# /etc/fail2ban/jail.local   (episode 10)
[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
# localhost and the NetBird mesh range are never banned. Do NOT put your own
# home/office IP here - if you never guess passwords you never get banned, and
# an ignore entry is one more secret to keep out of a public repo.
ignoreip = 127.0.0.1/8 ::1 100.125.0.0/16
banaction = iptables-multiport

[sshd]
enabled  = true
# Debian 13 ships no /var/log/auth.log without rsyslog; read the journal instead.
backend  = systemd
maxretry = 5
findtime = 10m
bantime  = 1h

[caddy-probes]
enabled  = true
backend  = auto
logpath  = /opt/selfhostedops-stack/logs/caddy/access.log
filter   = caddy-probes
maxretry = 10
findtime = 1m
bantime  = 1h
port     = http,https
# The ban has to land in DOCKER-USER, not INPUT - Caddy's traffic is forwarded,
# a ban in INPUT never touches it and the "banned" bot keeps getting answers.
# chain must be a plain parameter here: the default action_ template passes
# chain="%(chain)s", so putting [chain=...] inside banaction gets overridden.
chain = DOCKER-USER