/**
 * fail2ban Jail Şablonları — yaygın servisler için önceden yapılandırılmış jail'ler.
 * Kullanıcı "Şablon Galerisi"nden seç → ön-doldurulmuş form ile özelleştirip kaydet.
 *
 * Her şablon: jail_name, display_name, description, category, port, filter, logpath,
 * maxretry, findtime, bantime, action, severity (low|medium|high), recommended (bool).
 *
 * Severity: ne kadar agresif default ayarlar. UI bu rengi gösterir.
 * Recommended: yıldız işareti gösterilir, hosting paneli için temel.
 */

export const TEMPLATE_CATEGORIES = {
    ssh:      { code: 'ssh',      name: 'SSH & Shell',         color: 'rose'    },
    web:      { code: 'web',      name: 'Web Sunucu',          color: 'indigo'  },
    mail:     { code: 'mail',     name: 'Mail Sunucu',         color: 'amber'   },
    ftp:      { code: 'ftp',      name: 'FTP / SFTP',          color: 'cyan'    },
    db:       { code: 'db',       name: 'Veritabanı',          color: 'emerald' },
    cms:      { code: 'cms',      name: 'CMS / Uygulama',      color: 'purple'  },
    panel:    { code: 'panel',    name: 'Kontrol Paneli',      color: 'pink'    },
    dns:      { code: 'dns',      name: 'DNS',                 color: 'sky'     },
    voip:     { code: 'voip',     name: 'VoIP',                color: 'orange'  },
    misc:     { code: 'misc',     name: 'Diğer',               color: 'slate'   },
}

export const FAIL2BAN_TEMPLATES = [
    // ── SSH ────────────────────────────────────────────────────────────────
    {
        slug: 'sshd',
        category: 'ssh',
        display_name: 'SSH (OpenSSH)',
        description: 'SSH brute-force koruması — başarısız parola/key denemelerini banlar.',
        port: 'ssh',
        filter: 'sshd',
        logpath: '/var/log/secure',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_mwl)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'sshd-ddos',
        category: 'ssh',
        display_name: 'SSH DDoS',
        description: 'SSH bağlantı flood koruması — kısa sürede çok bağlantı kuran IP\'leri banlar.',
        port: 'ssh',
        filter: 'sshd-ddos',
        logpath: '/var/log/secure',
        maxretry: 10,
        findtime: 120,
        bantime: 1800,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },

    // ── Web (Apache) ───────────────────────────────────────────────────────
    {
        slug: 'apache-auth',
        category: 'web',
        display_name: 'Apache HTTP Auth',
        description: '.htpasswd korumalı sayfalarda başarısız auth denemeleri.',
        port: 'http,https',
        filter: 'apache-auth',
        logpath: '/var/log/httpd/*error_log',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: true,
    },
    {
        slug: 'apache-badbots',
        category: 'web',
        display_name: 'Apache Bad Bots',
        description: 'Bilinen kötü user-agent\'lerle (web scraper, spam bot) gelen istekleri banlar.',
        port: 'http,https',
        filter: 'apache-badbots',
        logpath: '/var/log/httpd/*access_log',
        maxretry: 2,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'medium',
        recommended: true,
    },
    {
        slug: 'apache-nohome',
        category: 'web',
        display_name: 'Apache User Enum',
        description: '/~username/ pattern ile user enumeration denemelerini banlar.',
        port: 'http,https',
        filter: 'apache-nohome',
        logpath: '/var/log/httpd/*error_log',
        maxretry: 3,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'low',
        recommended: false,
    },
    {
        slug: 'apache-overflows',
        category: 'web',
        display_name: 'Apache Buffer Overflow',
        description: 'Aşırı uzun URI / header ile yapılan exploit denemelerini banlar.',
        port: 'http,https',
        filter: 'apache-overflows',
        logpath: '/var/log/httpd/*error_log',
        maxretry: 2,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'apache-shellshock',
        category: 'web',
        display_name: 'Apache Shellshock',
        description: 'CVE-2014-6271 Bash exploit denemelerini banlar (eski sistemlerde kritik).',
        port: 'http,https',
        filter: 'apache-shellshock',
        logpath: '/var/log/httpd/*access_log',
        maxretry: 1,
        findtime: 86400,
        bantime: 604800,
        action: '%(action_)s',
        severity: 'high',
        recommended: false,
    },
    {
        slug: 'nginx-http-auth',
        category: 'web',
        display_name: 'Nginx HTTP Auth',
        description: 'Nginx basic auth korumasında failed login.',
        port: 'http,https',
        filter: 'nginx-http-auth',
        logpath: '/var/log/nginx/error.log',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },
    {
        slug: 'nginx-botsearch',
        category: 'web',
        display_name: 'Nginx Bot Search',
        description: 'Yaygın exploit URL\'leri arayan tarama botlarını banlar.',
        port: 'http,https',
        filter: 'nginx-botsearch',
        logpath: '/var/log/nginx/access.log',
        maxretry: 2,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },

    // ── Mail ───────────────────────────────────────────────────────────────
    {
        slug: 'postfix',
        category: 'mail',
        display_name: 'Postfix SMTP',
        description: 'SMTP auth ve relay denemelerine yönelik brute-force.',
        port: 'smtp,465,submission',
        filter: 'postfix',
        logpath: '/var/log/maillog',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'postfix-sasl',
        category: 'mail',
        display_name: 'Postfix SASL Auth',
        description: 'SASL kullanıcı authentication brute-force koruması.',
        port: 'smtp,465,submission',
        filter: 'postfix-sasl',
        logpath: '/var/log/maillog',
        maxretry: 3,
        findtime: 600,
        bantime: 7200,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'dovecot',
        category: 'mail',
        display_name: 'Dovecot IMAP/POP3',
        description: 'IMAP/POP3 brute-force koruması.',
        port: 'pop3,pop3s,imap,imaps',
        filter: 'dovecot',
        logpath: '/var/log/maillog',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'exim',
        category: 'mail',
        display_name: 'Exim SMTP',
        description: 'Exim MTA brute-force ve spam relay denemeleri.',
        port: 'smtp,465,submission',
        filter: 'exim',
        logpath: '/var/log/exim/main.log',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },

    // ── FTP ────────────────────────────────────────────────────────────────
    {
        slug: 'pure-ftpd',
        category: 'ftp',
        display_name: 'Pure-FTPd',
        description: 'Pure-FTPd brute-force koruması.',
        port: 'ftp,ftp-data,ftps,ftps-data',
        filter: 'pure-ftpd',
        logpath: '/var/log/secure',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: true,
    },
    {
        slug: 'proftpd',
        category: 'ftp',
        display_name: 'ProFTPd',
        description: 'ProFTPd brute-force koruması.',
        port: 'ftp,ftp-data,ftps,ftps-data',
        filter: 'proftpd',
        logpath: '/var/log/proftpd/proftpd.log',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },
    {
        slug: 'vsftpd',
        category: 'ftp',
        display_name: 'vsftpd',
        description: 'vsftpd brute-force koruması.',
        port: 'ftp,ftp-data,ftps,ftps-data',
        filter: 'vsftpd',
        logpath: '/var/log/secure',
        maxretry: 5,
        findtime: 600,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },

    // ── Database ───────────────────────────────────────────────────────────
    {
        slug: 'mysqld-auth',
        category: 'db',
        display_name: 'MySQL / MariaDB Auth',
        description: 'MySQL/MariaDB başarısız login denemeleri (genelde dış erişim açıksa).',
        port: '3306',
        filter: 'mysqld-auth',
        logpath: '/var/log/mariadb/mariadb.log',
        maxretry: 3,
        findtime: 600,
        bantime: 7200,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'postgresql',
        category: 'db',
        display_name: 'PostgreSQL Auth',
        description: 'PostgreSQL brute-force.',
        port: '5432',
        filter: 'postgresql',
        logpath: '/var/log/postgresql/postgresql.log',
        maxretry: 3,
        findtime: 600,
        bantime: 7200,
        action: '%(action_)s',
        severity: 'high',
        recommended: false,
    },

    // ── CMS / Application ──────────────────────────────────────────────────
    {
        slug: 'wordpress-hard',
        category: 'cms',
        display_name: 'WordPress (Sıkı)',
        description: 'WordPress wp-login.php brute-force koruması — saldırgan IP\'yi uzun süre banlar.',
        port: 'http,https',
        filter: 'wordpress-hard',
        logpath: '/var/log/httpd/*access_log',
        maxretry: 3,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'wordpress-soft',
        category: 'cms',
        display_name: 'WordPress (Yumuşak)',
        description: 'WordPress xmlrpc.php ve wp-login.php — kısa süreli ban.',
        port: 'http,https',
        filter: 'wordpress-soft',
        logpath: '/var/log/httpd/*access_log',
        maxretry: 10,
        findtime: 600,
        bantime: 1800,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },
    {
        slug: 'phpmyadmin',
        category: 'cms',
        display_name: 'phpMyAdmin',
        description: 'phpMyAdmin login brute-force koruması.',
        port: 'http,https',
        filter: 'phpmyadmin-syslog',
        logpath: '/var/log/httpd/*error_log',
        maxretry: 3,
        findtime: 600,
        bantime: 7200,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },

    // ── Panel ──────────────────────────────────────────────────────────────
    {
        slug: 'panel-login',
        category: 'panel',
        display_name: 'ONOX Panel Login',
        description: 'Panel /login sayfasında başarısız giriş denemeleri.',
        port: 'http,https',
        filter: 'panel-login',
        logpath: '/var/log/onox/panel.log',
        maxretry: 8,
        findtime: 300,
        bantime: 1800,
        action: '%(action_)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'panel-api',
        category: 'panel',
        display_name: 'ONOX API Abuse',
        description: 'API rate limit ihlali ve sürekli 401/429 dönen IP\'leri banlar.',
        port: 'http,https',
        filter: 'panel-api',
        logpath: '/var/log/onox/api.log',
        maxretry: 20,
        findtime: 60,
        bantime: 3600,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },

    // ── DNS ────────────────────────────────────────────────────────────────
    {
        slug: 'named-refused',
        category: 'dns',
        display_name: 'BIND Refused Queries',
        description: 'DNS amplification saldırılarına yol açan refused query\'leri banlar.',
        port: 'domain,953',
        filter: 'named-refused',
        logpath: '/var/log/messages',
        maxretry: 5,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'medium',
        recommended: false,
    },

    // ── VoIP ───────────────────────────────────────────────────────────────
    {
        slug: 'asterisk',
        category: 'voip',
        display_name: 'Asterisk',
        description: 'Asterisk SIP brute-force koruması.',
        port: '5060,5061',
        filter: 'asterisk',
        logpath: '/var/log/asterisk/messages',
        maxretry: 10,
        findtime: 600,
        bantime: 86400,
        action: '%(action_)s',
        severity: 'high',
        recommended: false,
    },

    // ── Misc ───────────────────────────────────────────────────────────────
    {
        slug: 'recidive',
        category: 'misc',
        display_name: 'Recidive (Tekrarcı Banlar)',
        description: 'Birden fazla jail\'de banlanmış IP\'leri çok uzun süre engeller (1 hafta).',
        port: '0:65535',
        filter: 'recidive',
        logpath: '/var/log/fail2ban.log',
        maxretry: 3,
        findtime: 86400,
        bantime: 604800,
        action: '%(action_mwl)s',
        severity: 'high',
        recommended: true,
    },
    {
        slug: 'php-url-fopen',
        category: 'misc',
        display_name: 'PHP Remote File Inclusion',
        description: 'PHP RFI/LFI exploit denemeleri (?file=http://...).',
        port: 'http,https',
        filter: 'php-url-fopen',
        logpath: '/var/log/httpd/*access_log',
        maxretry: 1,
        findtime: 86400,
        bantime: 604800,
        action: '%(action_)s',
        severity: 'high',
        recommended: false,
    },
]

// Helpers
export const RECOMMENDED_TEMPLATES = FAIL2BAN_TEMPLATES.filter(t => t.recommended)

export function getTemplatesByCategory(categoryCode) {
    return FAIL2BAN_TEMPLATES.filter(t => t.category === categoryCode)
}

export function findTemplate(slug) {
    return FAIL2BAN_TEMPLATES.find(t => t.slug === slug) || null
}

// Quick presets — global default ayarları
export const PRESETS = {
    aggressive: {
        name: 'Agresif',
        description: 'Sıkı koruma — az deneme, uzun ban. Saldırı altındaysanız.',
        color: 'rose',
        default_maxretry: 3,
        default_findtime: 600,
        default_bantime: 86400,
        recidive_enabled: true,
    },
    balanced: {
        name: 'Dengeli',
        description: 'Önerilen — çoğu ortam için optimal denge.',
        color: 'emerald',
        default_maxretry: 5,
        default_findtime: 600,
        default_bantime: 3600,
        recidive_enabled: false,
    },
    permissive: {
        name: 'Esnek',
        description: 'Az koruma — yüksek false-positive riski olan ortamlar için.',
        color: 'sky',
        default_maxretry: 10,
        default_findtime: 1800,
        default_bantime: 600,
        recidive_enabled: false,
    },
    panic: {
        name: 'Panik Modu',
        description: '⚠ Aktif saldırı altında — saniyede 1 deneme bile ban. Trusted IP listene bağlısın.',
        color: 'red',
        default_maxretry: 1,
        default_findtime: 86400,
        default_bantime: 2592000,  // 30 gün
        recidive_enabled: true,
    },
}
