Skip to main content

Templates

Templates define fail2ban jail configurations that can be deployed to servers.

Builtin Templates​

Bloqd includes 20+ pre-configured templates:

Common​

TemplateDescription
sshdSSH brute force protection
recidiveBans repeat offenders longer

Web Servers​

TemplateDescription
nginx-http-authHTTP Basic Auth failures
nginx-botsearchBot scanners (404 errors)
apache-authApache authentication failures
apache-badbotsMalicious user agents
apache-overflowsBuffer overflow attempts

Mail​

TemplateDescription
postfixPostfix authentication failures
postfix-saslSASL authentication failures
dovecotDovecot IMAP/POP3 failures

Mailcow​

TemplateDescription
mailcow-saslMailcow SASL failures
mailcow-pregreetPre-greeting protocol violations
mailcow-dnsblDNSBL rejections
mailcow-sogoSOGo webmail failures
mailcow-rspamdRspamd spam filter blocks

Databases​

TemplateDescription
mysqld-authMySQL authentication failures
mongodb-authMongoDB authentication failures

Web Applications​

TemplateDescription
wordpressWordPress login failures
wordpress-hardAggressive WordPress protection
phpmyadminphpMyAdmin login failures
nextcloudNextcloud login failures
grafanaGrafana login failures

Virtualization​

TemplateDescription
proxmoxProxmox VE login failures
proxmox-sshProxmox SSH access
proxmox-spiceproxySPICE proxy failures

Template Structure​

Each template consists of:

Filter Configuration​

Defines the regex patterns to match log entries:

[Definition]
failregex = ^<HOST> - .* "POST /wp-login.php .* 200
ignoreregex =
datepattern = ^%%d/%%b/%%Y:%%H:%%M:%%S %%z

Jail Configuration​

Defines how fail2ban handles matches:

[wordpress]
enabled = true
port = http,https
filter = wordpress
logpath = /var/log/nginx/access.log
maxretry = 5
findtime = 600
bantime = 3600
action = %(action_)s
         bloqd-report

Using Templates​

During Server Setup​

  1. Add a new server
  2. Select templates from the list
  3. Configure settings per template:
    • Log path (if different from default)
    • Max retry
    • Find time
    • Ban time
  4. Generate install command

Adding to Existing Server​

  1. Go to server detail page
  2. Click Edit Config
  3. In the Add Jails section, select new templates
  4. Configure settings
  5. Save changes

Agent applies changes on next sync.

Custom Templates (Personal+)​

Create your own templates for custom applications.

Create New Template​

  1. Go to Templates page
  2. Click Create Template
  3. Fill in details:
    • Name: Unique identifier (e.g., my-app)
    • Category: Organization category
    • Description: What this template protects
  4. Define the filter: 
    [Definition]
    failregex = ^<HOST> .* authentication failed
    ignoreregex =
  5. Define the jail config: 
    [my-app]
    enabled = true
    port = 8080
    filter = my-app
    logpath = /var/log/my-app/access.log
    maxretry = 3
  6. Save template

Copy Existing Template​

  1. Find a builtin template
  2. Click Copy action
  3. Modify as needed
  4. Save with new name

Template Variables​

Use placeholders for dynamic values:

PlaceholderDescription
__LOGPATH__Log file path
__PORT__Service port
__MAXRETRY__Max retry count
__FINDTIME__Find time window
__BANTIME__Ban duration

These are replaced with actual values during deployment.

Docker Templates​

For containerized applications, use the Docker log source:

  1. Set Is Docker to true
  2. Specify Container Name
  3. Bloqd creates a log streaming service

Example for a custom Docker app:

  • Container: my-docker-app
  • Log path: /var/log/bloqd/my-docker-app.log

Testing Templates​

Test Filter Regex​

Before deploying, test your filter:

  1. Go to template edit page
  2. Click Test Filter
  3. Paste sample log lines
  4. Verify matches

Preview Configuration​

See the generated configuration:

  1. Click Preview on template
  2. Enter sample values
  3. View generated filter.conf and jail.conf

Filter Syntax​

Basic Regex​

failregex = ^<HOST> .* "Failed password"
  • <HOST> - Special placeholder for IP extraction
  • ^ - Start of line
  • .* - Match any characters

Multiple Patterns​

failregex = ^<HOST> .* "authentication failure"
            ^<HOST> .* "invalid user"

Ignore Patterns​

ignoreregex = ^<HOST> .* "successful login"

Date Patterns​

datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
              ^%%d/%%b/%%Y:%%H:%%M:%%S

Best Practices​

  1. Test before deploying - Always test filters with real log samples
  2. Start conservative - Begin with higher maxretry, lower as needed
  3. Document filters - Add comments explaining regex patterns
  4. Use categories - Organize templates by service type
  5. Version control - Keep backups of custom templates