Timerix/serveg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updated caddy and fail2ban instructions

Browse Source
This commit is contained in:
Altair-sh
2026-11-07 01:03:13 +01:00
parent 2054f805c8
commit 05379e25cf
3 changed files with 39 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CADDY.md
+15 -11
View File
@@ -3,9 +3,15 @@
## Caddy ## Caddy
Modern http proxy server with easy configuration. Modern http proxy server with easy configuration.
Install log formatter plugin: Rebuild caddy with transform-encoder (used to format logs that fail2ban reads):
```sh ```sh
caddy add-package github.com/caddyserver/transform-encoder go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
~/go/bin/xcaddy build --with github.com/caddyserver/transform-encoder
sudo mv caddy /usr/bin/caddy
sudo systemctl restart caddy
caddy list-modules | grep transform
sudo apt-mark hold caddy
rm -rf ~/go
``` ```
Add to `/etc/caddy/Caddyfile`: Add to `/etc/caddy/Caddyfile`:
@@ -38,17 +44,15 @@ sudo systemctl restart caddy
### Fail2ban ### Fail2ban
Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password. Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf` 1. Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf`
Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local` 2. Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local`
3. Reload fail2ban:
Reload fail2ban:
```sh ```sh
sudo fail2ban-client reload sudo fail2ban-client reload
``` ```
4. Test fail2ban:
Test fail2ban:
```sh ```sh
curl -s -o /dev/null -u wrong:wrong https://files.example.com/ curl -s -o /dev/null -u wrong:wrong https://files.example.com/private
curl -s -o /dev/null https://files.example.com/ curl -s -o /dev/null https://files.example.com/private
fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf sudo fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
``` ```
deploy/caddy-auth.conf
+2 -1
View File
@@ -1,3 +1,4 @@
[Definition] [Definition]
failregex = <ADDR> 401 REDACTED$ datepattern = {^LN-BEG}%%Y-%%m-%%dT%%H:%%M:%%S\.%%f%%z
failregex = ^\s*<HOST>\s+401\s+REDACTED\s*$
ignoreregex = ignoreregex =
deploy/caddy-auth.local
+16 -8
View File
@@ -1,11 +1,19 @@
[caddy-auth] [caddy-auth]
enabled = true enabled = true
filter = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf # /etc/fail2ban/filter.d/caddy-auth.conf
filter = caddy-auth
logpath = /var/log/caddy/files-auth.log logpath = /var/log/caddy/files-auth.log
backend = auto # without it on debian fail2ban will use systemd logging and to read caddy log # without it on debian fail2ban will use systemd logging and to read caddy log
maxretry = 10 # N wrong passwords backend = auto
findtime = 10m # sent during 10 minutes # N wrong passwords
bantime = 1h # ban for 1 hour maxretry = 10
banaction = iptables-allports # ban the ip for all ports # sent during 10 minutes
protocol = all # and all protocols findtime = 10m
ignoreip = 127.0.0.1/8 ::1 # ignore localhost # ban for 1 hour
bantime = 1h
# ban the ip for all ports
banaction = iptables-allports
# and all protocols
protocol = all
# ignore localhost
ignoreip = 127.0.0.1/8 ::1