#!/bin/bash
# Install shared-bans client on a server.
# Run as root on the target server.
set -euo pipefail

REPO_URL="${1:-}"
if [ -z "$REPO_URL" ]; then
  echo "Usage: $0 <repo-url-with-token>"
  echo "Example: $0 'http://shared-bans-reader:TOKEN@100.81.59.99:3030/sami7777/shared-bans.git'"
  exit 1
fi

# Install scripts
install -m 0755 scripts/shared-bans-apply.sh /usr/local/bin/shared-bans-apply.sh
install -m 0755 scripts/shared-bans-update-static.sh /usr/local/bin/shared-bans-update-static.sh
install -m 0755 scripts/shared-bans-stage-ban.sh /usr/local/bin/shared-bans-stage-ban.sh
install -m 0644 scripts/fail2ban-action-shared-bans.conf /etc/fail2ban/action.d/shared-bans.conf

# Config
cat > /etc/shared-bans.conf <<EOF
SHARED_BANS_REPO_URL="$REPO_URL"
EOF
chmod 0600 /etc/shared-bans.conf

# Systemd units
cat > /etc/systemd/system/shared-bans-apply.service <<'EOF'
[Unit]
Description=Apply shared IP ban list from git repo to local ipset

[Service]
Type=oneshot
ExecStart=/usr/local/bin/shared-bans-apply.sh
EOF

cat > /etc/systemd/system/shared-bans-apply.timer <<'EOF'
[Unit]
Description=Apply shared IP ban list from git repo to local ipset

[Timer]
OnBootSec=2min
OnUnitActiveSec=5min

[Install]
WantedBy=timers.target
EOF

cat > /etc/systemd/system/shared-bans-update-static.service <<'EOF'
[Unit]
Description=Update shared IP ban list static sources from URLs

[Service]
Type=oneshot
ExecStart=/usr/local/bin/shared-bans-update-static.sh
EOF

cat > /etc/systemd/system/shared-bans-update-static.timer <<'EOF'
[Unit]
Description=Nightly update of shared IP ban list static sources

[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=true

[Install]
WantedBy=timers.target
EOF

systemctl daemon-reload
systemctl enable --now shared-bans-apply.timer shared-bans-update-static.timer

# fail2ban jail update
mkdir -p /var/lib/shared-bans-staging

if command -v nft >/dev/null 2>&1 && systemctl is-active nftables >/dev/null 2>&1; then
  FW_ACTION='nftables-multiport[name=sshd, port="22", protocol=tcp]'
else
  FW_ACTION='iptables-multiport[name=sshd, port="22", protocol=tcp]'
fi

cat > /etc/fail2ban/jail.local <<EOF
[DEFAULT]
bantime = 86400
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
action = $FW_ACTION
         shared-bans[name=sshd]
EOF

systemctl restart fail2ban

echo "Installed. Run /usr/local/bin/shared-bans-apply.sh to verify."