#!/bin/sh

set -e

# Ensure runtime directory exists
install -d -m 0755 /var/run/fail2ban

# Ensure log directory exists (syslog-based systems)
install -d -m 0755 /var/log/fail2ban

# Create default jail.local if it does not exist
if [ ! -f /etc/fail2ban/jail.local ]; then
    cat << 'EOF' > /etc/fail2ban/jail.local
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime  = 1h
findtime = 10m
maxretry = 5
backend  = auto

[sshd]
enabled = true
EOF
fi

# Enable service on boot (OpenRC)
if command -v rc-update >/dev/null 2>&1; then
    rc-update add fail2ban default 2>/dev/null || true
fi

exit 0
