403
Blocked by fail2ban (SERVER_ID)_
```
- Ensure that the html file is accessible to the user that executes nginx - in my case, this was `www-data`:
```bash
sudo chown www-data:www-data /var/www/html/custom-403.html
```
- Now you can edit any of the sites where you would like to apply this config (such as in `/etc/nginx/conf.d/vaultwarden.conf` ) and add a snippet in there:
```bash
sudo nano /etc/nginx/conf.d/vaultwarden.conf
# Find the server directive and add the following:
include /etc/nginx/snippets/custom-error-403.conf;
```
- For completeness, here is the full Nginx Vaultwarden config file:
```bash
server {
# We listen on 80 because HAProxy handles the SSL/HTTPS before it gets here.
listen 8081;
# Replace with your actual FQDN
server_name vault.yourdomain.tld;
# Handled below by the whitelisting script already - do not duplicate!
# Replace OPNSense's IP with the actual one to block the right users with fail2ban:
# set_real_ip_from 192.168.0.0/16; real_ip_header X-Forwarded-For; real_ip_recursive on;
# Whitelist Cloudflare proxies & internal subnet:
include /etc/nginx/snippets/trusted-proxies.conf;
# Find the server directive and add the following:
include /etc/nginx/snippets/custom-error-403.conf;
# Block Banned IPs from fail2ban
include /etc/nginx/blocklist.conf;
# Allow large attachments (optional, but good for saving PDFs/Images in vault)
client_max_body_size 128M;
location / {
proxy_pass http://127.0.0.1:8000;
# WebSocket support (used by /notifications/hub)
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
# Pass headers so Vaultwarden knows the real IP of the user, not just "127.0.0.1"
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
```
- Then remember to reload the nginx service
```bash
sudo nginx -t
sudo systemctl reload nginx
```
- Run a test. In my case (zoomed in a bit), it looks like this - while indicating which web server blocked it. For production use, you may wish to modify it.
