Timerix/serveg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added systemd service and moved fail2ban code to separate files

Browse Source
This commit is contained in:
Altair-sh
2026-11-07 00:17:13 +01:00
parent faa1eca7c3
commit 2054f805c8
4 changed files with 35 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CADDY.md
+2 -20
View File
@@ -38,27 +38,9 @@ sudo systemctl restart caddy
### Fail2ban ### Fail2ban
Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password. Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
Write to `/etc/fail2ban/filter.d/caddy-auth.conf` Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf`
```conf Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local`
[Definition]
failregex = <ADDR> 401 REDACTED$
ignoreregex =
```
Write to `/etc/fail2ban/jail.d/caddy-auth.local`
```conf
[caddy-auth]
enabled = true
filter = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf
logpath = /var/log/caddy/files-auth.log
backend = auto # without it on debian fail2ban will use systemd logging and to read caddy log
maxretry = 10 # N wrong passwords
findtime = 10m # sent during 10 minutes
bantime = 1h # ban for 1 hour
banaction = iptables-allports # ban the ip for all ports
protocol = all # and all protocols
ignoreip = 127.0.0.1/8 ::1 # ignore localhost
```
Reload fail2ban: Reload fail2ban:
```sh ```sh
sudo fail2ban-client reload sudo fail2ban-client reload
deploy/caddy-auth.conf
+3
View File
@@ -0,0 +1,3 @@
[Definition]
failregex = <ADDR> 401 REDACTED$
ignoreregex =
deploy/caddy-auth.local
+11
View File
@@ -0,0 +1,11 @@
[caddy-auth]
enabled = true
filter = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf
logpath = /var/log/caddy/files-auth.log
backend = auto # without it on debian fail2ban will use systemd logging and to read caddy log
maxretry = 10 # N wrong passwords
findtime = 10m # sent during 10 minutes
bantime = 1h # ban for 1 hour
banaction = iptables-allports # ban the ip for all ports
protocol = all # and all protocols
ignoreip = 127.0.0.1/8 ::1 # ignore localhost
deploy/serveg.service
+19
View File
@@ -0,0 +1,19 @@
[Unit]
Description=serveg file server
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=filebin
Group=filebin
WorkingDirectory=/home/filebin
ExecStart=/home/filebin/serveg
Restart=on-failure
RestartSec=5
KillSignal=SIGTERM
TimeoutStopSec=10
[Install]
WantedBy=multi-user.target