[INCLUDES]

before = paths-arch.conf

[DEFAULT]

# Never act on the machine itself or on a tunnel peer: the mesh's private range is
# ${machine:mesh-range}, named here rather than written as a value the module cannot
# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.
# **A ban list never holds a neighbour.** The mesh's own range is named rather than written
# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own
# network, not the internet. On a machine behind a router that reflects local traffic, every
# client in the house arrives as the gateway's address — so one mistyped local request banned
# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).
#
# **Nor the operator's own addresses** (novox/hq ADR 0339, issue 238): the public addresses the operator names
# as theirs, in the mesh-wide setting own-addresses. An agent polling the forge from the operator's home banned
# that home for four weeks on 2026-10-04, and nothing in the house reached the control-node until it was found
# among 400 bans. The file is written by this module's watch from the setting, one entry per line; fail2ban
# reads it again within a second of a change, so a new value needs no restart. Empty until the operator
# fills the setting. A jail that sets its own ignoreip leaves all of this out; the watch says so.
ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10 file:/var/lib/mesh-fail2ban/own-addresses

# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace
# themselves at one try every ten minutes, under any ten-minute window; a day's window counts
# them, and a day's ban costs a person who mistyped three times once, from one address, while
# the mesh's own range is never banned at all.
bantime  = 1d
findtime = 1d
maxretry = 3

# Ban through iptables, not through a firewall front-end the machine may not have. ufw is
# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out
# only at ban time: the service reports healthy, the jail counts the attempt, the ban command
# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a
# machine the mesh reported as protected.
#
# The action below is this module's own, already used by the recidive jail on every machine
# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is
# covered too.
banaction = iptables-allports-dualchain
banaction_allports = iptables-allports-dualchain

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s