---
- name: Gather package facts
  ansible.builtin.package_facts:
    manager: auto
  when: ansible_facts['os_family'] == "RedHat"
  tags: [fail2ban]

- name: Fail with guidance if EPEL is missing on RedHat family
  ansible.builtin.fail:
    msg: "fail2ban requires EPEL on RedHat family. Set epel_enabled: true (repo_management role) or provide fail2ban via custom_yum_repos."
  when:
    - ansible_facts['os_family'] == "RedHat"
    - "'epel-release' not in ansible_facts.packages"
  tags: [fail2ban]

- name: Install fail2ban
  ansible.builtin.package:
    name: fail2ban
    state: present
  tags: [fail2ban]

- name: Deploy fail2ban local jail configuration
  ansible.builtin.template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    owner: root
    group: root
    mode: "0644"
  notify: restart fail2ban
  tags: [fail2ban]

- name: Enable and start fail2ban
  ansible.builtin.systemd:
    name: fail2ban
    enabled: true
    state: started
  tags: [fail2ban]