diff --git a/fusionpbx/README.md b/fusionpbx/README.md
new file mode 100644
index 0000000..7bfce5d
--- /dev/null
+++ b/fusionpbx/README.md
@@ -0,0 +1,23 @@
+# FusionPBX Custom Configs (134.209.72.226)
+
+## Yealink T48S Provisioning Templates
+Applied to: /var/www/fusionpbx/resources/templates/provision/yealink/t48s/
+
+### y000000000000.boot
+- `overwrite_mode = 1` — phones re-provision on every reboot (critical)
+
+### y000000000065.cfg key changes
+- `features.auto_linekeys.enable = 0` — prevents phone firmware from auto-overriding BLF keys
+
+## BLF Configuration
+- Yealink T48S BLF type = **16** (in FusionPBX device profile)
+- pickup_value field required for type=16 BLF keys
+- manage-presence = true already set in FreeSWITCH external sofia profile
+
+## Provisioning URL
+https://fusion.orbishosting.com/app/provision/
+Auth: provision-master / Joker1974!!!
+
+## fail2ban Whitelist
+- 107.178.2.130 (office)
+- 97.154.109.245 (home WAN)
diff --git a/fusionpbx/fail2ban/jail.local b/fusionpbx/fail2ban/jail.local
new file mode 100644
index 0000000..d61b92d
--- /dev/null
+++ b/fusionpbx/fail2ban/jail.local
@@ -0,0 +1,10 @@
+[DEFAULT]
+ignoreip = 127.0.0.1/8 ::1 107.178.2.130 97.154.109.245
+
+[ssh]
+enabled  = true
+port     = 22
+protocol = ssh
+filter   = sshd
+logpath  = /var/log/auth.log
+action   = iptables-allports[name=sshd, protocol=all]
diff --git a/fusionpbx/provision/yealink/t48s/y000000000000.boot b/fusionpbx/provision/yealink/t48s/y000000000000.boot
new file mode 100644
index 0000000..84c836f
--- /dev/null
+++ b/fusionpbx/provision/yealink/t48s/y000000000000.boot
@@ -0,0 +1,7 @@
+#!version:1.0.0.1
+## The header above must appear as-is in the first line
+
+include:config "y000000000065.cfg"
+include:config "{$mac}.cfg"
+
+overwrite_mode = 1