#!/usr/bin/env bash
# Установка fail2ban filter/jail для HAProxy JSON-лога.
#   sudo bash fail2ban-install.sh
#   sudo bash fail2ban-install.sh --test   # только fail2ban-regex
set -Eeuo pipefail

SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
F2B_DIR="$SCRIPT_DIR/fail2ban"
TEST_ONLY=0

die() { echo "error: $*" >&2; exit 1; }
log() { echo "[*] $*"; }

while [[ $# -gt 0 ]]; do
    case "$1" in
        --test) TEST_ONLY=1; shift ;;
        -h | --help)
            echo "Usage: fail2ban-install.sh [--test]"
            exit 0
            ;;
        *) die "unknown option: $1" ;;
    esac
done

[[ -d $F2B_DIR ]] || die "missing $F2B_DIR"

command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt install fail2ban)"

install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local

log "fail2ban-regex haproxy-json-reject"
fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8

if [[ $TEST_ONLY -eq 1 ]]; then
    log "test only — jail not restarted"
    exit 0
fi

fail2ban-client -t
systemctl enable fail2ban
systemctl restart fail2ban
sleep 1
fail2ban-client status
fail2ban-client status haproxy-reject
log "done"