# Limristem eMail fail2ban jails (Debian 13 / systemd journal backend).
# Bootstrap defaults — at runtime regenerated by manage-limits.sh from env:
#   limristem-mail limits set fail2ban-<jail>-{maxretry,findtime,bantime} <value>
# Installed as /etc/fail2ban/jail.d/limristem-mail.local

[DEFAULT]
banaction = nftables-multiport
backend = systemd
findtime = 10m
bantime = 1h
maxretry = 5

[sshd]
enabled = true
backend = systemd
port = ssh
filter = sshd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
maxretry = 5
findtime = 10m
bantime = 1h

# Dovecot IMAP/POP auth failures
[dovecot]
enabled = true
backend = systemd
filter = dovecot
port = pop3,pop3s,imap,imaps,submission,465,sieve
journalmatch = _SYSTEMD_UNIT=dovecot.service + _COMM=dovecot
maxretry = 8
findtime = 15m
bantime = 1h

# Postfix SMTP (generic)
[postfix]
enabled = true
backend = systemd
filter = postfix[mode=more]
port = smtp,ssmtp,submission,465
journalmatch = _SYSTEMD_UNIT=postfix.service + _COMM=smtpd
maxretry = 8
findtime = 10m
bantime = 1h

# Postfix SASL auth failures (submission)
[postfix-sasl]
enabled = true
backend = systemd
filter = postfix[mode=auth]
port = smtp,ssmtp,submission,465
journalmatch = _SYSTEMD_UNIT=postfix.service + _COMM=smtpd
maxretry = 5
findtime = 10m
bantime = 1h

# Nginx basic auth / bot probes
[nginx-http-auth]
enabled = true
backend = systemd
port = http,https
filter = nginx-http-auth
journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
maxretry = 5
findtime = 10m
bantime = 1h

[nginx-botsearch]
enabled = true
backend = systemd
port = http,https
filter = nginx-botsearch
journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
maxretry = 10
findtime = 10m
bantime = 1h

# Limristem panel/API auth (custom filter)
[limristem-mail-auth]
enabled = true
backend = systemd
port = http,https
filter = limristem-mail-auth
journalmatch = _SYSTEMD_UNIT=limristem-mail.service
maxretry = 8
findtime = 15m
bantime = 2h

# Repeat offenders
[recidive]
enabled = true
logpath = /var/log/fail2ban.log
backend = auto
bantime = 1w
findtime = 1d
maxretry = 3