CaddyBan -- a lightweight alternative to fail2ban for Caddy

CaddyBan is meant to replace Fail2ban to analyse Caddy logs (JSON).

It's made for my own purpose, to protect my web server running Caddy and configured with picfg.

It is not as powerful or configurable than Fail2ban and it may break your own servers, you've been warned ;-)

CaddyBan is written in LuaX.

Usage

Usage: caddyban [-h] [-d] [-1] -c conf [-o output] [-b banned]
       <input> [<input>] ...

Light alternative to fail2ban for caddy

Arguments:
   input                 Caddy log files (JSON)

Options:
   -h, --help            Show this help message and exit.
   -d                    Dry run (only decode JSON files)
   -1                    Run once, don't watch for log updates (implies -d)
   -c conf               Configuration file
   -o output             Output file (default: stdin)
   -b banned             Save banned IPs to a file

CaddyBan detects bots and intrusive requests and ban their IPs with nftables.

Trouble shooting

CaddyBan uses nftables to block bots. Here are some commands that can be useful in case of trouble:

List banned IPs

sudo nft list set inet CADDYBAN BANNED_IPS

Remove banned IPs

Remove all IPs:

sudo nft flush set inet CADDYBAN BANNED_IPS

Remove one IP:

sudo nft delete element inet CADDYBAN BANNED_IPS { AAA.BBB.CCC.DDD }

License

CaddyBan is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

CaddyBan is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with CaddyBan.  If not, see <https://www.gnu.org/licenses/>.

For further information about CaddyBan you can visit
https://codeberg.org/cdsoft/caddyban