüfen:"
|
||||
echo " sudo nano $INSTALL_DIR/adguard-ratelimit.conf"
|
||||
echo " Nützliche Befehle:"
|
||||
echo " ──────────────────"
|
||||
echo " Konfiguration bearbeiten:"
|
||||
echo " sudo nano $INSTALL_DIR/adguard-shield.conf"
|
||||
echo ""
|
||||
echo " 2. Erst im Dry-Run testen:"
|
||||
echo " sudo $INSTALL_DIR/adguard-ratelimit.sh dry-run"
|
||||
echo " Dry-Run testen (nur loggen, nichts sperren):"
|
||||
echo " sudo $INSTALL_DIR/adguard-shield.sh dry-run"
|
||||
echo ""
|
||||
echo " 3. Service starten:"
|
||||
echo " sudo systemctl start adguard-ratelimit"
|
||||
echo " Service steuern:"
|
||||
echo " sudo systemctl start|stop|restart adguard-shield"
|
||||
echo " sudo systemctl status adguard-shield"
|
||||
echo ""
|
||||
echo " 4. Status prüfen:"
|
||||
echo " sudo systemctl status adguard-ratelimit"
|
||||
echo " sudo $INSTALL_DIR/adguard-ratelimit.sh status"
|
||||
echo ""
|
||||
echo " 5. Logs verfolgen:"
|
||||
echo " sudo journalctl -u adguard-ratelimit -f"
|
||||
echo " sudo tail -f /var/log/adguard-ratelimit.log"
|
||||
echo " Logs verfolgen:"
|
||||
echo " sudo journalctl -u adguard-shield -f"
|
||||
echo " sudo tail -f /var/log/adguard-shield.log"
|
||||
echo ""
|
||||
echo " Weitere Befehle:"
|
||||
echo " sudo $INSTALL_DIR/iptables-helper.sh status"
|
||||
echo " sudo $INSTALL_DIR/adguard-ratelimit.sh flush"
|
||||
echo " sudo $INSTALL_DIR/adguard-ratelimit.sh unban <IP>"
|
||||
echo " sudo $INSTALL_DIR/adguard-shield.sh flush"
|
||||
echo " sudo $INSTALL_DIR/adguard-shield.sh unban <IP>"
|
||||
echo ""
|
||||
echo " Hilfe anzeigen:"
|
||||
echo " sudo bash install.sh --help"
|
||||
echo ""
|
||||
}
|
||||
|
||||
# ─── Status anzeigen ─────────────────────────────────────────────────────────
|
||||
do_status() {
|
||||
check_root
|
||||
|
||||
echo -e "${YELLOW}Installationsstatus:${NC}"
|
||||
echo ""
|
||||
|
||||
# Installiert?
|
||||
if [[ -d "$INSTALL_DIR" ]]; then
|
||||
echo -e " ✅ AdGuard Shield ist installiert in: $INSTALL_DIR"
|
||||
|
||||
# Version aus installiertem Script lesen
|
||||
if [[ -f "$INSTALL_DIR/adguard-shield.sh" ]]; then
|
||||
local installed_version
|
||||
installed_version=$(grep -m1 '^VERSION=' "$INSTALL_DIR/adguard-shield.sh" 2>/dev/null | cut -d'"' -f2)
|
||||
echo -e " 📌 Installierte Version: ${GREEN}${installed_version:-unbekannt}${NC}"
|
||||
fi
|
||||
else
|
||||
echo -e " ❌ AdGuard Shield ist NICHT installiert"
|
||||
echo ""
|
||||
return
|
||||
fi
|
||||
|
||||
# Service-Status
|
||||
if systemctl is-enabled adguard-shield &>/dev/null 2>&1; then
|
||||
echo -e " ✅ Autostart: aktiviert"
|
||||
else
|
||||
echo -e " ❌ Autostart: deaktiviert"
|
||||
fi
|
||||
|
||||
if systemctl is-active adguard-shield &>/dev/null 2>&1; then
|
||||
echo -e " ✅ Service: läuft"
|
||||
else
|
||||
echo -e " ❌ Service: gestoppt"
|
||||
fi
|
||||
|
||||
# Konfig vorhanden?
|
||||
if [[ -f "$INSTALL_DIR/adguard-shield.conf" ]]; then
|
||||
echo -e " ✅ Konfiguration: vorhanden"
|
||||
else
|
||||
echo -e " ❌ Konfiguration: fehlt!"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
}
|
||||
|
||||
# ─── Installation ────────────────────────────────────────────────────────────
|
||||
do_install() {
|
||||
check_root
|
||||
|
||||
# Prüfen ob bereits installiert
|
||||
if [[ -d "$INSTALL_DIR" ]] && [[ -f "$INSTALL_DIR/adguard-shield.sh" ]]; then
|
||||
echo -e "${YELLOW}AdGuard Shield ist bereits installiert!${NC}"
|
||||
echo ""
|
||||
read -rp " Möchtest du stattdessen ein Update durchführen? [j/N]: " do_upd
|
||||
if [[ "${do_upd,,}" == "j" ]]; then
|
||||
do_update
|
||||
return
|
||||
else
|
||||
echo -e "${RED}Installation abgebrochen.${NC}"
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
check_dependencies
|
||||
install_files
|
||||
|
||||
# Bei Neuinstallation Konfig kopieren
|
||||
cp "$SCRIPT_DIR/adguard-shield.conf" "$INSTALL_DIR/"
|
||||
chmod 600 "$INSTALL_DIR/adguard-shield.conf"
|
||||
echo -e " ✅ Konfiguration kopiert"
|
||||
echo ""
|
||||
|
||||
configure
|
||||
install_service
|
||||
test_connection
|
||||
|
||||
# Interaktiv: Service jetzt starten?
|
||||
echo -e "${YELLOW}Service starten:${NC}"
|
||||
read -rp " Soll der AdGuard Shield Service jetzt gestartet werden? [J/n]: " start_now
|
||||
if [[ "${start_now,,}" != "n" ]]; then
|
||||
systemctl start adguard-shield
|
||||
echo -e " ✅ Service gestartet"
|
||||
else
|
||||
echo -e " ℹ️ Service nicht gestartet"
|
||||
echo -e " ${YELLOW}Später starten mit: sudo systemctl start adguard-shield${NC}"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
print_summary
|
||||
}
|
||||
|
||||
# ─── Update ──────────────────────────────────────────────────────────────────
|
||||
do_update() {
|
||||
check_root
|
||||
|
||||
# Prüfen ob installiert
|
||||
if [[ ! -d "$INSTALL_DIR" ]] || [[ ! -f "$INSTALL_DIR/adguard-shield.sh" ]]; then
|
||||
echo -e "${RED}AdGuard Shield ist nicht installiert!${NC}"
|
||||
echo "Bitte zuerst installieren: sudo bash $0 install"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${YELLOW}Starte Update von AdGuard Shield...${NC}"
|
||||
echo ""
|
||||
|
||||
check_dependencies
|
||||
install_files
|
||||
|
||||
# Konfigurations-Migration durchführen
|
||||
migrate_config
|
||||
|
||||
# Service-Datei aktualisieren
|
||||
echo -e "${YELLOW}Aktualisiere systemd Service...${NC}"
|
||||
cp "$SCRIPT_DIR/adguard-shield.service" "$SERVICE_FILE"
|
||||
systemctl daemon-reload
|
||||
echo -e " ✅ Service-Datei aktualisiert"
|
||||
echo ""
|
||||
|
||||
# Interaktiv: Autostart beim Booten?
|
||||
if systemctl is-enabled adguard-shield &>/dev/null; then
|
||||
echo -e " ℹ️ Autostart ist bereits aktiviert"
|
||||
else
|
||||
read -rp " Soll AdGuard Shield beim Booten automatisch starten? [J/n]: " autostart
|
||||
if [[ "${autostart,,}" != "n" ]]; then
|
||||
systemctl enable adguard-shield.service
|
||||
echo -e " ✅ Autostart aktiviert"
|
||||
else
|
||||
echo -e " ℹ️ Autostart bleibt deaktiviert"
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Interaktiv: Service neu starten?
|
||||
local service_was_active=false
|
||||
if systemctl is-active adguard-shield &>/dev/null; then
|
||||
service_was_active=true
|
||||
fi
|
||||
|
||||
if [[ "$service_was_active" == "true" ]]; then
|
||||
read -rp " Soll der Service jetzt neu gestartet werden? [J/n]: " restart_now
|
||||
if [[ "${restart_now,,}" != "n" ]]; then
|
||||
systemctl restart adguard-shield
|
||||
echo -e " ✅ Service wurde neu gestartet"
|
||||
else
|
||||
echo -e " ℹ️ Service wurde NICHT neu gestartet"
|
||||
echo -e " ${YELLOW}Bitte manuell neustarten: sudo systemctl restart adguard-shield${NC}"
|
||||
fi
|
||||
else
|
||||
read -rp " Soll der Service jetzt gestartet werden? [J/n]: " start_now
|
||||
if [[ "${start_now,,}" != "n" ]]; then
|
||||
systemctl start adguard-shield
|
||||
echo -e " ✅ Service gestartet"
|
||||
else
|
||||
echo -e " ℹ️ Service nicht gestartet"
|
||||
echo -e " ${YELLOW}Später starten mit: sudo systemctl start adguard-shield${NC}"
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo -e "${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo -e "${GREEN} AdGuard Shield - Update abgeschlossen!${NC}"
|
||||
echo -e "${GREEN}═══════════════════════════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
echo " Bitte prüfe bei Bedarf die Konfiguration:"
|
||||
echo " sudo nano $INSTALL_DIR/adguard-shield.conf"
|
||||
echo ""
|
||||
if [[ -f "$INSTALL_DIR/adguard-shield.conf.old" ]]; then
|
||||
echo " Backup der vorherigen Konfiguration:"
|
||||
echo " $INSTALL_DIR/adguard-shield.conf.old"
|
||||
echo ""
|
||||
fi
|
||||
}
|
||||
|
||||
# ─── Deinstallation ─────────────────────────────────────────────────────────
|
||||
uninstall() {
|
||||
do_uninstall() {
|
||||
check_root
|
||||
|
||||
# Prüfen ob installiert
|
||||
if [[ ! -d "$INSTALL_DIR" ]]; then
|
||||
echo -e "${RED}AdGuard Shield ist nicht installiert!${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${YELLOW}Deinstalliere AdGuard Shield...${NC}"
|
||||
echo ""
|
||||
|
||||
# Sicherheitsabfrage
|
||||
read -rp " Wirklich deinstallieren? [j/N]: " confirm
|
||||
if [[ "${confirm,,}" != "j" ]]; then
|
||||
echo -e "${GREEN}Deinstallation abgebrochen.${NC}"
|
||||
exit 0
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# Service stoppen und deaktivieren
|
||||
if systemctl is-active adguard-ratelimit &>/dev/null; then
|
||||
systemctl stop adguard-ratelimit
|
||||
if systemctl is-active adguard-shield &>/dev/null; then
|
||||
systemctl stop adguard-shield
|
||||
echo " ✅ Service gestoppt"
|
||||
fi
|
||||
if systemctl is-enabled adguard-ratelimit &>/dev/null; then
|
||||
systemctl disable adguard-ratelimit
|
||||
if systemctl is-enabled adguard-shield &>/dev/null; then
|
||||
systemctl disable adguard-shield
|
||||
echo " ✅ Service deaktiviert"
|
||||
fi
|
||||
rm -f "$SERVICE_FILE"
|
||||
@@ -255,13 +669,16 @@ uninstall() {
|
||||
# Dateien entfernen
|
||||
read -rp " Konfiguration und Logs behalten? [j/N]: " keep
|
||||
if [[ "${keep,,}" == "j" ]]; then
|
||||
rm -f "$INSTALL_DIR/adguard-ratelimit.sh"
|
||||
rm -f "$INSTALL_DIR/adguard-shield.sh"
|
||||
rm -f "$INSTALL_DIR/iptables-helper.sh"
|
||||
echo " ✅ Scripts entfernt (Konfiguration behalten)"
|
||||
rm -f "$INSTALL_DIR/unban-expired.sh"
|
||||
rm -f "$INSTALL_DIR/external-blocklist-worker.sh"
|
||||
echo " ✅ Scripts entfernt (Konfiguration und Logs behalten)"
|
||||
else
|
||||
rm -rf "$INSTALL_DIR"
|
||||
rm -rf /var/lib/adguard-ratelimit
|
||||
rm -f /var/log/adguard-ratelimit.log*
|
||||
rm -rf /var/lib/adguard-shield
|
||||
rm -f /var/log/adguard-shield.log*
|
||||
rm -f /var/log/adguard-shield-bans.log
|
||||
echo " ✅ Alles entfernt"
|
||||
fi
|
||||
|
||||
@@ -270,31 +687,40 @@ uninstall() {
|
||||
}
|
||||
|
||||
# ─── Hauptprogramm ──────────────────────────────────────────────────────────
|
||||
case "${1:-install}" in
|
||||
install)
|
||||
print_header
|
||||
check_root
|
||||
check_dependencies
|
||||
install_files
|
||||
configure
|
||||
install_service
|
||||
test_connection
|
||||
print_summary
|
||||
;;
|
||||
uninstall)
|
||||
print_header
|
||||
check_root
|
||||
uninstall
|
||||
;;
|
||||
update)
|
||||
print_header
|
||||
check_root
|
||||
install_files
|
||||
systemctl daemon-reload
|
||||
echo -e "${GREEN}AdGuard Shield Update abgeschlossen. Service neustarten mit: sudo systemctl restart adguard-ratelimit${NC}"
|
||||
;;
|
||||
*)
|
||||
echo "Nutzung: $0 {install|uninstall|update}"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
main() {
|
||||
case "${1:-}" in
|
||||
install)
|
||||
print_header
|
||||
do_install
|
||||
;;
|
||||
update)
|
||||
print_header
|
||||
do_update
|
||||
;;
|
||||
uninstall)
|
||||
print_header
|
||||
do_uninstall
|
||||
;;
|
||||
status)
|
||||
print_header
|
||||
do_status
|
||||
;;
|
||||
--help|-h)
|
||||
print_header
|
||||
print_help
|
||||
;;
|
||||
"")
|
||||
# Kein Argument → interaktives Menü anzeigen
|
||||
print_header
|
||||
show_menu
|
||||
;;
|
||||
*)
|
||||
echo -e "${RED}Unbekannter Befehl: $1${NC}"
|
||||
echo ""
|
||||
print_help
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
main "$@"
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-ratelimit.conf"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-shield.conf"
|
||||
|
||||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||
echo "FEHLER: Konfigurationsdatei nicht gefunden: $CONFIG_FILE" >&2
|
||||
@@ -212,7 +212,7 @@ case "${1:-help}" in
|
||||
;;
|
||||
*)
|
||||
cat << USAGE
|
||||
iptables Helper für AdGuard Rate-Limit
|
||||
iptables Helper für AdGuard Shield
|
||||
|
||||
Nutzung: $0 {create|remove|flush|ban|unban|status|save|restore}
|
||||
|
||||
|
||||
@@ -5,20 +5,20 @@
|
||||
# Wird z.B. alle 5 Minuten per Cron aufgerufen um abgelaufene Sperren zu prüfen.
|
||||
#
|
||||
# Crontab-Eintrag:
|
||||
# */5 * * * * /opt/adguard-ratelimit/unban-expired.sh
|
||||
# */5 * * * * /opt/adguard-shield/unban-expired.sh
|
||||
###############################################################################
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-ratelimit.conf"
|
||||
CONFIG_FILE="${SCRIPT_DIR}/adguard-shield.conf"
|
||||
|
||||
if [[ ! -f "$CONFIG_FILE" ]]; then
|
||||
exit 1
|
||||
fi
|
||||
source "$CONFIG_FILE"
|
||||
|
||||
BAN_HISTORY_FILE="${BAN_HISTORY_FILE:-/var/log/adguard-ratelimit-bans.log}"
|
||||
BAN_HISTORY_FILE="${BAN_HISTORY_FILE:-/var/log/adguard-shield-bans.log}"
|
||||
LOG_PREFIX="[$(date '+%Y-%m-%d %H:%M:%S')] [UNBAN-TIMER]"
|
||||
NOW=$(date '+%s')
|
||||
|
||||
|
||||
Reference in New Issue
Block a user