v1.1 — tighter dotfile blocking, shadowing detection, end-to-end CI

Hardening release: closes every finding from the July 2026 code review — one regex bypass, one nginx-precedence blind spot, and a batch of validation/robustness gaps. Drop-in update: re-run the script, no flag changes.

Fixed

• /.well-known look-alike bypass. deny-dotfiles.conf exempted every path starting with /.well-known — including /.well-knownfoo and /.well-known2/…. The lookahead is now (?!well-known(?:/|$)): only the real /.well-known segment stays reachable (Let's Encrypt HTTP-01 keeps working), everything else is 404'd.
• location ^~ silently disabling the trap. A ^~ prefix location that wins the prefix match makes nginx skip regex locations entirely — probes under it were served, never logged, never banned. The installer now detects overlapping ^~ prefixes in your vhosts and warns loudly (the ACME ^~ /.well-known/acme-challenge/ pattern is recognized as safe).
• IPv6 whitelist validation without python3. The bash fallback accepted garbage like :::: or 2001:db8::1/129, which would land in ignoreip and could break the jail. It now really validates IPv6: hextet count, a single ::, prefix ≤ 128, v4-embedded tails — cross-checked against python3's ipaddress on 48 cases.
• Parallel runs could corrupt each other's backups. An exclusive flock now guards the whole run.
• Test-ban check could false-match. 192.0.2.1 no longer matches a 192.0.2.10 already present in the nftables ruleset.

CI

New smoke job runs the installer end-to-end on a real Ubuntu VM every push: routing checks (trap paths logged + 404'd, dotfiles blocked, real /.well-known reachable, look-alikes not), idempotent re-run, and the full synthetic-hit → fail2ban → nftables ban chain.

Install

Follow the quick start: download → verify → read → run.

Checksums of setup-honeypot.sh at this release:

• MD5 d7bd727335602b57ea5b250d03c53ca5
• SHA-256 2c34338c3973b3edf8df565eb8d5122d33d66c1aa2ed3d61166b65ee6f2eff23