Make fail2ban hardening robust on fresh servers

scripts/security/harden-server.sh

@@ -228,8 +228,13 @@ configure_fail2ban() {
     return
   fi
 
+  local nginx_jail_enabled="false"
+  if [ -f /var/log/nginx/access.log ] || [ -f /var/log/nginx/error.log ]; then
+    nginx_jail_enabled="true"
+  fi
+
   mkdir -p "$(dirname "$FAIL2BAN_JAIL_FILE")"
-  cat > "$FAIL2BAN_JAIL_FILE" << 'EOF'
+  cat > "$FAIL2BAN_JAIL_FILE" << EOF
 [DEFAULT]
 bantime = 1h
 findtime = 10m
@@ -242,18 +247,25 @@ ignoreip = 127.0.0.1/8 ::1
 
 [sshd]
 enabled = true
-mode = aggressive
+backend = systemd
+journalmatch = _COMM=sshd
+mode = normal
 
 [nginx-http-auth]
-enabled = true
+enabled = ${nginx_jail_enabled}
 
 [nginx-botsearch]
-enabled = true
+enabled = ${nginx_jail_enabled}
 EOF
 
   systemctl enable fail2ban >/dev/null 2>&1 || true
   systemctl restart fail2ban >/dev/null 2>&1 || true
-  log "fail2ban configured"
+
+  if systemctl is-active --quiet fail2ban; then
+    log "fail2ban configured"
+  else
+    log "fail2ban failed to start, check: journalctl -u fail2ban -n 100 --no-pager"
+  fi
 }
 
 configure_sysctl() {