ADR 0186: a ban list never holds a neighbour, and the mesh's own bans are its own wherever they hang; design 31

2026-10-02 18:42:16 +02:00
parent a9f91fdd0c
commit d4a2f99ab5
3 changed files with 93 additions and 0 deletions
@@ -9,6 +9,7 @@ updated: 2026-10-02
 decisions:
  - 02-DECISIONS/0112-a-module-definition-names-no-node-mesh-or-path.md
  - 02-DECISIONS/0179-the-intrusion-seat-serves-its-verbs-and-every-door-declares-its-jail.md
+  - 02-DECISIONS/0186-a-ban-list-never-holds-a-neighbour.md
 ---

 # 31 — A module declares its fail2ban jail, and the mesh composes them per node
@@ -92,3 +93,13 @@ the daemon's, and both are read through the console.

 *How it is checked:* ADR 0179's table.

+## What the first jails taught, 2026-10-02
+
+[ADR 0186](../../02-DECISIONS/0186-a-ban-list-never-holds-a-neighbour.md). Within an hour of the
+first public jail the home server had banned the house's own router: the router reflects local
+traffic, so every client in the building arrives as the gateway's address. The never-ban list now
+holds every private range as well as the mesh's own. And the mesh read its own ban chain as a
+foreign rule set on that machine, because the chain hangs off the container runtime's user chain and
+that machine's forward policy is the runtime's DROP — the reader now calls a chain of source-named
+refusals a ban wherever it hangs, as it already did for the packet filter's own tables.
+