Vaultwarden Docker on Raspberry Pi with Caddy and Fail2ban

### docker-compose.yml ###
services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vaultwarden.example.com" # change to you external facing domain, otherwise you can set it your local host name
      SIGNUPS_ALLOWED: "true" # deactivate this with "false" after creating all accounts
      ADMIN_TOKEN: SOME_RANDOM_PASSWORD # You should follow the instructions here to encrypt it. https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#using-argon2
      LOG_FILE: "/data/vaultwarden.log"
      LOG_LEVEL: "warn"
      EXTENDED_LOGGING: "true"
      TZ: "America/Chicago" # Update to your time zone
    volumes:
      - /vw-data/:/data/ # update to your data folder, the first one is where it's on your local system
#    ports:
#      - 11005:80 # external:internal to docker

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
      - 443:443/udp # Needed for HTTP/3
    volumes:
      #- ./caddy:/usr/bin/caddy
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data
    environment:
      DOMAIN: "https://vaultwarden.example.com" # change to you external facing domain, otherwise you can set it your local host name
      EMAIL: "[email protected]"
      LOG_FILE: "/data/access.log"
      TZ: "America/Chicago" # Update to your time zone

  fail2ban:
    image: crazymax/fail2ban
    container_name: fail2ban
    restart: always
    environment:
      - TZ=America/Chicago  # Update to your time zone
      - F2B_DB_PURGE_AGE=30d
      - F2B_LOG_TARGET=/data/fail2ban.log
      - F2B_LOG_LEVEL=INFO
      - F2B_IPTABLES_CHAIN=FORWARD
    volumes:
      - /fail2ban/:/data
      - /vw-data:/vaultwarden:ro  # update both of these where you want the data for each of these to be stored on the host system
    network_mode: "host"
    privileged: true
    cap_add:
      - NET_ADMIN
      - NET_RAW


### Caddyfile ###
{$DOMAIN} {
  log {
    level INFO
    output file {$LOG_FILE} {
      roll_size 10MB
      roll_keep 10
    }
  }

  # Use the ACME HTTP-01 challenge to get a cert for the configured domain.
  tls {$EMAIL}

  # This setting may have compatibility issues with some browsers
  # (e.g., attachment downloading on Firefox). Try disabling this
  # if you encounter issues.
  encode zstd gzip

  # Uncomment to improve security (WARNING: only use if you understand the implications!)
  # If you want to use FIDO2 WebAuthn, set X-Frame-Options to "SAMEORIGIN" or the Browser will block those requests
  header / {
  #	# Enable HTTP Strict Transport Security (HSTS)
  #	Strict-Transport-Security "max-age=31536000;"
  #	# Disable cross-site filter (XSS)
  #	X-XSS-Protection "0"
  #	# Disallow the site to be rendered within a frame (clickjacking protection)
  #	X-Frame-Options "DENY"
	# Prevent search engines from indexing (optional)
	X-Robots-Tag "noindex, nofollow"
  #	# Disallow sniffing of X-Content-Type-Options
  #	X-Content-Type-Options "nosniff"
  #	# Server name removing
  #	-Server
  #	# Remove X-Powered-By though this shouldn't be an issue, better opsec to remove
  #	-X-Powered-By
  #	# Remove Last-Modified because etag is the same and is as effective
  #	-Last-Modified
  }

  # Proxy everything Rocket
  reverse_proxy vaultwarden:80 {
       # Send the true remote IP to Rocket, so that vaultwarden can put this in the
       # log, so that fail2ban can ban the correct IP.
       header_up X-Real-IP {remote_host}
  }
}


### /fail2ban/jail.d/vaultwarden.local ###
[vaultwarden]
enabled = true
port = 80,443,8081
filter = vaultwarden
banaction = %(banaction_allports)s
#banaction = iptables
logpath = /vaultwarden/vaultwarden.log
maxretry = 5
bantime = 14400
findtime = 14400
chain = FORWARD
actiontype = multiport

### /fail2ban/jail.d/vaultwarden-admin.local ###
[vaultwarden-admin]
enabled = true
port = 80,443
filter = vaultwarden-admin
banaction = %(banaction_allports)s
logpath = /vaultwarden/vaultwarden.log
maxretry = 3
bantime = 14400
findtime = 14400
chain = FORWARD
actiontype = multiport

### /fail2ban/jail.d/vaultwarden-totp.local ###
[vaultwarden-totp]
enabled = true
port = 80,443
filter = vaultwarden-totp
banaction = %(banaction_allports)s
logpath = /vaultwarden/vaultwarden.log
maxretry = 3
bantime = 14400
findtime = 14400
chain = FORWARD
actiontype = multiport

### /fail2ban/action.d/iptables.local ###
[Init]
blocktype = DROP
[Init?family=inet6]
blocktype = DROP

[Definition]
actionban = <iptables> -I <chain> 1 -s <ip> -j <blocktype>
actionunban = <iptables> -D <chain> -s <ip> -j <blocktype>

### /fail2ban/filter.d/vaultwarden.local ###
[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =

### /fail2ban/filter.d/vaultwarden-admin.local ###
[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*Invalid admin token\. IP: <ADDR>.*$
ignoreregex =

### /fail2ban/filter.d/vaultwarden-totp.local ###
[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*\[ERROR\] Invalid TOTP code! Server time: (.*) UTC IP: <ADDR>$
ignoreregex =