I’ve been doing some selfhosting and want to setup fail2ban for my exposed apps, but am unsure if that should be setup on my router (OpenWRT), on each server that may be exposed, or just in the Caddy container?

My setup right now is: TP-Link router with OpenWRT Lenovo M910q with Proxmox, which hosts the following:

  • Caddy in a container for reverse proxies to hosted apps
  • Home Assistant OS in VM#1
  • Other apps in docker containers on VM#2
  • frongt@lemmy.zipEnglish
    7·
    23 hours ago

    Don’t modify containers. Send their logs to fail2ban and block things at the edge.

    • anticonnor@lemmy.worldOPEnglish
      21·
      23 hours ago

      I’m still not sure what this means. Run fail2ban on the router or on each VM? Caddy does have a fail2ban module if it makes more sense to run there?