#!/bin/bash
set -e

echo "📦 Installing Fail2Ban..."
apt update && apt install -y fail2ban

echo "⚙️ Configuring Fail2Ban SSH jail..."
cat >/etc/fail2ban/jail.local <<'EOF'
[DEFAULT]
bantime = 60m
findtime = 60m
maxretry = 5
backend = systemd
allowipv6 = auto

[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log
EOF

echo "🔄 Restarting Fail2Ban..."
systemctl enable fail2ban
systemctl restart fail2ban

echo "✅ Fail2Ban SSH jail status:"
fail2ban-client status sshd
