Claude
5dbb27ee8b
FIXES: - Fix Magic Mirror npm install to run inside Docker container instead of on host - npm (Node Package Manager) commands now execute inside the MagicMirror container where Node.js is installed, preventing errors on hosts without Node.js NEW SERVICES: - Add ActualBudget: Open-source personal finance management with bank sync (SimpleFIN) - Add Keycloak: Identity and Access Management (SSO, OAuth2, SAML, MFA) - Both services integrated into main installation script and available as standalone docker-compose files for existing servers CADDY & FAIL2BAN: - Add caddy-setup-helper.sh: Interactive script to configure Caddy and fail2ban * Detects existing Caddy installation * Automatically backs up Caddyfile with timestamp * Checks for fail2ban support * Provides service integration examples - Add fail2ban filter and jail configurations for Caddy protection - Add comprehensive setup guide (CADDY-FAIL2BAN-SETUP.md) DOCUMENTATION: - Detailed deployment instructions for each service - Reverse proxy configuration examples - Security best practices and headers - Backup/restore procedures - Troubleshooting guides This update enables secure deployment of new services on existing servers with proper Caddy reverse proxy integration and fail2ban protection against attacks.
83 lines
2.5 KiB
Plaintext
83 lines
2.5 KiB
Plaintext
# Fail2ban jail configuration for Caddy web server
|
|
#
|
|
# INSTALLATION:
|
|
# 1. Copy this file to: /etc/fail2ban/jail.d/caddy.conf
|
|
# sudo cp fail2ban-caddy-jail.conf /etc/fail2ban/jail.d/caddy.conf
|
|
#
|
|
# 2. Ensure the filter is installed:
|
|
# sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
|
|
#
|
|
# 3. Create log directory if it doesn't exist:
|
|
# sudo mkdir -p /var/log/caddy
|
|
# sudo chown caddy:caddy /var/log/caddy # Or appropriate user
|
|
#
|
|
# 4. Restart fail2ban:
|
|
# sudo systemctl restart fail2ban
|
|
#
|
|
# 5. Check status:
|
|
# sudo fail2ban-client status caddy-auth
|
|
|
|
[caddy-auth]
|
|
# Enable this jail
|
|
enabled = true
|
|
|
|
# Ports to protect (HTTP and HTTPS)
|
|
port = http,https
|
|
|
|
# Filter to use (must match filename in /etc/fail2ban/filter.d/)
|
|
filter = caddy-auth
|
|
|
|
# Log file to monitor
|
|
# Adjust this path if your Caddy logs are elsewhere
|
|
logpath = /var/log/caddy/access.log
|
|
/var/log/caddy/*-access.log
|
|
|
|
# For Docker Caddy, you might need to use Docker logs:
|
|
# logpath = /var/lib/docker/containers/*-caddy*/*.log
|
|
|
|
# Maximum retry before ban
|
|
# 5 attempts within findtime period will trigger a ban
|
|
maxretry = 5
|
|
|
|
# Time window (seconds) to count failures
|
|
# 600 = 10 minutes
|
|
findtime = 600
|
|
|
|
# Ban duration (seconds)
|
|
# 3600 = 1 hour
|
|
# 86400 = 24 hours
|
|
bantime = 3600
|
|
|
|
# Action to take when banning
|
|
# iptables-multiport: Block on multiple ports
|
|
action = iptables-multiport[name=CaddyAuth, port="http,https", protocol=tcp]
|
|
# Optional: Send email notification
|
|
# sendmail-whois[name=CaddyAuth, dest=admin@yourdomain.com]
|
|
|
|
# Backend to use for monitoring log file
|
|
# auto = automatically detect (systemd journal or file polling)
|
|
backend = auto
|
|
|
|
# OPTIONAL SETTINGS:
|
|
|
|
# Increase ban time on repeat offenders
|
|
# First ban: 1 hour, second: 24 hours, third: 1 week
|
|
# bantime.increment = true
|
|
# bantime.factor = 24
|
|
# bantime.maxtime = 604800 # 1 week max
|
|
|
|
# Find all jails using this ban
|
|
# This enables ban synchronization across jails
|
|
# banaction_allports = iptables-allports
|
|
|
|
# NOTES:
|
|
# - Adjust maxretry, findtime, and bantime based on your security needs
|
|
# - More aggressive: maxretry=3, findtime=300, bantime=86400
|
|
# - More lenient: maxretry=10, findtime=1200, bantime=1800
|
|
#
|
|
# TESTING:
|
|
# - Check if jail is running: sudo fail2ban-client status caddy-auth
|
|
# - View banned IPs: sudo fail2ban-client get caddy-auth banip
|
|
# - Unban an IP: sudo fail2ban-client set caddy-auth unbanip 1.2.3.4
|
|
# - Test filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf
|