# ============================================
# Fail2Ban Configuration for SIAKAD
# ============================================

# /etc/fail2ban/jail.local

[DEFAULT]
# Ban settings
bantime = 3600
findtime = 600
maxretry = 5
backend = systemd

# Email notifications (optional)
destemail = security@undarma.ac.id
sendername = SIAKAD Security
mta = sendmail

# Actions
action = %(action_mwl)s

# ============================================
# JAILS
# ============================================

[nginx-auth]
enabled = true
filter = nginx-auth
port = http,https
logpath = /var/log/nginx/siakad-error.log
maxretry = 5
bantime = 3600

[nginx-login]
enabled = true
filter = nginx-login
port = http,https
logpath = /var/log/nginx/siakad-access.log
maxretry = 3
bantime = 7200
findtime = 300

[nginx-badbots]
enabled = true
filter = nginx-badbots
port = http,https
logpath = /var/log/nginx/siakad-access.log
maxretry = 2
bantime = 86400

[nginx-noscript]
enabled = true
filter = nginx-noscript
port = http,https
logpath = /var/log/nginx/siakad-access.log
maxretry = 6
bantime = 86400

[nginx-req-limit]
enabled = true
filter = nginx-limit-req
port = http,https
logpath = /var/log/nginx/siakad-error.log
maxretry = 10
bantime = 3600

[php-url-fopen]
enabled = true
port = http,https
filter = php-url-fopen
logpath = /var/log/nginx/siakad-access.log
maxretry = 1
bantime = 86400

[siakad-laravel]
enabled = true
filter = siakad-laravel
port = http,https
logpath = /var/www/siakad/storage/logs/laravel.log
maxretry = 5
bantime = 3600

# ============================================
# CUSTOM FILTERS
# /etc/fail2ban/filter.d/
# ============================================

# nginx-login.conf
# [Definition]
# failregex = ^<HOST> .* "(POST|GET) /login.* HTTP/[0-9.]+" (403|401|429)
#             ^<HOST> .* "POST /login.* HTTP/[0-9.]+" 200.*"login.*failed"
# ignoreregex = ^<HOST> .* "POST /login.* HTTP/[0-9.]+" 302

# siakad-laravel.conf
# [Definition]
# failregex = ^.*\[.*\].*login.*failed.*IP:\s*<HOST>
#             ^.*\[.*\].*unauthorized.*access.*IP:\s*<HOST>
#             ^.*\[.*\].*suspicious.*activity.*IP:\s*<HOST>
# ignoreregex =