[Definition]
# Posts ban events to n8n webhook for enrichment, HA alerting, and Google Sheets logging.
# Calls n8n directly on port 5678 (internal, no auth needed for webhooks).
actionban = curl -s -m 10 -X POST http://localhost:5678/webhook/security-alert \
            -H "Content-Type: application/json" \
            -d "{\"source_ip\":\"<ip>\",\"service\":\"n8n-brute-force\",\"attempt_count\":<failures>,\"event_type\":\"blocked\"}"

actionunban =

[Init]
