Merge pull request 'fix(fail2ban): pin polling backend so jail actually reads Caddy access log (#503)' (#504) from fix/issue-503-fail2ban-polling-backend into main

.gitea/workflows/ci.yml

@@ -172,6 +172,21 @@ jobs:
           echo "$out" | grep -qE '0 matched' \
             || { echo "expected 0 matches for /api/documents 401"; exit 1; }
 
+      # ── Backend resolves to file-polling, not systemd ─────────────────────
+      # The Debian/Ubuntu fail2ban package ships defaults-debian.conf with
+      # `[DEFAULT] backend = systemd`. Without `backend = polling` in our
+      # jail, the daemon loads the jail but reads from journald and never
+      # touches /var/log/caddy/access.log — i.e. the regex above passes in
+      # isolation while the live jail is inert. See issue #503.
+      - name: Jail resolves with polling backend (not inherited systemd)
+        run: |
+          sudo ln -sfn "$PWD/infra/fail2ban/jail.d/familienarchiv.conf"       /etc/fail2ban/jail.d/familienarchiv.conf
+          sudo ln -sfn "$PWD/infra/fail2ban/filter.d/familienarchiv-auth.conf" /etc/fail2ban/filter.d/familienarchiv-auth.conf
+          dump=$(sudo fail2ban-client -d 2>&1)
+          echo "$dump" | grep -E "add.*familienarchiv-auth" || true
+          echo "$dump" | grep -qE "\['add', 'familienarchiv-auth', 'polling'\]" \
+            || { echo "FAIL: familienarchiv-auth jail did not resolve to 'polling' backend"; exit 1; }
+
   # ─── Compose Bucket-Bootstrap Idempotency ─────────────────────────────────────
   # docker-compose.prod.yml's create-buckets service runs on every
   # `docker compose up` (one-shot, no restart). Must be idempotent — a

infra/fail2ban/jail.d/familienarchiv.conf

@@ -19,6 +19,12 @@
 
 [familienarchiv-auth]
 enabled  = true
+# Override Debian's `backend = systemd` default (set in
+# /etc/fail2ban/jail.d/defaults-debian.conf). Without this line our jail
+# inherits the systemd backend, reads from journald, and never inspects
+# Caddy's file-based JSON access log — i.e. brute-force protection is inert.
+# `polling` works without inotify and is fine for one rotated log file.
+backend  = polling
 filter   = familienarchiv-auth
 logpath  = /var/log/caddy/access.log
 maxretry = 10