Initial Authelia + fail2ban stack

Self-hosted SSO portal with file-based users, SQLite storage, filesystem
notifier, and an iptables-banning fail2ban sidecar. Designed to drop into
a DotheEvo-style ~/docker layout next to a dockerized Caddy on the main
server, joining the same external caddy_net so Caddy reaches Authelia by
container name. fail2ban runs in host network mode with NET_ADMIN/NET_RAW
caps so its bans hit DOCKER-USER and actually drop packets at the edge.

Includes a Caddy snippet (caddy/snippet.example.caddyfile) to merge into
the user's real Caddyfile -- this repo doesn't manage Caddy itself.

https://claude.ai/code/session_013XZ1vmgk78k2PEQ5DmJhF3

fail2ban/data/jail.d/authelia.local

@@ -0,0 +1,17 @@
+[authelia]
+enabled  = true
+filter   = authelia
+logpath  = /var/log/authelia/authelia.log
+maxretry = 3
+findtime = 10m
+bantime  = 1h
+
+# DOCKER-USER is the chain Docker inserts before its own per-container
+# rules; banning here drops packets destined for docker-published ports
+# (i.e. your Caddy container's 80/443) before iptables routes them in.
+chain     = DOCKER-USER
+banaction = iptables-allports
+
+# Tuple-form action so we record where it came from. `port=anyport` is
+# fine because chain=DOCKER-USER drops at the chain head regardless.
+action = iptables-allports[name=authelia, chain=DOCKER-USER]

fail2ban/data/jail.d/caddy.local

@@ -0,0 +1,14 @@
+[caddy-4xx]
+enabled  = true
+filter   = caddy-4xx
+# Adjust if your Caddy writes elsewhere -- this must match the host path
+# mounted into the fail2ban container in docker-compose.yml.
+logpath  = /var/log/caddy/access.log
+maxretry = 30
+findtime = 2m
+bantime  = 30m
+
+chain     = DOCKER-USER
+banaction = iptables-allports
+
+action = iptables-allports[name=caddy-4xx, chain=DOCKER-USER]