Setting up fail2ban for Trilium server

[nema69]

Hey everyone,
I have Trilium running in a docker container on a raspberry pi, which I can acces from the internet. For security reasons I'm trying to set up fail2ban. I'm stuck on the part where I have to tell fail2ban the path to the log file(s) of Trilium. Since Trilium creates a new logfile for every day, I'm not sure how to proceed. Has anyone set up fail2ban before and would share their config?
Thanks in advance :)

[sigaloid]

I believe that fail2ban should be pointed towards the path of the log file for your reverse proxy. Trilium doesn't log IP's so its logs won't be particularly helpful to banning bad IP's.

[Talisker69]

Hi folks,
Same problem here, that's really a shame that the log do not include client IP.
Hackers can brute force the password ...

[sigaloid]

It technically does log IP's but since it's behind a reverse proxy, it's just all localhost.

[TheBig-O]

There's actually a pretty easy way to get the client IP. In you reverse proxy, add the following line to your proxy and it will start showing correctly. For NGINX Proxy Manager, put this line under the "Advanced" tab: real_ip_header CF-Connecting-IP;
After that, you just need to add the filter to Fail2ban and you're all set.

[Talisker69]

Thanks