# fail2ban-shared — spec RPM pour Fedora / COPR
#
# Build local du SRPM :
#   make srpm                 # génère le tarball source + construit le SRPM
#   rpmbuild -bs fail2ban-shared.spec
#
# Build sur COPR (https://copr.fedorainfracloud.org) :
#   1. Créer un projet COPR
#   2. Ajouter un paquet de type « SRPM » et uploader le SRPM généré par la CI
#      (publié dans le registre de paquets GitLab), ou
#   3. Ajouter un paquet de type « SCM » pointant sur ce dépôt Git avec le
#      spec fail2ban-shared.spec — COPR clonera le dépôt et construira.

Name:           fail2ban-shared
Version:        0.4.2
Release:        1%{?dist}
Summary:        Fail2ban ban propagation between cluster nodes

License:        GPL-3.0-or-later
URL:            https://gitlab.tartarefr.eu/sources/fail2ban-shared
Source0:        %{name}-%{version}.tar.gz

BuildRequires:  golang >= 1.22
Requires:       fail2ban
Requires(post): systemd
Requires(preun): systemd
Requires(postun): systemd

%description
fail2ban-shared propagates fail2ban bans between cluster nodes without NFS.
Each node runs a lightweight Go daemon which, as soon as a ban (or unban) is
pronounced locally by fail2ban, propagates the IP address to the other nodes
on a dedicated port (default: 9650), and applies received events in place
via fail2ban-client. Nodes register with each other using a shared cluster
token.

%prep
%autosetup -n %{name}-%{version}

%build
go build -ldflags "-s -w -X main.version=%{version}" -o %{name} .

%install
# Binaire
install -D -m 0755 %{name} %{buildroot}%{_bindir}/%{name}
# Configuration du démon (conffile)
install -D -m 0750 -d %{buildroot}%{_sysconfdir}/%{name}
install -m 0640 deploy/config.example.json %{buildroot}%{_sysconfdir}/%{name}/config.json
install -D -m 0750 -d %{buildroot}%{_sysconfdir}/%{name}/tls
# Unité systemd (Fedora : /usr/lib/systemd/system/)
install -D -m 0644 deploy/fail2ban-shared.service %{buildroot}%{_unitdir}/%{name}.service
# Intégration fail2ban
install -D -m 0644 deploy/action.d/fail2ban-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/action.d/fail2ban-shared.conf
install -D -m 0644 deploy/filter.d/f2b-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/filter.d/f2b-shared.conf
install -D -m 0644 deploy/jail.d/f2b-shared.conf %{buildroot}%{_sysconfdir}/fail2ban/jail.d/f2b-shared.conf
# Répertoire de données (peers.json, etc.)
install -D -m 0700 -d %{buildroot}%{_localstatedir}/lib/%{name}

%files
%license LICENSE
%doc README.md ARCHITECTURE.md
%{_bindir}/%{name}
%dir %{_sysconfdir}/%{name}
%dir %{_sysconfdir}/%{name}/tls
%config(noreplace) %{_sysconfdir}/%{name}/config.json
%{_unitdir}/%{name}.service
%config(noreplace) %{_sysconfdir}/fail2ban/action.d/fail2ban-shared.conf
%config(noreplace) %{_sysconfdir}/fail2ban/filter.d/f2b-shared.conf
%config(noreplace) %{_sysconfdir}/fail2ban/jail.d/f2b-shared.conf
%dir %{_localstatedir}/lib/%{name}

%post
%systemd_post %{name}.service
# The f2b-shared jail watches this file; it must exist
# otherwise fail2ban refuses to start the jail.
if [ ! -f /var/log/f2b-shared.log ]; then
    touch /var/log/f2b-shared.log
    chmod 0640 /var/log/f2b-shared.log
fi

%preun
%systemd_preun %{name}.service

%postun
%systemd_postun_with_restart %{name}.service

%changelog
* Wed Oct 28 2026 Didier Fabert <didier.fabert@gmail.com> - 0.4.1-1
- Initial RPM packaging for COPR (Fedora / RHEL).
- Binaire /usr/bin/fail2ban-shared, unité systemd,
  configuration /etc/fail2ban-shared, hooks fail2ban.