add scheduled stopforumspam blocklist update

deploy

@@ -19,6 +19,6 @@ rsync -rptcv --chmod=D755,F644 --delete --fsync --preallocate nginx/{nginx.conf,
 rsync -ptcv --chmod=D755,F644 --fsync --preallocate my.cnf.d/server.cnf $remote:/etc/my.cnf.d/server.cnf
 rsync -rptcv --chmod=D755,F644 --fsync --preallocate php/{php.ini,php-fpm.d} $remote:/etc/php/
 rsync -rptcv --chmod=D755,F644 --fsync --preallocate php-legacy/{php.ini,php-fpm.d} $remote:/etc/php-legacy/
-rsync -ptcv --chmod=755 --fsync --preallocate {flarum-asset-compress,flarum-deploy,remote-backup} $remote:/usr/local/bin/
+rsync -ptcv --chmod=755 --fsync --preallocate {flarum-asset-compress,flarum-deploy,remote-backup,stopforumspam-update} $remote:/usr/local/bin/
 rsync -prctv --chmod=D755,F644 --fsync --preallocate systemd/system/ $remote:/etc/systemd/system
 ssh $remote nginx -s reload

stopforumspam-update

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -o errexit -o nounset -o pipefail
+
+curl --fail-with-body https://www.stopforumspam.com/downloads/toxic_ip_cidr.txt | awk ' { print $1 " 1;" } ' > /etc/nginx/stopforumspam-toxic_ip_cidr.conf.new
+mv /etc/nginx/stopforumspam-toxic_ip_cidr.conf.new /etc/nginx/stopforumspam-toxic_ip_cidr.conf
+curl --fail-with-body https://www.stopforumspam.com/downloads/bannedips.csv.gz | gunzip | tr ',' '\n' | awk ' { print $1 " 1;" } ' > /etc/nginx/stopforumspam-bannedips.conf.new
+mv /etc/nginx/stopforumspam-bannedips.conf.new /etc/nginx/stopforumspam-bannedips.conf
+nginx -s reload

systemd/system/stopforumspam-update.service

@@ -0,0 +1,38 @@
+[Unit]
+Description=Stop Forum Spam data update
+
+[Service]
+CapabilityBoundingSet=
+CPUSchedulingPolicy=batch
+ExecStart=/usr/local/bin/stopforumspam-update
+IOSchedulingPriority=7
+LockPersonality=true
+MemoryDenyWriteExecute=true
+Nice=19
+NoNewPrivileges=true
+PrivateDevices=true
+PrivateIPC=true
+PrivateTmp=true
+PrivateUsers=true
+ProcSubset=pid
+ProtectClock=true
+ProtectControlGroups=true
+ProtectHome=true
+ProtectHostname=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectProc=invisible
+ProtectSystem=strict
+ReadWritePaths=/etc/nginx
+RemoveIPC=true
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@privileged @resources @obsolete
+Type=oneshot
+UMask=0077
+WorkingDirectory=/etc/nginx

systemd/system/stopforumspam-update.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily Stop Forum Spam data update
+
+[Timer]
+OnCalendar=daily
+AccuracySec=1h
+Persistent=true
+
+[Install]
+WantedBy=timers.target