v1.1 — tighter dotfile blocking, shadowing detection, end-to-end CI

Hardening release: closes every finding from the July 2026 code review — one regex bypass, one nginx-precedence blind spot, and a batch of validation/robustness gaps. Drop-in update: re-run the script, no flag changes.

Fixed

• /.well-known look-alike bypass. deny-dotfiles.conf exempted every path starting with /.well-known — including /.well-knownfoo and /.well-known2/…. The lookahead is now (?!well-known(?:/|$)): only the real /.well-known segment stays reachable (Let's Encrypt HTTP-01 keeps working), everything else is 404'd.
• location ^~ silently disabling the trap. A ^~ prefix location that wins the prefix match makes nginx skip regex locations entirely — probes under it were served, never logged, never banned. The installer now detects overlapping ^~ prefixes in your vhosts and warns loudly (the ACME ^~ /.well-known/acme-challenge/ pattern is recognized as safe).
• IPv6 whitelist validation without python3. The bash fallback accepted garbage like :::: or 2001:db8::1/129, which would land in ignoreip and could break the jail. It now really validates IPv6: hextet count, a single ::, prefix ≤ 128, v4-embedded tails — cross-checked against python3's ipaddress on 48 cases.
• Parallel runs could corrupt each other's backups. An exclusive flock now guards the whole run.
• Test-ban check could false-match. 192.0.2.1 no longer matches a 192.0.2.10 already present in the nftables ruleset.

CI

New smoke job runs the installer end-to-end on a real Ubuntu VM every push: routing checks (trap paths logged + 404'd, dotfiles blocked, real /.well-known reachable, look-alikes not), idempotent re-run, and the full synthetic-hit → fail2ban → nftables ban chain.

Install

Follow the quick start: download → verify → read → run.

Checksums of setup-honeypot.sh at this release:

• MD5 d7bd727335602b57ea5b250d03c53ca5
• SHA-256 2c34338c3973b3edf8df565eb8d5122d33d66c1aa2ed3d61166b65ee6f2eff23

v1.0 — first stable release

One script turns an nginx box into a scanner trap: the first probe of /.env, /.git/config, /backup.sql and friends gets a 404 — and its IP gets banned on all ports by fail2ban + nftables, with incremental bans up to a week.

Highlights

• Safe by default. Detects and validates your admin IP, refuses to run without a whitelist (the ban covers SSH too), keeps backups outside the config tree, rolls everything back if nginx -t fails — and re-runs are idempotent.
• Verified install, not hopeful install. At setup time the script proves the whole chain: the jail loaded, it watches the honeypot log through the file backend (not journald), and a synthetic ban of a TEST-NET IP (192.0.2.1) actually lands in nftables — then gets unbanned.
• Honest CLI. Correct exit codes on every path, --help works when piped, and the summary never claims "Honeypot is live" when nothing got wired or nginx is down.
• Documented uninstall — four copy-paste, symlink-safe steps.
• EN + RU READMEs with CI-enforced script checksums for the verify-before-run step.

Install

Follow the quick start: download → verify → read → run.

Checksums of setup-honeypot.sh at this release:

• MD5 294548fc150f9b812a50ee99aaeb6cff
• SHA-256 efc79f2d1317bdb5aeb22e8570a6ecde0869bfbf227c8e61672a5847c27c5c28