fail2ban: implement for caddy basic auth

2026-01-20 14:35:20 -05:00
parent b550e495c8
commit aa2c61dcd3
1 changed files with 17 additions and 0 deletions
--- a/services/caddy.nix
+++ b/services/caddy.nix
@@ -80,4 +80,21 @@ in
  networking.firewall.allowedUDPPorts = [
    service_configs.ports.https
  ];
+
+  # Protect Caddy basic auth endpoints from brute force attacks
+  services.fail2ban.jails.caddy-auth = {
+    enabled = true;
+    settings = {
+      backend = "auto";
+      port = "http,https";
+      logpath = "/var/log/caddy/access-*.log";
+      # defaults: maxretry=5, findtime=10m, bantime=10m
+    };
+    filter.Definition = {
+      # Match Caddy JSON logs with 401 Unauthorized status (failed basic auth)
+      failregex = ''^.*"remote_ip":"<HOST>".*"status":401.*$'';
+      ignoreregex = "";
+      datepattern = ''"ts":{Epoch}\.'';
+    };
+  };
 }