# Fail2ban filter for Caddy web server
#
# INSTALLATION:
# 1. Copy this file to: /etc/fail2ban/filter.d/caddy-auth.conf
#    sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
#
# 2. Create jail configuration at: /etc/fail2ban/jail.d/caddy.conf
#    (See fail2ban-caddy-jail.conf in this directory)
#
# 3. Ensure Caddy is logging in JSON format to /var/log/caddy/access.log
#    (See caddy-setup-helper.sh for configuration examples)
#
# 4. Restart fail2ban:
#    sudo systemctl restart fail2ban
#
# 5. Check status:
#    sudo fail2ban-client status caddy-auth

[INCLUDES]
before = common.conf

[Definition]

# Match failed authentication attempts and forbidden access
# Caddy JSON log format: {"remote_ip":"1.2.3.4","status":401,...}
failregex = ^.*"remote_ip":"<HOST>".*"status":(?:401|403|429).*$
            ^.*"remote_addr":"<HOST>.*"status":(?:401|403|429).*$
            ^.*"client_ip":"<HOST>".*"status":(?:401|403|429).*$

# Ignore localhost and common false positives
ignoreregex = ^.*"remote_ip":"(?:127\.0\.0\.1|::1)".*$
              ^.*"remote_addr":"(?:127\.0\.0\.1|::1)".*$

# Optional: Date/time pattern for log analysis
# Most Caddy JSON logs include "ts" field with Unix timestamp
datepattern = "ts":%%s

[Init]
journalmatch = _SYSTEMD_UNIT=caddy.service

# NOTES:
# - This filter looks for HTTP status codes:
#   401 = Unauthorized (failed authentication)
#   403 = Forbidden (access denied)
#   429 = Too Many Requests (rate limiting)
#
# - Adjust the status codes based on your needs
# - For more aggressive blocking, add: 404|500
# - Test the filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf