fail2ban expands <HOST> into a named capture group, so a pattern naming it twice is a duplicate group name: the daemon refuses its whole configuration and exits, and the machine keeps no bans at all — for every jail, not the one at fault. Hit live on the control node the day the jails shipped. A jail with no name, no pattern, or a name another of the module's jails took is refused too.