Based on this comment: https://tt-rss.org/oldforum/viewtopic.php?p=18518&sid=cd24b02164d5690e0384795fc4a36c44#p18518 I updated the regex so it works with newer tt-rss versions and ported to nginx. tested on tt-rss18.8, behind nginx
edit config.php in tt-rss dir change the following line , so the parameter value is empty:
define('LOG_DESTINATION', '');
server {
...
error_log /var/log/nginx/tt-rss-error.log;
}
nano /etc/fail2ban/jail.local
add this to the end of the file:
[tt-rss]
enabled = true
port = http,https
filter = tt-rss
logpath = /var/log/nginx/tt-rss-error.log
maxretry = 3
cp tt-rss.conf /etc/fail2ban/filter.d/tt-rss.conf
service fail2ban restart