fail2ban: restart when the log declaration changes

The file that says where fail2ban logs was not in restart-on, so a change to it would sit on disk with the running service unaware of it -- the same shape as any other jail file this module already restarts for.
Merge pull request 'fail2ban declares where it logs, so the recidive jail has a file to read' (#132 ) from fix/fail2ban-declares-where-it-logs into main
2026-09-28 20:42:42 +02:00 · 2026-09-28 18:41:16 +00:00 · 2026-09-28 20:41:09 +02:00 · 2026-09-28 14:08:48 +00:00
1 changed files with 8 additions and 0 deletions
@@ -28,6 +28,13 @@
      "path": "/etc/fail2ban/action.d",
      "mode": "0755"
    },
+    {
+      "id": "fail2ban-local",
+      "type": "file",
+      "path": "/etc/fail2ban/fail2ban.local",
+      "mode": "0644",
+      "content": "[Definition]\n\n# Where fail2ban writes its own log, declared rather than assumed. The recidive jail reads\n# this file to ban whoever keeps coming back, and the logrotate file this module ships\n# rotates it -- but nothing told fail2ban to write there. Where the package default stands,\n# fail2ban logs to the journal, the recidive jail finds no log file, and the whole service\n# refuses to start, taking the sshd jail with it.\n#\n# In .local, not in fail2ban.conf: that file belongs to the package.\nlogtarget = /var/log/fail2ban.log\n"
+    },
    {
      "id": "jail-local",
      "type": "file",
@@ -70,6 +77,7 @@
      "state": "running",
      "boot": "enabled",
      "restart-on": [
+        "fail2ban-local",
        "jail-local",
        "jail-sshd",
        "jail-recidive",
Author	SHA1	Message	Date
jschoubben	c5af8635c8	fail2ban: restart when the log declaration changes The file that says where fail2ban logs was not in restart-on, so a change to it would sit on disk with the running service unaware of it -- the same shape as any other jail file this module already restarts for.	2026-09-28 20:42:42 +02:00
mesh-admin	87366c5f36	Merge pull request 'fail2ban declares where it logs, so the recidive jail has a file to read' (#132 ) from fix/fail2ban-declares-where-it-logs into main	2026-09-28 18:41:16 +00:00
jschoubben	f8ca36aacf	fail2ban: declare where it logs, so the recidive jail has a file to read The recidive jail reads /var/log/fail2ban.log and this module ships the logrotate file for it, but nothing ever told fail2ban to write there. Where the package default stands, fail2ban logs to the journal, the recidive jail finds no log file, and the whole service refuses to start -- taking the sshd jail with it. Two machines assigned this module today came up failed; the two where it worked had /etc/fail2ban/fail2ban.conf edited by hand, which a package upgrade would have undone. Declared in fail2ban.local, because fail2ban.conf belongs to the package.	2026-09-28 20:41:09 +02:00
mesh-admin	812355bf31	Merge pull request 'The catalogue hears what it missed' (#131 ) from feat/the-catalogue-hears-what-it-missed into main	2026-09-28 14:08:48 +00:00