---
# ============================================
# Fail2Ban Installation et configuration
# ============================================
- name: Installation et configuration de Fail2Ban
  hosts: uber-stup
  become: true
  gather_facts: true

  vars:
      fail2ban_bantime: "1h"
      fail2ban_findtime: "10m"
      fail2ban_maxretry: 5
      fail2ban_ignoreip: "127.0.0.1/8 ::1"

  tasks:
      # ============================================================
      # Installation
      # ============================================================
      - name: Installer Fail2Ban
        ansible.builtin.apt:
            name: fail2ban
            state: present
            update_cache: yes

      # ============================================================
      # Configuration globale (jail.local)
      # ============================================================
      - name: Créer jail.local avec la configuration globale
        ansible.builtin.copy:
            dest: /etc/fail2ban/jail.local
            owner: root
            group: root
            mode: "0644"
            content: |
                [DEFAULT]
                ignoreip    = {{ fail2ban_ignoreip }}
                bantime     = {{ fail2ban_bantime }}
                findtime    = {{ fail2ban_findtime }}
                maxretry    = {{ fail2ban_maxretry }}
                banaction   = iptables-multiport
                backend     = systemd
                loglevel    = INFO

                # ============================================================
                # SSH
                # ============================================================
                [sshd]
                enabled   = true
                port      = ssh
                filter    = sshd
                logpath   = %(sshd_log)s
                maxretry  = 3
                bantime   = 24h

                # ============================================================
                # Nginx - requêtes trop fréquentes (rate limit)
                # ============================================================
                [nginx-limit-req]
                enabled   = true
                port      = http,https
                filter    = nginx-limit-req
                logpath   = /var/log/nginx/error.log
                maxretry  = 10
                bantime   = 1h

                # ============================================================
                # Nginx - 4xx répétés (scan, bot)
                # ============================================================
                [nginx-http-auth]
                enabled   = true
                port      = http,https
                filter    = nginx-http-auth
                logpath   = /var/log/nginx/error.log
                maxretry  = 5
                bantime   = 1h

                # ============================================================
                # Nginx - bad bots / scans (404 répétés)
                # ============================================================
                [nginx-botsearch]
                enabled   = true
                port      = http,https
                filter    = nginx-botsearch
                logpath   = /var/log/nginx/access.log
                maxretry  = 10
                bantime   = 2h

                # ============================================================
                # API Backend - brute force login (POST /api/v2/login)
                # ============================================================
                [backend-login]
                enabled   = true
                port      = http,https
                filter    = backend-login
                logpath   = /var/log/nginx/access.log
                maxretry  = 10
                findtime  = 5m
                bantime   = 2h
        notify: Restart fail2ban

      # ============================================================
      # Filtre personnalisé - brute force login API
      # ============================================================
      - name: Créer le filtre fail2ban pour le login API
        ansible.builtin.copy:
            dest: /etc/fail2ban/filter.d/backend-login.conf
            owner: root
            group: root
            mode: "0644"
            content: |
                [Definition]
                failregex = ^<HOST> .* "POST /api/v2/login HTTP/.*" (401|403) .*$
                ignoreregex =
        notify: Restart fail2ban

      # ============================================================
      # Démarrage et activation
      # ============================================================
      - name: Démarrer et activer Fail2Ban
        ansible.builtin.systemd:
            name: fail2ban
            state: started
            enabled: yes

      # ============================================================
      # Vérification
      # ============================================================
      - name: Vérifier le statut de Fail2Ban
        ansible.builtin.command: fail2ban-client status
        register: fail2ban_status
        changed_when: false

      - name: Afficher le statut des jails
        ansible.builtin.debug:
            msg: "{{ fail2ban_status.stdout_lines }}"

  handlers:
      - name: Restart fail2ban
        ansible.builtin.systemd:
            name: fail2ban
            state: restarted