[authelia]
enabled  = true
filter   = authelia
logpath  = /var/log/authelia/authelia.log
maxretry = 3
findtime = 10m
bantime  = 1h

# DOCKER-USER is the chain Docker inserts before its own per-container
# rules; banning here drops packets destined for docker-published ports
# (i.e. your Caddy container's 80/443) before iptables routes them in.
chain     = DOCKER-USER
banaction = iptables-allports

# Tuple-form action so we record where it came from. `port=anyport` is
# fine because chain=DOCKER-USER drops at the chain head regardless.
action = iptables-allports[name=authelia, chain=DOCKER-USER]