Check jail.local state and warn user if it is not fail2ban-UI managed, disable automatic jail.local migration because it is only testing

internal/fail2ban/connector_local.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 	"os/exec"
 	"sort"
 	"strings"
@@ -343,9 +344,6 @@ func (lc *LocalConnector) UpdateDefaultSettings(ctx context.Context, settings co
 
 // EnsureJailLocalStructure implements Connector.
 func (lc *LocalConnector) EnsureJailLocalStructure(ctx context.Context) error {
-	// Note: Migration is handled in newConnectorForServer() before
-	// config.EnsureLocalFail2banAction() is called, so migration has already
-	// run by the time this method is called.
 	return config.EnsureJailLocalStructure()
 }
 
@@ -369,6 +367,20 @@ func (lc *LocalConnector) DeleteFilter(ctx context.Context, filterName string) e
 	return DeleteFilter(filterName)
 }
 
+// CheckJailLocalIntegrity implements Connector.
+func (lc *LocalConnector) CheckJailLocalIntegrity(ctx context.Context) (bool, bool, error) {
+	const jailLocalPath = "/etc/fail2ban/jail.local"
+	content, err := os.ReadFile(jailLocalPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return false, false, nil // file does not exist; OK, will be created
+		}
+		return false, false, fmt.Errorf("failed to read jail.local: %w", err)
+	}
+	hasUIAction := strings.Contains(string(content), "ui-custom-action")
+	return true, hasUIAction, nil
+}
+
 func executeShellCommand(ctx context.Context, command string) (string, error) {
 	parts := strings.Fields(command)
 	if len(parts) == 0 {