---
definitions:
  - &iptablesban iptables -I reaction 1 -s <ip> -j block
  - &iptablesunban iptables -D reaction 1 -s <ip> -j block

# regexes:
#   ip: '(([0-9]{1,3}\.){3}[0-9]{1,3})|([0-9a-fA-F:]{2,90})'

streams:
  - cmd: journalctl -fu phpfpm-nextcloud.service
    filters:
      - regex:
          - '"message":"Login failed: .\+ (Remote IP: <ip>)"'
        retry: 3
        retry-period: 1h
        actions:
          - cmd: *iptablesban
          - cmd: *iptablesunban 
            after: 1h