fix(fail2ban): start under ProtectSystem=strict hardening

- log to journald via fail2ban.local (logtarget is a fail2ban.conf option,
  not jail.local) so the server can start without /var/log write access
- create the socket dir via RuntimeDirectory=fail2ban instead of a
  non-creating ReadWritePaths entry
- add ufw write paths so bans persist under the read-only namespace
- manage override.conf unconditionally and restart on change

This commit is contained in:

Clément Désiles

2026-09-05 16:21:49 +02:00

parent ceca06ff2e

commit 120615c38f

5 changed files with 50 additions and 11 deletions

roles/fail2ban/templates/fail2ban.local.j2

View File

@@ -0,0 +1,2 @@
 [DEFAULT]
 logtarget = STDOUT