Documentation
Install, configure, migrate, and operate fail2zig.
Architecture
- Zero runtime dependencies fail2zig is a single static binary that speaks netlink directly to the kernel for every firewall operation. This page documents what that posture means in practice, which kernel ABIs the binary depends on, and why "exec nft safely" was not an acceptable alternative.
- Memory model A configurable ceiling that bounds the state tracker — the daemon's dominant memory consumer — regardless of attack volume, via a fixed entry cap, a zero-allocation hot path, and automatic eviction.
- Parser engine Comptime-generated specialised parsers — no regex engine in-process, zero-copy against buffered log data, bounds-checked on every input byte under ReleaseSafe.
- Log watching How fail2zig follows log files across rotation and truncation with inotify, reads the systemd journal via a journalctl poll, caps line length, and applies back-pressure without missing events.
- Trusted computing base What runs as root on a fail2zig host. The TCB of a root-privileged security daemon is every line of code with unconstrained authority over the system — fail2zig keeps that set small enough to audit.
- Netlink interop A reference-level walkthrough of fail2zig's direct netlink implementation for nftables — the six-message scaffold install, the TLV layout, ACK handling, and why "just exec nft" is not an option for a zero-dependency daemon.
Getting Started
- Migrating from fail2ban A practical, step-by-step guide to moving from fail2ban to fail2zig, including automated config import, side-by-side verification, and a complete rollback procedure.
- Verifying zero dependencies An operator-facing recipe for confirming that fail2zig is actually what it claims — a statically-linked binary whose default backend talks to the kernel directly over netlink, with subprocesses only on the optional journald, ipset, and iptables paths.
- Example jail configuration A readable end-to-end fail2zig.toml that protects SSH, nginx basic auth, and postfix — with commentary on each block, recidive escalation tuning, and a hardened ignoreip policy.
Reference
- Configuration reference Complete reference for fail2zig.toml — every key in [global], [defaults], and [jails.<name>], with types, defaults, constraints, and validation rules.
- Built-in filters Reference for all 15 built-in fail2zig filters — what each one matches, which log file to point at, example matching log lines, and recommended jail settings.
- fail2zig daemon — CLI reference Complete command-line reference for the fail2zig daemon binary, including all flags, exit codes, and usage examples.
- fail2zig-client — CLI reference Complete command-line reference for fail2zig-client, the unprivileged control tool for the fail2zig daemon.