Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/mkdeb.sh

@@ -0,0 +1,73 @@
+#!/bin/sh
+# Builds Guard's Debian package, dist/guard_<version>_<arch>.deb:
+#
+#   /usr/bin/guard and its bash completion
+#   /usr/lib/systemd/system/guard.service, /usr/lib/sysusers.d/guard.conf
+#   /usr/share/doc/guard/ (README, CHANGELOG, docs)
+#
+# Its scripts (deploy/debian) create the guard user and an example
+# /etc/guard/guard.yaml on the first install, restart a running guard on
+# upgrades, and stop it on removal. No file in /etc belongs to the
+# package, so an upgrade never asks about configuration files.
+#
+# Run through 'make deb'; needs only dpkg-deb, no root and no debhelper.
+set -eu
+
+: "${DEB_ARCH:?}" "${DEB_VERSION:?}" "${VERSION:?}" "${LDFLAGS:?}"
+GOFLAGS=${GOFLAGS:-}
+
+goarm=
+case "$DEB_ARCH" in
+amd64) goarch=amd64 ;;
+arm64) goarch=arm64 ;;
+armhf) goarch=arm goarm=7 ;;
+i386) goarch=386 ;;
+ppc64el) goarch=ppc64le ;;
+riscv64) goarch=riscv64 ;;
+*) echo "mkdeb: unsupported architecture $DEB_ARCH" >&2; exit 1 ;;
+esac
+
+if [ -z "${DEB_MAINTAINER:-}" ]; then
+	name=$(git config user.name 2>/dev/null || true)
+	email=$(git config user.email 2>/dev/null || true)
+	DEB_MAINTAINER="${name:-Guard packager} <${email:-root@localhost}>"
+fi
+
+work=dist/deb/${DEB_VERSION}_${DEB_ARCH}
+root=$work/guard
+rm -rf "$work"
+rm -f dist/guard_*_"$DEB_ARCH".deb
+mkdir -p "$root"
+
+echo "mkdeb: building for linux/$goarch"
+export GOFLAGS
+GOOS=linux GOARCH=$goarch GOARM=$goarm CGO_ENABLED=0 go build -ldflags "$LDFLAGS" -o "$work/bin/guard" ./cmd/guard
+make --no-print-directory install-files DESTDIR="$root" PREFIX=/usr UNITDIR=/usr/lib/systemd/system GUARD_BIN="$work/bin/guard" >/dev/null
+mkdir -p "$root/DEBIAN"
+for f in postinst prerm postrm; do
+	install -m 0755 "deploy/debian/$f" "$root/DEBIAN/$f"
+done
+
+indent() { sed -e 's/^$/./' -e 's/^/ /' "$1"; }
+{
+	echo "Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/"
+	echo "Upstream-Name: guard"
+	echo
+	echo "Files: *"
+	echo "Copyright: $(sed -n 's/^Copyright (c) //p' LICENSE)"
+	echo "License: Expat"
+	indent LICENSE
+} > "$root/usr/share/doc/guard/copyright"
+rm -f "$root/usr/share/doc/guard/LICENSE"
+find "$root" -type d -exec chmod 0755 {} +
+chmod -R go-w "$root"
+size=$(du -sk --exclude=DEBIAN "$root" | cut -f1)
+sed -e "s/@VERSION@/$DEB_VERSION/g" -e "s/@ARCH@/$DEB_ARCH/" -e "s/@SIZE@/$size/" \
+	-e "s|@MAINTAINER@|$DEB_MAINTAINER|" deploy/debian/control.in > "$root/DEBIAN/control"
+(cd "$root" && find . -path ./DEBIAN -prune -o -type f -print | sed 's|^\./||' | sort | xargs md5sum) > "$root/DEBIAN/md5sums"
+chmod 0644 "$root/DEBIAN/control" "$root/DEBIAN/md5sums"
+out=dist/guard_${DEB_VERSION}_${DEB_ARCH}.deb
+dpkg-deb --root-owner-group -Zxz --build "$root" "$out" >/dev/null
+echo "mkdeb: wrote $out"
+dpkg-deb --info "$out" | sed -n 's/^ \(Package\|Version\|Architecture\|Installed-Size\|Depends\):/  \1:/p'
+rm -rf dist/deb