{
  "module": "fail2ban",
  "version": "1",
  "capabilities": [
    "firewall"
  ],
  "claims": [
    {
      "name": "node-intrusion-prevention",
      "scope": "node",
      "serves": [
        "status",
        "banned",
        "ban",
        "unban"
      ]
    }
  ],
  "tools": [
    "fail2ban_settings",
    "fail2ban_health"
  ],
  "jailing": {
    "into": "/etc/fail2ban/jail.d/mesh.conf",
    "filter-into": "/etc/fail2ban/filter.d"
  },
  "config": {
    "own-addresses": {
      "type": "list",
      "description": "The addresses and networks outside the mesh that are the operator's own, each an IP address or a CIDR network: every jail ignores them beside the private ranges, the ban verb refuses them, and a failure a jail counted from one is said as a warning; empty is none.",
      "trusted": true,
      "default": []
    }
  },
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "fail2ban"
    },
    {
      "id": "state-dir",
      "type": "directory",
      "path": "/var/lib/mesh-fail2ban",
      "mode": "0755"
    },
    {
      "id": "own-addresses-list",
      "type": "file",
      "path": "/var/lib/mesh-fail2ban/own-addresses",
      "mode": "0644",
      "create-once": true,
      "template": "files/own-addresses"
    },
    {
      "id": "jail-d",
      "type": "directory",
      "path": "/etc/fail2ban/jail.d",
      "mode": "0755"
    },
    {
      "id": "action-d",
      "type": "directory",
      "path": "/etc/fail2ban/action.d",
      "mode": "0755"
    },
    {
      "id": "filter-d",
      "type": "directory",
      "path": "/etc/fail2ban/filter.d",
      "mode": "0755"
    },
    {
      "id": "run-dir",
      "type": "directory",
      "path": "/var/run/fail2ban",
      "mode": "0755"
    },
    {
      "id": "jail-local",
      "type": "file",
      "path": "/etc/fail2ban/jail.local",
      "mode": "0644",
      "template": "files/jail.local"
    },
    {
      "id": "jail-sshd",
      "type": "file",
      "path": "/etc/fail2ban/jail.d/sshd.conf",
      "mode": "0644",
      "template": "files/sshd.conf"
    },
    {
      "id": "own-addresses",
      "type": "file",
      "path": "/etc/fail2ban/mesh-own-addresses.json",
      "mode": "0644",
      "merge": "json",
      "takes-config": [
        "own-addresses"
      ],
      "trusted": true,
      "template": "files/mesh-own-addresses.json"
    },
    {
      "id": "watch",
      "type": "process",
      "name": "fail2ban-watch",
      "artifact": "tools",
      "run": [
        "./fail2ban-tools",
        "watch"
      ],
      "health": {
        "kind": "tool",
        "tool": "fail2ban_health",
        "interval": "60s",
        "timeout": "10s",
        "looks": 2,
        "grace": "90s"
      }
    },
    {
      "id": "log",
      "type": "file",
      "path": "/var/log/fail2ban.log",
      "mode": "0640",
      "create-once": true,
      "template": "files/own-addresses"
    },
    {
      "id": "jail-recidive",
      "type": "file",
      "path": "/etc/fail2ban/jail.d/recidive.conf",
      "mode": "0644",
      "template": "files/recidive.conf"
    },
    {
      "id": "action-dualchain",
      "type": "file",
      "path": "/etc/fail2ban/action.d/iptables-allports-dualchain.conf",
      "mode": "0644",
      "template": "files/iptables-allports-dualchain.conf"
    },
    {
      "id": "logrotate",
      "type": "file",
      "path": "/etc/logrotate.d/fail2ban",
      "mode": "0644",
      "template": "files/fail2ban"
    },
    {
      "id": "run",
      "type": "service",
      "unit": "fail2ban.service",
      "state": "running",
      "boot": "enabled",
      "restart-on": [
        "jail-local",
        "jail-sshd",
        "jail-recidive",
        "action-dualchain",
        "composed-jails"
      ],
      "health": {
        "kind": "unit"
      }
    }
  ],
  "build": {
    "artifacts": [
      {
        "name": "tools",
        "kind": "bundle",
        "language": "go",
        "system": "arch",
        "from": "cmd/fail2ban-tools",
        "binary": "fail2ban-tools",
        "loads": [
          "fail2ban-tools"
        ]
      },
      {
        "name": "files",
        "kind": "archive",
        "from": "files"
      }
    ]
  }
}