Funkwhale

Configuration for the Funkwhale music streaming platform.

It logs failed login attempts, but not the associated IP, so we'll need to resort to the reverse proxy logs.

Uncommonly, the HTTP code sent after a failed login is 400, Bad Request.

The request to authenticate is a POST on /api/v2/users/login.

A regex for nginx can look like this:

@'^<ip> .* domain.name "POST /api/v\d/users/login HTTP/..." 400 '

Adjust domain.name according to your domain.

Example:

{
  streams: {
    nginx: {
      cmd: ['...'], // see ./nginx.md
      filters: {
        directus: {
          regex: [
            @'^<ip> .* music.example.com "POST /api/v\d/users/login HTTP/..." 400 '
          ],
          retry: 3,
          retryperiod: '6h',
          actions: banFor('48h'),
        },
      },
    },
  },
}

This example makes the assumption that a function named banFor is defined. See the ipset example. It also makes the assumption that there is a pattern named ip.