Note that fail2ban depends on the order of the audit fields

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

max/audit.py

@@ -6,6 +6,9 @@ def audit(event, actor=None, target=None, **fields):
     Logs a security relevant event as one line with the message "audit". actor is the
     acting user, None for anonymous requests. target is the affected user, if any.
     """
+    # The order of the first fields is fixed: fail2ban matches
+    # 'audit event=… actor_user_id=… actor_email=… ip="<HOST>"' (filter max.conf on the VPS).
+    # Change the filter when changing the order or the names.
     values = dict(
         event=event,
         actor_user_id=actor.id if actor is not None else None,