For the web traffic, put a proxy around it.
The docs have several examples using caddy, nginx or apache.
Plenty of examples of getting those hooked up with fail2ban.

To get the ssh logins, you'd need to adjust your docker setup a bit. The docker image uses sshd inside the container. You'd need to expose that log so fail2ban can watch it.

https://github.com/gogs/gogs/tree/main/docker
sshd_conig is one of the files the docker container customizes.
You could change where the logs output. (say to the /data/gogs/log folder)

I'll say I dug around in the container and couldn't find any logs. I expected them to be in /var/log and even found log rotate scripts which pointed there but I didn't see any actual log files.