Migration in progress. api.legendary-arena.com and PostgreSQL are moving from Render to a self-hosted DigitalOcean Ubuntu host behind Cloudflare. Render remains rollback-ready until decommission phase.

Fail2ban and Unattended Upgrades

Enable intrusion mitigation and automatic security patching that were previously abstracted by managed hosting.

Summary

This page owns infra/scripts/07-fail2ban-upgrades.ps1, which:

• installs fail2ban and unattended-upgrades
• enables and starts fail2ban service
• enables unattended upgrades on a daily schedule

Execute

sudo pwsh -File infra/scripts/07-fail2ban-upgrades.ps1

Verification

# fail2ban running
sudo systemctl status fail2ban --no-pager
sudo fail2ban-client status

# unattended upgrades configured
sudo systemctl status unattended-upgrades --no-pager
sudo cat /etc/apt/apt.conf.d/20auto-upgrades

Expected:

• fail2ban service active
• unattended upgrades enabled for package list update and upgrade install

Operational note

Automatic patching can trigger package-level service restarts. Ensure the app remains managed by systemd so service restarts are recoverable.

References

• Plan section 4.1 (fail2ban-unattended-upgrades.md stub)
• Plan section 5.1 (Base security services)