abrown38andClaude Opus 5.5
941d4fb10d
make dist builds tarballs for linux/amd64 and linux/arm64. A pushed v* tag runs .gitea/workflows/release.yml, which checks the tag against VERSION and the CHANGELOG, tests, builds the tarballs and the .debs (amd64, arm64) and publishes them with scripts/gitea-release.sh: a Gitea release, and the .debs in the Debian registry (stable, or testing for a release candidate). As in Housecarl and Steward; no cli-dist, Guard is Linux only. docs/development.md has the steps, docs/install.md the apt source. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.5 KiB
1.5 KiB
Changelog
All notable changes to Guard are documented here. The format follows Keep a Changelog, and versions follow Semantic Versioning.
[Unreleased]
Added
- First version. Guard watches log files (followed through rotation and
truncation) and the systemd journal (by unit and syslog identifier),
matches lines with patterns holding one
<IP>, counts each address's bounty within a window, and bans an address that reaches a watch's hits in a Housecarl ban list (Housecarl 0.2): of every port, or of the watch's protocol and ports, for a time that grows for repeat offenders. IPv6 addresses are counted and banned by the ban list's prefix (/64). Never banned:never_ban(addresses, prefixes, host names), loopback, link-local, multicast; Housecarl adds its own. Bans wait while Housecarl can't be reached, across restarts. - Presets:
sshd,jarl,housecarl,steward,bind-xfr,postfix-sasl,dovecot,nginx-auth,housecarl-drops(Housecarl's log of dropped packets, TCP only by default). - Commands:
guard run,check,config [--example],presets,test(a watch's patterns over a log),status(through a local socket),bans,ban,unban,version. - A Debian package with a sandboxed systemd unit, as the
guarduser in theadmandsystemd-journalgroups, published with each release to the Gitea Debian registry (stable, ortestingfor a release candidate) along with tarballs for Linux amd64 and arm64.