2026-10-02 15:28:48 +00:00
1 changed files with 19 additions and 1 deletions
@@ -106,7 +106,25 @@ now logs the plain request too, with the asking address last, as its own jail's
 | A container's `logging` reaches the runtime's arguments and its spec; a place other than the journal is refused | host tests |
 | A module's jails compose into the holder's file and a filter per jail, and the file is written empty when none is declared | the controller's composition tests (to-be 31) |
 | The proxy logs a refused name with the address last | the proxy's tests |
-| Live | `node-intrusion-prevention.status@<node>` and `banned` answer on every machine through the console; the mail front end's jail reads the journal and counts a guess within the day; `ban` of a documentation address lands in the ban list and `unban` releases it; `status` is well |
+| A jail's pattern names `<HOST>` once per shape, since two is a duplicate capture group and costs the machine every ban | the catalogue's manifest tests |
+| Live | done 2026-10-02: `status` and `banned` answered on both servers through the console; the proxy's jail counted seven refusals on the home server; a documentation address banned in the ssh jail came back with its end time and was released |
+
+## Built and proven live, 2026-10-02
+
+All five rules are in the mesh. The host carries `logging`; the controller's seat row carries the four
+verbs and the proxy says a refused name in its log; the fail2ban module holds the seat from a runtime
+with the daemon's socket shared in, composes the jails, and the mail front end, the forge and the
+proxy each declare one. Through the console on the control node: `status` listed five jails with what
+each watches, `banned` listed the nine the long jail holds, and a documentation address banned in the
+ssh jail came back with its ban's end time and was released again. On the home server the proxy's jail
+had counted seven refusals within minutes of starting.
+
+**One fault, found by the machine and not by a test.** The proxy's pattern matched two shapes of
+refusal in one expression and so named `<HOST>` twice. fail2ban expands that placeholder into a named
+capture group; two of them is a duplicate group name, and the daemon refuses *its whole configuration*
+and exits — both servers kept no bans at all for about ten minutes, every jail and not the one at
+fault. The pattern is now one per shape. A manifest check refuses the mistake at merge time, naming
+what it would cost, which is the only reason this record can claim the rule rather than the instance.

 ## References