Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem
notifier, and an iptables-banning fail2ban sidecar. Designed to drop into
a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main
server, joining the same external caddy_net so Caddy reaches Authelia by
container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW
caps so its bans hit DOCKER-USER and actually drop packets at the edge.

Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into
the user's real Caddyfile -- this repo doesn't manage Caddy itself.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

fail2ban/data/filter.d/authelia.local

@@ -0,0 +1,15 @@
+# Matches Authelia's text-format log lines for failed authentication.
+# Targets Authelia 4.38+. If you change `log.format` to `json` in
+# authelia/configuration.yml, this regex needs updating.
+#
+# Test against a real log:
+#   docker compose exec fail2ban fail2ban-regex \
+#     /var/log/authelia/authelia.log \
+#     /data/filter.d/authelia.local
+
+[Definition]
+
+failregex = ^.*Unsuccessful (1FA|TOTP|Duo|U2F) authentication attempt by user.*remote_ip"?(:|=)"?<HOST>"?.*$
+            ^.*user not found.*path=/api/reset-password/identity/start.*remote_ip"?(:|=)"?<HOST>"?.*$
+
+ignoreregex =

fail2ban/data/filter.d/caddy-4xx.local

@@ -0,0 +1,12 @@
+# Bans IPs that spray 401/403/404/429 across many requests against Caddy.
+# Targets Caddy's default JSON access log shape (one JSON object per line).
+# Verify against a real log:
+#   docker compose exec fail2ban fail2ban-regex \
+#     /var/log/caddy/access.log \
+#     /data/filter.d/caddy-4xx.local
+
+[Definition]
+
+failregex = ^.*"remote_ip":"<HOST>".*"status":(401|403|404|429).*$
+
+ignoreregex = ^.*"uri":"/(favicon\.ico|robots\.txt|apple-touch-icon[^"]*)".*$

fail2ban/data/jail.d/authelia.local

@@ -0,0 +1,17 @@
+[authelia]
+enabled  = true
+filter   = authelia
+logpath  = /var/log/authelia/authelia.log
+maxretry = 3
+findtime = 10m
+bantime  = 1h
+
+# DOCKER-USER is the chain Docker inserts before its own per-container
+# rules; banning here drops packets destined for docker-published ports
+# (i.e. your Caddy container's 80/443) before iptables routes them in.
+chain     = DOCKER-USER
+banaction = iptables-allports
+
+# Tuple-form action so we record where it came from. `port=anyport` is
+# fine because chain=DOCKER-USER drops at the chain head regardless.
+action = iptables-allports[name=authelia, chain=DOCKER-USER]

fail2ban/data/jail.d/caddy.local

@@ -0,0 +1,14 @@
+[caddy-4xx]
+enabled  = true
+filter   = caddy-4xx
+# Adjust if your Caddy writes elsewhere -- this must match the host path
+# mounted into the fail2ban container in docker-compose.yml.
+logpath  = /var/log/caddy/access.log
+maxretry = 30
+findtime = 2m
+bantime  = 30m
+
+chain     = DOCKER-USER
+banaction = iptables-allports
+
+action = iptables-allports[name=caddy-4xx, chain=DOCKER-USER]