# Fail2ban filter for Traefik rate limiting
# Blocks IPs that trigger rate limit responses (429 Too Many Requests)

[Definition]
failregex = ^.*"ClientAddr":"<HOST>:\d+".*"RequestMethod":"(GET|POST|PUT|DELETE|PATCH)".*"DownstreamStatus":429.*$
ignoreregex =

# Example log line (JSON):
# {"ClientAddr":"192.168.1.100:54321","DownstreamStatus":429,"RequestMethod":"POST",...}