fail2ban: declare the log its own recidive jail reads

The recidive jail bans whoever keeps coming back by reading fail2ban's own log, and fail2ban checks every jail's log file while it configures itself -- before it has created that log. On a machine where the file is not there already, no jail is found for recidive, configuration fails, and the whole service refuses to start, taking the sshd jail with it. Two machines assigned this module today came up failed for exactly that reason; the two where it worked had a log from years of the service running. Declared create-once: the mesh puts an empty file there when it is absent and never touches it again, because what grows in it is fail2ban's, and the logrotate file this module already ships is what keeps it small. This also reverts the previous two commits' fail2ban.local. It declared a logtarget that the package already sets to the same path on every machine here -- pacman reports the config pristine -- so it fixed nothing and said something untrue about why.
Merge pull request 'fail2ban restarts when the log declaration changes' (#133 ) from fix/fail2ban-restarts-on-its-log-target into main
2026-09-28 20:45:32 +02:00 · 2026-09-28 18:42:44 +00:00 · 2026-09-28 20:42:42 +02:00 · 2026-09-28 18:41:16 +00:00 · 2026-09-28 20:41:09 +02:00 · 2026-09-28 14:08:48 +00:00
3 changed files with 24 additions and 3 deletions
@@ -42,6 +42,14 @@
      "mode": "0644",
      "content": "[sshd]\nenabled = true\nport    = ssh\nlogpath = %(sshd_log)s\nbackend = %(sshd_backend)s\nmaxretry = 5\n"
    },
+    {
+      "id": "log",
+      "type": "file",
+      "path": "/var/log/fail2ban.log",
+      "mode": "0640",
+      "create-once": true,
+      "content": ""
+    },
    {
      "id": "jail-recidive",
      "type": "file",
@@ -49,7 +49,15 @@ interface Built {
  replay?: boolean;
 }

-await on("mesh-build-machine.built", async (event) => {
+/**
+ * What a build means for the graph, wherever it came from.
+ *
+ * Two emitters say the same thing and neither is a mistake: the build machine says it as it happens,
+ * and the control plane says what it already held when this module asks what it missed
+ * (novox/hq ADR 0134). A replay is marked as one in its body, so nothing acts on a module that moved
+ * months ago — see `replay` above.
+ */
+const placeTheBuild = async (event: { body: unknown }): Promise<void> => {
  const body = event.body as Built;
  if (!body.module || !body.commit) {
    // Said rather than dropped: a build that announced itself without saying what it built is a
@@ -91,7 +99,11 @@ await on("mesh-build-machine.built", async (event) => {
      because: next.because,
    });
  }
-});
+};
+
+// As it happens, and what the mesh already held when this module asked what it missed.
+await on("mesh-build-machine.built", placeTheBuild);
+await on("mesh-controller.built-before", placeTheBuild);

 // **And ask for what was built before this catalogue existed** (novox/hq 04-ISSUES/050).
 //
@@ -29,7 +29,8 @@
    "broker": "/var/lib/mesh/mesh-catalog/broker"
  },
  "consumes": [
-    "mesh-build-machine.built"
+    "mesh-build-machine.built",
+    "mesh-controller.built-before"
  ],
  "emits": [
    "registered",
Author	SHA1	Message	Date
jschoubben	7c18cdbd39	fail2ban: declare the log its own recidive jail reads The recidive jail bans whoever keeps coming back by reading fail2ban's own log, and fail2ban checks every jail's log file while it configures itself -- before it has created that log. On a machine where the file is not there already, no jail is found for recidive, configuration fails, and the whole service refuses to start, taking the sshd jail with it. Two machines assigned this module today came up failed for exactly that reason; the two where it worked had a log from years of the service running. Declared create-once: the mesh puts an empty file there when it is absent and never touches it again, because what grows in it is fail2ban's, and the logrotate file this module already ships is what keeps it small. This also reverts the previous two commits' fail2ban.local. It declared a logtarget that the package already sets to the same path on every machine here -- pacman reports the config pristine -- so it fixed nothing and said something untrue about why.	2026-09-28 20:45:32 +02:00
mesh-admin	4fb16b2e6b	Merge pull request 'fail2ban restarts when the log declaration changes' (#133 ) from fix/fail2ban-restarts-on-its-log-target into main	2026-09-28 18:42:44 +00:00
jschoubben	c5af8635c8	fail2ban: restart when the log declaration changes The file that says where fail2ban logs was not in restart-on, so a change to it would sit on disk with the running service unaware of it -- the same shape as any other jail file this module already restarts for.	2026-09-28 20:42:42 +02:00
mesh-admin	87366c5f36	Merge pull request 'fail2ban declares where it logs, so the recidive jail has a file to read' (#132 ) from fix/fail2ban-declares-where-it-logs into main	2026-09-28 18:41:16 +00:00
jschoubben	f8ca36aacf	fail2ban: declare where it logs, so the recidive jail has a file to read The recidive jail reads /var/log/fail2ban.log and this module ships the logrotate file for it, but nothing ever told fail2ban to write there. Where the package default stands, fail2ban logs to the journal, the recidive jail finds no log file, and the whole service refuses to start -- taking the sshd jail with it. Two machines assigned this module today came up failed; the two where it worked had /etc/fail2ban/fail2ban.conf edited by hand, which a package upgrade would have undone. Declared in fail2ban.local, because fail2ban.conf belongs to the package.	2026-09-28 20:41:09 +02:00
mesh-admin	812355bf31	Merge pull request 'The catalogue hears what it missed' (#131 ) from feat/the-catalogue-hears-what-it-missed into main	2026-09-28 14:08:48 +00:00
jschoubben	016ddb2b3a	The catalogue hears what it missed It asks what it missed on every start and the answer never arrived: the control plane replayed each build it held as a module's event from a module called "control-plane", which does not exist, so its own account refused the publish and the graph kept the gap. The control plane now states those under the seat it holds (novox/hq ADR 0134, mesh-controller #129), so this consumes that too — one handler, because what a build means for the graph is the same whether the build machine says it as it happens or the mesh says what it already held.	2026-09-28 16:08:46 +02:00
mesh-admin	ea17bf46d2	Merge pull request 'The catalogue prepares its own schema instead of migrating at start' (#130 ) from feat/the-catalogue-prepares-its-own-schema into main	2026-09-28 13:40:30 +00:00