Your VPS, defended autonomously.
One static binary that replaces fail2ban, learns your host's known-good state, bans attackers at the firewall within seconds — and hands the interesting cases to an AI analyst. No agents to babysit, no Python, no OpenSSL.
curl -fsSL https://guard.shieldie.ai/install.sh | sudo shThe installer is interactive: it detects your SSH address and this server's own public addresses as the management addresses that are never auto-banned (you can add more), asks whether to enable the web dashboard (generated or your own password) and whether to join the shieldie.cloud shared blocklist, then downloads release v0.2.263, verifies its SHA-256 against the published checksum, runs the binary's own idempotent init and starts the daemon. Unattended: sudo sh -s -- --yes --web. Read the script first: install.sh.
How it works
What you get
⚡fail2ban, without the baggage
Single ~15 MB static binary, no runtime dependencies. Reads the system journal directly. Jails for common services ship enabled; a service without logs is reported, never silently ignored.
⛔Bans that actually block
Enforced in the kernel firewall (nftables, ufw as a fallback), covering traffic to Docker-published ports too. Recovers on its own if the ruleset is flushed. Optional banning of whole attacking subnets.
🔒Built not to lock you out
Your management addresses are exempt from every ban path and re-checked at boot. The daemon itself runs unprivileged; only a narrow, audited set of root actions is possible.
🧠An analyst, not an autopilot
An AI analyst reviews incidents, investigates the serious ones and explains what happened — with a hard spend cap and secrets redacted before anything leaves the box. Works rules-only without a key.
👁Host-state baseline (FIM)
Learns the known-good state of the host, then flags what appears or changes afterwards: listeners, privileged binaries, scheduled jobs, access keys, service units, suspicious processes and more.
📊Dashboard, CLI, MCP
Web viewer with the incident timeline and ban history; a fail2ban-style CLI; an MCP server for your own agents. ntfy / Telegram alerts.
☁shieldie.cloud (opt-in)
Share the addresses your jails banned and pull the network's blocklist — only addresses that several independent servers agreed on. Your local decisions always win.
🔁Recidivists get harsher
Returning attackers are banned for progressively longer; a subnet that keeps coming back can be banned as a whole.
After installing
| Do | Command |
|---|---|
| Status, jails, live feed | sudo shieldie-guard status · jails · watch |
| Enable the AI analyst (optional) | echo -n 'sk-ant-…' | sudo shieldie-guard set-key |
| Ban / unban by hand | sudo shieldie-guard ban 203.0.113.9 --ttl 3600 · unban 203.0.113.9 |
| Talk to the analyst | sudo shieldie-guard chat |
| Check a config edit before restarting | sudo shieldie-guard config-check |
| Join the shared blocklist | sudo shieldie-guard cloud enroll → [cloud] enabled = true |
| Upgrade | re-run the install command (idempotent; restarts the service) |
Requirements: Linux x86_64 with systemd and nftables (ufw works with limits). The default install is safe to run on a production host; set your management address before starting so a rule can never lock you out.
Downloads
| File | SHA-256 |
|---|---|
| shieldie-guard-v0.2.263-x86_64-unknown-linux-musl | 4ba23aed6723cede74204c7659a603ff639345a1b9273a21292cd8c141056885 |
| ….sha256 · all releases · install.sh | verify: sha256sum -c *.sha256 |
Manual install: download the binary, chmod +x, then sudo ./shieldie-guard init --admin-ip YOUR.IP and sudo systemctl start shieldie-guard. The binary embeds everything init installs.