#!/bin/mkpkg
# description: Protect hosts from brute-force attacks by aggregating logs
# url: https://www.sshguard.net

name=sshguard
version=2.5.1
release=6
depends=(nftables)
services=(sshguard)
permissions=(
    /var/db/sshguard:root:root:700
    /etc/sshguard.conf:root:root:644
    /etc/sshguard:root:root:755
    /etc/sshguard/whitelist:root:root:644
)
source=(https://downloads.sourceforge.net/project/$name/$name/$version/$name-$version.tar.gz)

sha256sums=(
    "997a1e0ec2b2165b4757c42f8948162eb534183946af52efc406885d97cb89fc"
)

build() {
    cd $name-$version

    ./configure \
        --prefix=/usr \
        --sbindir=/usr/bin \
        --libexecdir=/usr/lib/$name \
        --sysconfdir=/etc \
        --mandir=/usr/share/man

    make
    make DESTDIR=$PKG install

    # configure has no backend switch; keep nft-sets and null only
    for fw in firewalld hosts ipfilter ipfw ipset iptables pf; do
        rm -f $PKG/usr/lib/$name/sshg-fw-$fw
    done
}

post_build() {
    install -d $PKG/etc/sshguard
    install -d -m 700 $PKG/var/db/sshguard

    # Addresses here are never blocked. Add the admin's LAN, static IP and
    # VPN subnet, or a few failed logins can lock the admin out.
    printf '%s\n' \
        '# one address or CIDR block per line' \
        '127.0.0.0/8' \
        '::1/128' \
        > $PKG/etc/sshguard/whitelist

    printf '%s\n' \
        '# rawnix sshguard.conf' \
        'BACKEND="/usr/lib/sshguard/sshg-fw-nft-sets"' \
        '# sshd logs via svlogd -tt; sshg-parser does not understand that prefix.' \
        '# Strip it with a shell read loop: every line is written immediately.' \
        '# (awk here buffered all output despite fflush(), so nothing reached' \
        '# the parser and nothing was ever banned.)' \
        'LOGREADER="LANG=C tail -F -n 0 /var/log/sshd/current | while read -r _ts line; do printf '"'"'%s\n'"'"' \"\$line\"; done"' \
        'THRESHOLD=30' \
        'BLOCK_TIME=120' \
        'DETECTION_TIME=1800' \
        'BLACKLIST_FILE=200:/var/db/sshguard/blacklist.db' \
        'WHITELIST_FILE=/etc/sshguard/whitelist' \
        'SSHGUARD_USER=nobody' \
        > $PKG/etc/sshguard.conf

    # runit service
    install -d $PKG/etc/sv/sshguard/log

    # The sshguard wrapper ends with trap "kill 0" EXIT, which signals its
    # whole process group. Run it in its own group (chpst -P) so that a stop
    # or restart cannot take runsv and the log svlogd down with it.
    printf '%s\n' \
        '#!/bin/sh' \
        'exec 2>&1' \
        'exec chpst -P sshguard' \
        > $PKG/etc/sv/sshguard/run

    # On restart the old backend deletes its tables from its own exit trap.
    # Wait for it, so the next fw_init does not race that cleanup
    # ("Could not initialize firewall").
    printf '%s\n' \
        '#!/bin/sh' \
        'i=0' \
        'while pgrep -f /usr/lib/sshguard/sshg-fw-nft-sets >/dev/null && [ $i -lt 20 ]; do' \
        '    sleep 0.25; i=$((i+1))' \
        'done' \
        'nft delete table ip sshguard 2>/dev/null' \
        'nft delete table ip6 sshguard 2>/dev/null' \
        'exit 0' \
        > $PKG/etc/sv/sshguard/finish

    printf '%s\n' \
        '#!/bin/sh' \
        'mkdir -p /var/log/sshguard' \
        'exec svlogd -tt /var/log/sshguard' \
        > $PKG/etc/sv/sshguard/log/run

    chmod 755 $PKG/etc/sv/sshguard/run
    chmod 755 $PKG/etc/sv/sshguard/finish
    chmod 755 $PKG/etc/sv/sshguard/log/run
}

signify() {
    untrusted comment: public key
    RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3
}

# vim: filetype=sh