The standalone agent
The agent is a complete product on its own. Without a controller it reads its configuration from /etc/shieldlist and does everything it does when enrolled, except receive updates and share bans.
Install and watch
curl -fsSL https://repo.lrob.net/apt/shieldlist/shieldlist.gpg -o /usr/share/keyrings/shieldlist.gpg
echo "deb [signed-by=/usr/share/keyrings/shieldlist.gpg] https://repo.lrob.net/apt/shieldlist stable main" > /etc/apt/sources.list.d/shieldlist.list
apt update && apt install shieldlist-agent
stablecarries the releases. There is also adevsuite with our development builds: ahead of the releases, and expected to break.
It starts in detect-only. Give it rules — a free pack, copied under /etc/shieldlist/ — and validate:
shieldlist-agent -t # every problem at once
shieldlist-agent -dry-run /var/log/auth.log # what the rules would have done to this file
shield status # what it would be holding
shield why 203.0.113.9 # the log lines behind one address
Arm it with state: on in agent.yaml and a restart. From then on shield bans, shield lift, shield exempt are the day-to-day; the full CLI is under Agent → Commands.
Later, enrol
Enrolment is not a migration: the same files, plus mode: enrolled and a controller address. The day you have two servers, install a controller and enrol this one — its local configuration is kept, and switching back is one line.