fail2ban nginx jail: read the journal (NixOS nginx logs errors to stderr, not error.log)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/hosts/cc-ci/configuration.nix

@@ -58,7 +58,7 @@
   };
 
   # ---- fail2ban: sshd (password auth is off, this stops the log noise and slow brute force) and
-  # the opencode UI's basic auth (nginx logs 401s with the real client IP to its error log; the
+  # the opencode UI's basic auth (nginx logs 401s with the real client IP to the journal; the
   # built-in nginx-http-auth filter matches them). Those clients arrive through traefik's
   # docker-published 443, which iptables FORWARDs rather than INPUTs, so the ban for that jail
   # goes into the DOCKER-USER chain — an INPUT rule would never see the traffic.
@@ -71,8 +71,10 @@
     jails.nginx-http-auth.settings = {
       enabled = true;
       filter = "nginx-http-auth";
-      logpath = "/var/log/nginx/error.log";
-      backend = "auto";
+      # NixOS nginx logs errors to stderr → the journal, not /var/log/nginx/error.log (which
+      # exists but stays empty). Read the unit's journal instead.
+      backend = "systemd";
+      journalmatch = "_SYSTEMD_UNIT=nginx.service";
       banaction = "iptables-allports";
       chain = "DOCKER-USER";
     };