# fail2ban-shared — spec RPM pour Fedora / RHEL / Rocky (build avec mock)
#
# Cibles mock (CI et make rpm-all) :
#   - Rocky Linux (fixe) : rocky+epel-9-x86_64, rocky+epel-10-x86_64
#   - Fedora (auto)      : les versions maintenues détectées via
#                          https://fedoraproject.org/releases.json
#                          (state=stable ou branched, typiquement 2-3 versions),
#                          fallback sur les configs mock disponibles
#   - Fedora rawhide     : fedora-rawhide-x86_64 (toujours)
#
# Build local :
#   make srpm                 # génère le tarball source + construit le SRPM
#   make rpm                  # build une cible (MOCK_TARGET=fedora-rawhide-x86_64)
#   make rpm-rocky            # build Rocky 9 + 10 (fixe)
#   make rpm-fedora           # build les versions Fedora maintenues (auto) + rawhide
#   make rpm-all              # build tout (Rocky + Fedora auto + rawhide)
#   make rpm MOCK_TARGET=rocky+epel-9-x86_64
#
# Build manuel avec mock :
#   rpmbuild -bs fail2ban-shared.spec
#   mock -r fedora-rawhide-x86_64 --rebuild fail2ban-shared-*.src.rpm
#
# Le résultat se trouve dans /var/lib/mock/<cible>/result/

# Binaire Go compilé avec -s -w (strippé) : aucune info de debug n'est
# embarquée. Sans ceci, find-debuginfo génère un sous-paquet debugsource
# vide et le build échoue ("Empty %files file debugsourcefiles.list").
%global debug_package %{nil}

Name:           fail2ban-shared
Version:        0.5.2
Release:        1%{?dist}
Summary:        Fail2ban ban propagation between cluster nodes

License:        GPL-3.0-or-later
URL:            https://gitlab.tartarefr.eu/sources/fail2ban-shared
Source0:        %{name}-%{version}.tar.gz

BuildRequires:  golang >= 1.22
BuildRequires:  systemd-rpm-macros
Requires:       fail2ban
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd

%description
fail2ban-shared propagates fail2ban bans between cluster nodes without NFS.
Each node runs a lightweight Go daemon which, as soon as a ban (or unban) is
pronounced locally by fail2ban, propagates the IP address to the other nodes
on a dedicated port (default: 9650), and applies received events in place
via fail2ban-client. Nodes register with each other using a shared cluster
token.

%prep
%autosetup -n %{name}-%{version}

%build
# Binaire statique (pas de CGO) : fonctionne sur toutes les cibles
# Fedora / RHEL / Rocky sans dépendre des bibliothèques C du buildroot.
CGO_ENABLED=0 go build -ldflags "-s -w -X main.version=%{version}" -o %{name} .

%install
# Binaire
install -D -m 0755 %{name} %{buildroot}%{_bindir}/%{name}
# Configuration du démon (conffile)
install -D -m 0750 -d %{buildroot}%{_sysconfdir}/%{name}
install -m 0640 deploy/config.example.json %{buildroot}%{_sysconfdir}/%{name}/config.json
install -D -m 0750 -d %{buildroot}%{_sysconfdir}/%{name}/tls
# Unité systemd (Fedora : /usr/lib/systemd/system/)
install -D -m 0644 deploy/fail2ban-shared.service %{buildroot}%{_unitdir}/%{name}.service
# Intégration fail2ban
install -D -m 0644 deploy/action.d/fail2ban-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/action.d/fail2ban-shared.conf
install -D -m 0644 deploy/filter.d/f2b-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/filter.d/f2b-shared.conf
install -D -m 0644 deploy/jail.d/f2b-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/jail.d/f2b-shared.conf
# Répertoire de données (peers.json, etc.)
install -D -m 0700 -d %{buildroot}%{_localstatedir}/lib/%{name}

%files
%license LICENSE
%doc README.md ARCHITECTURE.md
%{_bindir}/%{name}
%dir %{_sysconfdir}/%{name}
%dir %{_sysconfdir}/%{name}/tls
%config(noreplace) %{_sysconfdir}/%{name}/config.json
%{_unitdir}/%{name}.service
%config(noreplace) %{_sysconfdir}/fail2ban/action.d/fail2ban-shared.conf
%config(noreplace) %{_sysconfdir}/fail2ban/filter.d/f2b-shared.conf
%config(noreplace) %{_sysconfdir}/fail2ban/jail.d/f2b-shared.conf
%dir %{_localstatedir}/lib/%{name}

%post
%systemd_post %{name}.service
# The f2b-shared jail watches this file; it must exist
# otherwise fail2ban refuses to start the jail.
if [ ! -f /var/log/f2b-shared.log ]; then
    touch /var/log/f2b-shared.log
    chmod 0640 /var/log/f2b-shared.log
fi

%preun
%systemd_preun %{name}.service

%postun
%systemd_postun_with_restart %{name}.service

%changelog
* Wed Oct 28 2026 Didier Fabert <didier.fabert@gmail.com> - 0.4.1-1
- Initial RPM packaging for Fedora / RHEL (build with mock).
- Binaire /usr/bin/fail2ban-shared, unité systemd,
  configuration /etc/fail2ban-shared, hooks fail2ban.