From b547308e05c9976f4213201f948f44aefd03ee75 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 17:20:54 +0200 Subject: [PATCH 1/2] The proxy's jail reads a refused name as well as a refused certificate The pattern ended at the line's end, which only the certificate refusal does; a request for an unserved name carries trailing text and never matched. Caught against the live lines before the jail counted anything (hq ADR 0179). --- modules/route-proxy/module.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/route-proxy/module.json b/modules/route-proxy/module.json index 23304a1..77558e2 100644 --- a/modules/route-proxy/module.json +++ b/modules/route-proxy/module.json @@ -199,7 +199,7 @@ "jails": [ { "name": "route-proxy", - "failregex": "^.*(?:TLS handshake error from :\\d+: (?:no public route for|acme/autocert: missing server name)|refused: no route for .*, asked from :\\d+)$", + "failregex": "^.*(?:TLS handshake error from :\\d+: (?:no public route for|acme/autocert: missing server name)|refused: no route for .*, asked from :\\d+)", "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d" } ] From 23112b111ce5bac6eba90e6dc06125903e9b79f4 Mon Sep 17 00:00:00 2001 From: jochen Date: Fri, 2 Oct 2026 17:23:42 +0200 Subject: [PATCH 2/2] The proxy's jail reads both refusals, each pattern naming the host once fail2ban expands to a named group, so two in one pattern is a duplicate group name and the daemon refuses to start at all -- every jail on the machine, not just this one. Two patterns, one each: the certificate refused for an unserved name, and the request refused for one. Caught live on the control node (hq ADR 0179). --- modules/route-proxy/module.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/route-proxy/module.json b/modules/route-proxy/module.json index 77558e2..08068f3 100644 --- a/modules/route-proxy/module.json +++ b/modules/route-proxy/module.json @@ -199,7 +199,7 @@ "jails": [ { "name": "route-proxy", - "failregex": "^.*(?:TLS handshake error from :\\d+: (?:no public route for|acme/autocert: missing server name)|refused: no route for .*, asked from :\\d+)", + "failregex": "^.*TLS handshake error from :\\d+: (?:no public route for|acme/autocert: missing server name)\n ^.*refused: no route for .*, asked from :\\d+$", "jail": "backend = systemd\njournalmatch = CONTAINER_NAME=route-proxy\nport = http,https\nmaxretry = 10\nfindtime = 1d\nbantime = 1d" } ]