fail2ban template fix

templates/etc/logrotate.d/fail2ban.j2

@@ -3,8 +3,17 @@
     {{ item.when }}
     rotate {{ item.keep }}
     compress
+    # Do not rotate if empty
+    notifempty
+ 
     delaycompress
     missingok
-    notifempty
+    postrotate
-    create 0640 root root
+    fail2ban-client flushlogs 1>/dev/null
+    endscript
+ 
+    # If fail2ban runs as non-root it still needs to have write access
+    # to logfiles.
+    create 640 {{ item.user }} adm
+
 }