novox/hq
3
0
Fork 0
Code Issues Pull Requests 2 Releases Wiki Activity

to-be 31: a module declares its fail2ban jail, mesh composes them per node #149

Merged
jschoubben merged 1 commits from design/a-module-declares-its-jail into main 2026-09-27 15:00:16 +00:00
Conversation 0 Commits 1 Files Changed 1
+65
jschoubben commented 2026-09-27 15:00:06 +00:00
Owner
Copy Link
Copy Source

Records the model you specified: a node's fail2ban config is composed from the modules it runs, like its firewall. A service module (postgres, mssql, mailu) declares its jail in its manifest (filter + stanza, naming no node/path per ADR 0112); the mesh writes the jails of a node's assigned modules into the fail2ban holder's jail.d/. The base (sshd, recidive, and the ignoreip = …${machine:mesh-range}) stays the fail2ban module's. Written after novox's HAL per-module jails were found as dangling symlinks — the ignoreip is now fixed on disk, the service jails need this mechanism to be restored properly.

Records the model you specified: a node's fail2ban config is composed from the modules it runs, like its firewall. A service module (postgres, mssql, mailu) declares its jail in its manifest (filter + stanza, naming no node/path per ADR 0112); the mesh writes the jails of a node's assigned modules into the fail2ban holder's `jail.d/`. The base (sshd, recidive, and the `ignoreip = …${machine:mesh-range}`) stays the fail2ban module's. Written after novox's HAL per-module jails were found as dangling symlinks — the ignoreip is now fixed on disk, the service jails need this mechanism to be restored properly.
jschoubben added 1 commit 2026-09-27 15:00:07 +00:00
to-be 31: a module declares its fail2ban jail, mesh composes them per node 225dfa9451 
A node's intrusion filter should be composed from its assigned modules, like
its firewall (the Filtering mechanism): a service module (postgres, mssql,
mailu) declares its jail in its manifest (filter + stanza, no node/path per ADR
0112), and the mesh writes the jails of a node's modules into the fail2ban
holder's jail.d. The base (sshd, recidive, ignoreip=mesh-range) stays the
fail2ban module's. Records the model after novox's HAL per-module jails were
lost as dangling symlinks; the ignoreip is now safe on disk, the service jails
need this to be restored.
jschoubben merged commit 9fc4e74b0d into main 2026-09-27 15:00:16 +00:00
jschoubben deleted branch design/a-module-declares-its-jail 2026-09-27 15:00:17 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/hq#149