Feature 57 (config and provisioning): modules declare config and provisions, their files rendered from templates; synced with main (issues of feature 57, 874)

modules/fail2ban/files/fail2ban

@@ -0,0 +1,7 @@
+/var/log/fail2ban.log {
+    missingok
+    notifempty
+    postrotate
+      /usr/bin/fail2ban-client flushlogs >/dev/null || true
+    endscript
+}

modules/fail2ban/files/iptables-allports-dualchain.conf

@@ -0,0 +1,40 @@
+# Fail2Ban action: ban in both INPUT and DOCKER-USER chains
+# Used by recidive to block repeat offenders from both host and Docker services
+
+[INCLUDES]
+
+before = iptables.conf
+
+[Definition]
+
+type = allports
+
+actionstart = { <iptables> -C f2b-<name> -j <returntype> >/dev/null 2>&1; } || { <iptables> -N f2b-<name> || true; <iptables> -A f2b-<name> -j <returntype>; }
+              { <iptables> -C INPUT -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I INPUT -p <protocol> -j f2b-<name>; }
+              { <iptables> -C DOCKER-USER -p <protocol> -j f2b-<name> >/dev/null 2>&1; } || { <iptables> -I DOCKER-USER -p <protocol> -j f2b-<name>; }
+
+actionstop = <iptables> -D INPUT -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -D DOCKER-USER -p <protocol> -j f2b-<name> 2>/dev/null || true
+             <iptables> -F f2b-<name>
+             <iptables> -X f2b-<name>
+
+actioncheck = <iptables> -n -L f2b-<name> >/dev/null
+
+actionban = <iptables> -I f2b-<name> 1 -s <ip> -j <blocktype>
+
+actionunban = <iptables> -D f2b-<name> -s <ip> -j <blocktype>
+
+[Init]
+
+chain = INPUT
+name = default
+protocol = tcp
+blocktype = REJECT --reject-with icmp-port-unreachable
+returntype = RETURN
+lockingopt = -w
+iptables = iptables <lockingopt>
+
+[Init?family=inet6]
+
+blocktype = REJECT --reject-with icmp6-port-unreachable
+iptables = ip6tables <lockingopt>

modules/fail2ban/files/jail.local

@@ -0,0 +1,48 @@
+[INCLUDES]
+
+before = paths-arch.conf
+
+[DEFAULT]
+
+# Never act on the machine itself or on a tunnel peer: the mesh's private range is
+# ${machine:mesh-range}, named here rather than written as a value the module cannot
+# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.
+# **A ban list never holds a neighbour.** The mesh's own range is named rather than written
+# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own
+# network, not the internet. On a machine behind a router that reflects local traffic, every
+# client in the house arrives as the gateway's address — so one mistyped local request banned
+# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).
+#
+# **Nor the operator's own addresses** (novox/hq ADR 0339, issue 238): the public addresses the operator names
+# as theirs, in the mesh-wide setting own-addresses. An agent polling the forge from the operator's home banned
+# that home for four weeks on 2026-10-04, and nothing in the house reached the control-node until it was found
+# among 400 bans. The file is written by this module's watch from the setting, one entry per line; fail2ban
+# reads it again within a second of a change, so a new value needs no restart. Empty until the operator
+# fills the setting. A jail that sets its own ignoreip leaves all of this out; the watch says so.
+ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10 file:/var/lib/mesh-fail2ban/own-addresses
+
+# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace
+# themselves at one try every ten minutes, under any ten-minute window; a day's window counts
+# them, and a day's ban costs a person who mistyped three times once, from one address, while
+# the mesh's own range is never banned at all.
+bantime  = 1d
+findtime = 1d
+maxretry = 3
+
+# Ban through iptables, not through a firewall front-end the machine may not have. ufw is
+# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out
+# only at ban time: the service reports healthy, the jail counts the attempt, the ban command
+# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a
+# machine the mesh reported as protected.
+#
+# The action below is this module's own, already used by the recidive jail on every machine
+# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is
+# covered too.
+banaction = iptables-allports-dualchain
+banaction_allports = iptables-allports-dualchain
+
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s

modules/fail2ban/files/mesh-own-addresses.json

@@ -0,0 +1,3 @@
+{
+  "own-addresses": []
+}

modules/fail2ban/files/recidive.conf

@@ -0,0 +1,9 @@
+[recidive]
+enabled = true
+logpath  = /var/log/fail2ban.log
+# Ban in both INPUT (host services like SSH) and DOCKER-USER (container services)
+banaction = iptables-allports-dualchain
+# Banned twice in two weeks, by any jail, is banned for four (novox/hq ADR 0179).
+bantime  = 4w
+findtime = 2w
+maxretry = 2

modules/fail2ban/files/sshd.conf

@@ -0,0 +1,8 @@
+[sshd]
+enabled = true
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+maxretry = 3
+findtime = 1d
+bantime  = 1d