# -*- coding: utf-8; mode: tcl; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- vim:fenc=utf-8:ft=tcl:et:sw=4:ts=4:sts=4

PortSystem              1.0
PortGroup               github 1.0
PortGroup               python 1.0

github.setup            fail2ban fail2ban 1.1.1
github.tarball_from     archive
revision                0
categories              security python
license                 GPL-2+
maintainers             @ArtKoKo openmaintainer
platforms               {darwin any}
supported_archs         noarch

description             Fail2ban protects computer against brute-force attacks

long_description        Fail2ban scans log files (e.g. /var/log/apache/error_log) and \
                        bans IPs that show the malicious signs -- too many password failures, \
                        seeking for exploits, etc. Generally Fail2Ban then used to update \
                        firewall rules to reject the IP addresses for a specified amount \
                        of time, although any arbitrary other action (e.g. sending an email, \
                        or ejecting CD-ROM tray) could also be configured. Out of the box \
                        Fail2Ban comes with filters for various services (apache, curier, ssh, etc).

homepage                https://www.fail2ban.org/

checksums               rmd160  848abe67f3f9200c1b0b5a02da9fce074888bf02 \
                        sha256  4be0ea0488e32de260058462a44a040f0542cd26a9fb6fa6d2514f9dd8ec1609 \
                        size    627126

python.default_version  314
# setup.py installs absolute data_files and the fail2ban-python link,
# which a wheel cannot carry
python.pep517           no
python.link_binaries_suffix

depends_build-append    port:py${python.version}-setuptools

set f2bconfdir          ${prefix}/etc/${name}
set f2brundir           ${prefix}/var/run/${name}
set f2bdbdir            ${prefix}/var/db/${name}
set f2bpid              ${f2brundir}/${name}.pid

patchfiles              patch-config-paths-osx.conf.diff

post-patch {
    # Move the hardcoded system paths under ${prefix}
    fs-traverse f [list ${worksrcpath}/setup.py ${worksrcpath}/bin \
                        ${worksrcpath}/config ${worksrcpath}/fail2ban \
                        ${worksrcpath}/man] {
        if {[string match */tests/files $f]} {
            continue
        }
        if {[file isfile $f] && ![catch {exec grep -q -E {/etc/fail2ban|/var/(run|lib)/fail2ban} $f}]} {
            reinplace -q "s|/etc/fail2ban|${f2bconfdir}|g; \
                          s|/var/run/fail2ban|${f2brundir}|g; \
                          s|/var/lib/fail2ban|${f2bdbdir}|g" $f
        }
    }
    reinplace "s|^before = paths-debian.conf|before = paths-osx.conf|" \
        ${worksrcpath}/config/jail.conf
    reinplace "s|@PREFIX@|${prefix}|g" ${worksrcpath}/config/paths-osx.conf
}

build.args-append       --without-tests
destroot.args-append    --without-tests

destroot.keepdirs       ${destroot}${f2brundir} \
                        ${destroot}${f2bdbdir} \
                        ${destroot}${f2bconfdir}/fail2ban.d \
                        ${destroot}${f2bconfdir}/jail.d

post-destroot {
    # Dedicated pf action for the IceFloor firewall front-end
    xinstall -m 0644 ${filespath}/pf-icefloor.conf ${destroot}${f2bconfdir}/action.d/

    xinstall -m 0644 -W ${worksrcpath}/man fail2ban-client.1 fail2ban-python.1 \
        fail2ban-regex.1 fail2ban-server.1 fail2ban.1 ${destroot}${prefix}/share/man/man1/
    xinstall -m 0644 ${worksrcpath}/man/jail.conf.5 ${destroot}${prefix}/share/man/man5/

    set docdir ${destroot}${prefix}/share/doc/${name}
    xinstall -d ${docdir}
    xinstall -m 0644 -W ${worksrcpath} ChangeLog COPYING DEVELOP FILTERS \
        README.md doc/run-rootless.txt ${docdir}
}

pre-activate {
    # Up to 0.9.4, post-activate copied the *.conf files outside of the
    # registry; move such copies aside, or activation fails on them.
    # Same suffix as 'port -f activate' uses for conflicting files.
    set baksuffix .mp_[clock seconds]
    set ref [registry_open ${subport} ${version} ${revision} ${portvariants} ${epoch}]
    foreach f [registry_prop_retr $ref imagefiles] {
        if {[string match ${f2bconfdir}/* $f] && [file isfile $f]
                && [registry_file_registered $f] == "0"} {
            ui_msg "--->  Moving unregistered $f to ${f}${baksuffix}"
            file rename $f ${f}${baksuffix}
        }
    }
}

startupitem.create      yes
startupitem.pidfile     clean ${f2bpid}
startupitem.start       "${prefix}/bin/${name}-client -x start"
startupitem.stop        "${prefix}/bin/${name}-client stop"

notes "
Do not edit the *.conf files in ${f2bconfdir}: they are replaced\
on each upgrade. Put your settings in *.local files instead (e.g.\
${f2bconfdir}/jail.local), as explained in jail.conf. On an upgrade\
from 0.9.4, the old copies of the *.conf files are renamed\
*.conf.mp_<timestamp>.

The default ban action is pf. Bans are added to sub-anchors of the\
f2b anchor, which must be referenced in /etc/pf.conf:

    anchor \"f2b/*\"

Start/stop fail2ban with: sudo port \[un\]load ${name}
"

github.livecheck.regex  {([0-9.]+)}
