Caddy

Developer Builds Custom Bouncer Tool to Automatically Block .env and SSH Probing on VPS

A system administrator running a small VPS with Caddy and static sites grew tired of constant password guessing attempts against SSH and repeated probes for files like .env, wp-admin, and config.php.bak. Instead of relying on Fail2ban, which required complex jail and filter configuration, the admin created a lightweight Rust-based tool named Bouncer. The program first crawls the site to build a list of legitimate paths, then monitors access logs and systemd journal entries for SSH invalid user attempts. IPs that generate multiple 404 responses for unknown paths or trigger SSH invalid user messages are added to an nftables set for automatic blocking. Special immediate bans are applied for direct hits on sensitive files such as /.env. The tool avoids double-counting SSH log lines, skips historical log replay on startup, and integrates directly with existing nftables rules without requiring additional runtime dependencies.