novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

A module declares its fail2ban jail; mesh composes per node (to-be 31 mechanism) #85

Merged
jschoubben merged 1 commits from feat/a-module-declares-its-jail into main 2026-09-27 15:21:03 +00:00
Conversation 0 Commits 1 Files Changed 4
+152
jschoubben commented 2026-09-27 15:20:58 +00:00
Owner
Copy Link
Copy Source

The mechanism from to-be 31, modeled on Filtering: a module declares jails (name, failregex, jail stanza) naming no node/path; the intrusion-prevention holder declares jailing (where composed jails go); the mesh gathers every assigned module's jails into one jail.d file (a fixed id the fail2ban service restart-ons) plus a filter.d file per jail. A node not running a module has none of its jails. Tested (jailsInto composition + empty case). Behaviour-neutral until a service module declares a jail. The per-service content (postgres/mssql/mailu failregex + logpath, verified against how each container logs) is the follow-on — not in this PR.

The mechanism from to-be 31, modeled on `Filtering`: a module declares `jails` (name, failregex, jail stanza) naming no node/path; the intrusion-prevention holder declares `jailing` (where composed jails go); the mesh gathers every assigned module's jails into one `jail.d` file (a fixed id the fail2ban service `restart-on`s) plus a `filter.d` file per jail. A node not running a module has none of its jails. Tested (`jailsInto` composition + empty case). Behaviour-neutral until a service module declares a jail. The per-service content (postgres/mssql/mailu failregex + logpath, verified against how each container logs) is the follow-on — not in this PR.
jschoubben added 1 commit 2026-09-27 15:20:58 +00:00
A module declares its fail2ban jail; the mesh composes them per node (to-be 31) 47d412e13f 
The mechanism, mirroring Filtering: a module declares Jails (name, failregex,
jail stanza) naming no node/path (ADR 0112); the intrusion-prevention holder
declares Jailing (where composed jails go); the mesh gathers every assigned
module's jails into one jail.d file (a fixed id the fail2ban service restarts
on) plus a filter.d file per jail. A node not running a module has none of its
jails. Tested. Behaviour-neutral until a service module declares a jail — the
per-service content (postgres/mssql/mailu failregex+logpath) is authored next,
against how each container actually logs.
jschoubben merged commit 71dbca6392 into main 2026-09-27 15:21:03 +00:00
jschoubben deleted branch feat/a-module-declares-its-jail 2026-09-27 15:21:04 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Assignees
Clear assignees
jschoubben miel.truyen
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: novox/mesh-controller#85