From 74173dad0bec0d7bc1e06ba9a7f5c5e4a11dc3cf Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Wed, 4 Mar 2026 14:05:39 -0600
Subject: [PATCH] fix: temporarily disable brute force IP protection

Disable all IP blocking and 404 tracking to allow unrestricted access
while we review and tune ban thresholds and exemptions.

This is a temporary measure to prevent legitimate traffic from being
blocked. Will re-enable after proper configuration.
---
 .../plugs/brute_force_protection.ex           | 34 +++++++++++--------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/lib/towerops_web/plugs/brute_force_protection.ex b/lib/towerops_web/plugs/brute_force_protection.ex
index da6f7c5c..9bf82031 100644
--- a/lib/towerops_web/plugs/brute_force_protection.ex
+++ b/lib/towerops_web/plugs/brute_force_protection.ex
@@ -38,23 +38,27 @@ defmodule ToweropsWeb.Plugs.BruteForceProtection do
   def init(opts), do: opts
 
   def call(conn, _opts) do
-    # Exempt agent WebSocket connections - they authenticate at channel join
-    if agent_websocket?(conn) do
-      conn
-    else
-      ip_address = get_remote_ip(conn)
+    # TEMPORARILY DISABLED - brute force protection bypassed
+    # Re-enable after reviewing ban thresholds and exemptions
+    conn
 
-      # Check whitelist and ban status before routing
-      conn = check_and_block(conn, ip_address)
+    # # Exempt agent WebSocket connections - they authenticate at channel join
+    # if agent_websocket?(conn) do
+    #   conn
+    # else
+    #   ip_address = get_remote_ip(conn)
 
-      # Only register 404 tracking if we didn't already halt the request
-      # (halted requests have already been sent, can't register before_send)
-      if conn.halted do
-        conn
-      else
-        maybe_track_404(conn, ip_address)
-      end
-    end
+    #   # Check whitelist and ban status before routing
+    #   conn = check_and_block(conn, ip_address)
+
+    #   # Only register 404 tracking if we didn't already halt the request
+    #   # (halted requests have already been sent, can't register before_send)
+    #   if conn.halted do
+    #     conn
+    #   else
+    #     maybe_track_404(conn, ip_address)
+    #   end
+    # end
   end
 
   defp agent_websocket?(conn) do