# SPDX-License-Identifier: AGPL-3.0-only
# The Shieldlist controller refusing a sign-in or a credential, in its own
# log (slog text): the console and the API under brute force. The address
# is the client's — X-Forwarded-For is trusted only from a proxy on the
# same machine — so behind nginx it is the real one.
#   time=2026-08-16T01:08:44.705Z level=WARN msg="sign-in refused" from=203.0.113.9 name=admin
#   time=2026-08-16T01:08:44.705Z level=WARN msg="credential refused" from=203.0.113.9
parser: shieldlist-refused
log: shieldlist
prefilter: "refused"
regex: '^time=(?P<time>\S+) level=WARN msg="(?:sign-in|credential) refused" from=(?P<ip>[0-9a-fA-F.:]+)'
time_field: time
time_format: rfc3339
