# Fail2ban jail configuration for Caddy web server
#
# INSTALLATION:
# 1. Copy this file to: /etc/fail2ban/jail.d/caddy.conf
#    sudo cp fail2ban-caddy-jail.conf /etc/fail2ban/jail.d/caddy.conf
#
# 2. Ensure the filter is installed:
#    sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
#
# 3. Create log directory if it doesn't exist:
#    sudo mkdir -p /var/log/caddy
#    sudo chown caddy:caddy /var/log/caddy  # Or appropriate user
#
# 4. Restart fail2ban:
#    sudo systemctl restart fail2ban
#
# 5. Check status:
#    sudo fail2ban-client status caddy-auth

[caddy-auth]
# Enable this jail
enabled = true

# Ports to protect (HTTP and HTTPS)
port = http,https

# Filter to use (must match filename in /etc/fail2ban/filter.d/)
filter = caddy-auth

# Log file to monitor
# Adjust this path if your Caddy logs are elsewhere
logpath = /var/log/caddy/access.log
          /var/log/caddy/*-access.log

# For Docker Caddy, you might need to use Docker logs:
# logpath = /var/lib/docker/containers/*-caddy*/*.log

# Maximum retry before ban
# 5 attempts within findtime period will trigger a ban
maxretry = 5

# Time window (seconds) to count failures
# 600 = 10 minutes
findtime = 600

# Ban duration (seconds)
# 3600 = 1 hour
# 86400 = 24 hours
bantime = 3600

# Action to take when banning
# iptables-multiport: Block on multiple ports
action = iptables-multiport[name=CaddyAuth, port="http,https", protocol=tcp]
         # Optional: Send email notification
         # sendmail-whois[name=CaddyAuth, dest=admin@yourdomain.com]

# Backend to use for monitoring log file
# auto = automatically detect (systemd journal or file polling)
backend = auto

# OPTIONAL SETTINGS:

# Increase ban time on repeat offenders
# First ban: 1 hour, second: 24 hours, third: 1 week
# bantime.increment = true
# bantime.factor = 24
# bantime.maxtime = 604800  # 1 week max

# Find all jails using this ban
# This enables ban synchronization across jails
# banaction_allports = iptables-allports

# NOTES:
# - Adjust maxretry, findtime, and bantime based on your security needs
# - More aggressive: maxretry=3, findtime=300, bantime=86400
# - More lenient: maxretry=10, findtime=1200, bantime=1800
#
# TESTING:
# - Check if jail is running: sudo fail2ban-client status caddy-auth
# - View banned IPs: sudo fail2ban-client get caddy-auth banip
# - Unban an IP: sudo fail2ban-client set caddy-auth unbanip 1.2.3.4
# - Test filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf