Support overriding configuration for default jails

README.md

@@ -174,6 +174,18 @@ Disable the fail2ban service.
     }
 ```
 
+Customize port definition per jail
+
+```yaml
+fail2ban::jails_config:
+  ssh:
+    port: ssh,2200
+  dropbear:
+    port:
+      - ssh
+      - 2201
+```
+
 ## Jails available
 
 ### Pre-defined jails

REFERENCE.md

@@ -21,9 +21,14 @@
 * [`fail2ban::define`](#fail2ban--define): == Define: fail2ban::define
 * [`fail2ban::jail`](#fail2ban--jail): Handles the jails.
 
+### Functions
+
+* [`fail2ban::port`](#fail2ban--port): See https://puppet.com/docs/puppet/latest/lang_write_functions_in_puppet.html for more information on native puppet functions.  Looks up fail
+
 ### Data types
 
 * [`Fail2ban::Logpath`](#Fail2ban--Logpath): Describes logpath format allowed
+* [`Fail2ban::Port`](#Fail2ban--Port): Port type
 * [`Fail2ban::Time`](#Fail2ban--Time): Describes time format allowed for bantime and findtime The time entries in fail2ban configuration (like findtime or bantime) can be provided 
 
 ### Tasks
@@ -72,15 +77,16 @@ The following parameters are available in the `fail2ban` class:
 * [`sender`](#-fail2ban--sender)
 * [`iptables_chain`](#-fail2ban--iptables_chain)
 * [`jails`](#-fail2ban--jails)
+* [`jails_config`](#-fail2ban--jails_config)
 * [`maxretry`](#-fail2ban--maxretry)
 * [`whitelist`](#-fail2ban--whitelist)
 * [`custom_jails`](#-fail2ban--custom_jails)
 * [`banaction`](#-fail2ban--banaction)
+* [`sendmail_config`](#-fail2ban--sendmail_config)
+* [`sendmail_actions`](#-fail2ban--sendmail_actions)
 * [`config_file_before`](#-fail2ban--config_file_before)
 * [`config_dir_filter_path`](#-fail2ban--config_dir_filter_path)
 * [`default_backend`](#-fail2ban--default_backend)
-* [`sendmail_config`](#-fail2ban--sendmail_config)
-* [`sendmail_actions`](#-fail2ban--sendmail_actions)
 
 ##### <a name="-fail2ban--package_ensure"></a>`package_ensure`
 
@@ -314,6 +320,14 @@ Determines which services should be protected by Fail2ban.
 
 Default value: `['ssh', 'ssh-ddos']`
 
+##### <a name="-fail2ban--jails_config"></a>`jails_config`
+
+Data type: `Hash`
+
+Allows configuration per-jail, e.g. override default port.
+
+Default value: `{}`
+
 ##### <a name="-fail2ban--maxretry"></a>`maxretry`
 
 Data type: `Integer[0]`
@@ -346,43 +360,43 @@ Determines which action to perform when performing a global ban (not overridden
 
 Default value: `'iptables-multiport'`
 
-##### <a name="-fail2ban--config_file_before"></a>`config_file_before`
+##### <a name="-fail2ban--sendmail_config"></a>`sendmail_config`
 
-Data type: `String[1]`
+Data type: `Hash`
 
 
 
-##### <a name="-fail2ban--config_dir_filter_path"></a>`config_dir_filter_path`
+Default value: `{}`
 
-Data type: `Stdlib::Absolutepath`
+##### <a name="-fail2ban--sendmail_actions"></a>`sendmail_actions`
 
+Data type: `Hash`
 
 
-Default value: `'/etc/fail2ban/filter.d'`
 
-##### <a name="-fail2ban--default_backend"></a>`default_backend`
+Default value: `{}`
 
-Data type: `Enum['pyinotify', 'gamin', 'polling', 'systemd', 'auto']`
+##### <a name="-fail2ban--config_file_before"></a>`config_file_before`
 
+Data type: `String[1]`
 
 
-Default value: `'auto'`
 
-##### <a name="-fail2ban--sendmail_config"></a>`sendmail_config`
+##### <a name="-fail2ban--config_dir_filter_path"></a>`config_dir_filter_path`
 
-Data type: `Hash`
+Data type: `Stdlib::Absolutepath`
 
 
 
-Default value: `{}`
+Default value: `'/etc/fail2ban/filter.d'`
 
-##### <a name="-fail2ban--sendmail_actions"></a>`sendmail_actions`
+##### <a name="-fail2ban--default_backend"></a>`default_backend`
 
-Data type: `Hash`
+Data type: `Enum['pyinotify', 'gamin', 'polling', 'systemd', 'auto']`
 
 
 
-Default value: `{}`
+Default value: `'auto'`
 
 ### <a name="fail2ban--install"></a>`fail2ban::install`
 
@@ -507,6 +521,7 @@ The following parameters are available in the `fail2ban::jail` defined type:
 * [`enabled`](#-fail2ban--jail--enabled)
 * [`action`](#-fail2ban--jail--action)
 * [`filter`](#-fail2ban--jail--filter)
+* [`logpath`](#-fail2ban--jail--logpath)
 * [`maxretry`](#-fail2ban--jail--maxretry)
 * [`findtime`](#-fail2ban--jail--findtime)
 * [`bantime`](#-fail2ban--jail--bantime)
@@ -602,6 +617,12 @@ Data type: `String`
 
 Default value: `$title`
 
+##### <a name="-fail2ban--jail--logpath"></a>`logpath`
+
+
+
+Default value: `undef`
+
 ##### <a name="-fail2ban--jail--maxretry"></a>`maxretry`
 
 Data type: `Integer`
@@ -714,6 +735,38 @@ Data type: `Optional[String]`
 
 Default value: `$fail2ban::config_file_require`
 
+## Functions
+
+### <a name="fail2ban--port"></a>`fail2ban::port`
+
+Type: Puppet Language
+
+See https://puppet.com/docs/puppet/latest/lang_write_functions_in_puppet.html
+for more information on native puppet functions.
+
+Looks up fail2ban::jails_config.{namespace} for port configuration
+
+#### `fail2ban::port(String[1] $config_key, Fail2ban::Port $default_port)`
+
+See https://puppet.com/docs/puppet/latest/lang_write_functions_in_puppet.html
+for more information on native puppet functions.
+
+Looks up fail2ban::jails_config.{namespace} for port configuration
+
+Returns: `String` actual config
+
+##### `config_key`
+
+Data type: `String[1]`
+
+
+
+##### `default_port`
+
+Data type: `Fail2ban::Port`
+
+
+
 ## Data types
 
 ### <a name="Fail2ban--Logpath"></a>`Fail2ban::Logpath`
@@ -722,6 +775,12 @@ Describes logpath format allowed
 
 Alias of `Variant[String[1], Array[String[1]]]`
 
+### <a name="Fail2ban--Port"></a>`Fail2ban::Port`
+
+Port type
+
+Alias of `Variant[Integer, String, Tuple[Variant[Integer, String], 1, default]]`
+
 ### <a name="Fail2ban--Time"></a>`Fail2ban::Time`
 
 Describes time format allowed for bantime and findtime

functions/port.pp

@@ -0,0 +1,19 @@
+# See https://puppet.com/docs/puppet/latest/lang_write_functions_in_puppet.html
+# for more information on native puppet functions.
+#
+# Looks up fail2ban::jails_config.{namespace} for port configuration
+#
+# @param config_key
+# @param default_port
+# @return actual config
+function fail2ban::port(String[1] $config_key, Fail2ban::Port $default_port) >> String {
+  $needle = "fail2ban::jails_config.${config_key}.port"
+  $result = lookup($needle, undef, undef, $default_port)
+
+  case $result {
+    String : { $result }
+    Integer : { String($result) }
+    Array,Tuple : { join($result, ',') }
+    default : { raise(Puppet::ParseError, "Unsupported type in lookup result: ${result}.class") }
+  }
+}

manifests/define.pp

@@ -1,5 +1,16 @@
 # == Define: fail2ban::define
 #
+# @param config_file_path
+# @param config_file_owner
+# @param config_file_group
+# @param config_file_mode
+# @param config_file_source
+# @param config_file_string
+# @param config_file_template
+# @param config_file_notify
+# @param config_file_require
+# @param config_file_options_hash
+#
 define fail2ban::define (
   Stdlib::Absolutepath $config_file_path = "${fail2ban::config_dir_path}/${title}",
   String $config_file_owner = $fail2ban::config_file_owner,

manifests/init.pp

@@ -32,11 +32,13 @@
 # @param sender Determines which email address should notify about restricted hosts and suspicious logins.
 # @param iptables_chain Determines chain where jumps will to be added in iptables-\* actions.
 # @param jails Determines which services should be protected by Fail2ban.
+# @param jails_config Allows configuration per-jail, e.g. override default port.
 # @param maxretry Determines the number of failed login attempts needed to block a host.
 # @param whitelist Determines which ip addresses will not be reported
 # @param custom_jails Determines which custom jails should be included
 # @param banaction Determines which action to perform when performing a global ban (not overridden in a specific jail).
-#
+# @param sendmail_config
+# @param sendmail_actions
 class fail2ban (
   String[1] $config_file_before,
 
@@ -77,6 +79,7 @@
   String[1] $sender = "fail2ban@${facts['networking']['fqdn']}",
   String[1] $iptables_chain = 'INPUT',
   Array[String[1]] $jails = ['ssh', 'ssh-ddos'],
+  Hash $jails_config = {},
   Integer[0] $maxretry = 3,
   Enum['pyinotify', 'gamin', 'polling', 'systemd', 'auto'] $default_backend = 'auto',
   Array $whitelist = ['127.0.0.1/8', '192.168.56.0/24'],

manifests/jail.pp

@@ -2,6 +2,30 @@
 #
 # @param logpath Filename(s) of the log files to be monitored
 #
+# @param filter_includes
+# @param filter_failregex
+# @param filter_ignoreregex
+# @param filter_maxlines
+# @param filter_datepattern
+# @param filter_additional_config
+# @param enabled
+# @param action
+# @param filter
+# @param logpath
+# @param maxretry
+# @param findtime
+# @param bantime
+# @param port
+# @param backend
+# @param journalmatch
+# @param ignoreip
+# @param config_dir_filter_path
+# @param config_file_owner
+# @param config_file_group
+# @param config_file_mode
+# @param config_file_source
+# @param config_file_notify
+# @param config_file_require
 define fail2ban::jail (
   Optional[String] $filter_includes = undef,
   Optional[String] $filter_failregex = undef,