redis: configure port and secure autoban CLI

ban-server/data/www/unban.php

@@ -5,6 +5,7 @@ session_start();
 $ip = $_SERVER['REMOTE_ADDR'] ?? '';
 $settings = parse_ini_file('/etc/eterban/settings.ini');
 $host_redis = is_array($settings) ? ($settings['redis_server'] ?? '') : '';
+$port_redis = is_array($settings) ? (int)($settings['redis_port'] ?? 6379) : 6379;
 $redis_username = is_array($settings) ? ($settings['redis_username'] ?? '') : '';
 $redis_password = is_array($settings) ? ($settings['redis_password'] ?? '') : '';
 $redis_tls = is_array($settings) && filter_var($settings['redis_tls'] ?? false, FILTER_VALIDATE_BOOLEAN);
@@ -64,7 +65,7 @@ if (!is_string($nonce) || !is_string($proof) || time() > $expires ||
 try {
     $redis = new Redis();
     $redis_host = $redis_tls ? 'tls://' . $host_redis : $host_redis;
-    if (!$redis->connect($redis_host, 6379, 2.5, null, 0, 0, $redis_tls ? ['stream' => ['verify_peer' => true]] : [])) {
+    if (!$redis->connect($redis_host, $port_redis, 2.5, null, 0, 0, $redis_tls ? ['stream' => ['verify_peer' => true]] : [])) {
         throw new RedisException('connection failed');
     }
     if ($redis_password !== '' && !$redis->auth($redis_username !== '' ? [$redis_username, $redis_password] : $redis_password)) {

common/etc/eterban/settings.ini

 [Settings]
 # blocking requests queue
 #redis_server = 10.20.30.101
+#redis_port = 6379
 # Optional Redis ACL/TLS settings. Keep this file root-readable only when a
 # password is configured.
 #redis_username = default

gateway/usr/share/eterban/autoban_cli.py

@@ -46,7 +46,16 @@ def get_redis():
     config = configparser.ConfigParser()
     config.read(CONFIG_PATH)
     redis_server = config.get('Settings', 'redis_server', fallback='localhost')
-    return redis.Redis(host=redis_server)
+    options = {'port': config.getint('Settings', 'redis_port', fallback=6379)}
+    username = config.get('Settings', 'redis_username', fallback='').strip()
+    password = config.get('Settings', 'redis_password', fallback='')
+    if username:
+        options['username'] = username
+    if password:
+        options['password'] = password
+    if config.getboolean('Settings', 'redis_tls', fallback=False):
+        options['ssl'] = True
+    return redis.Redis(host=redis_server, **options)
 
 
 def cmd_info(ip):

gateway/usr/share/eterban/eterban_switcher.py

@@ -109,7 +109,7 @@ def parse_config (path_to_config, path_to_log):
 
 
 def redis_connection_options(config):
-    options = {}
+    options = {'port': config.getint('Settings', 'redis_port', fallback=6379)}
     username = config.get('Settings', 'redis_username', fallback='').strip()
     password = config.get('Settings', 'redis_password', fallback='')
     if username:

gateway/usr/share/eterban/unban.py

@@ -18,7 +18,7 @@ def get_settings (path_to_config):
     # Читаем некоторые значения из конфиг. файла.
     redis_server = config.get("Settings", "redis_server", fallback = "localhost")
     hostname = config.get("Settings", "hostname", fallback = socket.gethostname())
-    options = {}
+    options = {'port': config.getint("Settings", "redis_port", fallback=6379)}
     username = config.get("Settings", "redis_username", fallback="").strip()
     password = config.get("Settings", "redis_password", fallback="")
     if username:

prod-server/usr/share/eterban/ban.py

@@ -24,7 +24,7 @@ def get_settings (path_to_config):
     # Читаем некоторые значения из конфиг. файла.
     redis_server = config.get("Settings", "redis_server", fallback = "localhost")
     hostname = config.get("Settings", "hostname", fallback = socket.gethostname())
-    options = {}
+    options = {'port': config.getint("Settings", "redis_port", fallback=6379)}
     username = config.get("Settings", "redis_username", fallback="").strip()
     password = config.get("Settings", "redis_password", fallback="")
     if username: