Introduce a centralized IP blocking feature within Ploi that allows users to block malicious IP addresses across all servers and services (UFW, Fail2Ban, NGINX) from a single interface.

TLDR; - Example Script: https://github.com/kayvanaarssen/ploi-tools-and-scripts/tree/main/ip-blocker

Problem / Context

We are seeing increasing abuse from single IPs targeting multiple services and sites.

Example: 1.2.3.4

• WordPress brute-force attacks
• Password reset attempts
• Multi-site probing

In modern setups: Sites are often behind Cloudflare This means:

• Firewall (UFW) and Fail2Ban often do not see the real client IP
• Only NGINX (if properly configured) can block based on real visitor IP

Result:

• Blocking is fragmented
• Requires manual workarounds (custom scripts, NGINX includes, etc.)
• No central visibility or audit trail

⸻

Proposed Solution

Add a Security / IP Blocking tab in Ploi with:

1. Central IP Block List

• Add/remove IPs
• Tagging (e.g. “brute force”, “bot”, “manual block”)
• Notes / reason field

Sync across:

• All servers
• Or per-server scope

⸻

2. Multi-Layer Blocking (Automatic Deployment) When an IP is blocked, Ploi should automatically:

Firewall Layer

• Add rule via UFW (or iptables/nftables)
• Full server access denial

Fail2Ban Layer

• Ban IP across all active jails
• Optional persistent ban support

NGINX Layer (critical)

• Maintain a global deny file (e.g. /etc/nginx/ploi/blocked_ips.conf)
• Automatically included in all vhosts or globally in http {} Example:

deny 1.2.3.4;

This ensures:

• Works even behind Cloudflare
• Blocks at application level (real visitor IP)

⸻

3. Global vs Server Scope Allow users to choose:

• Global (all servers)
• Per server
• Per site (optional advanced mode)

⸻

4. Real IP Awareness (Cloudflare / Proxy Support) Enhancement:

• Detect if server uses Cloudflare or reverse proxy

Ensure:

• real_ip_header
• set_real_ip_from

So NGINX + Fail2Ban can act on real client IP

⸻

5. Audit & Logging

• Who blocked/unblocked IP
• Timestamp
• Affected servers
• Sync status

⸻

6. API / Automation API endpoint:

• Add/remove IPs
• Sync across infrastructure

Useful for:

• SIEM integrations
• External abuse detection
• Automation pipelines

⸻

Why This Matters

• Modern hosting stacks (Cloudflare + NGINX + Fail2Ban) require multi-layer blocking
• Current approach is:
• Manual
• Error-prone
• Not scalable across servers

This feature would:

• Significantly improve security posture
• Reduce operational overhead
• Provide a clear UX for a common real-world problem

⸻

Expected Impact

• Faster response to abuse incidents
• Consistent blocking across infrastructure
• Reduced reliance on custom scripts
• Better visibility and control

⸻

MVP Suggestion

Start simple:

• Global IP list
• Deploy to:
• UFW
• NGINX (global include)
• Basic UI + sync button

Then expand with:

• Fail2Ban integration
• API
• tagging/logging
• Cloudflare-aware enhancements

⸻

Closing

This is a very common real-world issue when running multiple sites behind Cloudflare. Having this built into Ploi would remove the need for custom scripting and provide a clean, reliable, and scalable solution.