fail2ban.yml

- name: install fail2ban
  apt:
    state: present
    package:
      - fail2ban
      - ipset

- name: create fail2ban configuration directories
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  with_items:
    - "/etc/fail2ban"
    - "/etc/fail2ban/jail.d"
    - "/etc/fail2ban/filter.d"

- name: copy fail2ban global configuration
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: "0644"
  with_items:
    - { src: 'etc_fail2ban_jail.local.j2', dest: '/etc/fail2ban/jail.local' }
    - { src: 'etc_fail2ban_action.d_firewallcmd-ipset.conf.j2', dest: '/etc/fail2ban/action.d/firewallcmd-ipset.conf' }
    - { src: 'etc_fail2ban_fail2ban.local.j2', dest: '/etc/fail2ban/fail2ban.local' }
    - { src: 'var_lib_fail2ban_emptylog.log.j2', dest: '/var/lib/fail2ban/emptylog.log' }
  notify: restart fail2ban

- name: copy fail2ban sshd jail configuration
  template:
    src: etc_fail2ban_jail.d_sshd.conf.j2
    dest: /etc/fail2ban/jail.d/sshd.conf
    owner: root
    group: root
    mode: "0644"
  notify: reload fail2ban

- name: migration/1.17.0 - remove files from old versions of the role
  file:
    path: /etc/fail2ban/jail.d/pam-generic.conf
    state: absent
  notify: reload fail2ban

##### FACTS #####

- name: create ansible facts.d directory
  file:
    path: /etc/ansible/facts.d
    state: directory
    owner: root
    group: root
    mode: "0755"
  ignore_errors: "{{ ansible_check_mode }}"

- name: create fail2ban fact file
  template:
    src: etc_ansible_facts.d_fail2ban.fact.j2
    dest: /etc/ansible/facts.d/fail2ban.fact
    owner: root
    group: root
    mode: "0644"
  notify: update ansible facts
  ignore_errors: "{{ ansible_check_mode }}"

- name: apply configuration (flush handlers)
  meta: flush_handlers

##### SERVICES #####

- name: start and enable fail2ban
  service:
    name: fail2ban
    state: started
    enabled: yes
  ignore_errors: "{{ ansible_check_mode }}"
  tags: services