#
# Author: Mike Rushton
#
# IMPORTANT
#
# Please set jail.local's permission to 640 because it contains your CF API key.
#
# This action depends on curl and jq.
# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE
#
# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account
#
# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2
#
# You may ban IP-s only in one of your zones
# https://api.cloudflare.com/#firewall-access-rule-for-a-zone-create-access-rule

[Definition]

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
# API v4
actionban = curl -m 15 -s -o /dev/null -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -X POST \
            -H 'Content-Type: application/json' -d '{"mode":"block","configuration":{"target":"ip","value":"<ip>"}}' \
            <cfapibase>/user/firewall/access_rules/rules

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
# API v4
actionunban = curl -m 15 -s -o /dev/null -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -X DELETE \
              <cfapibase>/user/firewall/access_rules/rules/$(curl -s -H 'X-Auth-Email: <cfuser>' -H 'X-Auth-Key: <cftoken>' -X GET \
              '<cfapibase>/user/firewall/access_rules/rules?mode=block&configuration_target=ip&configuration_value=<ip>&page=1&per_page=1' | jq -r '.result[0].id')

[Init]

cfapibase = https://api.cloudflare.com/client/v4