serveg/CADDY.md

Caddy + fail2ban

Caddy

Modern http proxy server with easy configuration.

Rebuild caddy with transform-encoder (used to format logs that fail2ban reads):

go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
~/go/bin/xcaddy build --with github.com/caddyserver/transform-encoder
sudo mv caddy /usr/bin/caddy
sudo systemctl restart caddy
caddy list-modules | grep transform
sudo apt-mark hold caddy
rm -rf ~/go

Add to /etc/caddy/Caddyfile:

files.example.com { # your url
    request_body {
        max_size 4GB
    }
    reverse_proxy 127.0.0.1:8080 { # serveg address
        transport http {
            versions 1.1
        }
    }
    # log response status and request authorization for fail2ban
    log {
		output file /var/log/caddy/files-auth.log
		format transform "{ts} {request>client_ip} {status} {request>headers>Authorization>[0]}" {
			time_format iso8601
			placeholder -
		}
	}
}

Restart caddy:

sudo systemctl restart caddy

Fail2ban

Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.

1. Copy delpoy/caddy-auth.conf to /etc/fail2ban/filter.d/caddy-auth.conf
2. Copy delpoy/caddy-auth.local to /etc/fail2ban/jail.d/caddy-auth.local
3. Reload fail2ban:

   sudo fail2ban-client reload
   

4. Test fail2ban:

   curl -s -o /dev/null -u wrong:wrong https://files.example.com/private
   curl -s -o /dev/null https://files.example.com/private
   sudo fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf