fail2ban nginx jail: read the journal (NixOS nginx logs errors to stderr, not error.log)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
2026-09-07 21:08:22 +00:00
parent 666509d53d
commit 536d621865
2 changed files with 7 additions and 4 deletions
@@ -268,7 +268,8 @@ dig +short @<ip> ns-acme.commoninternet.net   # acme-dns answering on the public

 The opencode UI: `curl -s --resolve oc.ci.commoninternet.net:443:<ip> -o /dev/null -w '%{http_code}' https://oc.ci.commoninternet.net/`
 → 401 without credentials, 200 with `-u oc:<password>`; `fail2ban-client status nginx-http-auth`
-counts the failures.
+counts the failures (it reads nginx's journal — NixOS nginx logs to stderr, not to
+/var/log/nginx/error.log).

 When it is healthy: `sudo nixos-rebuild switch --flake .#cc-ci` (same config, now also the boot
 default). **If you are migrating from another host, do §6 before letting it serve anything**: right