Real-Time client protection

[Life4Us2025]

name: Real-Time Client Protection

on: push: branches: - main workflow_dispatch:

jobs: protect-client: runs-on: ubuntu-latest

steps:
- name: Set up environment
  run: |
    echo "Setting up environment for real-time protection..."
    mkdir -p logs
    touch logs/access_log.txt
    touch logs/suspicious_ips.txt

- name: Detect suspicious activity
  run: |
    echo "Monitoring logs for suspicious activity..."
    # Simulated log entries (replace with real log source)
    echo "192.168.1.10 - failed login attempt" >> logs/access_log.txt
    echo "192.168.1.20 - unauthorized access detected" >> logs/access_log.txt

    # Extract suspicious IPs
    grep -E "failed|unauthorized" logs/access_log.txt | awk '{print $1}' > logs/suspicious_ips.txt
    echo "Detected suspicious IPs:"
    cat logs/suspicious_ips.txt

- name: Block IPs on Cloudflare
  if: success()
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
    CLOUDFLARE_ZONE_ID: ${{ secrets.CLOUDFLARE_ZONE_ID }}
  run: |
    while read ip; do
      echo "Blocking IP on Cloudflare: $ip"
      curl -X POST "https://api.cloudflare.com/client/v4/zones/$CLOUDFLARE_ZONE_ID/firewall/access_rules/rules" \
        -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
        -H "Content-Type: application/json" \
        --data "{\"mode\":\"block\",\"configuration\":{\"target\":\"ip\",\"value\":\"$ip\"},\"notes\":\"Blocked due to suspicious activity\"}"
    done < logs/suspicious_ips.txt

- name: Notify admin
  env:
    ADMIN_EMAIL: ${{ secrets.ADMIN_EMAIL }}
  run: |
    echo "Notifying admin of blocked IPs..."
    if [[ -s logs/suspicious_ips.txt ]]; then
      echo "The following IPs have been blocked for suspicious activity:" > alert_message.txt
      cat logs/suspicious_ips.txt >> alert_message.txt
      echo "$(cat alert_message.txt)" | mail -s "Immediate Protection Alert" $ADMIN_EMAIL
    else
      echo "No suspicious activity detected."
    fi

- name: Upload logs
  uses: actions/upload-artifact@v3
  with:
    name: real-time-protection-logs
    path: logs