#!/usr/bin/env bash
# security/f2b-jail -- extra fail2ban jails for web traffic
set -o pipefail
SELF=$(readlink -f "${BASH_SOURCE[0]}")
NV_BASE=$(cd "$(dirname "$SELF")/../../.." && pwd)
export NV_BASE
# shellcheck source=/dev/null
. "$NV_BASE/lib/core/bootstrap.sh"

nv_require_root || exit 1
ui_header "$(t sec_m_f2bjail)"

if ! nv_have fail2ban-client; then
    ui_warn "$(t f2b_not_installed)"
    exit 1
fi

cfg=/etc/fail2ban/jail.d/nhanhvps-web.conf
ui_kv "$(t backup_location)" "$cfg"
ui_kv "$(t web_state)" "$([ -f "$cfg" ] && t state_enabled || t state_disabled)"
ui_blank
ui_info "$(t f2bjail_desc)"
ui_blank

if [ -f "$cfg" ]; then
    ui_confirm "$(t web_disable_q)" n || exit 0
    nv_backup_path "$cfg" fail2ban-jail >/dev/null 2>&1 || true
    rm -f "$cfg"
    svc_restart fail2ban
    nv_trace f2b-jail "disabled"
    ui_ok "$(t f2bjail_off)"
    exit 0
fi

ui_confirm "$(t web_enable_q)" y || exit 0
nv_backup_path "$cfg" fail2ban-jail >/dev/null 2>&1 || true
cat >"$cfg" <<'EOF'
# managed by nhanhvps -- jails for HTTP traffic
[nginx-http-auth]
enabled = true
logpath = /var/log/nginx/*error.log

[nginx-botsearch]
enabled = true
logpath = /var/log/nginx/*access.log
maxretry = 2

[nginx-req-limit]
enabled  = true
filter   = nginx-req-limit
logpath  = /var/log/nginx/*error.log
maxretry = 5
bantime  = 3600
EOF

if svc_restart fail2ban; then
    sleep 1
    nv_trace f2b-jail "enabled"
    ui_ok "$(t f2bjail_on)"
    jails=$(fail2ban-client status 2>/dev/null | sed -n 's/.*Jail list:[[:space:]]*//p')
    ui_kv "$(t f2b_jails)" "${jails:--}"
else
    ui_err "$(t f2bjail_failed)"
    rm -f "$cfg"
    svc_restart fail2ban >/dev/null 2>&1 || true
    exit 1
fi
exit 0
