Claude
5dbb27ee8b
FIXES: - Fix Magic Mirror npm install to run inside Docker container instead of on host - npm (Node Package Manager) commands now execute inside the MagicMirror container where Node.js is installed, preventing errors on hosts without Node.js NEW SERVICES: - Add ActualBudget: Open-source personal finance management with bank sync (SimpleFIN) - Add Keycloak: Identity and Access Management (SSO, OAuth2, SAML, MFA) - Both services integrated into main installation script and available as standalone docker-compose files for existing servers CADDY & FAIL2BAN: - Add caddy-setup-helper.sh: Interactive script to configure Caddy and fail2ban * Detects existing Caddy installation * Automatically backs up Caddyfile with timestamp * Checks for fail2ban support * Provides service integration examples - Add fail2ban filter and jail configurations for Caddy protection - Add comprehensive setup guide (CADDY-FAIL2BAN-SETUP.md) DOCUMENTATION: - Detailed deployment instructions for each service - Reverse proxy configuration examples - Security best practices and headers - Backup/restore procedures - Troubleshooting guides This update enables secure deployment of new services on existing servers with proper Caddy reverse proxy integration and fail2ban protection against attacks.
50 lines
1.6 KiB
Plaintext
50 lines
1.6 KiB
Plaintext
# Fail2ban filter for Caddy web server
|
|
#
|
|
# INSTALLATION:
|
|
# 1. Copy this file to: /etc/fail2ban/filter.d/caddy-auth.conf
|
|
# sudo cp fail2ban-caddy-filter.conf /etc/fail2ban/filter.d/caddy-auth.conf
|
|
#
|
|
# 2. Create jail configuration at: /etc/fail2ban/jail.d/caddy.conf
|
|
# (See fail2ban-caddy-jail.conf in this directory)
|
|
#
|
|
# 3. Ensure Caddy is logging in JSON format to /var/log/caddy/access.log
|
|
# (See caddy-setup-helper.sh for configuration examples)
|
|
#
|
|
# 4. Restart fail2ban:
|
|
# sudo systemctl restart fail2ban
|
|
#
|
|
# 5. Check status:
|
|
# sudo fail2ban-client status caddy-auth
|
|
|
|
[INCLUDES]
|
|
before = common.conf
|
|
|
|
[Definition]
|
|
|
|
# Match failed authentication attempts and forbidden access
|
|
# Caddy JSON log format: {"remote_ip":"1.2.3.4","status":401,...}
|
|
failregex = ^.*"remote_ip":"<HOST>".*"status":(?:401|403|429).*$
|
|
^.*"remote_addr":"<HOST>.*"status":(?:401|403|429).*$
|
|
^.*"client_ip":"<HOST>".*"status":(?:401|403|429).*$
|
|
|
|
# Ignore localhost and common false positives
|
|
ignoreregex = ^.*"remote_ip":"(?:127\.0\.0\.1|::1)".*$
|
|
^.*"remote_addr":"(?:127\.0\.0\.1|::1)".*$
|
|
|
|
# Optional: Date/time pattern for log analysis
|
|
# Most Caddy JSON logs include "ts" field with Unix timestamp
|
|
datepattern = "ts":%%s
|
|
|
|
[Init]
|
|
journalmatch = _SYSTEMD_UNIT=caddy.service
|
|
|
|
# NOTES:
|
|
# - This filter looks for HTTP status codes:
|
|
# 401 = Unauthorized (failed authentication)
|
|
# 403 = Forbidden (access denied)
|
|
# 429 = Too Many Requests (rate limiting)
|
|
#
|
|
# - Adjust the status codes based on your needs
|
|
# - For more aggressive blocking, add: 404|500
|
|
# - Test the filter: fail2ban-regex /var/log/caddy/access.log /etc/fail2ban/filter.d/caddy-auth.conf
|