BREACH::HARBOR: passive log-based intrusion blocking

hello all, my name is Chris and it's not the first time I am posting to this subreddit. You may possibly know me from tududi and reconYa projects. This is my third most valuable addition to my side projects. Heads up: I've been in the industry since 2009, on both sides of this: security work and software work. Two and a half years ago I left one job as a software engineer and had three months before the next one started, and I decided that instead of resting I was going to build the thing I actually wanted to exist. This is that thing, and obviously took a lot longer than three months. It was my sincere attempt to form a company in software and cybersecurity but life caught up (👶 #2) and it didn't proceed forward. The itch was boring and specific. I run a handful of VPSs running different stuff. Something feels off, I ssh in, tail auth.log, watch a few thousand failed root logins scroll past, then either shrug or hand-write an nftables/iptables/pf(openBSD) rule and forget I ever did it. I knew from the security side what I should be doing, and from the software side that I was never going to keep doing it by hand. So: BREACH::HARBOR . preview.redd.it/gcfsq3bejckh1.png It reads the logs your server already writes (sshd, nginx, fail2ban), scores the noise, and pushes block rules straight into nftables or iptables. No new agent collecting its own telemetry, no daemon sitting in the request path. Just the logs you already have. I tested it initially like a fail2ban UI with a collector agent as the middleman and created soem VPSs, quickly witnessing the server filling up with attack bot addresses. Two things I cared about most, mostly because I was afraid of locking myself out of my own server: It watches for 24 hours before it enforces anything. You get to look at what it would have blocked before it blocks a single packet. Your current SSH session is exempted automatically , and breachharbor agent flush removes every rule it has ever added in one command. Easy to undo was a hard requirement, not a nice-to-have. Nothing calls out. No account, no API key, no cloud scoring service deciding what your firewall does. The decision happens locally, from your own logs. It's one repository, agent and server, where a server can connect to multiple agents. On the path here, since people always ask: it started as Python spread across three repos, which was the fastest way for me to find out what the thing even was. Then one of those repos moved to Go, and eventually all of it collapsed into a single codebase. Those were rewrites I would not have attempted alone at nights-and-weekends pace a few years ago. Using AI as a working tool is what made the big structural changes cheap enough to actually do, so instead of living with the shape of my first guess I got to keep pushing the project toward the shape I wanted. Every design decision is mine and I've read every line that ships. Install takes about a minute. Also, there is a paid business license for companies that want to redistribute without GPL obligations, but if you are self-hosting you will never have to think about it. As I said, at some parallel universe it would be my attempt to create something open source that makes a living as well. Site and install instructions: breachharbor.com Repo: github.com/Dyneteq/Breach-Harbor Happy to answer anything. And yes, I know the top comment is going to be "why not just fail2ban" or "what does it do better than crowdsec" so I will get into these properly in the replies. Cheers, Chris