fail2ban on a jail you actually read the logs for

Enabling every bundled jail produces bans from filters matching log formats your software does not emit, and a config nobody trusts enough to tune.

[sshd]
enabled  = true
maxretry = 4
findtime = 10m
bantime  = 1h

[nginx-limit-req]
enabled  = true
logpath  = /var/log/nginx/error.log
bantime  = 10m

# and the test that says the filter matches reality:
# fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf

fail2ban-regex against a real log file is the step that converts a copied configuration into one that works — it reports how many lines matched, and a filter matching zero lines is the normal outcome for a jail nobody verified. An hour is a better default ban than a day: it stops the automated noise and limits the damage when a colleague fat-fingers a password from the office IP. Whitelisting the office range is worth doing before the first ban, not after.