#!/bin/bash

# pick the last 10 mins of the git.log (2000 lines should cover that) and count the auth failures 
# format logfile:
#   2020/12/29 15:41:45 ...xorm/session_find.go:199.........

ERRORFILE='/tmp/gitea_error.log'

tail -2000 /var/lib/gitea/log/gitea.log | grep 'Failed authentication' | ./last10mins gitea >${ERRORFILE}
cat ${ERRORFILE} | while read -r LINE; do
    IP=$(echo ${LINE} | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
    addEvent.sh "BLOCK,${IP},3,5,Unauthorized authorization attempt in Gitea"
done

cat ${ERRORFILE} | wc -l