From f8ca36aacf295babb533b0ab7d39ad7ed5ddc55e Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Mon, 28 Sep 2026 20:41:09 +0200
Subject: [PATCH] fail2ban: declare where it logs, so the recidive jail has a
 file to read

The recidive jail reads /var/log/fail2ban.log and this module ships the
logrotate file for it, but nothing ever told fail2ban to write there. Where
the package default stands, fail2ban logs to the journal, the recidive jail
finds no log file, and the whole service refuses to start -- taking the sshd
jail with it. Two machines assigned this module today came up failed; the two
where it worked had /etc/fail2ban/fail2ban.conf edited by hand, which a
package upgrade would have undone.

Declared in fail2ban.local, because fail2ban.conf belongs to the package.
---
 modules/fail2ban/module.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/modules/fail2ban/module.json b/modules/fail2ban/module.json
index d24a075..3b504a7 100644
--- a/modules/fail2ban/module.json
+++ b/modules/fail2ban/module.json
@@ -28,6 +28,13 @@
       "path": "/etc/fail2ban/action.d",
       "mode": "0755"
     },
+    {
+      "id": "fail2ban-local",
+      "type": "file",
+      "path": "/etc/fail2ban/fail2ban.local",
+      "mode": "0644",
+      "content": "[Definition]\n\n# Where fail2ban writes its own log, declared rather than assumed. The recidive jail reads\n# this file to ban whoever keeps coming back, and the logrotate file this module ships\n# rotates it -- but nothing told fail2ban to write there. Where the package default stands,\n# fail2ban logs to the journal, the recidive jail finds no log file, and the whole service\n# refuses to start, taking the sshd jail with it.\n#\n# In .local, not in fail2ban.conf: that file belongs to the package.\nlogtarget = /var/log/fail2ban.log\n"
+    },
     {
       "id": "jail-local",
       "type": "file",