From 7a43e7f8c93f41e5c908a72c5bbaa826e051d61b Mon Sep 17 00:00:00 2001
From: Altair-sh <altairgyg@gmail.com>
Date: Wed, 4 Nov 2026 17:44:49 +0100
Subject: [PATCH] added fail2ban instructions

---
 CADDY.md  | 72 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 README.md | 16 +------------
 2 files changed, 73 insertions(+), 15 deletions(-)
 create mode 100644 CADDY.md

diff --git a/CADDY.md b/CADDY.md
new file mode 100644
index 0000000..8dd369d
--- /dev/null
+++ b/CADDY.md
@@ -0,0 +1,72 @@
+# Caddy + fail2ban
+
+## Caddy
+Modern http proxy server with easy configuration.
+
+Install log formatter plugin:
+```sh
+caddy add-package github.com/caddyserver/transform-encoder
+```
+
+Add to `/etc/caddy/Caddyfile`:
+```Caddyfile
+files.example.com { # your url
+    request_body {
+        max_size 4GB
+    }
+    reverse_proxy 127.0.0.1:8080 { # serveg address
+        transport http {
+            versions 1.1
+        }
+    }
+    # log response status and request authorization for fail2ban
+    log {
+		output file /var/log/caddy/files-auth.log
+		format transform "{ts} {request>client_ip} {status} {request>headers>Authorization>[0]}" {
+			time_format iso8601
+			placeholder -
+		}
+	}
+}
+```
+
+Restart caddy:
+```sh
+sudo systemctl restart caddy
+```
+
+### Fail2ban
+Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
+
+Write to `/etc/fail2ban/filter.d/caddy-auth.conf`
+```conf
+[Definition]
+failregex = <ADDR> 401 REDACTED$
+ignoreregex =
+```
+
+Write to `/etc/fail2ban/jail.d/caddy-auth.local`
+```conf
+[caddy-auth]
+enabled   = true
+filter    = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf
+logpath   = /var/log/caddy/files-auth.log
+backend   = auto    # without it on debian fail2ban will use systemd logging and to read caddy log
+maxretry  = 10      # N wrong passwords
+findtime  = 10m     # sent during 10 minutes
+bantime   = 1h      # ban for 1 hour
+banaction = iptables-allports   # ban the ip for all ports
+protocol  = all                 # and all protocols
+ignoreip  = 127.0.0.1/8 ::1     # ignore localhost
+```
+Reload fail2ban:
+```sh
+sudo fail2ban-client reload
+```
+
+Test fail2ban:
+```sh
+curl -s -o /dev/null -u wrong:wrong https://files.example.com/
+curl -s -o /dev/null https://files.example.com/
+fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
+```
diff --git a/README.md b/README.md
index c3b7a00..cf9fdd2 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 # serveg
-Small HTTP/1.1 file server. Meant to run behind a reverse proxy that handles TLS (see [Caddy](#caddy)).
+Small HTTP/1.1 file server. Meant to run behind a reverse proxy that handles TLS (see [CADDY.md](./CADDY.md)).
 
 ## Features:
 - upload and download files
@@ -25,17 +25,3 @@ bin/servegp         # reads ./serveg.toml
 bin/servegp -config /etc/serveg/serveg.toml
 ```
 
-## Caddy
-
-```
-files.example.com {
-    request_body {
-        max_size 4GB
-    }
-    reverse_proxy 127.0.0.1:8080 {
-        transport http {
-            versions 1.1
-        }
-    }
-}
-```