# Fail2ban filter for Limristem eMail API/panel authentication failures.
#
# Matches the single line api/security.py:register_auth_failure() emits into the
# journal for every failed authentication — API Basic, Bearer, panel login, panel MFA
# and the internode token all funnel through that function.
#
# The address here is the one the app resolved, not the TCP peer: behind nginx the peer
# is always 127.0.0.1, so client_address() unwraps X-Forwarded-For for trusted proxies
# first. Earlier revisions of this filter guessed at half a dozen message formats the
# app never produced and therefore banned nobody; keep this in sync with
# AUTH_FAILURE_LOG_PREFIX rather than adding speculative alternatives.

[Definition]
failregex = ^.*limristem-mail authentication failure client=<HOST>\s*$

ignoreregex =

datepattern = {^LN-BEG}
journalmatch = _SYSTEMD_UNIT=limristem-mail.service