loki.relabel "journal" {
  forward_to = []

  rule {
    source_labels = ["__journal__systemd_unit"]
    target_label  = "unit"
  }

  rule {
    source_labels = ["__journal_priority_keyword"]
    target_label  = "level"
  }
}

loki.source.journal "system" {
  forward_to    = [loki.process.journal.receiver]
  relabel_rules = loki.relabel.journal.rules
  labels        = {
    job = "systemd-journal",
    host = "ingress",
  }
}

loki.process "journal" {
  forward_to = [loki.write.default.receiver]

  stage.match {
    selector = `{job="systemd-journal"} |~ "\\[UFW AUDIT\\]"`
    action   = "drop"
  }

  stage.match {
    selector = `{job="systemd-journal"} |~ "\\[UFW BLOCK\\]"`

    stage.regex {
      expression = `\[UFW\s(?P<action>\w+)\].*?SRC=(?P<ip>[0-9.]+).*?DST=(?P<dst>[0-9.]+).*?PROTO=(?P<proto>\w+)(?:\sSPT=(?P<spt>\d+))?(?:\sDPT=(?P<dpt>\d+))?`
    }

    stage.geoip {
      db      = "/opt/database/GeoLite2-City.mmdb"
      source  = "ip"
      db_type = "city"
    }

    stage.labels {
      values = {
        action                   = "",
        proto                    = "",
        dpt                      = "",
        geoip_country_name       = "",
        geoip_country_code       = "",
        geoip_location_latitude  = "",
        geoip_location_longitude = "",
      }
    }

    stage.static_labels {
      values = {
        job = "ufw",
      }
    }
  }
}

local.file_match "fail2ban" {
  path_targets = [{"__path__" = "/var/log/fail2ban.log", job = "fail2ban", host = "ingress"}]
}

loki.source.file "fail2ban_source" {
  targets    = local.file_match.fail2ban.targets
  forward_to = [loki.process.fail2ban.receiver]
}

loki.process "fail2ban" {
  forward_to = [loki.write.default.receiver]

  stage.regex {
    expression = `^.*:\s(?<level>\w*)\s*\[(?<service>\w*)\]\s(?<type>\w*)\s(?<ip>(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))).*$`
    labels_from_groups = true
  }

  stage.geoip {
    db      = "/opt/database/GeoLite2-City.mmdb"
    source  = "ip"
    db_type = "city"
  }

  stage.labels {
    values = {
      geoip_country_name       = "",
      geoip_country_code       = "",
      geoip_location_latitude  = "",
      geoip_location_longitude = "",
    }
  }
}

loki.write "default" {
  endpoint {
    url = "http://{{ wireguard_beepi_ip }}:3100/loki/api/v1/push"
  }
}