{
  lib,
  config,
  ...
}: let
  dataFolder = "/var/lib/fail2ban";
  dataFile = "fail2ban.sqlite3";
in {
  config = lib.mkIf (config.services.fail2ban.enable && config.host.impermanence.enable) {
    assertions = [
      {
        assertion = config.services.fail2ban.daemonSettings.Definition.dbfile == "${dataFolder}/${dataFile}";
        message = "fail2ban data file does not match persistence";
      }
    ];

    environment.persistence."/persist/system/root" = {
      directories = [
        {
          directory = dataFolder;
          user = "fail2ban";
          group = "fail2ban";
        }
      ];
    };
  };
}