setup_fail2ban() {
    $PKG install -y fail2ban
    CONF="/etc/fail2ban/jail.local"
    SNAP=$(backup_create fail2ban "$CONF")

    cat > "$CONF" <<EOF
[sshd]
enabled = true
bantime = 1d
findtime = 10m
maxretry = 3
EOF

    fail2ban-client -t || {
        cp "$SNAP/jail.local" "$CONF"
        err "Fail2Ban rollback"
    }

    systemctl enable --now fail2ban
    pause
}