Document what update-ngxblocker does

[spinitron]

In this repo's main README and in the output of update-ngxblocker -h I did not find a description of exactly what the update-ngxblocker script does.

I would like to think that it updates the files in the bots directory (e.g. /etc/nginx/bots.d) and nothing else. Is that the case?

Whatever it does I suggest adding a description exactly what it does in readmes and the -h output.

Thank you for nginx-ultimate-bad-bot-blocker!

[jwbjnwolf]

The update script is for updating the globalblacklist.conf in conf.d. The other files in bots.d and deny.d folders are one time install. Though the bots.d files are also in the updater which I guess makes sense that if there's suddenly something extra Mitchell adds in bots.d that's needed, then it auto retrieves that too. But those don't get updated often. The main blocklist file though that puts everything together is the globalblacklist.conf and is the file always getting updated synced with abuseIPDB and whenever other additions are done to the list. That's what the update script is for mainly. It checks your installed build version and the latest build version of the blocklist, and updates it when there's newer available.

Could either have it as a cron job to pull the latest daily, or say just run it each time you update your server and restarts your nginx server afterwards since it's a configuration change. Hence why it needs sudo to run a d well to place the conf file inside your nginx conf.d folder to provide answer to your other issue #645 asking why it uses sudo.

Personally I have a updateall script in my /usr/local/bin with dnf update; dnf autoremove; dnf clean all commands, and then this update script afterwards. I just SSH into my servers then on Sundays routinely and run updateall, say yes to the updates, observe it do it's thing and updates the blocker at the end.

Though myself I use my own fork of the blocker https://git.wolfi.ee/jase/nginx-bad-bot-blocker and so have my update script pointing to my repo, said change for doing so I highlight in this conmit: https://git.wolfi.ee/jase/nginx-bad-bot-blocker/commit/d516896054398363a6ec8eb85cc2752afecec42a. My fork I only update weekly on Sundays since I don't do automated, so just do so along with when updating my servers.

P.S, note the bad-ip-addresses.list file is empty currently #642, there's an issue with the server Mitchell hosts the IP list at retrieved from abuseIPDB which the bad ip update script https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/blob/master/dev-tools/update-bad-ips.sh then retrieves from.. It's been this way since 1st November.

My fork I independently retrieve the list from abuseIPDB and generate the blocklist myself so my fork is all good.. just again isn't updated daily but weekly. Not that daily really makes much use when it's been updating daily automated the last 2 half weeks in a broken state with Mitchell not aware of it still. Reason I just personally don't want to automate.. I can catch anything going wrong as I'm there doing it myself running the generation script each weekend and not follow through with committing and pushing botched updates and fix it.

If I'm just MIA then the list just falls out of date, and people begin noticing from it's not been updated, rather than begin noticing from suddenly their servers are being DDoS'd from sudden bad updates because the whole 10k IP blocklist from abuseIPDB is missing. Same reason I just don't like automated updates. I like to observe and see what's going on know everything is fine and well.

Wolfejo: You wouldn't download a wolf... right?

nginx-bad-bot-blocker

Nginx Bad Bot Blocker, customised for fedi instances, and made more tor friendly https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker

Wolfejo: You wouldn't download a wolf... right?

Reapply "Change url in updater for the global conf" · d516896054

Reapply with updated url for this repo

GitHub

nginx-ultimate-bad-bot-blocker/dev-tools/update-bad-ips.sh at master · mitchellkrogza/nginx-ultimate-bad-bot-blocker

Nginx Block Bad Bots, Spam Referrer Blocker, Vulnerability Scanners, User-Agents, Malware, Adware, Ransomware, Malicious Sites, with anti-DDOS, Wordpress Theme Detector Blocking and Fail2Ban Jail f...

[adam12b1]

+1 to adding explicit mention of what it touches and what it does not in the -h output and elsewhere, I really struggled to answer the same question when first installing... until finally I noticed under Step 9 in the repo's README.md, "These include files never get modified during an update..." and then it lists all of the files under bots.d/. Those are safe.

But I believe it should also mention conf.d/botblocker-nginx-settings.conf as untouched, because as @jwbjnwolf says, it seems to touch only the globalblacklist.conf file, nothing else. Or maybe I'm mistaken and that nginx-settings.conf file is not guaranteed safe?