Setting up fail2ban on Caddy

[PopeRigby]

OS: Debian Buster
Caddy: v2.1.1
Docker: v19.03.12

I’m trying to setup fail2ban on top of Caddy so I can block all suspicious traffic hitting my external services. How can I set this up? I have Caddy running in a Docker container, and fail2ban running on bare metal.

[francislavoie]

Unfortunately Caddy isn’t really equipped to make this easy right now, since fail2ban relies on reading server logs to make ban decisions.

If you’re willing to help test and give feedback, the following PR could possibly be reopened to add functionality in Caddy to make this easier:

https://github.com/caddyserver/caddy/pull/3364

Please read the discussion on that PR and the issue attached to get an idea of the problem at hand

[PopeRigby]

Thanks. I’ve commend on the PR.

[mysticaltech (Karim Naufal)]

@PopeRigby it’s actually not hard at all to do and works well, please see the latest comments on the github issue above.

[francislavoie]

FYI I recommend using common_log rather than logfmt because logfmt is deprecated and will be eventually removed.

Use format single_field common_log instead.

[mysticaltech (Karim Naufal)]

Thanks @francislavoie, I just switched and used the following caddy.conf file (for those that need it):

Btw, the depreciation notice could be updated in the docs to switch it from common_log to logfmt (probably it’s not necessary to open an issue for this).