initial commit

roles/fail2ban/handlers/main.yml

@@ -0,0 +1,5 @@
+---
+- name: restart fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    state: restarted

roles/fail2ban/tasks/main.yml

@@ -0,0 +1,37 @@
+---
+- name: Gather package facts
+  ansible.builtin.package_facts:
+    manager: auto
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [fail2ban]
+
+- name: Fail with guidance if EPEL is missing on RedHat family
+  ansible.builtin.fail:
+    msg: "fail2ban requires EPEL on RedHat family. Set epel_enabled: true (repo_management role) or provide fail2ban via custom_yum_repos."
+  when:
+    - ansible_facts['os_family'] == "RedHat"
+    - "'epel-release' not in ansible_facts.packages"
+  tags: [fail2ban]
+
+- name: Install fail2ban
+  ansible.builtin.package:
+    name: fail2ban
+    state: present
+  tags: [fail2ban]
+
+- name: Deploy fail2ban local jail configuration
+  ansible.builtin.template:
+    src: jail.local.j2
+    dest: /etc/fail2ban/jail.local
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart fail2ban
+  tags: [fail2ban]
+
+- name: Enable and start fail2ban
+  ansible.builtin.systemd:
+    name: fail2ban
+    enabled: true
+    state: started
+  tags: [fail2ban]

roles/fail2ban/templates/jail.local.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+[DEFAULT]
+bantime  = {{ fail2ban_bantime }}
+findtime = {{ fail2ban_findtime }}
+maxretry = {{ fail2ban_maxretry }}
+ignoreip = {{ fail2ban_ignoreip }}
+backend  = systemd
+
+[sshd]
+enabled = true
+port    = {{ ssh_port }}