From 536d621865a74934c9f51263e08e67f75db45a89 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 7 Sep 2026 21:08:22 +0000 Subject: [PATCH] fail2ban nginx jail: read the journal (NixOS nginx logs errors to stderr, not error.log) Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz --- README.md | 3 ++- nix/hosts/cc-ci/configuration.nix | 8 +++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index a11033e..fece428 100644 --- a/README.md +++ b/README.md @@ -268,7 +268,8 @@ dig +short @ ns-acme.commoninternet.net # acme-dns answering on the public The opencode UI: `curl -s --resolve oc.ci.commoninternet.net:443: -o /dev/null -w '%{http_code}' https://oc.ci.commoninternet.net/` → 401 without credentials, 200 with `-u oc:`; `fail2ban-client status nginx-http-auth` -counts the failures. +counts the failures (it reads nginx's journal — NixOS nginx logs to stderr, not to +/var/log/nginx/error.log). When it is healthy: `sudo nixos-rebuild switch --flake .#cc-ci` (same config, now also the boot default). **If you are migrating from another host, do §6 before letting it serve anything**: right diff --git a/nix/hosts/cc-ci/configuration.nix b/nix/hosts/cc-ci/configuration.nix index 5ae76b9..4a359c1 100644 --- a/nix/hosts/cc-ci/configuration.nix +++ b/nix/hosts/cc-ci/configuration.nix @@ -58,7 +58,7 @@ }; # ---- fail2ban: sshd (password auth is off, this stops the log noise and slow brute force) and - # the opencode UI's basic auth (nginx logs 401s with the real client IP to its error log; the + # the opencode UI's basic auth (nginx logs 401s with the real client IP to the journal; the # built-in nginx-http-auth filter matches them). Those clients arrive through traefik's # docker-published 443, which iptables FORWARDs rather than INPUTs, so the ban for that jail # goes into the DOCKER-USER chain — an INPUT rule would never see the traffic. @@ -71,8 +71,10 @@ jails.nginx-http-auth.settings = { enabled = true; filter = "nginx-http-auth"; - logpath = "/var/log/nginx/error.log"; - backend = "auto"; + # NixOS nginx logs errors to stderr → the journal, not /var/log/nginx/error.log (which + # exists but stays empty). Read the unit's journal instead. + backend = "systemd"; + journalmatch = "_SYSTEMD_UNIT=nginx.service"; banaction = "iptables-allports"; chain = "DOCKER-USER"; };