diff --git a/CADDY.md b/CADDY.md
index 0ed1e11..f21fb0e 100644
--- a/CADDY.md
+++ b/CADDY.md
@@ -3,9 +3,15 @@
 ## Caddy
 Modern http proxy server with easy configuration.
 
-Install log formatter plugin:
+Rebuild caddy with transform-encoder (used to format logs that fail2ban reads):
 ```sh
-caddy add-package github.com/caddyserver/transform-encoder
+go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
+~/go/bin/xcaddy build --with github.com/caddyserver/transform-encoder
+sudo mv caddy /usr/bin/caddy
+sudo systemctl restart caddy
+caddy list-modules | grep transform
+sudo apt-mark hold caddy
+rm -rf ~/go
 ```
 
 Add to `/etc/caddy/Caddyfile`:
@@ -38,17 +44,15 @@ sudo systemctl restart caddy
 ### Fail2ban
 Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
 
-Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf`
-Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local`
-
-Reload fail2ban:
-```sh
-sudo fail2ban-client reload
-```
-
-Test fail2ban:
-```sh
-curl -s -o /dev/null -u wrong:wrong https://files.example.com/
-curl -s -o /dev/null https://files.example.com/
-fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
-```
+1. Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf`
+2. Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local`
+3. Reload fail2ban:
+    ```sh
+    sudo fail2ban-client reload
+    ```
+4. Test fail2ban:
+    ```sh
+    curl -s -o /dev/null -u wrong:wrong https://files.example.com/private
+    curl -s -o /dev/null https://files.example.com/private
+    sudo fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
+    ```
diff --git a/deploy/caddy-auth.conf b/deploy/caddy-auth.conf
index 8d890ac..77493b5 100644
--- a/deploy/caddy-auth.conf
+++ b/deploy/caddy-auth.conf
@@ -1,3 +1,4 @@
 [Definition]
-failregex = <ADDR> 401 REDACTED$
-ignoreregex =
\ No newline at end of file
+datepattern = {^LN-BEG}%%Y-%%m-%%dT%%H:%%M:%%S\.%%f%%z
+failregex   = ^\s*<HOST>\s+401\s+REDACTED\s*$
+ignoreregex =
diff --git a/deploy/caddy-auth.local b/deploy/caddy-auth.local
index 7105f35..3b17665 100644
--- a/deploy/caddy-auth.local
+++ b/deploy/caddy-auth.local
@@ -1,11 +1,19 @@
 [caddy-auth]
 enabled   = true
-filter    = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf
+# /etc/fail2ban/filter.d/caddy-auth.conf
+filter    = caddy-auth
 logpath   = /var/log/caddy/files-auth.log
-backend   = auto    # without it on debian fail2ban will use systemd logging and to read caddy log
-maxretry  = 10      # N wrong passwords
-findtime  = 10m     # sent during 10 minutes
-bantime   = 1h      # ban for 1 hour
-banaction = iptables-allports   # ban the ip for all ports
-protocol  = all                 # and all protocols
-ignoreip  = 127.0.0.1/8 ::1     # ignore localhost
\ No newline at end of file
+# without it on debian fail2ban will use systemd logging and to read caddy log
+backend   = auto
+# N wrong passwords
+maxretry  = 10
+# sent during 10 minutes
+findtime  = 10m
+# ban for 1 hour
+bantime   = 1h
+# ban the ip for all ports
+banaction = iptables-allports
+# and all protocols
+protocol  = all
+# ignore localhost
+ignoreip  = 127.0.0.1/8 ::1