# Fail2ban filter configuration for traefik :: auth
# used to ban hosts, that were failed through traefik
#
# Author: CrazyMax
#
# To use 'traefik-auth' filter you have to configure your Traefik instance to write
# the access logs as describe in https://docs.traefik.io/configuration/logs/#access-logs
# into a log file on host and specifiy users for Basic Authentication
# https://docs.traefik.io/configuration/entrypoints/#basic-authentication
#
# Example:
#
# version: "3.2"
#
# services:
#   traefik:
#     image: traefik:latest
#     command:
#       - "--loglevel=INFO"
#       - "--accesslog=true"
#       - "--accessLog.filePath=/var/log/access.log"
# #       - "--accessLog.filters.statusCodes=400-499"
#       - "--defaultentrypoints=http,https"
#       - "--entryPoints=Name:http Address::80"
#       - "--entryPoints=Name:https Address::443 TLS"
#       - "--docker.domain=example.com"
#       - "--docker.watch=true"
#       - "--docker.exposedbydefault=false"
#       - "--api=true"
#       - "--api.dashboard=true"
#     ports:
#       - target: 80
#         published: 80
#         protocol: tcp
#         mode: host
#       - target: 443
#         published: 443
#         protocol: tcp
#         mode: host
#     labels:
#       - "traefik.enable=true"
#       - "traefik.port=8080"
#       - "traefik.backend=traefik"
#       - "traefik.frontend.rule=Host:traefik.example.com"
#       - "traefik.frontend.auth.basic.users=test:$$apr1$$H6uskkkW$$IgXLP6ewTrSuBkTrqE8wj/"
#     volumes:
#       - "/var/log/traefik:/var/log"
#       - "/var/run/docker.sock:/var/run/docker.sock"
#     restart: always
#

[Definition]

failregex = ^<HOST> \- (?!- )\S+ \[\] \"(GET|POST|HEAD) [^\"]+\" 401\b

ignoreregex =