## Version 2022/08/06
# Fail2Ban filter configuration for nextcloud

[INCLUDES]
before = common.conf

[Definition]

_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*)

failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Login failed:
            ^\{%(_groupsre)s,?\s*"remoteAddr":"<HOST>"%(_groupsre)s,?\s*"message":"Trusted domain error.

datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?"
