# Changelog

All notable changes to Guard are documented here. The format follows
[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
[Semantic Versioning](https://semver.org/).

## [Unreleased]

### Added

- First version. Guard watches log files (followed through rotation and
  truncation) and the systemd journal (by unit and syslog identifier),
  matches lines with patterns holding one `<IP>`, counts each address's
  bounty within a window, and bans an address that reaches a watch's
  hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the
  watch's protocol and ports, for a time that grows for repeat
  offenders. IPv6 addresses are counted and banned by the ban list's
  prefix (/64). Never banned: `never_ban` (addresses, prefixes, host
  names), loopback, link-local, multicast; Housecarl adds its own. Bans
  wait while Housecarl can't be reached, across restarts.
- Presets: `sshd`, `jarl`, `housecarl`, `steward`, `bind-xfr`,
  `postfix-sasl`, `dovecot`, `nginx-auth`, `housecarl-drops`
  (Housecarl's log of dropped packets, TCP only by default).
- Commands: `guard run`, `check`, `config [--example]`, `presets`,
  `test` (a watch's patterns over a log), `status` (through a local
  socket), `bans`, `ban`, `unban`, `version`.
- A Debian package with a sandboxed systemd unit, as the `guard` user in
  the `adm` and `systemd-journal` groups, published with each release to
  the Gitea Debian registry (`stable`, or `testing` for a release
  candidate) along with tarballs for Linux amd64 and arm64.

### Fixed

- The package's `guard` user is now in the `adm` and `systemd-journal`
  groups itself, as the documentation said, not only through its unit's
  `SupplementaryGroups`. `sudo -u guard guard test` and `guard check`
  could read neither `/var/log`'s files (`permission denied`) nor the
  journal. Upgrading adds the groups.