Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Makefile

@@ -0,0 +1,85 @@
+# Guard build.
+#
+#   make              build bin/guard (and its bash completion)
+#   make test         vet, gofmt check and unit tests
+#   make e2e          Guard and Housecarl together, with real traffic (scripts/e2e.sh; needs ../housecarl and Docker)
+#   sudo make install install the binary, completion, systemd unit and sysusers file,
+#                     and an example /etc/guard/guard.yaml
+#   make deb          the Debian package in dist/ (DEB_ARCH=arm64 for another architecture)
+
+VERSION ?= $(shell cat VERSION 2>/dev/null || echo 0.0.0-dev)
+RELEASE_TAG ?= $(shell t=v$(VERSION); git tag --points-at HEAD 2>/dev/null | grep -qx "$$t" && git diff --quiet HEAD 2>/dev/null && echo $$t)
+DESCRIBE ?= $(shell git describe --tags --long --match 'v[0-9]*' --abbrev=12 HEAD 2>/dev/null)
+LDFLAGS := -s -w -X guard/internal/version.Version=$(VERSION) -X guard/internal/version.Tag=$(RELEASE_TAG) \
+	-X guard/internal/version.Describe=$(DESCRIBE)
+GOFLAGS := -trimpath
+export CGO_ENABLED := 0
+
+PREFIX      ?= /usr/local
+BINDIR      ?= $(PREFIX)/bin
+DOCDIR      ?= $(PREFIX)/share/doc/guard
+BASHCOMPDIR ?= $(PREFIX)/share/bash-completion/completions
+UNITDIR     ?= /etc/systemd/system
+SYSUSERSDIR ?= /usr/lib/sysusers.d
+DESTDIR     ?=
+GUARD_BIN   ?= bin/guard
+
+DEB_ARCH    ?= $(shell dpkg --print-architecture 2>/dev/null || go env GOARCH)
+DEB_DEV_VERSION := $(shell [ -n '$(DESCRIBE)' ] || exit 0; \
+	m=; git diff --quiet HEAD 2>/dev/null || m=.m$$(date -u +%Y%m%d%H%M%S); \
+	echo '$(DESCRIBE)' | sed -E 's/^v(.*)-([0-9]+)-g([0-9a-f]{7})[0-9a-f]*$$/\1+git\2.g\3/' | tr - '~' | sed "s/$$/$$m/")
+DEB_VERSION ?= $(if $(RELEASE_TAG),$(subst -,~,$(VERSION)),$(or $(DEB_DEV_VERSION),$(subst -,~,$(VERSION))))
+
+.PHONY: all build completion test e2e install install-files uninstall deb clean
+
+all: build
+
+build:
+	go build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o bin/guard ./cmd/guard
+	$(MAKE) --no-print-directory completion
+
+completion:
+	mkdir -p bin/completion
+	bin/guard completion bash > bin/completion/guard
+
+test:
+	go vet ./...
+	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "gofmt: the files above need formatting"; exit 1; }
+	go test ./...
+
+e2e:
+	scripts/e2e.sh
+
+install: build install-files
+	@if [ ! -e $(DESTDIR)/etc/guard/guard.yaml ]; then \
+		install -d -m 0750 $(DESTDIR)/etc/guard && \
+		bin/guard config --example > $(DESTDIR)/etc/guard/guard.yaml && chmod 0640 $(DESTDIR)/etc/guard/guard.yaml && \
+		echo "wrote $(DESTDIR)/etc/guard/guard.yaml"; \
+	fi
+	@echo
+	@echo "Next (as root): systemd-sysusers guard.conf && chgrp guard /etc/guard /etc/guard/guard.yaml && systemctl daemon-reload"
+	@echo "Then follow docs/install.md (a ban list and token in Housecarl, guard check, systemctl enable --now guard)."
+
+# Everything but /etc/guard/guard.yaml (shared by install and deb).
+install-files:
+	install -D -m 0755 $(GUARD_BIN) $(DESTDIR)$(BINDIR)/guard
+	install -D -m 0644 bin/completion/guard $(DESTDIR)$(BASHCOMPDIR)/guard
+	install -D -m 0644 deploy/systemd/guard.service $(DESTDIR)$(UNITDIR)/guard.service
+	sed -i 's#/usr/local/bin/guard#$(BINDIR)/guard#; s#/usr/local/share/doc/guard#$(DOCDIR)#' $(DESTDIR)$(UNITDIR)/guard.service
+	install -D -m 0644 deploy/sysusers.d/guard.conf $(DESTDIR)$(SYSUSERSDIR)/guard.conf
+	install -D -m 0644 README.md $(DESTDIR)$(DOCDIR)/README.md
+	install -D -m 0644 LICENSE $(DESTDIR)$(DOCDIR)/LICENSE
+	install -D -m 0644 CHANGELOG.md $(DESTDIR)$(DOCDIR)/CHANGELOG.md
+	install -d $(DESTDIR)$(DOCDIR)/docs
+	install -m 0644 docs/*.md $(DESTDIR)$(DOCDIR)/docs/
+
+uninstall:
+	rm -f $(DESTDIR)$(BINDIR)/guard $(DESTDIR)$(BASHCOMPDIR)/guard $(DESTDIR)$(UNITDIR)/guard.service $(DESTDIR)$(SYSUSERSDIR)/guard.conf
+	rm -rf $(DESTDIR)$(DOCDIR)
+	@echo "Kept /etc/guard and /var/lib/guard."
+
+deb: build
+	DEB_ARCH=$(DEB_ARCH) DEB_VERSION=$(DEB_VERSION) VERSION=$(VERSION) LDFLAGS="$(LDFLAGS)" GOFLAGS="$(GOFLAGS)" scripts/mkdeb.sh
+
+clean:
+	rm -rf bin dist